Intelligent operation and maintenance early warning method of IT equipment, equipment and medium

Abstract

The invention discloses an intelligent operation and maintenance early warning method and device for IT equipment and a medium, and the method comprises the steps: collecting multi-dimensional perception data corresponding to the IT equipment through a pre-deployed distributed probe, so as to construct a multi-dimensional real-time perception data set corresponding to the IT equipment, the method comprises the steps of obtaining current equipment attribute information of IT equipment, determining a dynamic confidence interval corresponding to the IT equipment based on the current equipment attribute information and a pre-constructed equipment health baseline model, and when it is monitored that operation of the IT equipment is abnormal based on the dynamic confidence interval and a multi-dimensional real-time perception data set, determining whether the IT equipment is abnormal or not based on a pre-constructed equipment association map. Predicting a propagation path corresponding to the IT equipment, determining a fault propagation path corresponding to the IT equipment, carrying out the impact degree evaluation of the impact equipment according to the fault propagation path and the equipment service information of a plurality of impact equipment, and determining a fault risk index corresponding to each impact equipment, so as to carry out the fault risk early warning.

Description

Technical Field

[0001] This specification relates to the field of intelligent operation and maintenance early warning technology, and in particular to an intelligent operation and maintenance early warning method, device and medium for IT equipment. Background Technology

[0002] Against the backdrop of rapid advancements in intelligent infrastructure development, enterprise IT infrastructure continues to expand, resulting in a complex operational environment encompassing various network communication devices such as servers, switches, routers, and firewalls, as well as security equipment. Currently, under traditional operational models, increased device heterogeneity leads to a lack of effective integration of diverse data such as operating parameters, environmental status, and log characteristics. Single-dimensional monitoring indicators struggle to accurately reflect the true health status of equipment. Furthermore, existing early warning systems are limited by static threshold alarm mechanisms, resulting in frequent false alarms and delayed warnings. The intertwined physical connections and logical dependencies between devices mean that local anomalies can easily escalate into systemic risks when a fault occurs. Moreover, when critical equipment malfunctions, operational personnel often can only respond passively after the fault has spread to related devices, severely hindering operational efficiency and causing unnecessary resource waste.

[0003] Therefore, in complex operation and maintenance scenarios involving multiple IT devices, using a single-dimensional monitoring indicator for static threshold alarms does not take into account the dynamic factors that exist during device use and the physical connections and logical dependencies between devices, which poses a risk of false alarms and fault propagation. Summary of the Invention

[0004] This specification provides one or more embodiments of an intelligent operation and maintenance early warning method, device, and medium for IT equipment, which is used to solve the following technical problem: In complex operation and maintenance scenarios involving multiple IT devices, using a single-dimensional monitoring indicator for static threshold alarms does not consider the dynamic factors existing during device use and the physical connections and logical dependencies between devices, which poses a risk of false alarms and fault propagation.

[0005] One or more embodiments of this specification employ the following technical solutions:

[0006] This specification provides one or more embodiments of an intelligent operation and maintenance early warning method for IT equipment. The method includes: collecting multi-dimensional sensing data corresponding to the IT equipment through pre-deployed distributed probes to construct a multi-dimensional real-time sensing dataset corresponding to the IT equipment, wherein the multi-dimensional real-time sensing dataset includes equipment operating parameters, equipment environmental parameters, and equipment log features; obtaining the current equipment attribute information of the IT equipment; determining the dynamic confidence interval corresponding to the IT equipment based on the current equipment attribute information and a pre-built equipment health baseline model; performing status monitoring on the IT equipment based on the dynamic confidence interval and the multi-dimensional real-time sensing dataset; when an abnormal operation of the IT equipment is detected, predicting the propagation path corresponding to the IT equipment based on a pre-built equipment association graph to determine the fault propagation path corresponding to the IT equipment, wherein the fault propagation path includes multiple affected devices; assessing the degree of impact on the affected devices based on the fault propagation path and the equipment business information of the multiple affected devices, and determining the fault risk index corresponding to each affected device for fault risk early warning.

[0007] This specification provides one or more embodiments of an intelligent operation and maintenance early warning device for IT equipment, including:

[0008] At least one processor; and,

[0009] A memory communicatively connected to the at least one processor; wherein,

[0010] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the above-described method.

[0011] This specification provides one or more embodiments of a non-volatile computer storage medium storing computer-executable instructions configured to perform the above-described method.

[0012] The at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects: By using the technical solutions in the embodiments of this specification, and with the help of pre-deployed distributed probes, device operating parameters, device environmental parameters, and device log characteristics are collected to construct a multi-dimensional real-time perception dataset. This multi-dimensional data collection method can capture the device's status information in different aspects, and can more accurately and comprehensively understand the operating status of IT devices, avoiding the problem of one-sided data in traditional single-dimensional monitoring. First, the current device attribute information of the IT device is obtained, and then a dynamic confidence interval is determined by combining it with a pre-built device health baseline model. The dynamic confidence interval can change with the use of the device and changes in the environment. When the real-time data of the device exceeds this dynamic confidence interval, the device's abnormal operation can be detected in time, realizing dynamic and accurate monitoring of the device status. It takes into account the dynamic factors in the process of device use and avoids the problems of traditional static thresholds. To address the issues of frequent false alarms and delayed warnings in the current alarm mechanism, this system improves the accuracy and timeliness of warnings. When an IT device malfunction is detected, fault propagation paths are predicted based on a pre-built device association graph. This graph integrates physical topology data and real-time communication data, comprehensively reflecting the physical connections and logical dependencies between devices. Centered on the malfunctioning device, the analysis and calculation of the association graph determine the possible propagation paths of the fault and the multiple affected devices. When a fault occurs, the system predicts the possible propagation paths and affected devices in advance, preventing the fault from spreading into a systemic risk and reducing unnecessary resource consumption. Based on the fault propagation path and the business information of the affected devices, the system assesses the degree of impact on the affected devices, providing clear fault risk indicators for maintenance personnel, facilitating the rational allocation of maintenance resources, and improving maintenance efficiency. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] In the attached diagram:

[0015] Figure 1 A flowchart illustrating an intelligent operation and maintenance early warning method for IT equipment provided in an embodiment of this specification;

[0016] Figure 2 This is a structural diagram of an intelligent operation and maintenance early warning device for IT equipment provided in the embodiments of this specification. Detailed Implementation

[0017] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0018] This specification provides an intelligent operation and maintenance early warning method for IT equipment. It should be noted that the execution subject in this specification embodiment can be a server or any device with data processing capabilities. Figure 1 This is a flowchart illustrating an intelligent operation and maintenance early warning method for IT equipment provided in an embodiment of this specification, as shown below. Figure 1 As shown, the main steps include the following:

[0019] Step S101: Collect multi-dimensional sensing data corresponding to IT devices through pre-deployed distributed probes to construct a multi-dimensional real-time sensing dataset corresponding to IT devices.

