CN111143101B

CN111143101B - Method, device, storage medium and electronic equipment for determining fault source

Info

Publication number: CN111143101B
Application number: CN201911276703.6A
Authority: CN
Inventors: 任卫杰; 张霞; 黄治纲
Original assignee: Neusoft Corp
Current assignee: Neusoft Corp
Priority date: 2019-12-12
Filing date: 2019-12-12
Publication date: 2023-07-07
Anticipated expiration: 2039-12-12
Also published as: CN111143101A

Abstract

The present disclosure relates to a method, an apparatus, a storage medium, and an electronic device for determining a root cause of a failure. The method comprises the following steps: obtaining first time sequences of a plurality of failed target objects, determining an association relation between the target objects and a sequence of failed target objects according to the first time sequences of the target objects, and determining a source of the failure according to the association relation and the sequence. Therefore, after the association relation and the sequence between the target objects are determined, the causal relation of the faults can be determined based on the association relation and the sequence, and then the source of the faults can be determined. Therefore, the workload and time for determining the fault source by operation and maintenance personnel are greatly reduced, and the efficiency for determining the fault source is improved. Moreover, the operation and maintenance personnel can eliminate the faults of other target objects related to the operation and maintenance personnel only by repairing the root of the faults, so that the faults of the target objects can be quickly eliminated, and the normal operation of the target objects is ensured.

Description

Method, device, storage medium and electronic equipment for determining fault source

Technical Field

The present disclosure relates to the field of computer technology, and in particular, to a method, an apparatus, a storage medium, and an electronic device for determining a root cause of a fault.

Background

Many internet enterprises need to monitor many key performance indicators (KPIs, key Performance Indicator) in order to guarantee quality and reliability of service. In a generating environment, services or devices are often associated with each other, and an abnormality or instability of a service or device represented by a KPI may cause an abnormality of many other services or devices. For example, an anomaly in a database may result in a corresponding anomaly in other services based on the database. For another example, an abnormality occurs in a socket in the machine room, thereby causing an abnormality in an air conditioner, a temperature sensor in the machine room. A series of alarms may be triggered, which in severe cases may lead to alarm storms.

In the related art, the operation and maintenance personnel can only check one by one in the face of the alarm information, and the alarm storm can not be subsided until the alarm source is checked and repaired. By adopting the method, if the number of the related services or devices is large, the workload of operation and maintenance personnel is increased, so that the time for the operation and maintenance personnel to determine the fault source is long, and the efficiency for determining the fault source is low.

Disclosure of Invention

An object of the present disclosure is to provide a method, an apparatus, a storage medium, and an electronic device for determining a root cause of a fault, so as to improve efficiency of determining the root cause of the fault.

To achieve the above object, a first aspect of the present disclosure provides a method for determining a root cause of a fault, including:

acquiring a first time sequence of a plurality of failed target objects, wherein data in the first time sequence are key performance index data of the target objects;

determining the association relation between the target objects and the sequence of faults of the target objects according to the first time sequence of each target object;

and determining the source of the fault according to the association relation and the sequence.

Optionally, the determining the association relationship between the target objects according to the first time sequence of each target object includes:

smoothing the abnormal data used for indicating faults in the first time sequence of each target object, and determining a target time sequence corresponding to the target object according to a smoothing result, wherein the length of the target time sequence is the same as that of the first time sequence;

For each target object, determining a time sequence error of the target object according to the target time sequence and the first time sequence corresponding to the target object;

for each two target objects, determining the association relation between the two target objects according to the correlation coefficient between the time sequence errors of the two target objects.

Optionally, the target time sequence is a time sequence obtained after the first time sequence is smoothed.

Optionally, the first time series includes key performance indicator data for the target object over a plurality of days;

the determining the target time sequence corresponding to the target object according to the smoothing result comprises the following steps:

determining a time sequence obtained by smoothing the first time sequence of each target object as a second time sequence corresponding to the target object, wherein the length of the second time sequence is the same as that of the first time sequence;

and calculating N characteristic parameters of key performance index data at the same time in different days in the second time sequence aiming at the second time sequence corresponding to each target object, and sequentially replacing the key performance index data at the time in the second time sequence by each characteristic parameter to obtain N target time sequences corresponding to the target objects, wherein N is more than or equal to 1.

Optionally, the time sequence error determined for each target object is N;

for each two target objects, determining the association relationship between the two target objects according to the correlation coefficient between the time sequence errors of the two target objects, including:

for each two target objects, determining the association relation between the two target objects according to the maximum correlation coefficient between the time sequence errors of the two target objects.

Optionally, before determining the correlation coefficient, the method further comprises:

noise reduction is performed on the time series error by the following formula:

wherein x is an error value in the time series error; f (x) is a value obtained after noise reduction of x; alpha and beta are preset coefficients.

