## 2 Research Background  
Due to the complexity of distributed information system architecture, when a business application encounters an exception, a large number of alerts from different levels such as the operating system, network, and database are usually received at the infrastructure level, making it difficult to focus on the cause of the failure in the first place, and it is difficult to drill down from the abnormal application to analyze and locate the faulty operation and maintenance object at the infrastructure level. There are currently two main types of research. One is based on knowledge graphs [1; 2; 3; 4], involving multiple steps such as knowledge graph construction, knowledge learning, and knowledge reasoning. Key technologies include ontology modeling of domain knowledge, graph mining algorithms, and logical reasoning algorithms based on fast graph search. The technical complexity is high. This method has strong generalization but insufficient accuracy, and there are no mature cases of practical application. The knowledge graph technology has been used by Tsinghua University in the field of basic-level fault location in the vertical direction, applied to alarm traceability research [5; 6; 7]. Another type is based on root cause similarity analysis, such as the CoFlux algorithm [8] and FluxInfer algorithm [9]. Due to the lack of topological relationship knowledge, only based on algorithm analysis of the shape changes of indicator data, the accuracy is not good in the distributed architecture. A comparison of commonly used basic-level fault location methods is shown in Table 1.  
It can be seen that there is insufficient accuracy in basic-level fault location technology, which is effective in local scenarios but still has a gap from practical use. Take the distributed financial information system as an example. Considering the extremely strict stability guarantee and regulatory requirements brought by the characteristics of a financial business, the ideal emergency response time requirement is to detect anomalies within 1 min, provide the scope of the object of fault location within 5 min, and complete isolation, switching, expansion, restart and other emergency response operations within 10 min. The overall business impact time is controlled within 20 min. Against this background, fault location requires accuracy and efficiency, firstly, the coverage of fault types is sufficiently complete, and secondly, it meets the time requirement of fast location in minutes. As the financial distributed information system architecture evolves towards infrastructure cloudification, containerization of runtime environments, and microservice-oriented \begin{table}
\begin{tabular}{c c c} \hline \hline
**Method Type** & **Method Core Idea** & **Existing Problems** \\ \hline \multirow{4}{*}{Knowledge Graph} & Build a knowledge graph & The construction of the \\  & based on operation & knowledge graph is relatively \\  & experience and topology & complex and effective in local \\  & relationships, and achieve & scenarios, but there is still a \\  & location through knowledge & gap from practical use. \\  & fusion and fault reasoning. & \\ \hline \multirow{4}{*}{1-3 Similarity Analysis} & After applying anomalies, & \\  & directly compare the & \\ \cline{1-1}  & mutation patterns of a large & \\ \cline{1-1}  & number of indicators in the & \\ \cline{1-1}  & basic layer to locate. & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of commonly used basic-level fault location methods. business systems, the mutual invocation of IT components has become increasingly common and complex. However, the current widely established Configuration Management Database (CMDB) primarily focuses on the management of configuration items, with relational databases serving as the primary means to store static configuration information, making it difficult to dynamically reflect the topological relationships between configuration items.