CN114490157A - A fault detection method, device, equipment and storage medium - Google Patents

Abstract

The embodiment of the application provides a fault detection method, a fault detection device, equipment and a storage medium, which relate to the technical field of artificial intelligence, and the method comprises the following steps: an original failure node chain is obtained, wherein the original failure node chain comprises a plurality of original failure nodes. Because the original fault node chain contains more original fault nodes, the main fault node chain is determined by selecting the main fault nodes from the original fault nodes and determining the main fault node chain based on the selected main fault nodes, and the efficiency of fault detection can be effectively improved. And finally, determining a target root fault node from the main fault node chain according to the causal probability among all the main fault nodes in the main fault node chain, thereby effectively improving the accuracy of fault detection.

Description

A fault detection method, device, equipment and storage medium

technical field

The embodiments of the present invention relate to the technical field of artificial intelligence, and in particular, to a fault detection method, apparatus, device, and storage medium.

Background technique

With the rapid development of computer technology, there are more and more task nodes in the Internet business system, and the technical architecture is becoming more and more complex. When a business system fails, operation and maintenance personnel need to quickly and accurately determine the root fault node that causes the business system failure, and monitor data based on the root fault, such as CPU (Central Processing Unit, central processing unit) usage rate, memory usage rate , disk usage, QPS (Query Per Second, query rate per second), and TPS (Transaction Per Second, throughput) for subsequent analysis and troubleshooting.

However, when the business system fails, the monitoring data of each task node is generally analyzed based on the relationship table of each task node, and the faulty node chain is determined, but the root fault node in the faulty node chain cannot be specifically located, thus affecting the Accuracy of fault detection.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a fault detection method, apparatus, device, and storage medium, which are used to improve the accuracy of fault detection.

On the one hand, the embodiment of the present application provides a fault detection method, the method includes:

obtaining an original faulty node chain, where the original faulty node chain includes a plurality of original faulty nodes;

along the extension direction of the original faulty node chain, sequentially selecting main faulty nodes from the plurality of original faulty nodes, and determining the main faulty node chain based on each selected main faulty node;

Based on the causal probability between each main fault node in the main fault node chain, the target root fault node is determined from the main fault node chain.

Optionally, the obtaining the original faulty node chain includes:

Get the initial benchmark faulty node in the task node chain;

Based on the reference faulty node and the fault similarity between two adjacent task nodes in the task node chain, iteratively determines the original faulty node chain from the task node chain; wherein, each iteration process includes the following step:

From the task node chain, determine at least one candidate node adjacent to the reference faulty node;

determining a fault similarity between the reference faulty node and the at least one candidate node, respectively;

Based on the obtained fault similarities, at least one original faulty node is selected from the at least one candidate node, and the at least one original faulty node is used as a reference faulty node.

Optionally, the determining the fault similarity between the reference fault node and the at least one candidate node respectively includes:

For the at least one candidate node, respectively perform the following steps:

Acquiring the resource attribute information of the reference node corresponding to the reference fault node within the preset time period, and the resource attribute information of the candidate node corresponding to a candidate node within the preset time period;

Based on the resource attribute information of the reference node and the resource attribute information of the candidate node, the failure similarity between the reference faulty node and the one candidate node is determined.

Optionally, the determining, based on the resource attribute information of the reference node and the resource attribute information of the candidate node, determines the failure similarity between the reference faulty node and the one candidate node, including:

determining a reference node resource attribute image based on the reference node resource attribute information;

determining a candidate node resource attribute image based on the candidate node resource attribute information;

Using a similarity network model, determine the image similarity between the resource attribute image of the reference node and the resource attribute image of the candidate node;

The image similarity is used as the fault similarity between the reference fault node and the one candidate node.

Optionally, selecting the main faulty node from the plurality of original faulty nodes in sequence along the extension direction of the original faulty node chain, including:

Obtain an initial reference primary faulty node from the original faulty node chain;

Based on the reference main faulty node, along the extension direction of the original faulty node chain, iteratively selects the main faulty node from the plurality of original faulty nodes, wherein each iteration process includes the following steps:

If the reference main faulty node is not a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and the original faulty node chain adjacent to the main faulty node is set in the extension direction of the original faulty node chain. The faulty node is used as the reference main faulty node;

If the reference main faulty node is a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and based on the causal probability between the bifurcation faulty node and the corresponding multiple sub-faulty nodes, from the A sub-faulty node is selected from the plurality of sub-faulty nodes as the reference main faulty node.

Optionally, selecting a sub-fault node from the plurality of sub-fault nodes as the reference main fault node based on the causal probability between the bifurcated fault nodes and the corresponding multiple sub-fault nodes, including:

For the plurality of sub-faulty nodes, the following steps are respectively performed: based on the target resource exception information corresponding to the fork-faulty node and a sub-faulty node within a preset time period, determine the fork-faulty node and the one sub-faulty node. Causal probability between faulty nodes;

A maximum causal probability among the obtained multiple causal probabilities is determined, and among the multiple sub-fault nodes, the sub-fault node corresponding to the maximum causal probability is used as the reference main fault node.

Optionally, determining the target root fault node from the main fault node chain based on the causal probability between each main fault node in the main fault node chain, including:

Obtain an initial reference root fault node from the main fault node chain;

Based on the causal probability between the reference root fault node and other primary fault nodes in the primary fault node chain, the reference root fault node is iteratively updated until the iteration ends, and the reference root fault node is used as the target root fault node .

Optionally, each iteration process includes the following steps:

Obtain a primary faulty node from the other primary faulty nodes;

determining the causal probability between the reference root fault node and the one main fault node based on the target resource abnormality information corresponding to the reference root fault node and the target resource abnormality information corresponding to the one main fault node;

If the causal probability is greater than the preset causal threshold, the reference root fault node remains unchanged;

Otherwise, the one main faulty node is used as the reference root faulty node.

Optionally, the target resource abnormality information includes a target resource abnormality time point, a target resource abnormality amplitude, and a target resource abnormality duration period.

On the one hand, an embodiment of the present application provides a fault detection device, the device comprising:

an original faulty node chain acquisition module, used for acquiring the original faulty node chain, the original faulty node chain including a plurality of original faulty nodes;

a main faulty node chain obtaining module, configured to sequentially select main faulty nodes from the plurality of original faulty nodes along the extension direction of the original faulty node chain, and determine the main faulty node chain based on each selected main faulty node;

A target determination module, configured to determine a target root fault node from the main fault node chain based on the causal probability between each main fault node in the main fault node chain.