Optionally, the method further comprises:

acquiring the alarm time of each target object in a time period corresponding to the first time sequence;

generating alarm association diagrams of the plurality of target objects according to the alarm time of each target object;

the determining the source of the fault according to the association relation and the sequence comprises the following steps:

generating a time sequence association diagram of the plurality of target objects according to the association relation and the sequence;

Performing intersection operation on the time sequence association diagram and the alarm association diagram to obtain a target association diagram;

and determining the source of the fault according to the target association diagram.

Optionally, the generating an alarm association graph of the plurality of target objects according to the alarm time of each target object includes:

determining alarm time intervals among a plurality of target objects according to the alarm time of each target object;

grouping the plurality of target objects according to the alarm time interval, wherein the target objects with the alarm time interval smaller than the preset time interval are positioned in a group;

determining an association rule corresponding to each group of target objects through an association rule mining algorithm;

and generating alarm association diagrams of the plurality of target objects according to association rules corresponding to each group of target objects.

The second aspect of the present disclosure also provides an apparatus for determining a root cause of a fault, comprising:

the first acquisition module is used for acquiring a first time sequence of a plurality of failed target objects, wherein data in the first time sequence are key performance index data of the target objects;

the first determining module is used for determining the association relation between the target objects and the sequence of faults of the target objects according to the first time sequence of each target object;

And the second determining module is used for determining the root cause of the fault according to the association relation and the sequence.

Optionally, the first determining module includes:

the first determining submodule is used for carrying out smoothing processing on abnormal data used for indicating faults in the first time sequence of each target object and determining a target time sequence corresponding to the target object according to a smoothing processing result, wherein the length of the target time sequence is the same as that of the first time sequence;

the second determining submodule is used for determining a time sequence error of each target object according to the target time sequence and the first time sequence corresponding to the target object;

and the third determination submodule is used for determining the association relation between the two target objects according to the correlation coefficient between the time sequence errors of the two target objects for each two target objects.

The first determining submodule is used for determining a time sequence obtained by smoothing the first time sequence of each target object as a second time sequence corresponding to the target object, and the length of the second time sequence is the same as that of the first time sequence; and calculating N characteristic parameters of key performance index data at the same time in different days in the second time sequence aiming at the second time sequence corresponding to each target object, and sequentially replacing the key performance index data at the time in the second time sequence by each characteristic parameter to obtain N target time sequences corresponding to the target objects, wherein N is more than or equal to 1.

Optionally, the time sequence error determined for each target object is N;

the third determining submodule is used for determining the association relation between the two target objects according to the maximum correlation coefficient between the time sequence errors of the two target objects for each two target objects.

Optionally, the apparatus further comprises:

the noise reduction module is used for reducing noise of the time sequence error through the following formula:

Optionally, the apparatus further comprises:

the second acquisition module is used for acquiring the alarm time of each target object in the time period corresponding to the first time sequence;

the generating module is used for generating alarm association diagrams of the plurality of target objects according to the alarm time of each target object;

the second determining module is configured to generate a time sequence association graph of the plurality of target objects according to the association relationship and the sequence; performing intersection operation on the time sequence association diagram and the alarm association diagram to obtain a target association diagram; and determining the source of the fault according to the target association diagram.

Optionally, the generating module includes:

a fourth determining sub-module, configured to determine an alarm time interval between a plurality of target objects according to an alarm time of each of the target objects;

the grouping sub-module is used for grouping the plurality of target objects according to the alarm time interval, wherein the target objects with the alarm time interval smaller than the preset time interval are positioned in a group;

a fifth determining submodule, configured to determine, by using an association rule mining algorithm, an association rule corresponding to each group of target objects;

And the generation sub-module is used for generating alarm association graphs of the plurality of target objects according to association rules corresponding to each group of target objects.

The third aspect of the present disclosure also provides a computer readable storage medium having stored thereon a computer program which when executed by a processor implements the steps of the method provided by the first aspect of the present disclosure.

The fourth aspect of the present disclosure also provides an electronic device, including:

a memory having a computer program stored thereon;

a processor for executing the computer program in the memory to implement the steps of the method provided by the first aspect of the disclosure.

Through the technical scheme, first, the first time sequences of a plurality of failed target objects are obtained, then, the association relation between the target objects and the order of the failed target objects are determined according to the first time sequences of the target objects, and the source of the failure is determined according to the association relation and the order. Therefore, after the association relation between the target objects and the sequence of faults of the target objects are determined, the causal relation of the faults can be determined based on the association relation and the sequence, and then the source of the faults can be determined. Therefore, the workload and time for determining the fault source by operation and maintenance personnel are greatly reduced, and the efficiency for determining the fault source is improved. Moreover, the operation and maintenance personnel can eliminate the faults of other target objects related to the operation and maintenance personnel only by repairing the root of the faults, so that the faults of the target objects can be quickly eliminated, and the normal operation of the target objects is ensured.

Additional features and advantages of the present disclosure will be set forth in the detailed description which follows.

Drawings

The accompanying drawings are included to provide a further understanding of the disclosure, and are incorporated in and constitute a part of this specification, illustrate the disclosure and together with the description serve to explain, but do not limit the disclosure. In the drawings:

FIG. 1 is a flowchart illustrating a method for determining a root cause of a fault, according to an example embodiment.