[0020] The multidimensional real-time sensing dataset includes device operating parameters and device environmental parameters, as well as device log features.

[0021] In one embodiment of this specification, distributed probe nodes are deployed to collect device operating parameters, environmental parameters, and log characteristics using multiple protocols, constructing a three-dimensional perception capability covering the entire device state. This is combined with edge computing for data preprocessing, providing high-quality input for upper-layer analysis. Operating parameters can be collected via SNMP protocol to obtain operating metrics such as CPU / memory utilization and disk I / O; server hardware status parameters, such as power supply voltage and fan speed, can be obtained via IPMI protocol; and network traffic characteristics, such as bandwidth and packet loss rate, can be obtained by analyzing network traffic characteristics via NetFlow protocol. When collecting environmental parameters, deployed temperature, humidity, vibration, and electromagnetic sensors (such as SHT35 and ADXL345) transmit data via I2C / Modbus interfaces to obtain device environmental parameters, such as temperature, humidity, and vibration signals. Device logs are collected via Syslog protocol, and abnormal events are captured in real time using a Kafka streaming engine.

[0022] The probe incorporates a protocol parser to convert data from devices from different manufacturers into a unified JSON format. Edge preprocessing is performed on the data at the edge, including protocol parsing of operating parameters and conversion to a unified JSON format, Kalman filtering for noise reduction of temperature and humidity time-series data, and calculation of mean and variance based on a sliding window. Frequency domain analysis is performed on vibration signals to identify abnormal frequency characteristics, such as using FFT frequency domain analysis to identify abnormal frequency characteristics of mechanical components. Regular expressions are used to match preset keywords in log data to extract abnormal event types, such as "ERROR" and "CRITICAL". Furthermore, Delta-Zigzag encoding is used to compress time-series data, achieving a compression rate >75%; log text is compressed using the LZ4 algorithm. After these steps and processing, a standardized device status dataset is output to construct a multi-dimensional real-time sensing dataset corresponding to IT devices, containing timestamps, device IDs, and three-dimensional parameter values.

[0023] Step S102: Obtain the current device attribute information of the IT device; based on the current device attribute information and the pre-built device health baseline model, determine the dynamic confidence interval corresponding to the IT device; and monitor the status of the IT device based on the dynamic confidence interval and the multi-dimensional real-time perception dataset.

[0024] Based on the current device attribute information and a pre-built device health baseline model, the dynamic confidence interval corresponding to the IT device is determined (the dynamic confidence interval is the output data of the device health baseline model). Specifically, this includes: acquiring historical operating data, device metadata, and load fluctuation data of multiple existing IT devices from the database to construct a historical dataset of existing IT devices; training an LSTM-GRU hybrid network based on this historical dataset to determine a general health baseline model; determining whether the IT device belongs to the historical dataset of existing IT devices; if not, fine-tuning the fully connected layer parameters of the LSTM-GRU hybrid network based on the historical dataset corresponding to the IT device, using the historical dataset corresponding to the IT device, to determine the device health baseline model corresponding to the IT device; acquiring multi-dimensional aging impact data from the current device attribute information, including time-dimensional data, maintenance-dimensional data, and environmental-dimensional data; evaluating the aging status of the IT device using this multi-dimensional aging impact data to determine the corresponding device aging index; and dynamically adjusting the output data of the device health baseline model based on the device aging index and the multi-dimensional aging impact data to determine the dynamic confidence interval corresponding to the IT device.

[0025] In one embodiment of this specification, metrics such as CPU temperature, memory error rate, disk read / write speed, and network packet loss rate of IT equipment over historical periods (e.g., three years) are extracted from a time-series database and stored in 5-minute granularities. Equipment metadata is obtained by maintaining attribute information such as equipment model, years of service, and maintenance records, and resource utilization fluctuation patterns during peak business periods are collected. The historical data is decomposed into three parts using a Seasonal-Trend decomposition using LOESS (STL) algorithm, mainly including trend items, periodic items, and residual items. Trend items reflect the decline in equipment performance over service years, such as a 0.3% annual increase in CPU temperature; periodic items extract daily / weekly load fluctuation patterns, such as periodic increases in disk I / O due to nighttime backup tasks; residual items capture sudden abnormal signals, such as a sudden temperature rise caused by fan failure. Based on the CPU temperature, memory error rate, and other metric data extracted from historical periods, combined with the trend items, periodic items generated by STL decomposition, and filtered residual items, and overlaid with the service years and maintenance frequency from the equipment metadata, a trend feature matrix is ​​constructed by linear interpolation to compensate for breakpoints caused by equipment retirement or replacement. Embedded business peak labels (such as the 9:00-11:00 time period of the transaction system) are used to match the load fluctuation patterns of similar devices and construct a periodic feature matrix. Through adaptive threshold filtering, such as the Hampel identification method, abnormal fluctuations are eliminated and features that characterize the inherent noise of the devices are retained to construct a residual feature matrix.

