Fault root cause localization method and apparatus, and electronic device, storage medium and computer program product

Abstract

The present application relates to a fault root cause localization method and apparatus, and an electronic device, a storage medium and a computer program product. The method comprises: acquiring network data of a current network, and on the basis of the network data, performing query and reasoning in a multi-source knowledge graph, so as to obtain a detection result for the current network; and if the detection result indicates that there is a fault in the current network, locating a fault root cause of the current network on the basis of an entity relationship in the multi-source knowledge graph.

Description

Fault root cause localization methods, devices, electronic equipment, storage media, and computer program products

[0001] Related applications

[0002] This application claims priority to Chinese patent application No. 202411994914.4, filed on December 31, 2024, entitled "Fault Root Cause Location Method, Apparatus, Electronic Device, Storage Medium and Computer Program Product", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of network operation and maintenance technology, and in particular to a fault root cause localization method, device, electronic device, storage medium and computer program product. Background Technology

[0004] As networks continue to expand, the number of devices, nodes, and data volumes increase, leading to greater complexity in network operation and management. This can result in various types of network problems. Therefore, it is essential to promptly detect and alert on network faults and to pinpoint the root causes of these alarms to ensure network stability and reliability.

[0005] Current network alarm root cause localization methods typically employ route tracing or network topology-based real-time alarm methods. When network issues arise, such as slow terminal speeds or inability to access specific websites, route tracing analyzes the transmission of data packets between routers in the network link to identify potential problems and locate the root cause of the alarm. Alternatively, network topology-based real-time alarm methods combine network topology information and real-time alarm data, using a series of data processing and feature extraction steps to accurately locate the root cause of the fault.

[0006] However, current methods for locating the root cause of network alarms often fail to cover all possible fault scenarios. In particular, for complex and dynamically changing network environments, inaccurate root cause location of alarms is prone to occur. Summary of the Invention

[0007] This application provides a method, apparatus, electronic device, storage medium, and computer program product for locating the root cause of a fault.

[0008] This application provides a method for locating the root cause of a fault in a first aspect. The method includes: acquiring network data of a current network; querying and reasoning in a multi-source knowledge graph based on the network data to obtain a detection result of the current network; and if the detection result indicates that the current network has a fault, locating the root cause of the fault of the current network based on entity relationships in the multi-source knowledge graph.

[0009] In one embodiment, the method includes: acquiring multi-source network data information; extracting information from the multi-source network data information to obtain entity data and relation data associated with the fault; and performing knowledge modeling based on the entity data and the relation data to construct a multi-source knowledge graph.

[0010] In one embodiment, obtaining multi-source network data information includes: determining multiple data sources based on preset filtering rules; obtaining network data information of target networks corresponding to the multiple data sources to obtain multi-source network data information.

[0011] In one embodiment, the step of extracting information from the multi-source network data to obtain entity data and relational data associated with the fault includes: performing syntactic dependency analysis on the alarm records contained in the multi-source network data to determine the dependency relationships between the components contained in the multi-source network data; constructing a dependency projection tree between the components based on the dependency relationships, and filtering dependency projection subtrees that conform to the matching rules based on pre-configured matching rules; generating triples based on the dependency projection subtrees that conform to the matching rules; the triples contain entity data and relational data associated with the alarm fault.

[0012] In one embodiment, after generating triples based on dependency projection subtrees conforming to the matching rules, the method further includes: performing synonym expansion on entity data and / or relation data in the triples based on relation feature words to obtain multiple triples after synonym expansion; evaluating and filtering the multiple triples based on preset evaluation rules to obtain triples used to generate a multi-source knowledge graph.

[0013] In one embodiment, the step of constructing a multi-source knowledge graph based on the entity data and the relation data includes: constructing a knowledge graph for each data source based on the evaluated and filtered triples; and fusing the knowledge graphs from multiple data sources to obtain a multi-source knowledge graph.

[0014] In one embodiment, if the detection result indicates that the current network is faulty, locating the root cause of the fault based on the entity relationships in the multi-source knowledge graph includes: if the detection result indicates that the current network is faulty, querying and reasoning the knowledge path where the current network fault is located based on the relationship data between entities in the multi-source knowledge graph; locating the root cause of the current network fault based on the knowledge path, and issuing an alarm for the current network fault.

[0015] In a second aspect, this application provides a fault root cause localization device, the device comprising: an acquisition module, configured to acquire network data of a current network, and based on the network data, perform querying and reasoning in a multi-source knowledge graph to obtain a detection result of the current network; and a fault localization module, configured to, if the detection result indicates that the current network has a fault, locate the root cause of the fault of the current network based on entity relationships in the multi-source knowledge graph.

[0016] In one embodiment, the above-mentioned device further includes: an information extraction module, used to acquire multi-source network data information, extract information from the multi-source network data information, and obtain entity data and relation data associated with the fault; and a construction module, used to perform knowledge modeling based on entity data and relation data, and construct a multi-source knowledge graph.

[0017] In one embodiment, the information extraction module is used to: determine multiple data sources based on preset filtering rules; obtain network data information of the target network corresponding to the multiple data sources, and obtain the multi-source network data information.