Fig. 2 is a schematic diagram illustrating a time sequence of a target object according to an exemplary embodiment.

Fig. 3 is a flowchart illustrating a method of determining an association relationship between target objects according to an exemplary embodiment.

FIG. 4 is a flowchart illustrating a method for determining a root cause of a fault, according to another exemplary embodiment.

FIG. 5a is an alarm correlation diagram illustrating an example embodiment.

Fig. 5b is a time series correlation diagram illustrating an example embodiment.

FIG. 5c is a graph of target correlations from an intersection of the alarm correlation graph shown in FIG. 5a and the time series correlation graph shown in FIG. 5b, according to an exemplary embodiment.

FIG. 6 is a block diagram illustrating an apparatus for determining a root cause of a fault, according to an example embodiment.

Fig. 7 is a block diagram of an electronic device, according to an example embodiment.

Fig. 8 is a block diagram of an electronic device, according to another example embodiment.

Detailed Description

Specific embodiments of the present disclosure are described in detail below with reference to the accompanying drawings. It should be understood that the detailed description and specific examples, while indicating and illustrating the disclosure, are not intended to limit the disclosure.

FIG. 1 is a flowchart illustrating a method for determining a root cause of a fault, according to an example embodiment. As shown in fig. 1, the method for determining the root cause of a fault may include steps 101 to 103.

In step 101, a first time series of a plurality of failed target objects is acquired. The data in the first time sequence is key performance index data of the target object.

It should be noted that the method may be applied to an electronic device or a server. When the electronic device is applied, the electronic device may be a monitor, and the monitor may acquire a first time sequence of a plurality of failed target objects and perform subsequent operations during the process of monitoring the target objects. When the method is applied to a server, the server can acquire a first time sequence of each target object from a plurality of failed target objects, or can acquire the first time sequence of each target object from a monitor and execute subsequent operations.

In this disclosure, the target object may be an object of a service class, such as: weChat services, unionPay services, etc., may also be objects of a class of devices, such as: outlet devices, air conditioning devices, temperature sensor devices, and the like. The present disclosure is not particularly limited thereto.

Furthermore, the target object may be a monitored object. Thus, when the target object fails, a first time series of the target object can be acquired, and the data in the first time series is key performance index data of the target object, and the first time series includes abnormal data for indicating that the failure occurs.

For example, assume that the plurality of failed target objects are a target object K1, a target object K2, a target object K3, a target object K4, a target object K5, and a target object K6, respectively, and the respective first time series are as shown in fig. 2. And, as shown in fig. 2, the upward or downward mutation data in each first time series is noted as abnormal data.

In step 102, according to the first time sequence of each target object, the association relationship between the target objects and the order of failure of the target objects are determined.

As described above, after the first time series of the plurality of failed target objects are obtained in step 101, the association relationship between the target objects and the order of failed target objects may be determined according to the first time series of each target object.

Specifically, the inventors consider that an index of signal waveform similarity is generally calculated with Normalized Cross-Correlation (NCC) in the communication field, and the first time series may also be represented with a waveform chart (as shown in fig. 2), and therefore, in the present disclosure, the association relationship between target objects may be determined in accordance with the manner in which signal waveform similarity is calculated in the communication field. It should be noted that the present disclosure only shows an embodiment for determining the association relationship between the target objects according to the normalized cross-correlation coefficient, and other ways of determining the association relationship between the target objects are equally applicable to the present disclosure.

In addition, the order of faults of the target objects can be determined according to the first time sequence of each target object. For example, the order of occurrence of the faults is determined according to the time corresponding to the upward or downward mutation data in the first time sequence. Illustratively, as shown in FIG. 2, the time at which the target object K1 fails is earlier than the time at which the target object K2 fails, the time at which the target object K2 fails is earlier than the time at which the target object K3 fails, and so on.

The values illustrate that, in one embodiment, for each of a plurality of target objects, an association relationship between the target objects is determined, and for each of the plurality of target objects, a sequencing of the failure of the target objects is determined. For example, the association relationship between the target object K1 to the target object K6 is calculated, and the order in which the target object K1 to the target object K6 fail is calculated, respectively.

In another embodiment, first, for any two target objects of the plurality of target objects, an association relationship between the two target objects is determined, and then, for the two target objects having the association relationship, a sequence in which the two target objects fail is determined. For example, the target object K1 and the target object K2 have an association relationship, and the target object K1 and the target object K3 do not have an association relationship, so that only the order of faults of the target object K1 and the target object K2 is required to be determined, the order of faults of the target object K1 and the target object K3 is not required to be determined any more, the workload of determining the order of faults of the target object can be reduced, and the efficiency of determining the root cause of the faults is improved.

In step 103, the source of the fault is determined according to the association and the sequence.

According to the association relationship between the target objects and the sequence of faults determined in the step 102, the causal relationship of faults of the target objects can be further determined, and then the source of the faults can be determined according to the causal relationship.