[0026] A dual-channel collaborative training framework is designed to couple long-term and short-term features. A bidirectional LSTM network is deployed to process the trend feature matrix, capturing device performance degradation patterns, such as an average annual decrease of 2.3% in disk read / write speed, through a sliding window with a time step of 30 days. A GRU fluctuation sensing channel is deployed, using gated recurrent units to process the residual feature matrix. Its reset gate dynamically adjusts the weights of sudden noise events, such as temperature spikes caused by fan failures. A cross-modal feature fusion layer aligns the long-term predictions of the trend channel with the short-term sensitive features of the fluctuation channel through a multi-head attention mechanism (4 heads), generating a joint feature vector. 288 neurons are deployed in the output layer, corresponding to 24-hour predictions at a 5-minute granularity. A course learning strategy is used to expand the prediction duration in stages: 4 hours → 12 hours → 24 hours. Device models are encoded as 32-dimensional feature vectors, and adversarial training is used to eliminate the influence of manufacturer differences, enabling the model to learn hardware-independent general health patterns. A composite loss function is used for optimization: weighted mean square error is combined to enhance accuracy during peak business periods, dynamic time warping loss is used to compensate for time offset errors, and peak constraint loss is used to suppress abnormal predictions exceeding device specifications. A hybrid neural network architecture is employed, using an LSTM network to learn long-term performance degradation trends and a GRU network to capture short-term load fluctuation characteristics. This hybrid neural network architecture outputs the predicted device health baseline curve for the next 24 hours. It should be noted that during model training, a baseline model can be trained using historical data from a group of devices of the same model. For the prediction model of a single device, the parameters of the fully connected layers can be adjusted using data from the device within the last 30 days. After obtaining the general health baseline model in the above manner, the current device attribute information of each target IT device is obtained. This device attribute information can be extracted from the metadata database, including device model, firmware version, hardware configuration, and other device identification features. In addition, the device attribute information also includes multi-dimensional aging impact data.

[0027] Using the device attribute information of the current device, an index query is performed on the existing historical dataset to retrieve the device model list from the time-series database. It should be noted that the historical dataset here should be updated synchronously with the historical dataset used during model training. The system checks if the current device exists in the historical dataset by calculating the cosine similarity between the current device model and the historical dataset. If the similarity is ≥0.85, indicating the same manufacturer and series, it is considered a known device type, and the general model is directly called. If the similarity is <0.85, indicating a new model or heterogeneous device, the transfer learning process is triggered. The pre-trained LSTM-GRU backbone network in the general model is retained, the weights of the bidirectional LSTM / GRU layers are frozen, the parameters of the fully connected layers are unsealed, and the original output layer → 24-hour prediction is used for retraining. At least 30 days of operational data (5-minute granularity) for the device is pulled from edge computing nodes, and trend, period, and residual terms specific to the device are generated through STL decomposition to determine the device health baseline model corresponding to this IT device. Using the obtained device health baseline model, the output includes baseline values, variance range, and confidence labels, such as baseline CPU temperature = 45℃ ± 2℃, with a confidence level of 95%. It should be noted that the device health baseline model in the above example is a health baseline model for a specific metric, and its effectiveness depends on the historical dataset corresponding to that metric used for training or fine-tuning. For example, CPU temperature corresponds to one health baseline model, and disk read / write speed corresponds to another.

[0028] LSTM (Long Short-Term Memory) is a special type of recurrent neural network (RNN) primarily used to address the "vanishing gradient" or "exploding gradient" problems that traditional RNNs encounter when processing long sequences of data. It effectively captures long-term dependencies in sequential data. GRU (Gated Recurrent Unit) is a simplified variant of LSTM, also an improved model of recurrent neural networks (RNNs). It is mainly used to process sequential data, solving the "vanishing / exploding gradient" problem of traditional RNNs while simplifying the structure to improve computational efficiency.

[0029] The above technical solution utilizes historical operational data, device metadata, and load fluctuation data from multiple existing IT devices to train an LSTM-GRU hybrid network, constructing a general health baseline model. This model learns the operating patterns and characteristics of different IT devices under normal circumstances, providing a foundation for determining the health baseline of specific devices. For devices not included in the existing IT device historical dataset, the fully connected layer parameters are fine-tuned based on the general health baseline model using their own historical data to obtain a device-specific health baseline model. This allows for personalized modeling tailored to the characteristics of different devices, more accurately reflecting their normal operating status and improving the model's adaptability and accuracy. Furthermore, multi-dimensional aging impact data from current device attribute information, including time, maintenance, and environmental dimensions, is acquired and used to dynamically adjust the output data of the device health baseline model, determining dynamic confidence intervals. This fully considers aging factors during device use, enabling the health baseline to dynamically change with device usage, better reflecting the actual operating conditions of the devices and avoiding misjudgments or omissions caused by device aging.

[0030] By using this multidimensional aging impact data, the aging status of the IT equipment is assessed, and the corresponding equipment aging index is determined. Specifically, this includes: obtaining the equipment service life in the time dimension data, the number of repairs in the maintenance dimension data, and the environmental parameter deviation data in the environment dimension data; weighting and normalizing the equipment service life, the number of repairs, and the environmental parameter deviation data to determine the corresponding equipment aging index of the IT equipment.

[0031] In one embodiment of this specification, aging impact factors are extracted from multidimensional aging impact data, obtaining the equipment service life in the time dimension data, the number of repairs in the maintenance dimension data, and the environmental parameter deviation data in the environmental dimension data. It should be noted that the number of repairs here refers to repairs without replacing core components, and the environmental parameter deviation data refers to the difference between environmental data such as the computer room temperature and the equipment environmental parameters such as CPU temperature in the trend item. Generally, the temperature and humidity in the computer room should be within a suitable range, which can be set based on empirical data. The environmental parameter deviation data here refers to the amount of change in environmental parameters that is higher or lower than the set suitable range. When determining the environmental temperature and humidity deviation, the median value of the environmental parameters corresponding to the suitable range is first obtained. The ratio of the environmental parameter change to this median value is used to determine the environmental temperature / humidity deviation. The average of the environmental temperature deviation and the environmental humidity deviation is determined as the environmental temperature deviation. The aging index is calculated as follows: Aging index = (service years × 0.4) + (number of repairs × 0.3) + (ambient temperature and humidity deviation × 0.3). After obtaining the aging data, it is normalized to a range of 0-1. The larger the value, the more severe the aging.

[0032] The equipment aging index is determined by acquiring data on equipment service life, maintenance frequency, and environmental parameter deviations, and then performing weighted calculations and normalization. This comprehensive assessment method takes into account multiple key factors affecting equipment aging. Equipment service life reflects the long-term wear and tear of the equipment, maintenance frequency reflects the frequency and severity of equipment failures, and environmental parameter deviations take into account the impact of the external environment on the equipment. This comprehensive assessment method can more fully and accurately reflect the aging status of the equipment, providing a reliable basis for subsequent dynamic adjustments.