[0018] In one embodiment, the information extraction module is used to: perform syntactic structure dependency analysis on the alarm records contained in the multi-source network data information to determine the dependency relationships between the components contained in the multi-source network data information; construct a dependency projection tree between the components based on the dependency relationships, and filter the dependency projection subtrees that conform to the pre-configured matching rules based on the pre-configured matching rules; and generate triples based on the dependency projection subtrees that conform to the matching rules, wherein the triples contain entity data and relation data associated with alarm faults.

[0019] In one embodiment, the above-mentioned device further includes: an extension module, used to perform synonym expansion on entity data and / or relation data in the triples based on relation feature words, to obtain multiple triples after synonym expansion; and a filtering module, used to evaluate and filter the multiple triples based on preset evaluation rules, to obtain triples for generating the multi-source knowledge graph.

[0020] In one embodiment, the construction module is used to: construct a knowledge graph of the data sources for the triples after evaluation and screening for each data source; and perform graph fusion of the knowledge graphs of multiple data sources to obtain the multi-source knowledge graph.

[0021] In one embodiment, the fault location module is used to: if the detection result indicates that there is a fault in the current network, query and infer the knowledge path where the current network fault is located based on the relationship data between entities in the multi-source knowledge graph; locate the root cause of the current network fault based on the knowledge path, and issue an alarm for the current network fault.

[0022] This application provides an electronic device in a third aspect, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: acquiring network data of a current network; querying and reasoning in a multi-source knowledge graph based on the network data to obtain a detection result of the current network; and if the detection result indicates that the current network has a fault, locating the root cause of the fault of the current network based on the entity relationships in the multi-source knowledge graph.

[0023] In a fourth aspect, this application provides a non-volatile computer-readable storage medium storing a computer program thereon, which, when executed by a processor, performs the following steps: acquiring network data of a current network; querying and reasoning in a multi-source knowledge graph based on the network data to obtain a detection result of the current network; and if the detection result indicates that the current network has a fault, locating the root cause of the fault of the current network based on entity relationships in the multi-source knowledge graph.

[0024] This application provides a computer program product in a fifth aspect, including a computer program that, when executed by a processor, causes the processor to implement the fault root cause localization method provided in the embodiments of this application. The method may include: acquiring network data of a current network; querying and reasoning in a multi-source knowledge graph based on the network data to obtain a detection result of the current network; and if the detection result indicates that the current network has a fault, locating the root cause of the fault of the current network based on entity relationships in the multi-source knowledge graph.

[0025] The aforementioned fault root cause localization method, apparatus, electronic device, storage medium, and computer program product acquire network data of the current network, and based on the network data, perform queries and reasoning in a multi-source knowledge graph to obtain the detection result of the current network. If the detection result indicates that the current network has a fault, the root cause of the fault in the current network is located based on the entity relationships in the multi-source knowledge graph. This method comprehensively summarizes information on various types of faults in the network through a pre-constructed multi-source knowledge graph, acquires network data of the current network, performs queries and reasoning through the multi-source knowledge graph to achieve network status detection, and if the current network has a fault, locates the root cause of the fault based on the entity relationships contained in the multi-source knowledge graph, thus improving the accuracy and intuitiveness of fault root cause localization. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 is a flowchart illustrating a fault root cause localization method in one embodiment of this application.

[0028] Figure 2 is a flowchart illustrating a method for constructing a multi-source knowledge graph in one embodiment of this application.

[0029] Figure 3 is a flowchart illustrating the steps of obtaining multi-source network data information in one embodiment of this application.

[0030] Figure 4 is a flowchart illustrating the steps for generating triples in one embodiment of this application.

[0031] Figure 5 is a flowchart illustrating the steps of generating and filtering triples in one embodiment of this application.

[0032] Figure 6 is a flowchart illustrating the steps of graph fusion based on multiple data source knowledge graphs in one embodiment of this application.

[0033] Figure 7 is a flowchart illustrating the steps for locating the root cause of a current network fault and issuing an alarm in one embodiment of this application.

[0034] Figure 8 is a flowchart illustrating the steps of constructing a multi-source knowledge graph for fault root cause localization in an embodiment of this application.

[0035] Figure 9 is a structural block diagram of a fault root cause localization device in one embodiment of this application.

[0036] Figure 10 is an internal structure diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0038] This application provides a method for locating the root cause of a fault. This method can be applied to a terminal, a server, or a system containing both a terminal and a server, and is implemented through interaction between the terminal and the server.

[0039] The terminals can be, but are not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle systems, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing cloud computing services.

[0040] Traditionally, root cause analysis of network faults typically employs route tracing. When network outages, slow speeds, or inaccessibility to specific websites occur, route tracing can pinpoint the root cause—whether it's a problem with a local device or a network link. This method analyzes the transmission of data packets between routers, helping maintenance personnel assess network connection quality, identify potential issues, and perform targeted optimizations. Alternatively, root cause analysis can be based on network topology and real-time alarms. This approach combines network topology information with real-time alarm data, employing a series of data processing and feature extraction steps to accurately pinpoint the root cause of the fault.