Optionally, the original faulty node chain acquisition module is specifically used for:

Get the initial benchmark faulty node in the task node chain;

Based on the reference faulty node and the fault similarity between two adjacent task nodes in the task node chain, iteratively determines the original faulty node chain from the task node chain; wherein, each iteration process includes the following step:

From the task node chain, determine at least one candidate node adjacent to the reference faulty node;

determining a fault similarity between the reference faulty node and the at least one candidate node, respectively;

Based on the obtained fault similarities, at least one original faulty node is selected from the at least one candidate node, and the at least one original faulty node is used as a reference faulty node.

Optionally, the original faulty node chain acquisition module is specifically used for:

For the at least one candidate node, respectively perform the following steps:

Acquiring the resource attribute information of the reference node corresponding to the reference fault node within the preset time period, and the resource attribute information of the candidate node corresponding to a candidate node within the preset time period;

Based on the resource attribute information of the reference node and the resource attribute information of the candidate node, the failure similarity between the reference faulty node and the one candidate node is determined.

Optionally, the original faulty node chain acquisition module is specifically used for:

determining a reference node resource attribute image based on the reference node resource attribute information;

determining a candidate node resource attribute image based on the candidate node resource attribute information;

Using a similarity network model, determine the image similarity between the resource attribute image of the reference node and the resource attribute image of the candidate node;

The image similarity is used as the fault similarity between the reference fault node and the one candidate node.

Optionally, the main fault node chain acquisition module is specifically used for:

Obtain an initial reference primary faulty node from the original faulty node chain;

Based on the reference main faulty node, along the extension direction of the original faulty node chain, iteratively selects the main faulty node from the plurality of original faulty nodes, wherein each iteration process includes the following steps:

If the reference main faulty node is not a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and the original faulty node chain adjacent to the main faulty node is set in the extension direction of the original faulty node chain. The faulty node is used as the reference main faulty node;

If the reference main faulty node is a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and based on the causal probability between the bifurcation faulty node and the corresponding multiple sub-faulty nodes, from the A sub-faulty node is selected from the plurality of sub-faulty nodes as the reference main faulty node.

Optionally, the main fault node chain acquisition module is specifically used for:

For the plurality of sub-faulty nodes, the following steps are respectively performed: based on the target resource exception information corresponding to the fork-faulty node and a sub-faulty node within a preset time period, determine the fork-faulty node and the one sub-faulty node. Causal probability between faulty nodes;

A maximum causal probability among the obtained multiple causal probabilities is determined, and among the multiple sub-fault nodes, the sub-fault node corresponding to the maximum causal probability is used as the reference main fault node.

Optionally, the target determination module is specifically used for:

Obtain an initial reference root fault node from the main fault node chain;

Based on the causal probability between the reference root fault node and other primary fault nodes in the primary fault node chain, the reference root fault node is iteratively updated until the iteration ends, and the reference root fault node is used as the target root fault node .

Optionally, the target determination module is specifically used for:

Each iteration process includes the following steps:

Obtain a primary faulty node from the other primary faulty nodes;

determining the causal probability between the reference root fault node and the one main fault node based on the target resource abnormality information corresponding to the reference root fault node and the target resource abnormality information corresponding to the one main fault node;

If the causal probability is greater than the preset causal threshold, the reference root fault node remains unchanged;

Otherwise, the one main faulty node is used as the reference root faulty node.

Optionally, the target resource abnormality information includes a target resource abnormality time point, a target resource abnormality amplitude, and a target resource abnormality duration period.

On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the above-mentioned fault detection method when the program is executed. step.

On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program runs on the computer device, causes the computer device to perform the above-mentioned fault detection method. step.

In the embodiment of the present application, since the original faulty node chain contains many original faulty nodes, the main faulty node is selected from the multiple original faulty nodes, and the main faulty node chain is determined based on each selected main faulty node, which can effectively to improve the efficiency of fault detection. Finally, through the causal probability between each main fault node in the main fault node chain, the target root fault node is determined from the main fault node chain, which effectively improves the accuracy of fault detection.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a schematic diagram of a system architecture provided by an embodiment of the present application;

2 is a schematic flowchart of a fault detection method provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a task node chain provided by an embodiment of the present application;

FIG. 4 is a schematic flowchart of a method for obtaining an original faulty node chain according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a task node chain provided by an embodiment of the present application;

6 is a schematic flowchart of a method for determining fault similarity provided by an embodiment of the present application;

FIG. 7 is a schematic flowchart of a method for determining fault similarity according to an embodiment of the present application;

FIG. 8 is a schematic diagram of a reference node resource attribute image provided by an embodiment of the present application;

FIG. 9 is a schematic diagram of a candidate node resource attribute image provided by an embodiment of the present application;

FIG. 10 is a schematic structural diagram of a similarity network model provided by an embodiment of the present application;

FIG. 11 is a schematic diagram of a CPU usage rate provided by an embodiment of the present application;

FIG. 12 is a schematic structural diagram of an original faulty node chain provided by an embodiment of the present application;

13 is a schematic flowchart of a method for determining a reference root fault node according to an embodiment of the present application;

FIG. 14 is a schematic structural diagram of a main fault node chain provided by an embodiment of the present application;

15 is a schematic flowchart of a fault detection method provided by an embodiment of the present application;

FIG. 16 is a schematic diagram of a system architecture provided by an embodiment of the present application;

17 is a schematic structural diagram of a fault detection apparatus provided by an embodiment of the application;

FIG. 18 is a schematic structural diagram of a computer device according to an embodiment of the present application.

Detailed ways

In order to make the objectives, technical solutions and beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

Referring to FIG. 1 , which is a system architecture diagram to which the embodiments of the present application are applied, the system architecture at least includes a terminal device 101, a fault detection system 102, and a service system 103, wherein the fault detection system 102 may be independent of the service system 103, or may Built into the business system 103 .

The terminal device 101 is installed with a target application for fault detection, and the application may be a pre-installed client, a web version application, or a small program embedded in other applications, or the like. The terminal device 101 may be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc., but is not limited thereto.

