An automated operation and maintenance method and system suitable for a closed system

Abstract

The application provides an automated operation method and system suitable for a closed system. It aims to solve the technical problem that traditional operation schemes are difficult to apply due to network isolation and sample scarcity in closed environments such as finance and energy. The method includes: generating a unique and traceable migration identifier for all operation data, models and inference results through a data and migration governance module; quantitatively calculating the transferability score between the source domain and the target domain through a transferability evaluation module; dynamically selecting the optimal model migration strategy according to the transferability score to achieve efficient self-adaptation of the model; through a multi-agent collaboration system containing detection, diagnosis and repair agents, a closed-loop operation is performed, and the system is self-learning and self-optimizing through small sample active learning and knowledge base evolution mechanism. The application realizes the rapid construction, continuous evolution and whole-process traceability of artificial intelligence operation capability in a closed system, and has significant innovation and industrial application value.

Description

Technical Field

[0001] This invention belongs to the field of Artificial Intelligence Operations and Maintenance (AIOps), and particularly relates to an automated operation and maintenance method and system suitable for closed systems. Background Technology

[0002] Currently, in actual enterprise operations and maintenance, AIOps systems often rely on external datasets, cloud-based model updates, and cross-domain knowledge sharing for continuous optimization. However, in closed or semi-closed systems such as those in finance, telecommunications, energy dispatching, and military industries, the operational environment has the following characteristics:

[0003] 1. Data scarcity: The system cannot access open networks, resulting in very few abnormal event samples, making it difficult to train traditional deep learning models;

[0004] 2. Severe data silos: Departments or subsystems do not share logs and monitoring information with each other, and there is a lack of a unified knowledge aggregation mechanism;

[0005] 3. Strong security and compliance constraints: Data and model migration must be traceable, verifiable, and rollbackable; any external access must comply with security audit requirements.

[0006] 4. Lagging model updates: In a closed environment, it is impossible to obtain external algorithm upgrades in real time, and the model does not update for a long time, resulting in a decrease in accuracy;

[0007] 5. The problem of knowledge decay is prominent: Failure modes, system configurations and operating experience are difficult to effectively accumulate and reuse.

[0008] Therefore, traditional AIOps frameworks cannot be directly applied in such environments. In particular, existing technical solutions have fundamental limitations when applied to closed or semi-closed systems with network isolation and data scarcity, such as those in finance, telecommunications, energy dispatching, and military industries. These limitations are as follows:

[0009] 1. The rule base cannot be effectively updated within the isolation network;

[0010] 2. Machine learning models cannot be effectively trained due to a lack of large-scale, high-quality labeled samples, resulting in a serious "cold start" problem;

[0011] 3. Large cloud-based models cannot be directly deployed or accessed.

[0012] Essentially, existing technologies lack a mechanism to securely introduce, efficiently absorb, and continuously iterate knowledge within strict security boundaries. Therefore, a novel AIOps architecture is urgently needed, which must inherently possess the ability to self-learn, adapt, and evolve in small-sample, isolated environments. Summary of the Invention

[0013] To address the aforementioned technical problems, this invention proposes a technical solution for an automated operation and maintenance method suitable for closed systems, in order to solve these problems, particularly the issue of existing AIOps technology being unsuitable for closed environments.

[0014] The first aspect of this invention discloses an automated operation and maintenance method suitable for closed systems; the method includes:

[0015] Data and migration governance steps: Upon receiving operation and maintenance data, generate a migration identifier containing a unique identifier MID and metadata for the operation and maintenance data or the model and inference results generated based on the operation and maintenance data, so as to realize the full lifecycle traceability and governance of the operation and maintenance data, model and inference results;

[0016] The transferability evaluation steps are as follows: Based on the source model trained on the source domain and the target data in the target domain, calculate the transferability score Tscore, which quantifies the fit between the source domain and the target domain.

[0017] Model transfer and adaptation steps: Based on the transferability score, dynamically determine the model transfer strategy and transfer the source model to the target domain to obtain the target model; and

[0018] Closed-loop operation and maintenance execution steps: Using the target model, perform operation and maintenance tasks including anomaly detection, root cause diagnosis and automated repair in the closed system, and update the newly generated knowledge in the operation and maintenance tasks to achieve adaptive evolution.

[0019] Preferably, the metadata of the migration identifier includes at least one of the following:

[0020] Entity type information, source information, version information, migration strategy information, risk level information, or governance audit information.