[0041] However, traditional technologies, whether route tracing methods or real-time alarm root cause localization methods, rely on predefined rule bases or templates to identify the root cause of alarms. However, these rule bases often struggle to cover all possible fault scenarios, especially in complex and dynamically changing network environments. When new fault types or patterns emerge, the rule base may not be updated in a timely manner, leading to missed or false alarms. Furthermore, due to the limitations of rule bases or templates, traditional technologies currently have limited reasoning capabilities in terms of knowledge representation and reasoning, thus the accuracy of the inferred root cause localization still needs improvement.

[0042] Based on the aforementioned traditional techniques, this application provides a method for locating the root cause of a fault. By constructing a comprehensive, accurate, and easily understandable multi-source knowledge graph, and performing queries and reasoning within this graph, the detection result of the current network is determined. If the detection result indicates a fault in the current network, the root cause of the fault can be located based on the entity relationships within the multi-source knowledge graph. The multi-source knowledge graph comprehensively summarizes information on various types of faults, enabling rapid and accurate querying and reasoning of the root cause, thus improving the accuracy and intuitiveness of fault root cause location.

[0043] It should be noted that the beneficial effects or technical problems solved by the technical solutions described in the embodiments of this application are not limited to this one, but may also be other implicit or related problems. For details, please refer to the description of the embodiments below.

[0044] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0045] In one embodiment, as shown in FIG1, a fault root cause localization method is provided. Taking the application of the method to a terminal device (hereinafter referred to as the terminal) as an example, the method includes the following steps S102 to S104.

[0046] Step S102: Obtain the network data of the current network, and based on the network data, perform queries and inferences in the multi-source knowledge graph to obtain the detection results of the current network.

[0047] In practice, a multi-source knowledge graph is pre-built in the terminal. This knowledge graph is constructed based on multi-source network data and contains various types of faults and related information. Thus, for the current network to be detected, the terminal acquires the network data, extracts and analyzes it, and performs queries and inferences based on the pre-built multi-source knowledge graph to determine the detection result for the current network. The query result for the current network reflects whether a fault exists in the current network.

[0048] The network data can be real-time data of the current network or historical data of the current network. This application embodiment does not limit the timeliness of the network data of the current network.

[0049] Step S104: If the detection result indicates that there is a fault in the current network, locate the root cause of the fault in the current network based on the entity relationships in the multi-source knowledge graph.

[0050] In practice, if the detection result indicates that there is a fault in the current network, the terminal will query and reason based on the entity data and relationship data contained in the multi-source knowledge graph, that is, the entity relationships in the knowledge contained in the multi-source knowledge graph, to locate the root cause of the current network fault and realize the fault analysis and alarm of the current network.

[0051] In the above-mentioned fault root cause localization method, a pre-constructed multi-source knowledge graph is used to comprehensively summarize information on various types of faults in the network; network data of the current network is obtained, and network status detection is achieved by querying and reasoning through the multi-source knowledge graph; if a fault exists in the current network, the root cause of the fault is located based on the entity relationships contained in the multi-source knowledge graph, thereby improving the accuracy and intuitiveness of fault root cause localization.

[0052] In one embodiment, when performing fault root cause localization based on a multi-source knowledge graph, it is necessary to pre-construct a multi-source knowledge graph about fault root cause localization and alarms, as shown in Figure 2. The method also includes the following steps S202 to S204.

[0053] Step S202: Obtain multi-source network data information, extract information from the multi-source network data information, and obtain entity data and relation data associated with the fault.

[0054] In practical implementation, the terminal acquires multi-source network data information, which may include alarm data from the target network (e.g., an Internet Protocol (IP) network). This target network's alarm data may contain information such as the target network's alarm type (i.e., fault type), alarm cause, and alarm solution characteristics. Then, the terminal extracts information from the alarm data within the multi-source network data information to obtain entity and relationship data associated with the fault. During the extraction process, the alarm data can be transformed into elements in a graph triplet, enabling entity extraction, attribute extraction, and relationship extraction. Structured / unstructured / scenario-based extraction methods are supported, with the TTPM algorithm provided for scenario-based extraction to meet the needs of alarm root cause localization graph construction in alarm scenarios. Thus, after acquiring multi-source network data information, the terminal extracts useful information from a large amount of unstructured or semi-structured multi-source network data, especially entity and relationship data related to specific faults. This process requires not only accurate identification of relevant entities, such as equipment, system components, and error codes, but also understanding the relationships between these entities, such as causal relationships, temporal relationships, or spatial relationships, in order to comprehensively grasp the causes and development process of the failure. Specifically: First, information extraction typically involves Natural Language Processing (NLP) techniques to parse text data, such as log files, maintenance records, and user reports. By employing techniques such as Named-Entity Recognition (NER), syntactic analysis, and semantic analysis, key entities in the text can be identified, and their roles and relationships within the context can be understood. Second, due to the diverse sources of data, which may include different formats and languages, data preprocessing methods are needed to ensure data consistency and comparability. This involves steps such as data cleaning, standardization, and transformation to facilitate subsequent analysis and extraction. Third, to improve the accuracy of information extraction, machine learning and deep learning methods can be used to train machine learning models to automatically identify and extract entities and relationships related to the failure. These machine learning models can be trained on labeled datasets to learn different types of failure modes and their associated entity relationships. Finally, the extracted entity and relational data need to be structured for further analysis and application.