The fault detection system 102 is a background server of the target application, and provides services for the target application. The fault detection system 102 may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud Cloud servers for basic cloud computing services such as communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

The service system 103 includes a plurality of task nodes. When a task node fails, the task node is the original failure node. The business system 103 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, and cloud communications. , middleware services, domain name services, security services, Content Delivery Network (CDN), and cloud servers for basic cloud computing services such as big data and artificial intelligence platforms.

The terminal device 101 and the fault detection system 102 may be directly or indirectly connected through wired or wireless communication, which is not limited in this application. The fault detection system 102 and the service system 103 may be directly or indirectly connected through wired or wireless communication, which is not limited in this application.

The terminal device 101 issues a failure detection instruction to the failure detection system 102 in response to the user's failure detection operation. The fault detection system 102 receives the fault detection instruction, and obtains the original faulty node chain from the service system 103, wherein the original faulty node chain includes a plurality of original faulty nodes. The fault detection system 102 sequentially selects the main faulty nodes from the plurality of original faulty nodes along the extension direction of the original faulty node chain, and determines the main faulty node chain based on each selected main faulty node. Finally, based on the causal probability between each main fault node in the main fault node chain, the target root fault node is determined from the main fault node chain.

Based on the system architecture diagram shown in FIG. 1 , an embodiment of the present application provides a process of a fault detection method. As shown in FIG. 2 , the process of the method is executed by a computer device, and the computer device may be the fault shown in FIG. 1 . The detection system 102 includes the following steps:

Step S201, obtaining the original faulty node chain.

Specifically, the original faulty node chain includes a plurality of original faulty nodes.

Based on the resource attribute information corresponding to each task node, it can be determined whether the task node is the original faulty node. The resource attribute information includes CPU usage, memory usage, disk usage, QPS, and TPS.

For example, as shown in Figure 3, the business system includes 8 task nodes, namely task node A, task node B, task node C, task node D, task node E, task node F, task node G, task node Node H. Setting By judging the resource attribute information corresponding to the above 8 task nodes, it is determined that task node B, task node D, task node E, task node F, and task node G are faulty. Therefore, task node B, task node D , task node E, task node F, and task node G are the original faulty nodes, and the original faulty node chain is composed of the above five original faulty nodes.

Step S202 , along the extension direction of the original faulty node chain, sequentially select main faulty nodes from a plurality of original faulty nodes, and determine the main faulty node chain based on each selected main faulty node.

Specifically, the original faulty node chain may include a master faulty node chain and at least one slave faulty node chain, or may only include a master faulty node chain.

The extension direction of the original faulty node chain can be from left to right, from right to left, from top to bottom, from bottom to top, or in any other direction.

Taking the extension direction of the original faulty node chain as an example from left to right, for the original faulty node chain in Figure 3, set the main faulty nodes selected from the five original faulty nodes as task node B and task node respectively. D and task node E. The above three main fault nodes constitute the main fault node chain.

Step S203, based on the causal probability between each main fault node in the main fault node chain, determine the target root fault node from the main fault node chain.

For example, as shown in FIG. 3 , the main faulty nodes are task node B, task node D and task node E. A possible implementation method is to obtain by comparing the causal probability between task node B and task node D, the causal probability between task node B and task node E, and the causal probability between task node D and task node E. The three causal probabilities of , and finally determine the target root fault node from the three main fault nodes.

In the embodiment of the present application, since the original faulty node chain contains many original faulty nodes, the main faulty node is selected from the multiple original faulty nodes, and the main faulty node chain is determined based on each selected main faulty node, which can effectively to improve the efficiency of fault detection. Finally, through the causal probability between each main fault node in the main fault node chain, the target root fault node is determined from the main fault node chain, which effectively improves the accuracy of fault detection.

Optionally, in the above step S201, acquiring the original faulty node chain includes the following steps in FIG. 4:

Step S401, acquiring the initial reference fault node in the task node chain.

In a possible implementation manner, when a task node alarm occurs in the service system, the task node that has the task node alarm may be directly used as a reference fault node.

For example, as shown in FIG. 5 , the service system includes five task nodes, namely task node A, task node B, task node C, task node D, and task node E. When a task node alarm occurs in the business system, it is set that task node B sends out a task node alarm, and task node B is used as the reference fault node.

In another possible implementation manner, when a task monitoring alarm occurs in the business system, the task currently being executed by the business system is determined, and the first task node in the business system that executes the task is used as the reference fault node.

For example, as shown in FIG. 5 , the service system includes five task nodes, namely task node A, task node B, task node C, task node D, and task node E. When a task monitoring alarm occurs in the business system, determine that the task currently being executed by the business system is the transaction data storage task, determine the first task node in the business system to execute the transaction data storage task as task node A, and use task node A as the benchmark failed node.

Step S402 , based on the reference faulty node and the fault similarity between two adjacent task nodes in the task node chain, iteratively determine the original faulty node chain from the task node chain.

Each iteration process includes the following steps:

First, from the task node chain, determine at least one candidate node adjacent to the reference faulty node. Then determine the fault similarity between the reference faulty node and at least one candidate node, select at least one original faulty node from the at least one candidate node based on the obtained fault similarities, and use at least one original faulty node as the reference faulty node .

Specifically, the fault similarity threshold is set, and the following judgments are made for each obtained fault similarity:

If the fault similarity between the reference faulty node and the candidate node is less than the fault similarity threshold, it means that the candidate node is not the original faulty node; otherwise, it means that the candidate node is the original faulty node.

The iterative stop condition includes the following two possible ways: The first iterative stop condition is that no original faulty node can be selected from at least one candidate node. In the second iterative stop condition, the determined original faulty nodes exceed a preset number threshold.

For example, as shown in Figure 5, the business system includes five task nodes, namely task node A, task node B, task node C, task node D, and task node E. The above five task nodes constitute task nodes. chain. Set task node B as the reference fault node.

Three candidate nodes adjacent to the reference faulty node are determined, namely task node A, task node C and task node D. The fault similarity between the benchmark faulty node and task node A is set to 0.3, the fault similarity between the benchmark faulty node and task node C is 0.6, and the fault similarity between the benchmark faulty node and task node D is 0.7. The fault similarity threshold is 0.4.