[0033] Based on the equipment aging index and the multidimensional aging impact data, the output data of the equipment health baseline model is dynamically adjusted to determine the dynamic confidence interval corresponding to the IT equipment. Specifically, this includes: performing linear regression analysis on the trend term in the historical dataset of the IT equipment based on the equipment's service life in the time dimension data to determine the performance degradation slope corresponding to the IT equipment; performing linear compensation on the baseline value in the output data based on the performance degradation slope to determine the compensation baseline value, and expanding the variance range in the output data through the equipment aging index to determine the compensation variance range corresponding to the IT equipment; and determining the dynamic confidence interval corresponding to the IT equipment according to the normal distribution based on the compensation baseline value and the compensation variance range.

[0034] In one embodiment of this specification, a linear regression analysis is performed on the trend term based on the equipment service life in the time dimension data to calculate the performance degradation slope, such as the annual growth rate of CPU temperature ΔT. The baseline value is then linearly compensated according to the service life, and the adjusted baseline temperature = original baseline temperature × (1 + service life × performance degradation slope). For example, if a switch has been in service for 24 months with a performance degradation slope of 0.1% / month, and today's predicted baseline temperature is 45℃, the corresponding correction value = 45 + 0.1% × 24 × 45 = 45 + 1.08 = 46.08℃. The original variance is obtained from the output of the healthy baseline model, and the variance range is expanded according to the aging index. The adjusted variance = original variance × (1 + 0.5 * aging index). For example, when the aging index is 0.5, the variance tolerance is expanded to 1.25 times the original value. For severely aged equipment, short-term exceedances of key parameters (such as temperature) are allowed (e.g., exceeding the limit for 5 minutes without triggering an alarm). Based on the adjusted baseline value and variance, a dynamic confidence interval is calculated according to a normal distribution. The dynamic confidence interval = adjusted baseline value ± Z × adjusted variance, where the Z value is determined based on the confidence level output by the healthy baseline model. The Z value is a quantile of the standard normal distribution and is directly related to the confidence level; its value is derived from the probability density function characteristics of the standard normal distribution. For example, a 95% confidence level corresponds to Z = 1.96. Real-time data exceeding the dynamic confidence interval and persisting for more than a set duration (e.g., 3 minutes) is marked as abnormal.

[0035] By employing the aforementioned technical solutions, linear regression analysis is performed on the trend terms in the historical data of the equipment based on its service life to determine the performance degradation slope. This quantifies the changing trend of equipment performance over time, accurately grasps the decline in equipment performance, and provides specific numerical basis for adjusting the health baseline, making the assessment of equipment health status more accurate. Linear compensation of the baseline value based on the performance degradation slope, and expansion of the variance range through the equipment aging index, allow for dynamic adjustment of the confidence interval of the health baseline according to the degree of equipment aging and performance degradation. This gradually widens the tolerance range for equipment operating data during the aging process, more reasonably reflecting the normal operating range of the equipment at different aging stages, reducing false alarms caused by equipment aging, and promptly detecting abnormal situations that exceed the normal range, improving the accuracy and timeliness of early warnings. Determining the dynamic confidence interval according to a normal distribution ensures that the assessment results have statistical rationality and reliability.

[0036] Step S103: When an abnormal operation of an IT device is detected, the propagation path corresponding to the IT device is predicted based on a pre-built device association map to determine the fault propagation path corresponding to the IT device.

[0037] The fault propagation path includes multiple affected devices;

[0038] In one embodiment of this specification, the multidimensional real-time sensing dataset includes device operating parameters and device environmental parameters. For each of these parameters, the collected multidimensional real-time sensing dataset is compared with the corresponding dynamic confidence intervals to determine whether the data in the dataset belongs to the appropriate dynamic confidence interval. If an IT device's indicator does not belong to a dynamic confidence interval, the current indicator is determined to be an abnormal indicator. If the abnormal indicator falls within a preset key indicator range and has been determined to be an abnormal indicator for at least three consecutive sampling periods, the IT device is determined to be an abnormal device. It should be noted that the collected real-time sensing data comprises data from multiple dimensions, such as fan speed data and CPU temperature data, each with a corresponding matching dynamic confidence interval. The multidimensional real-time sensing dataset also includes device log features. Abnormal event identification is performed by extracting keywords from the logs based on these features.

[0039] Based on a pre-constructed device association graph, the method predicts the propagation path corresponding to the IT device. Before determining the fault propagation path corresponding to the IT device, the method further includes: acquiring device physical topology data and periodically acquiring real-time device communication data. The device physical topology data includes device hierarchy, power links, and VLAN configurations, while the real-time device communication data includes TCP / UDP connection frequency, traffic volume, and communication latency data. Based on the device physical topology data, a corresponding device spatial graph is constructed with devices as nodes and physical connections as edges. The communication weight is calculated in real time using the real-time device communication data, and the edge weight of the edge is dynamically updated using the communication weight to determine the corresponding device association graph.

[0040] In one embodiment of this specification, device physical topology data is acquired, including device hierarchical relationships such as core switch → aggregation layer → access layer, power link topology, and VLAN (Virtual Local Area Network) configuration table. The frequency of TCP / UDP connections between devices is periodically collected via the NetFlow protocol, such as daily or weekly. Traffic volume is captured using a traffic probe (unit: MB / s), and device CPU / memory utilization is collected via the SNMP protocol. The device physical topology data in JSON / XML format is parsed to extract device nodes and physical connection relationships, such as the downlink port of a switch → server network card. Communication data is cleaned to filter transient noise, such as occasional ping timeouts, and the average traffic and packet loss rate are calculated in 5-minute windows.

[0041] In the device space graph, devices are designated as nodes. Node attributes include device type (server / switch), IP address, rack, power link ID, and initial CPU baseline value. Edge attributes include physical connection type (fiber optic / copper), port speed, and VLAN ID. Physical connections are mapped to edges in the graph structure, generating basic adjacency moments. Core nodes, such as core switches, are marked and assigned a priority label (critical=1). Communication weights are calculated in real-time using traffic volume, packet loss rate, and communication latency data from the current time slice. Communication weight = (current traffic volume / maximum port bandwidth) × (1 - packet loss rate) × latency attenuation factor, where latency attenuation factor = 1 / (1 + communication latency / baseline latency). The edge weights are dynamically updated based on the communication weights to determine the corresponding device association graph.