[0021] Preferably, the version information includes the parent migration identifier number and a Boolean identifier indicating whether it is a rollback point, so as to realize the tracing of the version chain and one-click rollback.

[0022] Preferably, the transferability score Tscore is calculated as follows:

[0023]

[0024] Where Sim(S,T) is the task similarity between the source domain S and the target domain T, Stab(S,T) is the prediction stability of the source model on the target domain data, and α and β are the weight coefficients of preset or adaptive learning.

[0025] Preferably, the calculation steps for the task similarity Sim(S,T) include:

[0026] Extract the operation and maintenance logs of the source domain and the target domain respectively, and generate their respective log template sets;

[0027] The log template set is converted into its respective domain feature vectors using feature engineering methods;

[0028] Calculate the vector distance or similarity between the two domain feature vectors, and use it as the task similarity.

[0029] Preferably, the calculation steps for the predicted stability Stab(S,T) include:

[0030] Test samples are obtained by sampling data from the target domain.

[0031] The test samples are augmented to generate a set of perturbation samples;

[0032] The source model is used to predict the test samples and the perturbation samples respectively;

[0033] The prediction stability score is calculated based on the degree of consistency of the prediction results.

[0034] Preferably, the model transfer strategy includes based on transferability.

[0035] The model adaptively selects the proportion of frozen layers, fine-tuning methods, or lightweight adapter parameters within a given numerical range.

[0036] Preferably, the closed-loop operation and maintenance execution steps further include a small-sample active learning process:

[0037] Use the target model to infer the target domain data and calculate the confidence level of the prediction results;

[0038] When the confidence level is lower than a preset threshold, the corresponding sample is submitted to the manual annotation pool;

[0039] The target model is incrementally fine-tuned using high-value samples that have been manually labeled.

[0040] Preferably, the closed-loop operation and maintenance execution steps further include the step of building and evolving a knowledge base:

[0041] Alarms, root cause analysis results, and remediation solutions generated during operation and maintenance tasks are stored in a structured form in a knowledge base and associated with the corresponding migration identifiers;

[0042] Periodically or based on preset rules, knowledge in the knowledge base is eliminated or downgraded.

[0043] When performing root cause diagnosis, the Retrieval Enhancement Generation (RAG) mechanism is used to retrieve relevant historical knowledge from the knowledge base and dynamically generate optimized prompts to guide model reasoning.

[0044] A second aspect of this invention discloses an automated operation and maintenance system suitable for closed systems; the system employs the method described in any one of the first aspects, and the system includes:

[0045] The data and migration governance module is used to generate migration identifiers containing unique identifiers (MID) and metadata for operational data, models, and inference results.

[0046] The portability assessment module is used to calculate the portability score Tscore between the source domain and the target domain;

[0047] The model transfer and adaptation module is used to dynamically determine the model transfer strategy and execute the model transfer based on the transferability score.

[0048] A multi-agent collaborative system is used to execute closed-loop operation and maintenance tasks using a transferred target model. The multi-agent collaborative system includes:

[0049] A detection agent is used to perform anomaly detection;

[0050] A diagnostic agent is used to perform root cause diagnosis;

[0051] Repair agent, used to perform automated repairs.

[0052] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of an automated operation and maintenance method for a closed system according to any one of the first aspects of this disclosure.

[0053] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an automated operation and maintenance method for a closed system according to any one of the first aspects of this disclosure.

[0054] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0055] 1. Achieved full lifecycle compliance and traceability: The unique Migration Identifier (MID) governance system acts like a "digital ID card" for data and models, ensuring that every introduction of knowledge, model iteration, and inference execution is traceable and verifiable, and supports one-click rollback. This fundamentally solves the rigid requirements of closed systems for security auditing and risk control.

[0056] 2. It realizes the scientific and automated nature of migration decisions: Through the quantitative transferability score (Tscore), the question of "whether the model is applicable" that previously relied on expert experience is transformed into a calculable and measurable scientific decision-making process, which automatically controls the migration depth and avoids performance degradation or resource waste caused by blind migration, thus realizing the intelligentization of the migration process.

[0057] 3. Solved the challenge of cold start with small samples: By integrating few-sample learning, active learning, and lightweight fine-tuning techniques, a data-driven self-optimizing closed loop was constructed. This enables the system to start quickly with only a small number of labeled samples, and through the cycle of "model discovering doubts -> expert confirmation -> model learning," it continuously learns knowledge from new events, achieving adaptive evolution that "gets smarter with use."