Since 0.3 is less than the fault similarity threshold of 0.4, task node A is not the original fault node. Since 0.6 is greater than the fault similarity threshold of 0.4, and 0.7 is greater than the fault similarity threshold of 0.4, both task node C and task node E are the original fault nodes.

Then, the task node C is used as the reference fault node. Since the reference fault node has no adjacent candidate nodes, the iteration of the task node C for the reference fault node ends.

Then take task node D as the benchmark fault node, determine the candidate node adjacent to the benchmark fault node as task node E, and set the fault similarity between the benchmark fault node and task node E as 0.2, because 0.2 is less than the fault similarity threshold. 0.4, therefore, task node E is not the original faulty node.

The original faulty nodes finally determined are task node B, task node C and task node D, and the original faulty node chain is composed of the above three original faulty nodes.

In this embodiment of the present application, by comparing the fault similarity between the reference faulty node and at least one adjacent candidate node, at least one original faulty node is determined from the at least one candidate node, which can effectively avoid omission of the original faulty node, It is beneficial to improve the accuracy of fault detection. At the same time, since the fault similarity judgment is performed on the reference fault node and the adjacent candidate nodes each time, the judgment complexity is simplified and the accuracy of the fault similarity judgment is improved.

Optionally, in the above step S402, in order to determine the fault similarity between the reference fault node and the at least one candidate node, respectively, for the at least one candidate node, perform the following steps in FIG. 6 :

Step S601: Acquire the resource attribute information of the reference node corresponding to the reference faulty node within the preset time period, and the resource attribute information of the candidate node corresponding to a candidate node within the preset time period.

Specifically, the preset time period may be determined according to the failure time point and the preset time period.

For example, the fault time point is 10:05:00, the preset duration is 2 minutes, and the preset time period can be 10:05:00-10:07:00, or 10:03:00-10:05 :00, or 10:04:00-10:06:00.

Resource attribute information includes CPU usage, memory usage, disk usage, QPS, and TPS.

The resource attribute information of the reference node is the resource attribute information corresponding to the reference fault node within the preset time period, and the resource attribute information of the candidate node is the resource attribute information corresponding to a candidate node within the preset time period.

Step S602, based on the resource attribute information of the reference node and the resource attribute information of the candidate node, determine the failure similarity between the reference faulty node and a candidate node.

Specifically, as shown in Figure 7, determining the fault similarity between the reference fault node and a candidate node includes the following steps:

Step S701, based on the reference node resource attribute information, determine the reference node resource attribute image.

Step S702: Determine the resource attribute image of the candidate node based on the resource attribute information of the candidate node.

For example, the reference failure node is task node B, and the candidate node is task node C. Obtain the resource attribute information of the reference node corresponding to the reference failure node in the preset time period 10:00:00-10:02:00, and obtain the candidate node The resource attribute information of the corresponding candidate node within the preset time period 10:00:00-10:02:00.

Based on the reference node resource attribute information, the reference node resource attribute image is determined, as shown in FIG. 8 . Based on the resource attribute information of the candidate node, the resource attribute image of the candidate node is determined, as shown in FIG. 9 .

In step S703, the similarity network model is used to determine the image similarity between the resource attribute image of the reference node and the resource attribute image of the candidate node.

Specifically, the similarity network model includes two feature extraction modules and a similarity judgment module. The two feature extraction modules are respectively a first feature extraction module and a second feature extraction module, and the first feature extraction module and the second feature extraction module are identical.

The reference node resource attribute image is input to the first feature extraction module to obtain reference image features. At the same time, input the candidate node resource attribute image to the second feature extraction module to obtain candidate image features. Then, the reference image features and the candidate image features are input to the similarity judgment module to obtain the image similarity between the reference node resource attribute image and the candidate node resource attribute image.

The first feature extraction module includes a plurality of different convolution modules and a data flattening layer, and each convolution module includes at least one convolution layer and at least one downsampling layer. The second feature extraction module includes a plurality of different convolution modules and a data flattening layer, and each convolution module includes at least one convolution layer and at least one downsampling layer. The similarity judgment module includes a feature difference layer, at least one fully connected layer and a normalization layer. The output of the normalization layer is a value between 0-1.

For example, the similarity network model is shown in Figure 10. The first feature extraction module includes 3 different convolution modules and a data flattening layer. The second feature extraction module includes 3 convolution modules and a data flattening layer. The similarity judgment module includes a feature difference layer, a fully connected layer and a normalization layer.

Input the reference node resource attribute image into the first convolution module C1 in the first feature extraction module to obtain the reference image feature f11; then input the reference image feature f11 into the second convolution module in the first feature extraction module C2, obtain the reference image feature f12; then input the reference image feature f12 into the third convolution module C3 in the first feature extraction module to obtain the reference image feature f13, and finally input the reference image feature f13 into the first feature extraction module The data flattening layer in , obtains the reference image feature f14.

At the same time, input the candidate node resource attribute image into the first convolution module C1 in the second feature extraction module to obtain the candidate image feature f21; then input the candidate image feature f21 into the second volume in the second feature extraction module Product module C2 to obtain candidate image feature f22; then input candidate image feature f22 to the third convolution module C3 in the second feature extraction module to obtain candidate image feature f23, and finally input candidate image feature f23 to the second feature Extract the data flattening layer in the module to obtain candidate image features f24.

Input the reference image feature f14 and the candidate image feature f24 into the feature difference layer in the similarity judgment module to obtain the image difference feature f3; then input the image difference feature f3 into the fully connected layer to obtain the image difference feature f4; Then, the image difference feature f4 is input to the normalization layer, and finally the image similarity between the resource attribute image of the reference node and the resource attribute image of the candidate node is obtained.

Step S704, the image similarity is used as the fault similarity between the reference fault node and a candidate node.

In the embodiment of the present application, after obtaining the reference node resource attribute information corresponding to the reference fault node within the preset time period and the candidate node resource attribute information corresponding to a candidate node within the preset time period, the reference node resource attribute image is determined. and candidate node resource attribute images, and then through the similarity network model, the image similarity between the reference node resource attribute image and the candidate node resource attribute image is judged, and the image similarity is regarded as the fault similarity between a quasi-faulty node and a candidate node. Because the judgment of fault similarity directly based on the resource attribute information of the quasi-node and the resource attribute information of the candidate node depends on the prior knowledge of the operation and maintenance personnel to a large extent, it will cause the low accuracy and low efficiency of the fault similarity judgment, and the The above two kinds of information are converted into images, and then the fault similarity judgment is carried out through the similarity network model, which enhances the accuracy of fault similarity judgment, and at the same time, improves the practicability of fault similarity judgment.