For example, if the target object K1 and the target object K2 have an association relationship, the target object K2 and the target object K3 have an association relationship, and the sequence of the occurrence of the faults of the three target objects is as follows: the causal relationship of the faults of the three target objects can be determined as follows: the target object K1 fails to cause the target object K2 to fail, the target object K2 fails to cause the target object K3 to fail, and then the root cause of the failure can be determined to be the target object K1. Thus, the operation and maintenance personnel only need to perform fault investigation on the target object K1, and after repairing the fault of the target object K1, the faults of the target object K2 and the target object K3 may be eliminated.

By adopting the technical scheme, first, the first time sequences of a plurality of failed target objects are obtained, then, the association relation between the target objects and the order of the failed target objects are determined according to the first time sequences of the target objects, and the source of the failure is determined according to the association relation and the order. Therefore, after the association relation between the target objects and the sequence of faults of the target objects are determined, the causal relation of the faults can be determined based on the association relation and the sequence, and then the source of the faults can be determined. Therefore, the workload and time for determining the fault source by operation and maintenance personnel are greatly reduced, and the efficiency for determining the fault source is improved. Moreover, the operation and maintenance personnel can eliminate the faults of other target objects related to the operation and maintenance personnel only by repairing the root of the faults, so that the faults of the target objects can be quickly eliminated, and the normal operation of the target objects is ensured.

The following describes the determining of the association relationship between the target objects according to the first time sequence of each target object in the step 102.

As shown in fig. 3, determining the association relationship between the target objects may specifically include steps 1021 to 1023.

In step 1021, smoothing is performed on the abnormal data in the first time sequence of each target object for indicating the occurrence of the fault, and a target time sequence corresponding to the target object is determined according to the smoothing result, wherein the length of the target time sequence is the same as the length of the first time sequence.

The first time series of each target object includes abnormal data (as shown in fig. 2, upward or downward abrupt data in each first time series) for indicating the occurrence of a fault, and in order to obtain a time series when the target object operates normally, in the present disclosure, the abnormal data may be smoothed according to data before and/or after the abnormal data.

Specifically, in one embodiment, if the key performance index data at time t is abnormal data, the abnormal data at time t may be replaced with the key performance index data at time t-1 (time immediately before time t) or time t+1 (time immediately after time t).

In another embodiment, if the key performance index data at the time t is abnormal data, a data may be generated based on the key performance index data at the time t-1 (the time before the time t) and the time t+1 (the time after the time t) to replace the abnormal data at the time t. For example, if the key performance index data at time t-1 is a1 and the key performance index data at time t+1 is a2, the abnormal data at time t may be replaced by any one of the values a1 and a2 or the average value of a1 and a 2.

The foregoing are only two embodiments of smoothing abnormal data shown in the present disclosure, and other smoothing manners are equally applicable to the present disclosure, which are not described herein in detail.

After smoothing processing is performed in any one of the above modes, a target time series corresponding to the target object is determined according to the smoothing processing result, and the length of the target time series is the same as the length of the first time series.

The method of determining the target time series corresponding to the target object based on the smoothing result is not limited to the following two methods. In a first possible embodiment, the target time sequence is a time sequence obtained after the first time sequence is smoothed. Specifically, the abnormal data indicating the occurrence of the failure in the first time series is subjected to smoothing processing, and the smoothed first time series is determined as the target time series.

Considering that the time sequence obtained after the smoothing of the original first time sequence is determined as the target time sequence, it may result in that the target time sequence of the target object in normal operation cannot be accurately determined, and further, a time sequence error of the target object cannot be accurately determined, and therefore, another way of determining the target time sequence is also proposed in the present disclosure.

In a second possible embodiment, the first time series includes key performance indicator data for the target object over a plurality of days; firstly, determining a time sequence obtained by smoothing the first time sequence of each target object as a second time sequence corresponding to the target object, wherein the length of the second time sequence is the same as that of the first time sequence. And then, aiming at a second time sequence corresponding to each target object, calculating N characteristic parameters of key performance index data at the same time in different days in the second time sequence, and sequentially replacing the key performance index data at the time in the second time sequence by each characteristic parameter to obtain N target time sequences corresponding to the target objects, wherein N is more than or equal to 1. Wherein the characteristic parameters may include, but are not limited to, average, median, mode. For ease of illustration, the present disclosure takes N characteristic parameters including average, median, mode as examples.