[0055] In one optional embodiment, a single alarm data entry contains multiple entity features, each with a corresponding feature description, also known as a feature value, used to characterize the specific information of the feature. The feature description information for each type of feature can be represented by a string in a specific format; generally, different types of features use different formats for their feature description information.

[0056] Step S204: Based on entity data and relation data, perform knowledge modeling and construct a multi-source knowledge graph.

[0057] In practical implementation, the terminal constructs triples based on entity data and relation data, and uses these triples to achieve knowledge modeling, resulting in a multi-source knowledge graph. Specifically, firstly, the specific application scenarios and requirements of the knowledge graph are clarified. For the network fault root cause localization method in this application, the fault root cause localization requirements for different types or levels of faults under different application scenarios are pre-defined. Based on the set application scenarios and requirements, the ontology of the knowledge graph is defined. This ontology describes the common characteristics of all things within a certain scope and the relationships between transactions. Then, the concepts and categories in the knowledge graph are defined to form an ontology structure, and inheritance and association relationships between entities are established to form a hierarchical structure. Based on the triples of entity data and relation data, the terminal imports the determined hierarchical structure for data integration and fusion, constructing a multi-source knowledge graph. The consistency and integrity of the data in the multi-source knowledge graph are then checked, thus obtaining the final multi-source knowledge graph.

[0058] In one optional embodiment, a knowledge graph configuration interface is displayed on the information processing platform. This interface includes various functional controls for configuring the knowledge graph. Users can trigger the ontology selection control within these controls to define and select the ontology of the knowledge graph. A knowledge graph can select one or more ontology instances; however, this embodiment does not limit the actual structure of the knowledge graph.

[0059] In one optional embodiment, after obtaining the multi-source knowledge graph, it can be saved, for example, by storing multiple pieces of knowledge information contained in the multi-source knowledge graph in a knowledge base. Furthermore, users can view the saved multi-source knowledge graph at any time through the information processing platform. Simultaneously, in response to updates to network data, the multi-source knowledge graph can be updated and edited synchronously. Various pre-configured functional controls in the information processing platform allow for the editing and adjustment of elements such as ontology, relationships, and attributes within the multi-source knowledge graph.

[0060] In this embodiment, by extracting information from multi-source network data, entity data and relational data associated with the fault are obtained, and a multi-source knowledge graph is constructed. This multi-source knowledge graph contains multi-source fault information, which facilitates the comprehensive, accurate and efficient location of the root cause of the fault.

[0061] In one embodiment, as shown in FIG3, the specific processing procedure of step S202 may include the following steps S302 to S304.

[0062] Step S302: Determine multiple data sources based on preset filtering rules.

[0063] In practical implementation, data sources are the foundation for building knowledge graphs, and their quality and coverage directly affect the accuracy, completeness, and usability of the knowledge graph. In IP network alarm knowledge graphs, selecting appropriate data sources is crucial for timely detection and handling of network faults and ensuring network security. Therefore, when building a knowledge graph, the terminal can filter and determine multiple data sources based on preset filtering rules. For example, for the fault alarm requirements of a target network, the terminal can determine multiple data sources such as log files, maintenance records, and user reports. Different data sources may have different dimensions of data content collection and different data quality.

[0064] In an optional embodiment, this application can pre-integrate an information processing platform for knowledge graph construction in the terminal. Through the open interface of the information processing platform, users can filter data sources for building the knowledge graph. For example, the terminal can perform fuzzy search on the data uploaded in the pre-managed data and select one or more data sources for information extraction. The supported data formats include text format (txt), document format (xlsx), comma-separated values ​​(csv, a common data exchange format), etc.

[0065] Step S304: Obtain network data information of the target network corresponding to multiple data sources to obtain multi-source network data information.

[0066] In practice, the terminal obtains network data information of the target network corresponding to the selected multiple data sources, thus obtaining multi-source network data information.

[0067] In one optional embodiment, since the data quality of different data sources is different, the data in multiple data sources can be preprocessed. Through data cleaning, standardization and other methods, the data from different data sources can be unified to obtain the final multi-source network data information fused from multiple data sources.

[0068] In this embodiment, by acquiring multi-source network data information and covering various types of fault information through the different data dimensions in different data sources, a knowledge graph can be constructed based on the multi-source network data information, ensuring the accuracy and comprehensiveness of the multi-source knowledge graph.

[0069] In one embodiment, as shown in FIG4, the specific processing procedure of step S204 may include the following steps S402 to S406.

[0070] Step S402: Perform syntactic structure dependency analysis on the alarm records contained in the multi-source network data information to determine the dependency relationships between the components contained in the multi-source network data information.

[0071] In practice, the multi-source network data information contains alarm records. The terminal parses the sentence structure in the alarm records, extracts each component in the alarm records, and determines the dependency relationship between the various components contained in the multi-source network data information.

[0072] In one optional embodiment, when extracting information from alarm records contained in multi-source network data, structured / unstructured / scenario-based extraction methods are supported. Different extraction methods have different information extraction dimensions, and users can customize the configuration in the information processing platform integrated into the terminal. This application embodiment does not limit the extraction method.