Since the fault similarity judgment based on the similarity network model does not have any restrictions on the resource attribute information, the application scope is wider. When the resource attribute information is increased, the cost will not be increased, and the promotion of the fault detection system can be quickly realized at a low cost.

Optionally, in the above step S202, along the extension direction of the original faulty node chain, the main faulty node is selected from a plurality of original faulty nodes in sequence, including the following steps:

Get the initial reference primary failed node from the original failed node chain. Then, based on the reference main faulty node, along the extension direction of the original faulty node chain, iteratively selects the main faulty node from multiple original faulty nodes.

Each iteration process includes the following steps:

If the reference main faulty node is not a bifurcation faulty node, the reference main faulty node is used as the main faulty node, and the original faulty node adjacent to the main faulty node in the extension direction of the original faulty node chain is used as the reference main faulty node.

If the reference main fault node is a bifurcation fault node, the reference main fault node is used as the main fault node, and based on the causal probability between the bifurcation fault node and the corresponding sub-fault nodes, one of the sub-fault nodes is selected. The child faulty node serves as the reference master faulty node.

Specifically, for a plurality of sub-faulty nodes, the following steps are respectively performed: based on the target resource anomaly information corresponding to the fork-faulty node and a sub-faulty node within a preset time period, respectively, determine the relationship between the fork-faulty node and a sub-faulty node. causal probability.

Finally, the maximum causal probability among the obtained multiple causal probabilities is determined, and among the multiple child fault nodes, the child fault node corresponding to the maximum causal probability is used as the reference main fault node.

The target resource abnormality information includes the target resource abnormality time point, the target resource abnormality amplitude, and the target resource abnormality duration period. Resource attribute information includes CPU usage, memory usage, disk usage, QPS, and TPS.

Determining target resource exception information includes the following two implementations:

In a first possible implementation manner, select one of the resource attribute information as the target resource attribute information, and then determine the target resource abnormality information according to the target resource attribute information.

In the second possible implementation manner, for each resource attribute information, respectively determine the resource abnormal amplitude value corresponding to each resource attribute information, determine the resource attribute information corresponding to the maximum resource abnormal amplitude value as the target resource attribute information, and then according to the target resource attribute information. The information determines the target resource exception information.

Specifically, the causal probability between a bifurcation fault node and a sub-fault node is expressed by the following formula 1:

Among them, Prob represents the causal probability between the bifurcation fault node and a sub-fault node, t1 represents the abnormal time point of the target resource corresponding to the bifurcation fault node, A1 represents the abnormal amplitude of the target resource corresponding to the bifurcation fault node, and D1 represents the bifurcation fault node. The target resource anomaly duration period corresponding to the fault node, t2 represents the abnormal time point of the target resource corresponding to a sub-fault node, A2 represents the abnormal amplitude of the target resource corresponding to a sub-fault node, and D2 represents the target resource corresponding to a sub-fault node. Abnormal duration period.

For example, the attribute information of the target resource is set as the CPU usage rate, and the preset time period is 10:00:00-10:02:00. As shown in FIG. 11 , including the CPU usage rate corresponding to the fork fault node within the preset period, the CPU usage rate corresponding to the sub-fault node 1 within the preset period, and the CPU usage corresponding to the sub-fault node 2 within the preset period Rate.

For the CPU usage corresponding to the fork failure node in the preset period, the abnormal time point of the CPU usage is 10:00:12, and the abnormal amplitude of the CPU usage is 100% minus 40%, that is, 60%, and the CPU usage rate is 60%. The abnormal duration period is 10:02:00 minus 10:00:12, which is 108s.

For the CPU usage of the sub-faulty node 1 in the preset period, the abnormal time point of the CPU usage is 10:00:15, and the abnormal amplitude of the CPU usage is 85% minus 25%, that is, 60%. The abnormal duration period is 10:02:00 minus 10:00:15, which is 105s.

For the corresponding CPU usage of the sub-faulty node 2 within the preset time period, the abnormal time point of the CPU usage is 10:00:15, and the abnormal amplitude of the CPU usage is 50% minus 30%, that is, 20%. The abnormal duration period is 10:02:00 minus 10:00:15, which is 105s.

According to formula (1), the causal probability between the bifurcation fault node and the sub-fault node 1 is determined as

According to formula (1), the causal probability between the bifurcation fault node and the sub-fault node 2 is determined as

Since the causal probability 0.0162 between the bifurcation fault node and sub-fault node 1 is greater than the causal probability 0.0054 between the bifurcation fault node and sub-fault node 2, the sub-fault node 1 is used as the reference main fault node.

In the above step S202, along the extension direction of the original faulty node chain, the main faulty node is selected from a plurality of original faulty nodes in turn, and an example is given. As shown in FIG. 12, the original faulty node chain includes 5 original faulty nodes. They are the original faulty node 1, the original faulty node 2, the original faulty node 3, the original faulty node 4 and the original faulty node 5, respectively.

The extension direction of the original faulty node chain is set to be from left to right, and the original faulty node 1 is obtained from the original faulty node chain as the initial reference main faulty node. Since the reference main faulty node is not a bifurcation faulty node, the reference The primary faulty node is used as the primary faulty node, and the original faulty node 2 is used as the reference primary faulty node.

When the original faulty node 2 is used as the reference main faulty node, the reference main faulty node is the bifurcation faulty node, the reference main faulty node is used as the main faulty node, and the two sub-faulty nodes corresponding to the reference main faulty node are determined to be the original faulty node 3 respectively. and the original faulty node 4. Determine the causal probability between the reference faulty node and the original faulty node 3 as prob23, determine the causal probability between the reference faulty node and the original faulty node 4 as prob24, and set the causal probability prob23 to be less than the causal probability prob24, then the original faulty node 4 as the reference primary failed node.

When the original faulty node 4 is used as the reference main faulty node, since the reference main faulty node is not a bifurcation faulty node, the reference main faulty node is used as the main faulty node, and the original faulty node 5 is used as the reference main faulty node.