Taking the characteristic parameter as an average value as an example, if the first time series includes key performance index data of the target object within two days (hereinafter referred to as first day and second day), the first time series may be represented as [ a ] ₁₁ ,a ₁₂ ,a ₁₃ ,…，a _1n ；a ₂₁ ,a ₂₂ ,a ₂₃ ,…，a _2n ]Wherein a is ₁₁ ,a ₁₂ ,a ₁₃ Critical performance index data, a, representing the first, second and third moments of the first day, respectively ₂₁ ,a ₂₂ ,a ₂₃ Key performance index data representing the first time, the second time, and the third time, respectively, within the second day, and each day includes n times. Calculation of a ₁₁ And a ₂₁ And replacing key performance index data at the first day and at the first time in the second time series with the average value to calculate a ₁₂ And a ₂₂ And replacing key performance index data at the first day and at a second time instant in the second time series with the average, and calculating a ₁₃ And a ₂₃ And replacing the key performance index data at the first and third time instants in the second time series by the average value, and so on until a is calculated _1n And a _2n And replacing the key performance indicator data at the nth time instant in the first day and in the second day in the second time series with the average. Thus, after the replacement of the key performance index data at each moment in the second time sequence is completed, the second time sequence after the replacement is completed can be used for determining the target time sequence corresponding to the target object. For convenience of description, the target time series may be referred to as a target time series corresponding to the average value. Further, the above-described method can be referred to as a method of calculating a target time series corresponding to the median and a target time series corresponding to the mode.

According to the mode, N target time sequences corresponding to each target object can be determined for each target object.

In step 1022, for each target object, a time series error of the target object is determined according to the target time series and the first time series corresponding to the target object.

For example, for each target object, the target time sequence corresponding to the target object determined in the step 1021 and the key performance index data at the same time in the first time sequence may be subtracted to obtain an error value at the time, so that the key performance index data at each time in the time sequence is subtracted to obtain the time sequence error of the target object.

In the first possible embodiment, since each target object corresponds to only one target time sequence, the determined time sequence error is one for each target object.

In the second possible embodiment, since each target object corresponds to N target time sequences, and each target time sequence and the first time sequence of the target object may determine a time sequence error, the determined time sequence error is N for each target object.

In step 1023, for each two target objects, an association relationship between the two target objects is determined according to a correlation coefficient between time series errors of the two target objects.

In the first possible embodiment described above, since the time series error of each target object is one, the number of correlation coefficients between the time series errors of two target objects calculated for each time series error of two target objects is 1. In this embodiment, the association relationship between two target objects is determined based on 1 correlation coefficient between time series errors of the two target objects.

As described above, the correlation coefficient between the target objects can be determined by calculating the signal waveform similarity. After calculating the correlation coefficient between the target objects, it may be determined whether the two target objects have an association relationship according to a comparison result of the correlation coefficient and a first preset threshold. For example, if the correlation coefficient is greater than a first preset threshold, determining that the two target objects have an association relationship, otherwise, determining that the two target objects do not have an association relationship. The first preset threshold is a value set by a user, and the range of the first preset threshold is related to the value range of a formula adopted in calculating the correlation coefficient. For example, the value range of the formula for calculating the correlation coefficient is [0,1], and the first preset threshold may be 0.6; the range of the formula for calculating the correlation coefficient is [0, 100], the first preset threshold may be 60, and so on.

In the second possible embodiment, the number of determined time series errors is N, and the determining, in step 1023, the association relationship between the two target objects according to the correlation coefficient between the time series errors of the two target objects may be implemented as follows: for each two target objects, determining the association relation between the two target objects according to the maximum correlation coefficient between the time sequence errors of the two target objects.

For example, the two target objects are taken as a target object K1 and a target object K2, the time sequence error of the target object K1 is 3, and the time sequence error corresponding to the target object K2 is also 3. And respectively determining the time sequence error corresponding to each feature in the target object K1 and the time sequence error corresponding to each feature in the target object K2, determining 9 correlation coefficients between the time sequence errors of the two target objects, determining the maximum correlation coefficient in the 9 correlation coefficients, and determining the association relationship between the two target objects based on the maximum correlation coefficient. For example, if the maximum correlation coefficient is greater than the second preset threshold, determining that the two target objects have an association relationship, otherwise, determining that the two target objects do not have an association relationship. The second preset threshold may be the same as or different from the first preset threshold. The second preset threshold is also a value set by the user, and the setting of the second preset threshold is the same as the setting of the first preset threshold, which is not described herein.

By adopting the technical scheme, N characteristic parameters of key performance index data at the same time in different days in the second time sequence are calculated to obtain N target time sequences corresponding to the target objects, so that more accurate target time sequences can be obtained, further, time sequence errors of the target objects and correlation coefficients between the time sequence errors can be accurately determined, and finally, whether the two target objects have a correlation relationship or not can be accurately determined, namely, the accuracy of determining the correlation relationship between the target objects is improved.

In addition, in consideration of noise existing in the time series error of the determined target object, the correlation coefficient between the calculated time series errors of the two target objects may be affected, so in the present disclosure, a noise reduction process may be further performed on the time series error before the correlation coefficient is determined, to improve the accuracy of the determined correlation coefficient.

The inventors consider that the following requirements are satisfied when noise reduction processing is performed on the time series error: for smaller error values, the value becomes smaller after the noise reduction process, and for larger error values, the value becomes larger after the noise reduction process, based on which the inventors propose a new noise reduction way to reduce the time series error.

Specifically, the time series error is noise reduced by the formula (1):

wherein x is an error value in the time series error; f (x) is a value obtained after noise reduction of x; alpha and beta are preset coefficients. For example, the value range of α may be empirically set to [0,1], and the value range of β may be set to [5,10].

