Graph-centric agentic intelligence

來源原標題

Graph-centric agentic intelligence

機構

Amazon

原始連結

https://www.amazon.science/blog/graph-centric-agentic-intelligence

摘要原文

Graphs encode relationships. In a world where AI agents need to reason about complex systems, not just retrieve information, graph structure provides the scaffolding for causal inference, dependency tracking, and compositional reasoning. Unlike tabular or unstructured data, graphs preserve the topology of real-world systems: what connects to what and how influence flows. For networks, this is not a metaphor. Networks are natively graphs. Every device, link, open communication channel, and service dependency is a vertex or edge in a structure that can span millions of elements. The question facing operational teams today is not whether to represent networks as graphs but how to let AI agents reason over that structure autonomously, adaptively, and at speed. This post traces how graph intelligence evolved across scientific research on networks, from passive modeling to active agentic reasoning, and demonstrates agentic reasoning through cascaded graph analytics for root cause identification. For the solution architecture and a guide to common routines (a runbook), see our companion post, “Beyond correlation: Finding root causes using a network digital twin graph and agentic AI”. Graphs for networks The earliest use of graphs for networks was to represent topology — to model physical connectivity so that operators could compute paths and isolate failures in seconds rather than hours. Knowledge graphs and ontologies enhanced topological models by adding semantics, defining, for instance, what a "cell", an "SLA breach", or an "escalation procedure" is and how these concepts relate to each other across vendors and network generations. This enabled machine-readable operations and multivendor interoperability. Once the graph carried both structure and semantics, the next step was encoding causation. Alarm correlation graphs, which map relationships among network-generated alerts about phenomena like lost connections or network breaches, introduced hierarchical relationships between network events. Walking upstream through the graph condensed tens of thousands of raw alarms into a single causal chain within minutes, a significant advance over manual correlation but one that required predefined alarm hierarchies. Dependency graphs removed that requirement: autogenerated in real time from software-defined-networking (SDN) and network functions virtualization (NFV) controllers, they enabled Bayesian fault localization at 95% accuracy in under 30 seconds with no manually authored rules. Causal subgraphs answered not just where but why. Live alarms converted into directed acyclic graphs revealed the propagation paths of key performance indicators (KPIs), giving operators evidence rather than predictions. Graph neural networks (GNNs), which produce vector representations of graph nodes for use in downstream applications, learned what topology and causal structure alone could not show: hidden intercell dependencies, data patterns that would have emerged had failed nodes not stopped reporting, and spatiotemporal dynamics. These were sequential scientific advances, each addressing a limitation of its predecessor. Today they converge. A single network can be simultaneously represented as a topology graph, enriched with ontology semantics, annotated with temporal KPIs, and reasoned over by GNNs, all coordinated by an agentic layer that selects the right graph tool for each failure pattern. The graph went from a passive data model to an active agentic reasoning substrate. Root cause analysis Root cause analysis is the natural proving ground for graph intelligence. When a network fails, finding the root cause can take hours. For complex multilayer failures, remediation in traditional network operations centers (NOCs) averages four to five hours and can extend to days. The bottleneck is not engineering expertise; it is cognitive overload. Human operators cannot correlate hundreds of alarms, configuration files, and telemetry data across thousands of nodes faster than customer impact accumulates. Traditional approaches rely on temporal correlation: if alarm A precedes alarm B, the system infers that A caused B. This heuristic fails in complex topologies where failures propagate through multiple parallel paths, polling intervals (i.e., intervals between regular system state queries) make timing unclear, and the true root cause may generate no alarm at all. To address the problem of root cause analysis in complex networks, we designed and developed an approach combining cascaded graph algorithms with agentic-AI execution. The graph algorithms provide mathematical precision in the analysis of network topology; the agentic layer provides adaptive intelligence for applying those algorithms correctly across diverse failure scenarios. We demonstrated our approach with NTT DOCOMO at the Mobile World Conference (MWC) earlier this year, achieving root cause analysis in minutes on commercial networks. Three pillars underpin our design: graph modeling, graph-centric analytics, and agentic orchestration. 1. Graph modeling: The digital twin We represent the network as a continuously synchronized graph whose vertices are devices with attributes and whose edges represent connections. This “digital twin” of a physical or software-defined network ingests network dependencies, live alarms, and KPIs from multiple data sources across network segments and layers, transforming them into a topology-aware data structure that all analytics operate on. 2. Graph-centric analytics: The cascaded pipeline Against this graph, the system orchestrates a three-stage cascade of graph algorithms, each stage narrowing the search space for the next: Stage 1, decomposition Based on the number and strength of connections, we identify the most-connected parts of the topology. When failures sever links, the network may fragment into disconnected subgraphs, which allows us to immediately localize analysis to boundary nodes and prevent wasted computation on unaffected regions. This narrows the candidate set from thousands of nodes to hundreds. Stage 2, clustering Within the affected components, community detection algorithms (Louvain or label propagation) group nodes that frequently interact or share dependencies. This process reveals functional groupings and distinguishes failures affecting a single cluster from those propagating across cluster boundaries. The number of candidates narrows from hundreds to tens. Stage 3, centrality ranking Within the identified clusters, a suite of centrality algorithms ranks candidates according to the likelihood that they are the root cause. Standard centrality algorithms measure structural importance: PageRank determines which node is most central within the subgraph; degree centrality determines which node has the most connections; and closeness determines which node is nearest to everything. These answers are static; they don't change when a failure occurs. For root cause analysis, the question is fundamentally different: which node is most important relative to this particular failure? The alarming nodes define the reference frame. Every centrality measure must be recomputed, not against the full graph, but against the failure set. We apply this principle, conditioning on the alarm set, across three centrality algorithms in the suite. Personalized PageRank works by performing a random walk along network paths, evaluating the number and importance of each node’s connections. Our version of the algorithm seeds the random walk from nodes that are issuing alarms (“alarming nodes”). The ranking component of the algorithm concentrates on common ancestors of alarming nodes, tracing faults upward in hierarchical topologies. Our algorithm for computing degree centrality counts only edges to alarming nodes: a gateway with 50 total connections but zero to alarming nodes scores zero; a switch with five alarm connections scores five.