[0058] 4. An endogenous knowledge evolution ecosystem has been built: Through a graph-structured knowledge base and a dynamic prompt optimization mechanism, isolated operation and maintenance events are transformed into reusable structured knowledge. The automatic elimination of knowledge and the generation of optimization prompts enable the system's "experience" to keep pace with the times, avoiding knowledge solidification and decay, and ensuring the effectiveness of long-term operation and maintenance. Attached Figure Description

[0059] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0060] Figure 1 This is a flowchart illustrating an automated operation and maintenance method for a closed system according to an embodiment of the present invention;

[0061] Figure 2 This is a schematic diagram of a closed-loop process in an automated operation and maintenance method for a closed system according to an embodiment of the present invention;

[0062] Figure 3 This is a structural diagram of an automated operation and maintenance system suitable for closed systems according to an embodiment of the present invention;

[0063] Figure 4 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] The first aspect of this invention discloses an automated operation and maintenance method suitable for closed systems.

[0066] Example 1:

[0067] Figure 1 This is a flowchart of an automated operation and maintenance method for a closed system according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes:

[0068] Step S1: Data and Migration Governance Steps:

[0069] Upon receiving operation and maintenance data, a migration identifier containing a unique identifier (MID) and metadata is generated for the operation and maintenance data or the model and inference results generated based on the operation and maintenance data, so as to realize the full lifecycle traceability and governance of the operation and maintenance data, model and inference results;

[0070] The metadata of the migration identifier includes at least one of the following:

[0071] Entity type information, source information, version information, migration strategy information, risk level information, or governance audit information.

[0072] The version information includes the parent migration identifier number and a boolean identifier indicating whether it is a rollback point, so as to realize the tracing of the version chain and one-click rollback.

[0073] In some specific embodiments, the system collects indicator data internally, verifies data legitimacy through a security audit component, and automatically generates migration identifiers for each data stream, model file, and inference result. These identifiers contain metadata such as source, version, adaptation strategy, risk level, and rollback point, enabling full-process traceability and rollback capability. A migration identifier is a programmable metadata structure used to manage the lifecycle of data and models. An example is shown below, and related explanations are detailed in Table 1:

[0074] {

[0075] "identifier_id":"mid_2025-11-03_00012345",

[0076] "entity_type":"model|dataset|inference",

[0077] "source":{"origin":"internal","provider":"Bank-AI-Lab","license":"CC-BY-NC"},

[0078] "versioning":{"semver":"1.3.2","parent_id":"mid_2025-10-01_00001","rollback_point":true},

[0079] "transfer":{

[0080] "strategy":"adapter",

[0081] "frozen_layers":8,

[0082] "tscore":{"similarity":0.78,"stability":0.85,"alpha":0.6,"beta":0.4,"value":0.81}

[0083] },

[0084] "risk_level":"medium",

[0085] "governance":{"owner":"AIOps-Team","created_at":"2025-11-0306:00:00"},

[0086] "content":"Automated operation and maintenance applicable to closed systems YYYYYYYYZZZ"

[0087] }

[0088] Table 1

[0089]

[0090] a. Generation mechanism:

[0091] The identifier is automatically created by the identifier generation service in the operation and maintenance sample registration center.

[0092] Each externally imported operation and maintenance sample or inference result is bound to a unique MID.

[0093] b. Storage mechanism:

[0094] MIDs are stored as metadata in the governance database for use in audit reports or knowledge backtracking.

[0095] c. Circulation mechanism:

[0096] When the diagnostic agent performs reasoning, the system reads the associated MID;

[0097] The reasoning result generates a new sub-identifier MID, which inherits and references the parent information to achieve full-chain traceability;

[0098] The audit module can trace back to any historical state by MID, enabling verification and rollback.

[0099] Step S2: Transferability assessment step:

[0100] Based on the source model trained on the source domain and the target data in the target domain, the transferability score Tscore, which quantifies the fit between the source domain and the target domain, is calculated.

[0101] The transferability score Tscore is calculated as follows:

[0102]

[0103] Where Sim(S,T) represents the task similarity between the source domain S and the target domain T, Stab(S,T) represents the prediction stability of the source model on the target domain data, and α and β are pre-set or adaptively learned weight coefficients. .