[0042] By acquiring physical topology data and real-time device communication data, the above technical solution integrates multi-dimensional information such as device hierarchy, power links, VLAN configurations, TCP / UDP connection frequency, traffic volume, and communication latency. A device spatial graph is constructed with devices as nodes and physical connections as edges. The device association graph is determined by dynamically updating edge weights using real-time communication data (once all physical connection edges in the device spatial graph are assigned dynamically updated weights, a "device association graph" is formed). This comprehensively and accurately reflects the physical connections and logical dependencies between IT devices, more realistically presenting the complex relationships between devices in complex IT operations and maintenance environments. In complex IT operations and maintenance environments, device status and their relationships... The communication relationships are dynamic. By periodically acquiring real-time device communication data and calculating communication weights in real time to dynamically update the edge weights of the device association graph, changes in the communication status between devices can be captured in a timely manner. This adapts to the dynamic nature of IT equipment operation and enables more timely detection of abnormal changes in the relationships between devices, providing a more accurate basis for predicting fault propagation paths. Through the constructed device association graph, the relationships between devices and potential fault propagation paths can be understood in advance. When a fault occurs, potentially affected devices can be quickly located, rather than passively responding after the fault spreads to related devices. Measures can be taken in advance for early warning and prevention, reducing the risk of fault propagation, reducing unnecessary resource consumption, and improving operation and maintenance efficiency.

[0043] Based on a pre-built device association graph, the propagation path corresponding to the IT device is predicted to determine the fault propagation path corresponding to the IT device. Specifically, this includes: acquiring abnormal indicator data of the abnormal IT device; triggering the abnormal indicator data to retrieve the real-time communication indicator data of the abnormal IT device; extracting a three-hop subgraph from the device association graph centered on the abnormal IT device to determine the initial target subgraph; updating the local weights in the initial target subgraph using the real-time communication indicator data to determine the edge attributes of the updated subgraph to determine the device association subgraph; and calculating the fault propagation probability of the device association subgraph to determine the fault propagation path corresponding to the IT device. The fault propagation probability is calculated for the device association subgraph to determine the fault propagation path corresponding to the IT device. Specifically, this includes: obtaining the weights of multiple updated edges in the device association subgraph; starting from the abnormal IT device, calculating the propagation probability hop-by-hop along the descending order of edge weights to determine the probability of direct-connected devices being affected; aggregating the node state features of neighboring nodes in the device association subgraph using a graph attention network to generate node embeddings, and predicting the probability of non-directly connected devices being affected based on these embeddings; generating a fault propagation path list using the probability of direct-connected devices being affected and the probability of non-directly connected devices being affected, and determining the fault propagation path corresponding to the IT device by sorting them by probability. Three-hop subgraph extraction is performed on the device association graph, including: using the abnormal IT device as the central node, extracting all nodes and edges within the "three-hop" range in the constructed device association graph: first-hop nodes: devices directly physically connected to the abnormal device (e.g., directly connected switches, adjacent servers); second-hop nodes: devices directly connected to the first-hop nodes (e.g., servers indirectly connected via switches); third-hop nodes: devices directly connected to the second-hop nodes. This step, through the "three-jump" range limitation, focuses on the set of devices that the abnormal device may directly or indirectly affect, forming an "initial target sub-map" to avoid low analysis efficiency due to the excessive size of the map.

[0044] In one embodiment of this specification, when an IT device malfunction is detected, abnormal indicator data of the abnormal IT device is acquired. Triggered by the abnormal indicator data, real-time communication indicator data of the abnormal device is retrieved from a time-series database. Starting from and rooting at the abnormal device, a three-hop traversal query is performed in the graph database (Neo4j) to generate an initial target subgraph containing core devices, secondary switches, and storage nodes. It should be noted that although the initial target subgraph already contains edge weights corresponding to the communication data, the communication data collected during the device association graph construction phase is periodic real-time communication data. This means that the edge weights in the initial target subgraph, relative to the time of the anomaly, are still historical communication data. The edge weights in the initial target subgraph are updated a second time using the communication data at the time of the anomaly to ensure that the edge weights in the subgraph better reflect the actual communication situation.

[0045] The update method here can be set as follows: First, obtain the mapping relationship between the device association graph generated during the device association graph construction phase and the corresponding communication parameters. Compare the real-time communication indicator data at the current moment with the latest communication parameters corresponding to the latest device association graph, calculate the difference between the real-time communication indicator data and the latest communication parameters, and use the ratio of this difference to the latest communication parameters to calculate the change rate of each communication data, such as the change rate of traffic volume. If the change rate of each communication data is within the preset change range, the local weights in the initial target subgraph are not updated. The change range here can be set based on empirical data, with the weight change range within 0.1 as the standard. If the change rate of any communication data is outside the allowed change range, then update the communication weight = (current traffic volume data / maximum port bandwidth) × (1 - packet loss rate) × delay attenuation factor, where the delay attenuation factor = 1 / (1 + communication delay data / baseline delay). Update the subgraph edge attributes with the edge weights calculated in the above way to determine the device association subgraph. By updating the weights in a local range, faster state synchronization can be achieved, and the processing pressure caused by full updates can be avoided.

[0046] The propagation probability is calculated hop-by-hop along the descending edge weight direction. Propagation probability = current node outlier value × edge weight × initial outlier confidence. Starting from the outlier device node, the real-time updated weight values ​​of all its directly connected edges are extracted. The connected edges are sorted from high to low weight values ​​to generate a priority propagation queue. The higher the weight, the stronger the communication dependency, and the higher the probability that the fault will propagate along this path. The probability allocation is decayed hop-by-hop. In the first hop propagation, the initial outlier confidence (e.g., 90%) of the outlier device is allocated to directly connected devices according to the edge weight ratio. For example, if the edge weight ratios are 40%, 30%, and 30%, the corresponding devices will receive propagation probabilities of 36%, 27%, and 27%. In the second hop propagation, the above process is repeated for each propagated device, but a hop decay coefficient is applied, which can be set to decay by 30% per hop. If a device receives a 27% probability in the first hop, its probability of propagating to the next hop will decrease to 27% × 70% = 18.9%. Propagation stops when the propagation probability falls below a preset threshold (e.g., 5%) or reaches the maximum hop limit of 3 hops. During the propagation process, the paths of visited nodes are recorded. When the current device is detected to have appeared in the historical path, the propagation in that direction is immediately terminated to avoid redundant probability calculations.