When the original faulty node 5 is used as the reference main faulty node, since the reference main faulty node is not the bifurcation faulty node, the reference main faulty node is used as the main faulty node, and the process ends.

Finally, the original faulty node 1, the original faulty node 2, the original faulty node 4, and the original faulty node 5 are all main faulty nodes, forming the main faulty node chain.

In the embodiment of the present application, since the original faulty node chain contains many original faulty nodes, by selecting the main faulty node from the multiple original faulty nodes, and determining the main faulty node chain based on each selected main faulty node, it is possible to effectively to improve the efficiency of fault detection.

When the reference main fault node is a bifurcation fault node, determine the causal probability between the bifurcation fault node and multiple sub-fault nodes. The larger the causal probability, the stronger the causality between the bifurcation fault node and the sub-fault nodes. , therefore, the sub-fault node corresponding to the maximum causal probability is selected as the reference main fault node, which can reasonably filter the sub-fault nodes with weak causality, which ensures the accuracy of the selected main failure node, that is, the main failure node is guaranteed. The accuracy of the node chain.

Optionally, in the above step S203, based on the causal probability between each main fault node in the main fault node chain, the target root fault node is determined from the main fault node chain, including the following execution steps:

Obtain the initial reference root fault node from the main fault node chain; then based on the causal probability between the reference root fault node and other main fault nodes in the main fault node chain, iteratively update the reference root fault node until the end of the iteration. The faulty node is used as the target root faulty node.

Each iteration process includes the following steps in Figure 13:

Step S1301: Obtain a main faulty node from other main faulty nodes.

Step S1302: Determine the causal probability between the reference source fault node and a main fault node based on the target resource abnormality information corresponding to the reference root fault node and the target resource abnormality information corresponding to a main fault node.

Specifically, the target resource abnormality information includes the target resource abnormality time point, the target resource abnormality amplitude, and the target resource abnormality duration period. The method for determining the abnormal information of the target resource is the same as above.

The causal probability between the reference root fault node and a main fault node is shown in formula 1, where Prob represents the causal probability between the reference root fault node and a main fault node, and t1 represents the target resource abnormality corresponding to the reference root fault node Time point, A1 represents the abnormal amplitude of the target resource corresponding to the reference root fault node, D1 represents the abnormal duration of the target resource corresponding to the reference root fault node, t2 represents the abnormal time point of the target resource corresponding to a main fault node, and A2 represents a main fault node. The abnormal amplitude of the target resource corresponding to the faulty node, D2 represents the abnormal duration of the target resource corresponding to a main faulty node.

In step S1303, if the causal probability is greater than the preset causal threshold, step S1304 is performed; otherwise, step S1305 is performed.

Step S1304, the reference source fault node remains unchanged.

Step S1305, a main fault node is used as a reference root fault node.

For example, as shown in FIG. 14 , the main failure node chain includes a main failure node 1 , a main failure node 2 , a main failure node 3 , and a main failure node 4 . The main faulty node 1 is obtained from the main faulty node chain as the initial reference root fault node, and the other main faulty nodes include the main faulty node 2, the main faulty node 3, and the main faulty node 4. Set the causal probability threshold to 0.45.

The main faulty node 1 is the reference root faulty node, and a main faulty node, that is, the main faulty node 2, is obtained from other main faulty nodes. The causal probability between the reference root fault node and the main fault node 2 is set to 0.3. Since 0.3 is less than the causal probability threshold of 0.45, the main fault node 2 is used as the reference root fault node.

The main faulty node 2 is a reference root fault node, and a main faulty node, that is, the main faulty node 3, is obtained from other main faulty nodes. The causal probability between the reference root fault node and the main fault node 3 is set to 0.7. Since 0.7 is greater than the causal probability threshold of 0.45, the reference root fault node remains unchanged.

The main faulty node 2 is the reference root fault node, and a main faulty node, that is, the main faulty node 4, is obtained from other main faulty nodes. The causal probability between the reference root fault node and the main fault node 4 is set to 0.6. Since 0.6 is greater than the causal probability threshold of 0.45, the reference root fault node remains unchanged.

Finally, the reference root fault node, that is, the main fault node 2, is determined as the target root fault node.

In the embodiment of the present application, selecting a main fault node from other main fault nodes, and determining the causal probability between the reference root fault node and a main fault node each time, can effectively improve the fault detection efficiency. Finally, when the reference root fault node is compared with each main fault node in other main fault nodes, the target root fault node is determined, and the effect of improving the fault detection accuracy is achieved.

In order to better explain the embodiments of the present application, a fault detection method provided by the embodiments of the present application is described below with reference to specific implementation scenarios. As shown in FIG. 15 , the method includes the following steps:

Step S1501, obtaining the initial reference fault node in the task node chain.

Step S1502, based on the reference faulty node and the fault similarity between two adjacent task nodes in the task node chain, iteratively determine the original faulty node chain from the task node chain.

Step S1503: Obtain the initial reference main faulty node from the original faulty node chain.

Step S1504, based on the reference main faulty node, along the extension direction of the original faulty node chain, iteratively selects the main faulty node from a plurality of original faulty nodes.

Step S1505, based on each selected main faulty node, determine the main faulty node chain.

In step S1506, an initial reference root fault node is obtained from the main fault node chain, and other main fault nodes are determined.

In step S1507, it is judged whether other main faulty nodes are empty, if so, step S1513 is performed; otherwise, step S1508 is performed.

Step S1508: Obtain a main faulty node from other main faulty nodes.

Step S1509: Determine the causal probability between the reference root fault node and a main fault node based on the target resource abnormality information corresponding to the reference root fault node and the target resource abnormality information corresponding to a main fault node.

In step S1510, it is determined whether the causal probability is greater than the preset causal threshold, and if so, step S1511 is performed; otherwise, step S1512 is performed.

Step S1511, the reference source fault node remains unchanged.

Step S1512, a main fault node is used as a reference root fault node.

Step S1513, taking the reference root fault node as the target root fault node.

In the embodiment of the present application, since the original faulty node chain contains many original faulty nodes, by selecting the main faulty node from the multiple original faulty nodes, and determining the main faulty node chain based on each selected main faulty node, it is possible to effectively to improve the efficiency of fault detection. Based on the causal probability between the reference root fault node and other main fault nodes, the target root fault node is determined, which not only improves the efficiency of fault detection, but also ensures the accuracy of fault detection.