[0104] The steps for calculating the task similarity Sim(S,T) include:

[0105] Extract the operation and maintenance logs of the source domain and the target domain respectively, and generate their respective log template sets;

[0106] The log template set is converted into its respective domain feature vectors using feature engineering methods;

[0107] Calculate the vector distance or similarity between the two domain feature vectors, and use it as the task similarity.

[0108] Specifically, the log template sets P(S) and P(T) of the source and target domains are extracted, and the calculation is performed. S and T For the corresponding feature vector V s、 V t, and the corresponding cosine similarity:

[0109]

[0110] In some specific implementations, all log templates from the source and target domains are first merged to construct a global bag-of-words (BOB) model or TF-IDF dictionary. Then, the log template sets P(S) and P(T) for each domain are represented as long vectors, where each dimension corresponds to a word (or token) in the dictionary, and its value can be the frequency of that word in the template set or its TF-IDF value. This yields feature vectors Vs and Vt. Alternatively, more preferably, a pre-trained language model (such as BERT) is used to encode each log template, obtaining an embedding vector for each template. Then, the embedding vectors of all templates within a domain are averaged to obtain vectors Vs and Vt representing the overall features of that domain.

[0111] Furthermore, the calculation steps for the predicted stability Stab(S,T) include:

[0112] Test samples are obtained by sampling data from the target domain.

[0113] The test samples are augmented to generate a set of perturbation samples;

[0114] The source model is used to predict the test samples and the perturbation samples respectively;

[0115] Based on the consistency of the prediction results, the prediction stability score is calculated as follows:

[0116] Stability Stab(S,T)

[0117] On a small sample size in the target domain T, prediction consistency is tested using a set of minor perturbations (such as random occlusion, noise, or template equivalent replacement). The stronger the invariance of the prediction after the perturbation, the higher the stability. Equivalence specifically refers to the prediction results being close to or consistent with the operational and maintenance recommendations in the source domain. If the model's prediction results on T are highly consistent before and after the migration, the migration process is stable; the greater the difference, the lower the stability, indicating that the adaptation process changes the estimation of the operational and maintenance strategies required for system events.

[0118]

[0119] To calculate the stability score, a small sample set D is first randomly drawn from the target domain T. sample For D sample Each sample x in i Generate K perturbed samples {x' i1 ,x' i2 ,...,x' iK Using a model M pre-trained on the source domain S. S Make predictions for both the original samples and the perturbed samples.

[0120] The stability score Stab(S,T) is defined as follows:

[0121] Where I(.) is an indicator function, taking the value 1 when the condition within the parentheses is true, and 0 otherwise. This formula calculates the average proportion of model predictions that remain consistent with the original predictions under all perturbations.

[0122] Weighting coefficients α and β

[0123] In some specific embodiments, the initial values ​​can be set to empirical values ​​α=0.6 and β=0.4;

[0124] Then, based on the historical transfer effect, constrained least squares regression is used to automatically learn the optimal weights:

[0125]

[0126] Step S3: Model Transfer and Adaptation Steps

[0127] Based on the transferability score, a model transfer strategy is dynamically determined, and the source model is transferred to the target domain to obtain the target model.

[0128] The model transfer strategy includes adaptively selecting the proportion of the frozen layer, fine-tuning method, or lightweight adapter parameters of the model based on the numerical range of the transferability score.

[0129] In some specific implementations, the migration strategy is automatically selected based on Tscore, as shown in Table 2 below:

[0130] Table 2

[0131]

[0132] Step S4 Closed-Loop Maintenance Execution Steps:

[0133] Using the target model, operational tasks including anomaly detection, root cause diagnosis, and automated repair are executed in the closed system, and newly generated knowledge from the operational tasks is updated to achieve adaptive evolution.

[0134] The closed-loop operation and maintenance execution steps further include a small-sample active learning process:

[0135] Use the target model to infer the target domain data and calculate the confidence level of the prediction results;

[0136] When the confidence level is lower than a preset threshold, the corresponding sample is submitted to the manual annotation pool;

[0137] The target model is incrementally fine-tuned using high-value samples that have been manually labeled.

[0138] The few-sample active learning process involves constructing a high-dimensional embedding space to enhance inter-class separability; using log template perturbation and temporal jitter for data augmentation; employing low-rank adaptation, cue-based fine-tuning, and lightweight adapters to achieve rapid model updates; and triggering manual annotation for low-confidence samples to close the loop.