The time series error may be normalized before the noise reduction, for example, by a normalization method or a z-score normalization method.

In addition, in consideration of that the target object can output an alarm signal to prompt a user to fail when the target object fails, the purpose of tracking the root of the failure when the target device alarms can be achieved based on the alarm signal output by the target device.

Specifically, as shown in fig. 4, the method for determining the root cause of a fault may include

steps

104 and 105, and steps 1031 to 1033, in addition to steps 101 to 102.

In step 104, the alert time of each target object in the time period corresponding to the first time sequence is obtained.

For example, assuming that the period corresponding to the first time series is 31 in 12 months in 2018 to 26 in 2 months in 2019, the acquired alarm time of each target object in the period is shown in table 1. It should be noted that, table 1 includes only the alarm times of the target object K2, the target object K3, the target object K4, the target object K5, and the target object K6, and in other embodiments, table 1 may also include other alarm times of the target objects, which is not specifically limited in this disclosure.

TABLE 1

Target object	Alarm time
		Target object K2	2018-12-31 19:25:09
Target object K3	2018-12-31 19:26:09
		Target object K5	2018-12-31 19:27:09
Target object K4	2019-01-01 10:02:20
		Target object K6	2019-01-01 10:03:17
Target object K3	2019-02-18 09:03:22
		Target object K6	2019-02-2518:09:17

In step 105, an alert association graph for a plurality of target objects is generated based on the alert time for each target object.

First, an alarm time interval between a plurality of target objects is determined according to an alarm time of each target object. The alarm time interval between any two target objects can be determined to determine the alarm time intervals of a plurality of target objects, the alarm time can be sequenced according to the sequence (as shown in table 1), and the time intervals of two adjacent alarm times are calculated respectively to determine the alarm time intervals between a plurality of target objects.

And then, grouping the plurality of target objects according to the alarm time interval, wherein the target objects with the alarm time interval smaller than the preset time interval are positioned in one group. In one embodiment, after determining the alert time interval between the plurality of target objects, the target objects having a time interval less than the preset time interval may be grouped into a group. In another embodiment, the plurality of target objects may be further grouped according to a sliding time window, wherein the sliding time window has a size corresponding to a preset time interval, so that the target objects located in the same window may be grouped into a group. Illustratively, the alert data in Table 1 may be converted to a form as shown in Table 2 in any of the manners described above.

TABLE 2

Target object K2	Target object K3	Target object K5	Target object K4	Target object K6
					yes	yes	yes
			yes	yes
						yes
				yes

The yes in table 2 is used to indicate that the target object outputs an alarm signal, each row except the first row indicates a group, the target objects corresponding to the yes in the same row are located in a group, and the target objects corresponding to the yes in the same row can be considered to output an alarm signal in the same time period.

And then, determining the association rule corresponding to each group of target objects according to an association rule mining algorithm Apriori. The determination of the association rule corresponding to the target object by the association rule mining algorithm belongs to a well-known technology in the art, and is not described herein.

Illustratively, based on the association rule mining algorithm and table 2, it may be determined that the target object K2, the target object K3, and the target object K5 are association rules, and the target object K4 and the target object K6 are association rules.

And finally, generating alarm association graphs of a plurality of target objects according to association rules corresponding to each group of target objects. Illustratively, the generated alert association graphs for the plurality of target objects are shown in FIG. 5 a.

Accordingly, step 103 in fig. 1 may specifically include steps 1031 to 1033.

In step 1031, a time series association diagram of a plurality of target objects is generated according to the association relationship and the sequence.

Illustratively, a time series correlation diagram of the plurality of target objects is generated, as shown in fig. 5 b. In the time-series association diagram shown in fig. 5b, the target object K1 and the target object K2 have an association relationship, the target object K2 and the target object K3 have an association relationship, the target object K4 and the target object K5 have an association relationship, and the target object K4 and the target object K6 have an association relationship. The time of the failure of the target object K1 is earlier than the time of the failure of the target object K2, the time of the failure of the target object K2 is earlier than the time of the failure of the target object K3, and the time of the failure of the target object K4 is earlier than the time of the failure of the target object K5 and the time of the failure of the target object K6. Thus, as shown in FIG. 5b, target object K1 points to target object K2, target object K2 points to target object K3, and target object K4 points to target object K5, target object K4 points to target object K6.

In step 1032, an intersection operation is performed on the time series association graph and the alarm association graph to obtain a target association graph.

In step 1033, the source of the fault is determined from the target association graph.

Intersection operation is performed on the alarm correlation diagram shown in fig. 5a and the time series correlation diagram shown in fig. 5b, so as to obtain a target correlation diagram shown in fig. 5 c. Then, the source of the fault is determined according to the target association diagram. For example, when both the target object K1 and the target object K2 fail, it may be that the target object K2 fails after the target object K1 fails, so that the operation and maintenance personnel can preferentially inspect the target object K1, which greatly reduces the workload and time of the operation and maintenance personnel for one-by-one inspecting to determine the failure source, and improves the efficiency of determining the failure source. Moreover, the operation and maintenance personnel can eliminate the faults of other target objects related to the operation and maintenance personnel only by repairing the root of the faults, so that the faults of the target objects can be quickly eliminated, and the normal operation of the target objects is ensured.