In order to better explain the embodiments of the present application, a fault detection method provided by the embodiments of the present application is described below with reference to specific implementation scenarios. The method is executed by the fault detection system 102 in FIG. 1 . As shown in FIG. 16 , it includes a task node chain acquisition module 1601 , a monitoring module 1602 , an algorithm module 1603 , a fault handling module 1604 and a feedback module 1605 .

The task node chain obtaining module 1601 obtains the task node chain in the task system 103 .

The monitoring module 1602 obtains resource attribute information corresponding to each task node in the task node chain, including CPU usage, memory usage, disk usage, QPS, and TPS.

The algorithm module 1603 receives the task node chain sent by the task node chain acquisition module 1601 and the resource attribute information corresponding to each task node sent by the monitoring module 1602, and determines the target root fault based on the task node chain and the resource attribute information corresponding to each task node. node.

The fault handling module 1604 performs operations such as restarting the process, restarting the application, or restarting the virtual machine according to the target root fault node determined by the algorithm module 1603 .

The feedback module 1605 records and analyzes the target root fault node determined by the algorithm module 1603, and regularly updates the similarity network model in the algorithm module.

In the embodiment of the present application, the task node chain obtaining module 1601 will obtain and update the task node chain in real time without manual participation. The feedback module 1605 records and analyzes each fault detection result, and regularly updates the similarity network model to ensure the accuracy of fault detection.

Based on the same technical concept, an embodiment of the present application provides a fault detection apparatus. As shown in FIG. 17 , the fault detection apparatus 1700 includes:

The original faulty node chain acquisition module 1701 is used to acquire the original faulty node chain, the original faulty node chain includes a plurality of original faulty nodes;

The main faulty node chain acquisition module 1702 is configured to select the main faulty node from the plurality of original faulty nodes in turn along the extension direction of the original faulty node chain, and determine the main faulty node chain based on each selected main faulty node ;

The target determination module 1703 is configured to determine a target root fault node from the main fault node chain based on the causal probability between each main fault node in the main fault node chain.

Optionally, the original faulty node chain acquisition module 1701 is specifically configured to:

Get the initial benchmark faulty node in the task node chain;

Based on the reference faulty node and the fault similarity between two adjacent task nodes in the task node chain, iteratively determines the original faulty node chain from the task node chain; wherein, each iteration process includes the following step:

From the task node chain, determine at least one candidate node adjacent to the reference faulty node;

determining a fault similarity between the reference faulty node and the at least one candidate node, respectively;

Based on the obtained fault similarities, at least one original faulty node is selected from the at least one candidate node, and the at least one original faulty node is used as a reference faulty node.

Optionally, the original faulty node chain acquisition module 1701 is specifically configured to:

For the at least one candidate node, respectively perform the following steps:

Acquiring the resource attribute information of the reference node corresponding to the reference fault node within the preset time period, and the resource attribute information of the candidate node corresponding to a candidate node within the preset time period;

Based on the resource attribute information of the reference node and the resource attribute information of the candidate node, the failure similarity between the reference faulty node and the one candidate node is determined.

Optionally, the original faulty node chain acquisition module 1701 is specifically configured to:

determining a reference node resource attribute image based on the reference node resource attribute information;

determining a candidate node resource attribute image based on the candidate node resource attribute information;

Using a similarity network model, determine the image similarity between the resource attribute image of the reference node and the resource attribute image of the candidate node;

The image similarity is used as the fault similarity between the reference fault node and the one candidate node.

Optionally, the main faulty node chain acquisition module 1702 is specifically configured to:

Obtain an initial reference primary faulty node from the original faulty node chain;

Based on the reference main faulty node, along the extension direction of the original faulty node chain, iteratively selects the main faulty node from the plurality of original faulty nodes, wherein each iteration process includes the following steps:

If the reference main faulty node is not a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and the original faulty node chain adjacent to the main faulty node is set in the extension direction of the original faulty node chain. The faulty node is used as the reference main faulty node;

If the reference main faulty node is a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and based on the causal probability between the bifurcation faulty node and the corresponding multiple sub-faulty nodes, from the A sub-faulty node is selected from the plurality of sub-faulty nodes as the reference main faulty node.

Optionally, the main faulty node chain acquisition module 1702 is specifically configured to:

For the plurality of sub-faulty nodes, the following steps are respectively performed: based on the target resource exception information corresponding to the fork-faulty node and a sub-faulty node within a preset time period, determine the fork-faulty node and the one sub-faulty node. Causal probability between faulty nodes;

A maximum causal probability among the obtained multiple causal probabilities is determined, and among the multiple sub-fault nodes, the sub-fault node corresponding to the maximum causal probability is used as the reference main fault node.

Optionally, the target determination module 1703 is specifically configured to:

Obtain an initial reference root fault node from the main fault node chain;

Based on the causal probability between the reference root fault node and other primary fault nodes in the primary fault node chain, the reference root fault node is iteratively updated until the iteration ends, and the reference root fault node is used as the target root fault node .

Optionally, the target determination module 1703 is specifically configured to:

Each iteration process includes the following steps:

Obtain a primary faulty node from the other primary faulty nodes;

determining the causal probability between the reference root fault node and the one main fault node based on the target resource abnormality information corresponding to the reference root fault node and the target resource abnormality information corresponding to the one main fault node;

If the causal probability is greater than the preset causal threshold, the reference root fault node remains unchanged;

Otherwise, the one main faulty node is used as the reference root faulty node.

Optionally, the target resource abnormality information includes a target resource abnormality time point, a target resource abnormality amplitude, and a target resource abnormality duration period.

Based on the same technical concept, an embodiment of the present application provides a computer device. The computer device may be a terminal or a server, as shown in FIG. 18 , and includes at least one processor 1801 and a memory 1802 connected to the at least one processor. The specific connection medium between the processor 1801 and the memory 1802 is not limited in the application embodiments. In FIG. 18 , the connection between the processor 1801 and the memory 1802 is taken as an example. The bus can be divided into address bus, data bus, control bus and so on.