[0073] Step S404: Based on the dependency relationship, construct the dependency projection tree between each component, and based on the pre-configured matching rules, filter the dependency projection subtrees that meet the matching rules.

[0074] In practical implementation, the terminal constructs a dependency projection tree based on the extracted dependency relationships, using each component as a node and the dependency relationships between components as edges. This dependency projection tree is a tree-like structure where each node represents a word and edges represent the dependency relationships between words. The root node of the tree is typically the core verb or core word of the sentence. Matching rules are pre-stored in the terminal. These rules are used to filter information within the dependency projection tree. These rules can be configured through an open configuration interface provided by the information processing platform, allowing users to configure them based on business alarm requirements, or they can be configured during development. For example, the matching rules could be used to check whether the nouns in the nodes of each dependency relationship in the dependency projection tree are abnormal, or to verify the format and validity of each dependency relationship in the dependency projection tree, etc. Thus, the terminal filters within the dependency projection tree based on these matching rules, traversing each dependency projection subtree to see if it conforms to the matching rules, obtaining the dependency projection subtrees that meet the matching rules.

[0075] Step S406: Generate triples based on the dependency projection subtree that conforms to the matching rules.

[0076] The triple contains entity data and relational data associated with alarms and faults.

[0077] In practice, the terminal generates corresponding triples based on the rule-compliant dependency projection subtrees. Specifically, for each node in each dependency projection subtree, it is transformed into structured entity data in the corresponding knowledge graph triple, and the dependency relations in the dependency projection subtree are transformed into structured relation data in the corresponding knowledge graph triple. Thus, triples containing entity data and relation data are obtained.

[0078] In this embodiment, syntactic structural dependency analysis is performed by extracting multi-source network data information to determine the dependency relationships between components, thereby constructing a dependency projection tree. Based on pre-configured matching rules, dependency projection subtrees in the dependency projection tree are filtered to select those that meet the matching rules. This not only ensures the accuracy of the selected dependency projection subtrees, but also sorts and transforms the dependency projection subtrees into structured triples for use in knowledge graph construction, enabling rapid location of fault root causes.

[0079] In one embodiment, as shown in FIG5, the specific processing procedure of step S406 may include the following steps S502 to S504.

[0080] Step S502: Based on relational feature words, perform synonym expansion on the entity data and / or relational data in the triples to obtain multiple triples after synonym expansion.

[0081] In practical implementation, the terminal performs synonym expansion on the entity data and / or relation data in the triples based on relational feature words. The purpose of this step is to enrich the information in the triples and improve the accuracy and comprehensiveness of the information contained within them. Specifically, when performing synonym expansion on triples, it can be done by expanding the entity data in the triples with synonyms similar to the instance features of that entity data, or by expanding the relation data in the triples with synonyms similar to the instance features of that relation data, thus obtaining multiple triples after synonym expansion. For example, the characteristics of fault data in multi-source network data information can be used as attributes of entities, represented by triples. The ontology triple model is represented as: (IP network fault class entity name, characteristic name, characteristic value type). The instantiated triple model is represented as: (IP network fault class entity identifier, characteristic name, specific characteristic value). Thus, by obtaining multiple synonymous feature words of the same type and performing synonym expansion on the instantiated triple model, multiple synonymous instantiated triples are obtained.

[0082] Step S504: Based on preset evaluation rules, evaluate and filter multiple triples to obtain triples for generating multi-source knowledge graphs.

[0083] In practical implementation, the terminal has preset evaluation rules for triples. These rules include multi-dimensional evaluation criteria such as triple format detection, triple missingness, and accuracy of the information contained in the triples. Then, based on these preset evaluation rules, the terminal evaluates and filters multiple triples, selecting those that meet the evaluation rules. These selected triples are used to generate the multi-source knowledge graph, thereby achieving the construction of a comprehensive and accurate multi-source knowledge graph.

[0084] In this embodiment, by extending the synonyms of the triples, the information content of the triples is enriched, and the extended triples are evaluated and screened to obtain triples that meet the evaluation rules. This ensures the quality of the constituent elements of the multi-source knowledge graph and improves the information accuracy and comprehensiveness of the multi-source knowledge graph.

[0085] In one embodiment, as shown in FIG6, the specific processing procedure of step S204 may include the following steps S602 to S604.

[0086] Step S602: For each data source, construct a knowledge graph of the data sources after evaluation and screening of the triples.

[0087] In practice, the triples selected after evaluation are categorized based on their data sources, and knowledge graphs for each data source are constructed for each categorized triple. For example, for multi-source network data information of the target network, this multi-source network data information may come from log files, maintenance records, user reports, etc. The data content of the corresponding records may not be exactly the same for different data sources. Thus, knowledge graphs for different data sources are constructed for the triples generated from different data sources.

[0088] Step S604: Merge the knowledge graphs from multiple data sources to obtain a multi-source knowledge graph.