[0047] Based on node embeddings generated by GNN, the probability of non-directly connected devices being affected is predicted. Real-time status metrics of all devices in the device association subgraph are collected, including CPU load, memory error rate, and temperature offset, to construct a multi-dimensional feature vector. A multi-head attention mechanism (typically 4-6 attention heads) is used to calculate the association strength between the current node and all its neighboring nodes. For devices sharing implicit resources (such as power supplies or cooling systems) but without physical connections, the attention coefficient increases significantly. When aggregating neighborhood node features, the feature vectors are weighted and summed according to the attention coefficients to generate an embedding vector containing the device's own state and implicit dependencies. The embedding vector is input into a fully connected neural network, outputting the probability of non-directly connected devices being affected. This probability reflects the risk of fault propagation between devices due to non-physical factors such as shared resources and business logic dependencies. Through the high-order neighborhood information transmission of GNN, devices that are not physically connected but have highly correlated states in the subgraph are identified, such as those connected via edges with a GAT attention coefficient > 0.7; implicit relationships are added to the propagation path, such as adding "Server D is affected by path A→B due to shared storage array". Graph Neural Networks (GNNs) rely on the latest edge weights and node states, such as real-time packet loss rates and overload markers, for accurate prediction. Unupdated subgraphs introduce historical data biases; for example, if the edge weights of overloaded devices in a subgraph are not updated (e.g., weight × 0.3), the GNN may overestimate their propagation impact. Limiting the GNN's processing scope to local subgraphs rather than the global graph reduces computational load, meets real-time requirements, and minimizes processing latency. Graph Neural Networks directly process dynamically updated device-related subgraphs after subgraph updates, achieving high-precision fault propagation prediction through feature aggregation, propagation probability calculation, and implicit relationship mining. Employing a collaborative mechanism of subgraph updates and GNN inference solves the prediction lag and missed reporting problems caused by static graphs and manual rules, achieving a breakthrough improvement in operational efficiency. A fault propagation path list is generated based on the affected probability of directly connected devices and the affected probability of indirect devices. Sorted by probability, the fault propagation path corresponding to the IT device is determined, such as "path A→B→C, probability 82%".

[0048] Through the above technical solution, after acquiring the abnormal indicator data of abnormal IT devices, their real-time communication indicator data can be immediately retrieved. This allows for precise focus on the abnormal devices, combining the abnormal behavior of the devices with real-time communication status, and comprehensively analyzing this data. This provides a more comprehensive and accurate understanding of the abnormal devices' status, offering a more reliable basis for predicting subsequent fault propagation paths. Centered on the abnormal IT devices, a three-hop subgraph is extracted from the device association graph, and weight updates are performed within a local area. This enables faster state synchronization and avoids the processing pressure caused by full updates. Limiting the GNN's processing scope to a local subgraph, rather than the global graph, reduces computational load and meets real-time requirements. When calculating the fault propagation probability, whether determining the impact probability of directly connected devices or predicting the impact probability of non-directly connected devices, it is based on real-time updated edge weights and node state characteristics. The calculation method based on real-time data can promptly reflect the current status of the devices, making the prediction of fault propagation paths more accurate and timely, and improving the effectiveness of early warning. By calculating the fault propagation probability of the device association subgraph, a fault propagation path list is generated and sorted, enabling early prediction of the possible propagation paths of abnormal IT device faults and the devices affected.

[0049] Step S104: Based on the fault propagation path and the equipment business information of multiple affected devices, assess the degree of impact on the affected devices, determine the fault risk indicators corresponding to each affected device, and conduct fault risk warning.

[0050] Based on the fault propagation path and the equipment business information of the multiple affected devices, the impact degree of the affected devices is assessed, and the fault risk index corresponding to each affected device is determined. Specifically, this includes: obtaining the business priority in the equipment business information of each affected device, quantifying the business priority, and determining the corresponding business importance index; and calculating the fault risk index corresponding to each affected device by using the probability data corresponding to each affected device in the fault propagation path, the business importance index, and the anomaly confidence level corresponding to the abnormal IT device.

[0051] In one embodiment of this specification, the business priority corresponding to each affected device is quantified. The quantification of device business priority is based on the criticality of the business it carries, and classification is achieved through a predefined business level system. Core production systems, real-time transaction platforms, and other businesses that directly affect the core revenue of the enterprise are classified as the highest priority and assigned a base value of 1.0; secondary critical auxiliary businesses such as disaster recovery backup systems and internal collaboration platforms are assigned a base value of 0.6-0.8; and non-production businesses such as development and testing environments are assigned a base value of 0.3. To achieve dynamic adaptability, when a single device carries multiple businesses, a priority stacking mechanism is adopted. If a device supports both core transaction and database services, a gain coefficient of 0.1 is added to its highest priority base value, resulting in a final calibration value of 1.1. Business priority data is obtained in real time from the CMDB system. When the business architecture is upgraded or the service scope is expanded, the calibration value is automatically updated through the configuration management interface to ensure that the evaluation model is closely synchronized with the actual business.

[0052] The device impact probabilities generated by fault propagation path prediction are divided into two categories: physical propagation and implicit propagation. Physical propagation probability is calculated by analyzing explicit correlations such as communication weights and topology connection strength between devices. For example, the probability that a core switch will propagate a fault to the next hop device due to port traffic overload is 65%. Implicit propagation probability relies on the aggregation of state characteristics of non-directly connected devices using a graph attention network. For example, the implicit impact probability of a server in a shared storage array due to I / O resource contention is 25%. For the same device, its physical propagation probability and implicit propagation probability are automatically compared, and the higher value is selected as the final propagation probability input. For example, if device A has a physical propagation probability of 0.4 and an implicit propagation probability of 0.35, then 0.4 is ultimately used as the basis for subsequent calculations.

[0053] Anomaly confidence level characterizes the reliability of anomaly detection for the initial faulty device and can be obtained from the confidence level output data of the device health baseline model. During fault propagation, the confidence level decreases hop-by-hop along the physical path, with the attenuation coefficient preset according to the device type: 15% attenuation per hop for network devices and 20% attenuation per hop for storage devices. For example, a core server with an initial anomaly confidence level of 0.9 will have a receive confidence level of 0.9 × 0.85 = 0.765 at its first directly connected switch, and the confidence level at the second-hop storage device will further decrease to 0.765 × 0.8 = 0.612. For non-directly connected devices with implicit propagation, the confidence level is not attenuated by hop count and directly inherits the initial anomaly confidence level value to reflect the global impact characteristics of implicit dependencies.