[0139] The closed-loop operation and maintenance execution steps further include the steps of building and evolving a knowledge base:

[0140] Alarms, root cause analysis results, and remediation solutions generated during operation and maintenance tasks are stored in a structured form in a knowledge base and associated with the corresponding migration identifiers;

[0141] Periodically or based on preset rules, knowledge in the knowledge base is eliminated or downgraded.

[0142] During root cause diagnosis, the Retrieval Enhancement Generation (RAG) mechanism retrieves relevant historical knowledge from the knowledge base and dynamically generates optimized prompts to guide model reasoning.

[0143] In some specific embodiments, the closed-loop process is as follows: Figure 2 As shown, the details are as follows:

[0144] During model inference, the confidence level is calculated. When the output confidence level c < τ (e.g., 0.6), the sample is marked as low confidence and added to the "labeling pool".

[0145] Operations experts confirm root cause labels in the manual labeling interface;

[0146] The labeled samples are then added to the "high-value training set";

[0147] When the number of high-value training set samples reaches a threshold N (e.g., 100), the system automatically triggers incremental fine-tuning:

[0148] Only update the LoRA or Prompt-Tuning layer;

[0149] Control the number of training rounds to 1-3.

[0150] After fine-tuning, a gray-scale verification is performed. If performance is improved, a new MID is registered, forming a new version chain.

[0151] By integrating external knowledge and internal events, a retrieval index based on graph and template structures is established to support causal tracing; outdated knowledge is periodically eliminated, and the prompt template is dynamically optimized by combining the retrieval enhancement generation mechanism and migration identification information.

[0152] In some specific implementations, the knowledge obsolescence rules are as follows:

[0153] A certain repair solution has not been used within one year and is marked as "expired";

[0154] If the success rate of the proposed solution is less than 50% and the number of samples is greater than or equal to 20, it will be automatically downgraded.

[0155] If a higher success rate alternative (≥95%) exists, the old option becomes an "alternative".

[0156] The optimization mechanism is as follows:

[0157] When the diagnostic agent receives a new alarm, the system retrieves historical similar alarms (similarity ≥ 0.8).

[0158] Obtain historical root causes and repair records (including success rate and MID information);

[0159] The following is a template for constructing optimization suggestions:

[0160] Perform root cause analysis on the alerts: {alert_details}. Historically, similar alerts have often been caused by memory leaks in service B, which can be resolved by restarting the service (95% success rate). Please verify if this is the case before performing any remedial actions.

[0161] A multi-agent collaborative system is used to execute closed-loop operation and maintenance tasks using a transferred target model. The system comprises three types of agents: detection, diagnosis, and repair. The detection agent performs anomaly detection; the diagnosis agent performs root cause analysis using a knowledge base and dependency topology; and the repair agent generates repair scripts and records operation fingerprints. These three agents work together to form a closed-loop operation and maintenance system.

[0162] Example 2:

[0163] The automated operation and maintenance process in this embodiment, which involves the secure migration and adaptive evolution from a public network general model to a bank's internal dedicated model, includes the following steps:

[0164] Step S100: Compliant introduction of external knowledge and creation of migration identifier (MID) (corresponding to point A)

[0165] The goal of this step is to securely introduce an externally trained general log anomaly detection model (source model Ms) and its training dataset (source data Ds) into the bank's closed system and establish a traceable "digital identity" for it.

[0166] Data Transfer and Security Audit: Operations personnel transfer generic log anomaly detection model files (e.g., a BERT-based pre-trained model stored in .pt or .h5 format) and partially anonymized training log samples (source data Ds) obtained from an external public cloud AIOps platform via encrypted storage media through the bank's internal secure access gateway. The security audit component automatically performs static virus scans on the model files and checks the data samples for sensitive information to ensure there are no security risks.

[0167] Migration Identifier Generation: Upon receiving the compliant source model Ms and source data Ds, the identifier generation service of the Data and Migration Governance module automatically creates an initial root migration identifier MID_A. This identifier is a structured JSON object;

[0168] This MID_A is stored in the governance database as the "ancestor" node for all subsequent derived models and knowledge, thus achieving traceability of the source.