By adopting the technical scheme, the time sequence association diagram and the alarm association diagram are comprehensively considered to obtain the target association diagram, and the source of the fault is determined based on the target association diagram. Therefore, the defect that the alarm cannot be traced and traced when the fault source is determined only according to the time sequence association diagram can be avoided, and the defect that the association relation between the determined target objects is easy to distort when the fault source is determined only according to the alarm association diagram in the related technology can be avoided, so that the accuracy of determining the fault source is further improved.

Based on the same inventive concept, the present disclosure also provides an apparatus for determining a root cause of a fault. FIG. 6 is a block diagram illustrating an apparatus for determining a root cause of a fault, according to an example embodiment. As shown in fig. 6, the apparatus 60 may include:

a first obtaining module 601, configured to obtain a first time sequence of a plurality of failed target objects, where data in the first time sequence is key performance index data of the target objects;

a first determining module 602, configured to determine, according to the first time sequence of each target object, an association relationship between the target objects, and a sequence in which the target objects fail;

And a second determining module 603, configured to determine a root cause of the fault according to the association relationship and the sequence.

Optionally, the first determining module 602 may include:

The first determining submodule may be configured to determine a time sequence obtained by smoothing the first time sequence of each target object as a second time sequence corresponding to the target object, where a length of the second time sequence is the same as a length of the first time sequence; and calculating N characteristic parameters of key performance index data at the same time in different days in the second time sequence aiming at the second time sequence corresponding to each target object, and sequentially replacing the key performance index data at the time in the second time sequence by each characteristic parameter to obtain N target time sequences corresponding to the target objects, wherein N is more than or equal to 1.

Optionally, the time sequence error determined for each target object is N;

the third determining submodule may be configured to determine, for each two target objects, an association relationship between the two target objects according to a maximum correlation coefficient between time series errors of the two target objects.

Optionally, the apparatus may further include:

Optionally, the apparatus may further include:

Optionally, the generating module may include:

The specific manner in which the various modules perform the operations in the apparatus of the above embodiments have been described in detail in connection with the embodiments of the method, and will not be described in detail herein.

Fig. 7 is a block diagram of an electronic device, which may be a monitor, according to an example embodiment. As shown in fig. 7, the electronic device 700 may include: a processor 701, a memory 702. The electronic device 700 may also include one or more of a multimedia component 703, an input/output (I/O) interface 704, and a communication component 705.

Wherein the processor 701 is configured to control the overall operation of the electronic device 700 to perform all or part of the steps in the method for determining a root cause of a fault described above. The memory 702 is used to store various types of data to support operation on the electronic device 700, which may include, for example, instructions for any application or method operating on the electronic device 700, as well as application-related data, such as contact data, messages sent and received, pictures, audio, video, and so forth. The Memory 702 may be implemented by any type or combination of volatile or non-volatile Memory devices, such as static random access Memory (Static Random Access Memory, SRAM for short), electrically erasable programmable Read-Only Memory (Electrically Erasable Programmable Read-Only Memory, EEPROM for short), erasable programmable Read-Only Memory (Erasable Programmable Read-Only Memory, EPROM for short), programmable Read-Only Memory (Programmable Read-Only Memory, PROM for short), read-Only Memory (ROM for short), magnetic Memory, flash Memory, magnetic disk, or optical disk. The multimedia component 703 can include a screen and an audio component. Wherein the screen may be, for example, a touch screen, the audio component being for outputting and/or inputting audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in the memory 702 or transmitted through the communication component 705. The audio assembly further comprises at least one speaker for outputting audio signals. The I/O interface 704 provides an interface between the processor 701 and other interface modules, which may be a keyboard, mouse, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 705 is for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, bluetooth, near field communication (Near Field Communication, NFC for short), 2G, 3G, 4G, NB-IOT, eMTC, or other 5G, etc., or one or a combination of more of them, is not limited herein. The corresponding communication component 705 may thus comprise: wi-Fi module, bluetooth module, NFC module, etc.

In an exemplary embodiment, the electronic device 700 may be implemented by one or more application specific integrated circuits (Application Specific Integrated Circuit, abbreviated ASIC), digital signal processor (Digital Signal Processor, abbreviated DSP), digital signal processing device (Digital Signal Processing Device, abbreviated DSPD), programmable logic device (Programmable Logic Device, abbreviated PLD), field programmable gate array (Field Programmable Gate Array, abbreviated FPGA), controller, microcontroller, microprocessor, or other electronic component for performing the method for determining a root cause of a fault described above.

In another exemplary embodiment, a computer readable storage medium is also provided comprising program instructions which, when executed by a processor, implement the steps of the above-described method for determining a root cause of a fault. For example, the computer readable storage medium may be the memory 702 including program instructions described above that are executable by the processor 701 of the electronic device 700 to perform the method for determining the root cause of a fault described above.