[0089] In practice, the terminal fuses knowledge graphs from multiple data sources to obtain a multi-source knowledge graph. Specifically, after obtaining the knowledge graphs from multiple data sources, the terminal performs entity alignment, relation alignment, and attribute alignment on each knowledge graph. Based on these alignment relationships, it then performs one or more of these processes—entity fusion, relation fusion, and attribute fusion—and resolves conflicts during the fusion process. For example, if the same entity has different attribute values ​​in different knowledge graphs, a single value needs to be selected as the final value, or multiple values ​​can be recorded and marked as conflicting. After resolving all conflicts in the fusion process, the fused multi-source knowledge graph is obtained.

[0090] The processes of entity alignment, relation alignment, and attribute alignment are described below.

[0091] Entity alignment: The terminal identifies entities in the knowledge graphs of various data sources, ensuring that the same entity is correctly identified in different knowledge graphs. Pre-defined matching algorithms (such as string matching, feature-based matching, machine learning methods, etc.) are used to identify and align identical entities in different knowledge graphs. For example, it identifies whether "UE" and "user equipment" are the same entity. Then, based on the identification result (i.e., "UE" and "user equipment" are the same entity), a unified entity identifier is constructed by linking entities with different representations. For example, "UE" and "user equipment" are linked as the same entity, thus completing the entity alignment in the knowledge graphs from different data sources.

[0092] Relation Alignment: The terminal identifies the relation types in the knowledge graphs of various data sources, ensuring that the same relation is correctly identified in different knowledge graphs. Then, the terminal uses a matching algorithm to identify and align the same relations in different knowledge graphs. For example, it identifies whether "sender device-receiver device" and "terminal-server" are the same relation type. When determining that the two represent the same meaning, a unified relation identifier is constructed by linking relations with different representations, that is, linking "sender device-receiver device" and "terminal-server" as the same relation type.

[0093] Attribute Alignment: The terminal identifies attributes in each knowledge graph, ensuring that the same attribute is correctly identified in different knowledge graphs. Then, the terminal uses a matching algorithm to identify and align the same attributes across different knowledge graphs. For example, identifying whether "date of birth" and "date of birth" are the same attribute. Attribute Linking: A unified attribute identifier is constructed by linking different attributes. For example, linking "date of birth" and "date of birth" as the same attribute.

[0094] In this embodiment, knowledge graphs from multiple data sources are merged into a unified multi-source knowledge graph to form a more comprehensive and accurate network fault knowledge network of the target network, i.e., a multi-source knowledge graph, so as to provide a more accurate and intuitive information view.

[0095] In one embodiment, as shown in FIG7, the specific processing procedure of step S204 may include the following steps S702 to S704.

[0096] Step S702: If the detection result indicates that there is a fault in the current network, query and infer the knowledge path where the current network fault is located based on the relationship data between entities in the multi-source knowledge graph.

[0097] In practice, if the detection result indicates that there is a fault in the current network, the terminal can obtain the paths that are connected by multiple relationships between entities based on the relationship data between entities in the multi-source knowledge graph, thereby querying and reasoning to determine the fault type and the knowledge path where the fault-related information is located.

[0098] Step S704: Based on the knowledge path, locate the root cause of the current network fault and issue an alarm for the current network fault.

[0099] In practice, the terminal traces each node in the knowledge path based on the knowledge path to locate the root cause of the current network failure. After determining the root cause of the current network failure, the terminal can issue an alarm for the current network failure to inform the user of the current or historical network failure.

[0100] In this embodiment, the root cause of the current network failure is queried and reasoned based on the constructed multi-source knowledge graph, thereby realizing the location of the root cause of the failure and improving the accuracy and efficiency of the root cause location.

[0101] In one embodiment, as shown in Figure 8, a multi-source knowledge graph for root cause localization of IP network faults is provided. This specific process may include the following steps:

[0102] Step 801: Identify the source of the IP network failure;

[0103] Step 802: Obtain multi-source IP network fault data based on IP network fault data sources;

[0104] Step 803: Extract knowledge from the multi-source IP network fault data to obtain entity data and relation data in the fault data, and construct triples based on the entity data and relation data;

[0105] Step 804: Construct knowledge graphs corresponding to multiple data sources based on each triple, and perform knowledge fusion on the knowledge graphs corresponding to multiple data sources to obtain a multi-source knowledge graph;

[0106] Step 805: Perform knowledge reasoning on the root cause of the fault based on the multi-source knowledge graph to determine the root cause of the fault in the current network;

[0107] Step 806: Push the root cause of the current network fault to the IP network fault management scenario for analysis and application.

[0108] Optionally, in step 8031: during the construction of the knowledge graph for fault root cause localization of IP networks, the knowledge records generated by the triples can be stored.

[0109] Optionally, step 8041: After generating the multi-source knowledge graph, perform a quality assessment on the multi-source knowledge graph.

[0110] It should be understood that although the steps in the flowcharts of Figures 1 to 8 are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in Figures 1 to 8 may include multiple steps or stages, which are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0111] In one embodiment, as shown in FIG9, a fault root cause location device 900 is provided, including: an acquisition module 901 and a fault location module 902, wherein:

[0112] The acquisition module 901 is used to acquire the network data of the current network, and based on the network data, to perform queries and inferences in the multi-source knowledge graph to obtain the detection results of the current network;

[0113] The fault location module 902 is used to locate the root cause of the fault in the current network based on the entity relationships in the multi-source knowledge graph if the detection result indicates that there is a fault in the current network.