[0169] Step S200: Portability assessment and determination of adaptive migration strategy (A→B)

[0170] The goal of this step is to scientifically evaluate the compatibility between the source model Ms and the bank's core transaction system (target domain T) and automatically select the optimal migration strategy.

[0171] Target domain data acquisition: The acquisition component within the device continuously collects the operational logs of the core trading system for the past 7 days, which are used as target data Dt.

[0172] Calculate the task similarity Sim(S,T):

[0173] Log template extraction: The source data Ds and the target data Dt are processed using a log parsing algorithm (such as the Drain algorithm) to extract their respective log template sets P(S) and P(T). For example, P(S) may contain "Userloginfailedfrom{IP}", while P(T) may contain "Transaction{TXN_ID}timeoutforaccount{ACC_NUM}".

[0174] Feature vectorization: This embodiment uses a pre-trained BERT model as the text encoder. All templates in P(S) and P(T) are input into BERT respectively to obtain the [CLS] embedding vector for each template. Then, average pooling is performed on the embedding vectors of all templates in P(S) to obtain the feature vector Vs representing the source domain; similarly, the feature vector Vt representing the target domain is obtained.

[0175] Similarity calculation: Calculate the cosine similarity between Vs and Vt. Sim(S,T)=cosine_similarity(Vs,Vt). The calculated Sim(S,T)=0.76. This indicates that although the business logic is different, there is a high degree of similarity in the log's syntactic structure and commonly used vocabulary.

[0176] Calculate the predicted stability Stab(S,T):

[0177] Perturbation sample generation: Randomly select 1000 log entries from the target data Dt as the test set. For each log entry, generate K=5 perturbation samples by template equivalent substitution (e.g., replacing "timeout" with "timedout") and random masking (masking IP addresses or transaction IDs).

[0178] Consistency check: Use the untuned source model Ms to predict anomalies in the original 1000 logs and their 5000 perturbation samples (output is "normal" or "abnormal").

[0179] Stability calculation: Based on the aforementioned formula, the proportion of statistical prediction results that remain unchanged. The calculated value is Stab(S,T)=0.84. This indicates that the source model has good robustness to small changes in the target domain data.

[0180] Calculate Tscore and determine migration strategy:

[0181] The device reads the weighting coefficients from the configuration, initially set to α=0.6, β=0.4.

[0182] Tscore=0.6*0.76+0.4*0.84=0.456+0.336=0.792.

[0183] The model migration and adaptation module queries the internal migration strategy mapping table. Since Tscore=0.792 falls within the range of [0.5,0.8], the system automatically selects the "mid-level migration" strategy.

[0184] The strategy is specifically defined as follows: Unfreeze the last 50% of the Transformer layers of the source model Ms (e.g., for a 12-layer BERT, unfreeze layers 7-12) and fine-tune them using the LoRA (low-rank adaptation) method, setting the rank of LoRA to 16.

[0185] Generate a new migration identifier MID_B: Before performing the migration operation, the system automatically generates a new migration identifier MID_B to record the migration decision.

[0186] This MID_B is bound to the new model that will be generated soon, and clearly records how it evolved from MID_A.

[0187] Step S300: Gray-scale validation and few-shot active learning (B→C)

[0188] The goal of this step is to validate the new model in a real-world environment and establish a closed loop of continuous learning and optimization.

[0189] Model fine-tuning and canary deployment: The system uses a small number (e.g., 500) of labeled internal bank log samples to perform LoRA fine-tuning on the source model Ms according to the strategy defined in MID_B, generating a new target model Mb. Mb is marked as a canary version and deployed online to handle 1% of the real-time log traffic.

[0190] Low-confidence sample discovery: When performing inference, Mb outputs a softmax confidence score in addition to the "normal / abnormal" prediction. When the confidence score c < 0.6 (preset threshold), the log is judged as a "difficult sample" and is automatically sent to the "annotation pool" of the operations and maintenance experts along with its context information.

[0191] Manual annotation for closed-loop processing: Operations experts see these problematic samples on the web interface, such as a log entry: "[WARN] Core_TXN_Servicehealthcheckprobefailed,statuscode503". The model might be confused because it has never seen healthcheckprobe before. Experts confirm that this is an exception indicating "application health check failure" and assign the correct label.

[0192] Incremental Fine-tuning and Version Iteration: Once 100 high-value samples confirmed by experts have accumulated in the "Annotation Pool," the system automatically triggers an incremental fine-tuning. It uses only these 100 new samples to quickly train the LoRA adapter weights of model Mb for 1-3 epochs, generating a model Mc with better performance.