Fig. 8 is a block diagram of an electronic device, according to another example embodiment. For example, the electronic device 800 may be provided as a server. Referring to fig. 8, the electronic device 800 includes a processor 822, which may be one or more in number, and a memory 832 for storing computer programs executable by the processor 822. The computer program stored in memory 832 may include one or more modules each corresponding to a set of instructions. Further, the processor 822 may be configured to execute the computer program to perform the method for determining the root cause of a fault described above.

In addition, the electronic device 800 may further include a power supply component 826 and a communication component 850, the power supply component 826 may be configured to perform power management of the electronic device 800, and the communication component 850 may be configured to enable communication of the electronic device 800, such as wired or wireless communication. In addition, the electronic device 800 may also include an input/output (I/O) interface 858. The electronic device 800 may operate based on an operating system stored in the memory 832, such as Windows Server, mac OS XTM, unixTM, linuxTM, etc.

In another exemplary embodiment, a computer readable storage medium is also provided comprising program instructions which, when executed by a processor, implement the steps of the above-described method for determining a root cause of a fault. For example, the computer readable storage medium may be the memory 832 described above including program instructions executable by the processor 822 of the electronic device 800 to perform the method for determining the root cause of a fault described above.

In another exemplary embodiment, a computer program product is also provided, comprising a computer program executable by a programmable apparatus, the computer program having code portions for performing the above-described method for determining a root cause of a fault when executed by the programmable apparatus.

The preferred embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings, but the present disclosure is not limited to the specific details of the above embodiments, and various simple modifications may be made to the technical solutions of the present disclosure within the scope of the technical concept of the present disclosure, and all the simple modifications belong to the protection scope of the present disclosure.

In addition, the specific features described in the above embodiments may be combined in any suitable manner without contradiction. The various possible combinations are not described further in this disclosure in order to avoid unnecessary repetition.

Moreover, any combination between the various embodiments of the present disclosure is possible as long as it does not depart from the spirit of the present disclosure, which should also be construed as the disclosure of the present disclosure.

Claims

1. A method for determining a root cause of a fault, comprising:

acquiring a first time sequence of a plurality of failed target objects, wherein the first time sequence comprises key performance index data of the target objects in a plurality of days;

Determining the source of the fault according to the association relation and the sequence;

wherein the determining the association relationship between the target objects according to the first time sequence of each target object includes:

performing smoothing processing on the abnormal data used for indicating faults in the first time sequence of each target object, and determining the time sequence obtained after the smoothing processing as a second time sequence corresponding to the target object, wherein the length of the second time sequence is the same as that of the first time sequence;

for the second time sequence corresponding to each target object, N characteristic parameters of key performance index data at the same moment in different days in the second time sequence are calculated, and each characteristic parameter is sequentially used for replacing the key performance index data at the moment in the second time sequence to obtain N target time sequences corresponding to the target objects, wherein N is more than or equal to 1, and the length of the target time sequences is the same as that of the first time sequence;

for each target object, determining N time sequence errors corresponding to the target object according to N target time sequences and the first time sequence corresponding to the target object;

And aiming at each two target objects, determining the association relation between the two target objects according to the maximum correlation coefficient between N time sequence errors respectively corresponding to the two target objects.

2. The method of claim 1, wherein prior to determining the correlation coefficient, the method further comprises:

noise reduction is performed on the time series error by the following formula:

3. The method according to claim 1, wherein the method further comprises:

4. An apparatus for determining a root cause of a fault, comprising:

the system comprises a first acquisition module, a second acquisition module and a first processing module, wherein the first acquisition module is used for acquiring a first time sequence of a plurality of failed target objects, and the first time sequence comprises key performance index data of the target objects in a plurality of days;

the second determining module is used for determining the root cause of the fault according to the association relation and the sequence;

wherein the first determining module includes:

a first determining submodule, configured to perform smoothing processing on abnormal data indicating a fault in the first time sequence of each target object, determine a time sequence obtained after the smoothing processing as a second time sequence corresponding to the target object, where the length of the second time sequence is the same as that of the first time sequence, and calculate N feature parameters of key performance index data at the same time in different days in the second time sequence for the second time sequence corresponding to each target object, and sequentially replace the key performance index data at the same time in the second time sequence with each feature parameter to obtain N target time sequences corresponding to the target object, where N is greater than or equal to 1, and the length of the target time sequence is the same as that of the first time sequence;

The second determining submodule is used for determining N time sequence errors corresponding to each target object according to N target time sequences and the first time sequence corresponding to the target object;

and the third determining submodule is used for determining the association relation between every two target objects according to the maximum correlation coefficient between N time sequence errors respectively corresponding to the two target objects.

5. A computer readable storage medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the steps of the method according to any of claims 1-3.

6. An electronic device, comprising:

a memory having a computer program stored thereon;

a processor for executing the computer program in the memory to carry out the steps of the method of any one of claims 1-3.