[0114] In one embodiment, the device 900 further includes:

[0115] The information extraction module is used to acquire multi-source network data information, extract information from the multi-source network data information, and obtain entity data and relation data associated with the fault.

[0116] The building module is used to perform knowledge modeling based on entity data and relational data, and to build multi-source knowledge graphs.

[0117] In one embodiment, the information extraction module is specifically used for:

[0118] Multiple data sources are determined based on preset filtering rules;

[0119] By acquiring network data information of the target network corresponding to multiple data sources, multi-source network data information is obtained.

[0120] In one embodiment, the information extraction module is specifically used for:

[0121] Syntactic structure dependency analysis is performed on alarm records contained in multi-source network data to determine the dependency relationships between the components contained in the multi-source network data.

[0122] Based on dependency relationships, a dependency projection tree is constructed between components, and dependency projection subtrees that meet the matching rules are selected based on pre-configured matching rules.

[0123] Based on the dependency projection subtree that conforms to the matching rules, triples are generated; the triples contain entity data and relation data associated with alarms and faults.

[0124] In one embodiment, the device 900 further includes:

[0125] The extension module is used to perform synonym expansion on entity data and / or relation data in triples based on relation feature words, so as to obtain multiple triples after synonym expansion;

[0126] The filtering module is used to evaluate and filter multiple triples based on preset evaluation rules to obtain triples for generating multi-source knowledge graphs.

[0127] In one embodiment, the building module is specifically used for:

[0128] For each data source, after evaluation and screening of the triples, a knowledge graph of the data sources is constructed;

[0129] By fusing knowledge graphs from multiple data sources, a multi-source knowledge graph can be obtained.

[0130] In one embodiment, the fault location module 902 is specifically used for:

[0131] If the detection result indicates that there is a fault in the current network, based on the relationship data between entities in the multi-source knowledge graph, query and infer the knowledge path where the current network fault is located.

[0132] Based on the knowledge path, the root cause of the current network failure is located, and an alarm is issued for the current network failure.

[0133] Specific limitations regarding the root cause localization device can be found in the limitations of the root cause localization method described above, and will not be repeated here. Each module in the aforementioned root cause localization device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0134] In an exemplary embodiment, an electronic device is provided, which may be a terminal, and its internal structure diagram is shown in Figure 10. The electronic device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a network management method. The display unit is used to form a visually visible image and may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the electronic device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the electronic device, or external keyboards, touchpads, or mice, etc.

[0135] Those skilled in the art will understand that the structure shown in Figure 10 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0136] In one embodiment, an electronic device is provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0137] Obtain the network data of the current network, and based on the network data, perform queries and inferences in the multi-source knowledge graph to obtain the detection results of the current network;

[0138] If the detection result indicates that there is a fault in the current network, the root cause of the fault is located based on the entity relationships in the multi-source knowledge graph.

[0139] In one embodiment, the processor may further perform the following steps when executing a computer program:

[0140] Acquire multi-source network data information, extract information from the multi-source network data information, and obtain entity data and relational data associated with the fault;

[0141] Knowledge modeling is performed based on entity data and relational data to construct a multi-source knowledge graph.

[0142] In one embodiment, the processor may further perform the following steps when executing a computer program:

[0143] Multiple data sources are determined based on preset filtering rules;

[0144] By acquiring network data information of the target network corresponding to multiple data sources, multi-source network data information is obtained.

[0145] In one embodiment, the processor may further perform the following steps when executing a computer program:

[0146] Syntactic structure dependency analysis is performed on alarm records contained in multi-source network data to determine the dependency relationships between the components contained in the multi-source network data.

[0147] Based on dependency relationships, a dependency projection tree is constructed between components, and dependency projection subtrees that meet the matching rules are selected based on pre-configured matching rules.

[0148] Based on the dependency projection subtree that conforms to the matching rules, triples are generated; the triples contain entity data and relation data associated with alarms and faults.

[0149] In one embodiment, the processor may further perform the following steps when executing a computer program:

[0150] Based on relational feature words, the entity data and / or relational data in the triples are expanded by synonyms to obtain multiple triples after synonym expansion;

[0151] Based on preset evaluation rules, multiple triples are evaluated and screened to obtain triples for generating multi-source knowledge graphs.

[0152] In one embodiment, the processor may further perform the following steps when executing a computer program:

[0153] For each data source, after evaluation and screening of the triples, a knowledge graph of the data sources is constructed;

[0154] By fusing knowledge graphs from multiple data sources, a multi-source knowledge graph can be obtained.

[0155] In one embodiment, the processor may further perform the following steps when executing a computer program:

[0156] If the detection result indicates that there is a fault in the current network, based on the relationship data between entities in the multi-source knowledge graph, query and infer the knowledge path where the current network fault is located.

[0157] Based on the knowledge path, the root cause of the current network failure is located, and an alarm is issued for the current network failure.

[0158] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, causes the processor to perform the steps in the above method embodiments.