[0054] The fault risk indicator is generated by fusing three core factors: propagation probability, business priority, and anomaly confidence level. During calculation, propagation probability is used as the base coefficient, business priority as the weighting amplifier, and anomaly confidence level as the reliability correction factor; these three are multiplied to synthesize the final indicator. For example, database device A carrying core business (priority 1.1) has a propagation probability of 0.6 and a received anomaly confidence level of 0.7. Therefore, the fault risk indicator = 0.6 × 1.1 × 0.7 = 0.462. This value falls within the preset medium-risk range (0.3-0.6), triggering an automatic recommendation to expand storage resources. To improve the interpretability of the indicator, a dynamic scaling mechanism can be built in. When the business priority exceeds 1.0, the maximum value of the risk indicator is automatically limited to no more than 1.0, avoiding numerical distortion in extreme scenarios. It should be noted that different risk levels are preset for different fault risk indicators. At a high risk level, the fault risk indicator is ≥0.6, requiring immediate isolation and activation of the emergency plan. For example, at a medium risk level of core database overload, the fault risk indicator is not less than 0.3 and not greater than 0.6, requiring resource expansion and enhanced monitoring, such as addressing backup storage IO bottlenecks. At a low risk level, the fault risk indicator is less than 0.3; in this case, logs are recorded and subsequent status is observed, such as a transient increase in CPU usage on the test server. Devices are sorted in descending order of risk indicator value, with high-risk devices prioritized. For devices with the same risk value, they are further sorted according to business importance.

[0055] The accuracy of risk assessment is continuously validated through a historical failure case database, and the calculation logic is optimized using a difference backtracking mechanism. When the actual impact range of a certain type of equipment failure deviates from the predicted risk indicator by more than 20%, a calibration process is automatically triggered: first, it analyzes whether the business priority labeling is outdated; second, it checks whether the propagation probability model has missed key correlations; and finally, it verifies whether the anomaly confidence decay coefficient is suitable for the equipment type. For example, if the historical failure propagation speed of storage devices is higher than the model prediction value, its decay coefficient is reduced from 20% to 15%, and the implicit correlation detection module of the graph attention network is retrained. Quarterly full model retraining further ensures assessment accuracy, and by injecting new failure case data, the risk prediction accuracy is maintained above 92%.

[0056] At the engineering implementation level, a layered data processing pipeline is constructed. Business priority data is synchronized in real time from the CMDB system to the in-memory database via a message queue. Propagation probabilities are asynchronously generated by the graph computing engine and written to a high-speed cache. Anomaly confidence is dynamically updated through a streaming computing framework. The risk assessment module is deployed as a microservice. After receiving input from the above data sources, it completes the calculation of risk indicators for thousands of devices within 200ms. The calculation results are pushed to the operation and maintenance monitoring dashboard, visually displaying the device risk level through a heatmap and supporting drill-down to view detailed factor decomposition. To cope with sudden traffic surges, an elastic resource scheduling strategy is adopted, automatically expanding computing nodes during peak periods to ensure that 99.9% of requests are responded to within 1 second.

[0057] This system calculates fault risk indicators by integrating probability data of devices affected in the fault propagation path, business importance indicators, and anomaly confidence levels of abnormal IT devices. In complex IT operations environments, probability data reflects the likelihood of a fault propagating to affected devices, business importance indicators reflect the criticality of the device's business, and anomaly confidence levels indicate the credibility of an abnormal IT device experiencing a fault. By integrating these three dimensions, the system can more comprehensively and accurately assess the extent to which each affected device is impacted by a fault. The calculated fault risk indicators provide clear quantitative basis for fault risk warnings, allowing for rapid identification of which affected devices face higher fault risks and which face relatively lower risks. This helps operations personnel take timely measures to reduce the likelihood and scope of fault occurrence. Based on the level of the fault risk indicators, operations personnel can rationally allocate operations resources. Targeted resource allocation can reduce operations costs while ensuring the stable operation of IT systems. Closely linked to data acquisition, status monitoring, and fault propagation path prediction, it forms a complete closed-loop management system. From collecting equipment data to detecting anomalies, predicting fault propagation paths, and finally assessing the risk of failure affecting the equipment and issuing early warnings, each link collaborates and supports each other, ensuring the efficiency and accuracy of the entire operation and maintenance process.

[0058] The technical solutions described in this specification utilize pre-deployed distributed probes to collect device operating parameters, device environmental parameters, and device log characteristics, constructing a multi-dimensional real-time sensing dataset. This multi-dimensional data collection method captures device status information from different aspects, providing a more accurate and comprehensive understanding of IT device operation, avoiding the limitations of traditional single-dimensional monitoring data. First, the current device attribute information is obtained, then a dynamic confidence interval is determined by combining it with a pre-built device health baseline model. This dynamic confidence interval changes with device usage and environmental variations. When the device's real-time data exceeds this dynamic confidence interval, abnormal device operation can be detected promptly, achieving dynamic and accurate monitoring of device status. This approach considers dynamic factors during device use, avoiding frequent false alarms and delayed warnings inherent in traditional static threshold alarm mechanisms. The system aims to improve the accuracy and timeliness of early warnings. Upon detecting abnormal IT equipment operation, it predicts fault propagation paths based on a pre-built device association graph. This graph integrates physical topology data and real-time communication data, comprehensively reflecting the physical connections and logical dependencies between devices. Centered on the abnormal device, the analysis and calculation of the association graph determine the possible propagation paths of the fault and the multiple affected devices. When a fault occurs, it predicts the possible propagation paths and affected devices in advance, preventing the fault from spreading into a systemic risk and reducing unnecessary resource consumption. Based on the fault propagation path and the business information of the affected devices, it assesses the degree of impact on the affected devices, providing clear fault risk indicators for maintenance personnel, facilitating the rational allocation of maintenance resources, and improving maintenance efficiency.

[0059] This specification also provides an intelligent operation and maintenance early warning device for IT equipment, such as... Figure 2 As shown, the device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described method.

[0060] This specification also provides a non-volatile computer storage medium storing computer-executable instructions configured to perform the above-described method.