In this embodiment of the present application, the memory 1802 stores instructions that can be executed by at least one processor 1801 , and the at least one processor 1801 can execute the steps included in the above fault detection method by executing the instructions stored in the memory 1802 .

Among them, the processor 1801 is the control center of the computer equipment, and can use various interfaces and lines to connect various parts of the computer equipment, by running or executing the instructions stored in the memory 1802 and calling the data stored in the memory 1802, so as to troubleshoot detection. Optionally, the processor 1801 may include one or more processing units, and the processor 1801 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem The modulation processor mainly handles wireless communication. It can be understood that, the above-mentioned modulation and demodulation processor may not be integrated into the processor 1801. In some embodiments, the processor 1801 and the memory 1802 may be implemented on the same chip, and in some embodiments, they may be implemented separately on separate chips.

The processor 1801 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

The memory 1802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. The memory 1802 may include at least one type of storage medium, for example, may include a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk, CD and so on. Memory 1802 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory 1802 in this embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, for storing program instructions and/or data.

Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program runs on the computer device, causes the computer device to execute the steps of the above fault detection method.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims (12)

1. a fault detection method, is characterized in that, comprises: obtaining an original faulty node chain, where the original faulty node chain includes a plurality of original faulty nodes; along the extension direction of the original faulty node chain, sequentially selecting main faulty nodes from the plurality of original faulty nodes, and determining the main faulty node chain based on each selected main faulty node; Based on the causal probability between each main fault node in the main fault node chain, the target root fault node is determined from the main fault node chain. 2. The method of claim 1, wherein the acquiring the original faulty node chain comprises: Get the initial benchmark faulty node in the task node chain; Based on the reference faulty node and the fault similarity between two adjacent task nodes in the task node chain, iteratively determines the original faulty node chain from the task node chain; wherein, each iteration process includes the following step: From the task node chain, determine at least one candidate node adjacent to the reference faulty node; determining a fault similarity between the reference faulty node and the at least one candidate node, respectively; Based on the obtained fault similarities, at least one original faulty node is selected from the at least one candidate node, and the at least one original faulty node is used as a reference faulty node. 3. The method according to claim 2, wherein the determining the fault similarity between the reference faulty node and the at least one candidate node respectively comprises: For the at least one candidate node, respectively perform the following steps: Acquiring the resource attribute information of the reference node corresponding to the reference fault node within the preset time period, and the resource attribute information of the candidate node corresponding to a candidate node within the preset time period; Based on the resource attribute information of the reference node and the resource attribute information of the candidate node, the failure similarity between the reference faulty node and the one candidate node is determined. 4 . The method according to claim 3 , wherein, based on the resource attribute information of the reference node and the resource attribute information of the candidate node, the failure similarity between the reference faulty node and the one candidate node is determined. 5 . ,include: determining a reference node resource attribute image based on the reference node resource attribute information; determining a candidate node resource attribute image based on the candidate node resource attribute information; Using a similarity network model, determine the image similarity between the resource attribute image of the reference node and the resource attribute image of the candidate node; The image similarity is used as the fault similarity between the reference fault node and the one candidate node. 5 . The method according to claim 1 , wherein the selecting the main faulty node from the plurality of original faulty nodes in sequence along the extension direction of the original faulty node chain, comprising: 6 . Obtain an initial reference primary faulty node from the original faulty node chain; Based on the reference main faulty node, along the extension direction of the original faulty node chain, iteratively selects the main faulty node from the plurality of original faulty nodes, wherein each iteration process includes the following steps: If the reference main faulty node is not a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and the original faulty node chain adjacent to the main faulty node is set in the extension direction of the original faulty node chain. The faulty node is used as the reference main faulty node; If the reference main faulty node is a bifurcation faulty node, the reference main faulty node is regarded as the main faulty node, and based on the causal probability between the bifurcation faulty node and the corresponding multiple sub-faulty nodes, from the A sub-faulty node is selected from the plurality of sub-faulty nodes as the reference main faulty node. 6 . The method according to claim 5 , wherein, based on the causal probability between the bifurcated fault nodes and the corresponding plurality of sub-fault nodes, a sub-fault is selected from the plurality of sub-fault nodes. 7 . The node is used as the reference main fault node, including: For the plurality of sub-faulty nodes, the following steps are respectively performed: based on the target resource exception information corresponding to the fork-faulty node and a sub-faulty node within a preset time period, determine the fork-faulty node and the one sub-faulty node. Causal probability between faulty nodes; A maximum causal probability among the obtained multiple causal probabilities is determined, and among the multiple sub-fault nodes, the sub-fault node corresponding to the maximum causal probability is used as the reference main fault node. 7. The method according to claim 1, wherein the target root fault node is determined from the main fault node chain based on the causal probability between each main fault node in the main fault node chain, include: Obtain an initial reference root fault node from the main fault node chain; Based on the causal probability between the reference root fault node and other primary fault nodes in the primary fault node chain, the reference root fault node is iteratively updated until the iteration ends, and the reference root fault node is used as the target root fault node . 8. The method of claim 7, wherein each iterative process comprises the steps of: Obtain a primary faulty node from the other primary faulty nodes; determining the causal probability between the reference root fault node and the one main fault node based on the target resource abnormality information corresponding to the reference root fault node and the target resource abnormality information corresponding to the one main fault node; If the causal probability is greater than the preset causal threshold, the reference root fault node remains unchanged; Otherwise, the one main faulty node is used as the reference root faulty node. 9. The method according to claim 6 or 8, wherein the target resource abnormality information comprises a target resource abnormality time point, a target resource abnormality amplitude, and a target resource abnormality duration time period. 10. A fault detection device, comprising: an original faulty node chain acquisition module, used for acquiring the original faulty node chain, the original faulty node chain including a plurality of original faulty nodes; a main faulty node chain obtaining module, configured to sequentially select main faulty nodes from the plurality of original faulty nodes along the extension direction of the original faulty node chain, and determine the main faulty node chain based on each selected main faulty node; A target determination module, configured to determine a target root fault node from the main fault node chain based on the causal probability between each main fault node in the main fault node chain. 11. A computer device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements any one of claims 1 to 9 when executing the program. steps of the method described. 12. A computer-readable storage medium, characterized in that it stores a computer program executable by a computer device, and when the program runs on the computer device, the computer device is made to execute any one of claims 1 to 9. steps of the method described.

Images