[0159] In one embodiment, a non-volatile computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, causes the processor to perform the steps in the above method embodiments.

[0160] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0161] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for locating the root cause of a fault, the method comprising: Obtain the network data of the current network, and based on the network data, perform querying and reasoning in a multi-source knowledge graph to obtain the detection results of the current network; as well as If the detection result indicates that the current network is faulty, the root cause of the fault in the current network is located based on the entity relationships in the multi-source knowledge graph.

2. The method according to claim 1, further comprising: Acquire multi-source network data information, extract information from the multi-source network data information, and obtain entity data and relationship data associated with the fault; Knowledge modeling is performed based on the entity data and the relationship data to construct a multi-source knowledge graph.

3. The method according to claim 2, wherein acquiring multi-source network data information includes: Multiple data sources are determined based on preset filtering rules; By acquiring network data information of the target network corresponding to multiple data sources, multi-source network data information is obtained.

4. The method according to claim 2, wherein extracting information from the multi-source network data to obtain entity data and relationship data associated with the fault includes: Syntactic structure dependency analysis is performed on the alarm records contained in the multi-source network data information to determine the dependency relationships between the components contained in the multi-source network data information. Based on the dependency relationship, a dependency projection tree between the components is constructed, and based on the pre-configured matching rules, dependency projection subtrees that conform to the matching rules are selected. Based on the dependency projection subtree that conforms to the matching rules, triples are generated; the triples contain entity data and relation data associated with alarm faults.

5. The method according to claim 4, after generating triples based on the dependency projection subtree conforming to the matching rule, the method further includes: Based on relational feature words, the entity data and / or relational data in the triples are expanded by synonyms to obtain multiple triples after synonym expansion. Based on preset evaluation rules, the multiple triples are evaluated and screened to obtain triples used to generate the multi-source knowledge graph.

6. The method according to claim 5, wherein the knowledge modeling based on the entity data and the relation data to construct a multi-source knowledge graph includes: For each data source, after evaluation and filtering of the triples, a knowledge graph of the data source is constructed; The multi-source knowledge graph is obtained by fusing knowledge graphs from multiple data sources.

7. The method according to claim 1, wherein if the detection result indicates a fault in the current network, locating the root cause of the fault in the current network based on entity relationships in the multi-source knowledge graph includes: If the detection result indicates that the current network is faulty, based on the relationship data between entities in the multi-source knowledge graph, query and infer the knowledge path where the current network is faulty. Based on the knowledge path, the root cause of the current network failure is located, and an alarm is issued for the current network failure.

8. A fault root cause location device, the device comprising: The acquisition module is used to acquire network data of the current network, and based on the network data, to perform querying and reasoning in a multi-source knowledge graph to obtain the detection results of the current network. as well as The fault location module is used to locate the root cause of the fault in the current network based on the entity relationships in the multi-source knowledge graph if the detection result indicates that the current network has a fault.

9. The apparatus according to claim 8, further comprising: The information extraction module is used to acquire multi-source network data information, extract information from the multi-source network data information, and obtain entity data and relation data associated with the fault. The building module is used to perform knowledge modeling based on entity data and relational data, and to build multi-source knowledge graphs.

10. The apparatus according to claim 9, wherein the information extraction module is used for: Multiple data sources are determined based on preset filtering rules; Obtain network data information of the target network corresponding to the multiple data sources to obtain the multi-source network data information.

11. The apparatus according to claim 9, wherein the information extraction module is used for: Syntactic structure dependency analysis is performed on the alarm records contained in the multi-source network data information to determine the dependency relationships between the components contained in the multi-source network data information. Based on the dependency relationships, a dependency projection tree is constructed between the components, and based on the pre-configured matching rules, dependency projection subtrees that conform to the matching rules are selected. Based on the dependency projection subtree that conforms to the matching rules, triples are generated, wherein the triples contain entity data and relation data associated with alarm faults.

12. The apparatus of claim 11, further comprising: The extension module is used to perform synonym expansion on the entity data and / or relation data in the triples based on relation feature words, so as to obtain multiple triples after synonym expansion; The filtering module is used to evaluate and filter the multiple triples based on preset evaluation rules to obtain triples used to generate the multi-source knowledge graph.

13. The apparatus of claim 12, wherein the building module is configured to: For each data source, after evaluation and screening of the triples, a knowledge graph of the data sources is constructed; The multi-source knowledge graph is obtained by fusing knowledge graphs from multiple data sources.

14. The apparatus of claim 8, wherein the fault location module is used for: If the detection result indicates that there is a fault in the current network, based on the relationship data between entities in the multi-source knowledge graph, query and infer the knowledge path where the current network fault is located. Based on the knowledge path, the root cause of the current network failure is located, and an alarm is issued for the current network failure.

15. An electronic device comprising a memory and a processor, the memory storing a computer program, wherein the processor executes the computer program to implement the steps of the method of any one of claims 1 to 7.

16. A non-volatile computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, causes the processor to perform the steps of the method according to any one of claims 1 to 7.

17. A computer program product comprising a computer program, wherein when executed by a processor, the computer program causes the processor to perform the steps of the method according to any one of claims 1 to 7.

Images