[0061] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0062] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0063] The devices, media, and methods provided in the embodiments of this specification are one-to-one correspondences. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0064] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0065] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0066] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0067] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0068] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0069] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0070] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0071] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0072] The above description is merely one or more embodiments of this specification and is not intended to limit this specification. Various modifications and variations can be made to the one or more embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of one or more embodiments of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for intelligent operation and maintenance early warning of IT equipment, characterized in that, The method includes: By pre-deploying distributed probes, multi-dimensional sensing data corresponding to IT devices are collected to construct a multi-dimensional real-time sensing dataset corresponding to IT devices. The multi-dimensional real-time sensing dataset includes device operating parameters and device environmental parameters. Obtain the current device attribute information of the IT device, and determine the dynamic confidence interval corresponding to the IT device based on the current device attribute information and the pre-built device health baseline model, so as to perform status monitoring on the IT device based on the dynamic confidence interval and the multi-dimensional real-time perception dataset; When an abnormal operation of an IT device is detected, the propagation path corresponding to the IT device is predicted based on a pre-built device association map to determine the fault propagation path corresponding to the IT device. The fault propagation path includes multiple affected devices. Based on the fault propagation path and the equipment service information of the multiple affected devices, the degree of impact on the affected devices is assessed, and the fault risk index corresponding to each affected device is determined for fault risk early warning.

2. The intelligent operation and maintenance early warning method for IT equipment according to claim 1, characterized in that, Based on the current device attribute information and the pre-built device health baseline model, the dynamic confidence interval corresponding to the IT device is determined, specifically including: Historical operating data, device metadata, and load fluctuation data of multiple existing IT devices are obtained from the database to construct a historical dataset of existing IT devices. Based on the historical dataset of existing IT devices, the LSTM-GRU hybrid network is trained to determine a general health baseline model. Determine whether the IT device belongs to the existing IT device historical dataset. If not, based on the general health baseline model, fine-tune the fully connected layer parameters using the device historical dataset corresponding to the IT device to determine the device health baseline model corresponding to the IT device. Obtain multidimensional aging impact data from the current device attribute information, wherein the aging impact data includes time dimension data, maintenance dimension data, and environmental dimension data; The aging status of the IT equipment is assessed using the multidimensional aging impact data to determine the equipment aging index corresponding to the IT equipment. Based on the equipment aging index and the multidimensional aging impact data, the output data of the equipment health baseline model is dynamically adjusted to determine the dynamic confidence interval corresponding to the IT equipment. The output data includes the baseline value, variance range, and confidence level.

3. The intelligent operation and maintenance early warning method for IT equipment according to claim 2, characterized in that, The aging status of the IT equipment is assessed using the multidimensional aging impact data to determine the corresponding equipment aging index, specifically including: Obtain the equipment service life from the time dimension data, the number of repairs from the maintenance dimension data, and the environmental parameter deviation data from the environmental dimension data; The equipment aging index corresponding to the IT equipment is determined by weighting and normalizing the data on the equipment's service life, the number of maintenance operations, and the deviation of environmental parameters.

4. The intelligent operation and maintenance early warning method for IT equipment according to claim 2, characterized in that, Based on the equipment aging index and the multidimensional aging impact data, the output data of the equipment health baseline model is dynamically adjusted to determine the dynamic confidence interval corresponding to the IT equipment, specifically including: Based on the service life of the equipment in the time dimension data, linear regression analysis is performed on the trend items in the historical data set of the IT equipment to determine the performance degradation slope of the IT equipment. Based on the performance degradation slope, the baseline value in the output data is linearly compensated to determine the compensation baseline value, and the variance range in the output data is expanded by the equipment aging index to determine the compensation variance range corresponding to the IT equipment. Based on the compensation baseline value and the compensation variance range, the dynamic confidence interval corresponding to the IT device is determined according to a normal distribution.

5. The intelligent operation and maintenance early warning method for IT equipment according to claim 1, characterized in that, Based on a pre-built device association graph, the propagation path corresponding to the IT device is predicted. Before determining the fault propagation path corresponding to the IT device, the method further includes: The device physical topology data is acquired, and real-time device communication data is acquired periodically. The device physical topology data includes device hierarchy, power links and VLAN configurations, and the real-time device communication data includes TCP / UDP connection frequency, traffic volume data and communication latency data. Based on the physical topology data of the devices, a corresponding device space graph is constructed with devices as nodes and physical connections as edges; The communication weights are calculated in real time using the real-time device communication data, and the edge weights of the edges are dynamically updated based on these communication weights to determine the corresponding device association graph.

6. The intelligent operation and maintenance early warning method for IT equipment according to claim 1, characterized in that, Based on a pre-built device association graph, the propagation path corresponding to the IT device is predicted to determine the fault propagation path corresponding to the IT device, specifically including: Obtain abnormal indicator data of abnormal IT devices, and when triggered by the abnormal indicator data, pull the real-time communication indicator data of the abnormal IT devices. Centered on the abnormal IT device, a three-hop subgraph is extracted from the device association graph to determine the initial target subgraph. The local weights in the initial target subgraph are updated using the real-time communication index data to determine the edge attributes of the updated subgraph, thereby determining the device association subgraph. The probability of fault propagation is calculated for the device association subgraph to determine the fault propagation path corresponding to the IT device.

7. The intelligent operation and maintenance early warning method for IT equipment according to claim 6, characterized in that, The fault propagation probability is calculated for the device association subgraph to determine the fault propagation path corresponding to the IT device, specifically including: Obtain multiple update edge weights in the device association subgraph. Starting from the abnormal IT device, calculate the propagation probability hop by hop along the descending direction of the edge weights based on the multiple update edge weights to determine the probability of the directly connected device being affected. By using a graph attention network, the node state features of neighboring nodes in the device association subgraph are aggregated to generate node embeddings, and the probability of non-directly connected devices being affected is predicted based on the node embeddings. A list of fault propagation paths is generated based on the affected probability of the directly connected devices and the affected probability of the non-directly connected devices. The fault propagation paths corresponding to the IT devices are then determined by sorting them according to their probabilities.

8. The intelligent operation and maintenance early warning method for IT equipment according to claim 7, characterized in that, Based on the fault propagation path and the equipment service information of the multiple affected devices, the impact degree of the affected devices is assessed, and a fault risk index corresponding to each affected device is determined, specifically including: Obtain the service priority from the equipment service information of each of the affected devices, quantify the service priority, and determine the corresponding service importance index; By using the probability data corresponding to each affected device in the fault propagation path, the business importance index, and the anomaly confidence level corresponding to the abnormal IT device, the fault risk index corresponding to each affected device is calculated.

9. An intelligent operation and maintenance early warning device for IT equipment, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-8.

10. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions are configured to perform the method as described in any one of claims 1-8.

Images