[0193] Generation of the transfer identifier MID_C: The generation of the new model Mc is considered a successful iteration. The system generates a new transfer identifier MID_C for it, with its parent_id pointing to MID_B. semver is updated to 1.1.0, and this is recorded as a fine-tuning based on active learning. After A / B testing verifies that Mc's F1 score is 5% higher than Mb's, the rollback_point of MID_C is marked as true, and Mc becomes the new production baseline model.

[0194] Step S400: Knowledge Base Evolution and Multi-Agent Collaborative Diagnosis (C→D)

[0195] This step demonstrates how the system transforms operational experience into knowledge and achieves higher levels of automation through multi-agent collaboration.

[0196] 1. Knowledge Accumulation and Storage: An alarm "database connection pool exhausted" successfully detected by model Mc triggers the multi-agent collaboration process.

[0197] Detection agent: Detects an anomaly, publishes an "anomaly event message", and associates it with MID_C.

[0198] The diagnostic agent, upon receiving the message, not only uses the model for reasoning but also initiates a retrieval from the knowledge base. The knowledge base, through its graph structure, discovers a strong correlation between the alarm and a "sudden surge in traffic to the upstream batch payment gateway" (a causal graph constructed based on historical events). The diagnostic agent, combining the model and knowledge base information, concludes that the root cause is "upstream traffic surge" and provides a high-confidence conclusion in the "diagnostic result message."

[0199] Repair agent: Upon receiving the diagnostic results, it automatically executed the repair script in the contingency plan to "temporarily limit the flow of the upstream gateway" and successfully resolved the problem.

[0200] 2. Knowledge Base Evolution: The successful "detection-diagnosis-repair" chain described above, as a complete operational case, is structured and stored in the knowledge base. This includes alarm templates, root causes, remediation solutions, execution success rates, and associated MID_Cs.

[0201] 3. Optimization suggestion (RAG application): One week later, the system detected a similar "database connection pool exhausted" alarm again.

[0202] Before performing reasoning, the diagnostic agent first uses the features of the alarm (such as log templates and service names) to perform vector retrieval in the knowledge base.

[0203] Retrieve the previous successful case and read its metadata, including the repair solution and success rate (100%).

[0204] The system dynamically generates an optimized prompt word and inputs it along with the original alarm into the Large Language Model (LLM), which serves as the core of the reasoning process (here, it can be considered part of the diagnostic agent).

[0205] [System Prompt]: Please perform root cause analysis on the following alarm. [Historical Knowledge]: Historically, the root cause of a similar 'database connection pool exhausted' alarm (similarity 0.92) was identified as 'instantaneous traffic surge at the upstream batch payment gateway,' and was successfully resolved through 'temporary rate limiting' (100% success rate, associated MID: mid_xxx). Please first verify whether the current situation is consistent with this historical case.

[0206] [Current Alerts]: {alert_details}

[0207] This "prior knowledge" tip greatly improved the accuracy and speed of diagnosis. The LLM quickly identified the root cause and recommended a proven remedial solution.

[0208] 4. New Version Release: With the continuous enrichment of the knowledge base and the maturation of the prompt optimization mechanism, the intelligence level of the entire operation and maintenance system has been improved. This can be regarded as a system-level upgrade. Therefore, a new milestone marker, MID_D, can be created for the entire system status, marking the system's entry into a new and more mature evolutionary stage.

[0209] Through the complete process of A→B→C→D above, this invention successfully transforms an external general model into a dedicated intelligent operation and maintenance system that is highly adapted to internal business and has self-evolution capabilities in a completely closed banking environment. This transformation is achieved through traceable migration (MID), quantifiable evaluation (Tscore), closed-loop learning (active learning), and evolvable knowledge (knowledge base and RAG).

[0210] In summary, the solution proposed in this invention can:

[0211] 1. Migration Identification Governance System: Enables full-process tracking and compliance auditing of data, models, and inference;

[0212] 2. Transferability Quantification Model: The Tscore metric is used to quantify transferability and dynamically control the transfer depth;

[0213] 3. Rapid modeling and active learning with few samples: Achieving efficient model training and continuous optimization under limited sample conditions;

[0214] 4. Knowledge base evolution and suggestion optimization: Dynamic knowledge accumulation and template self-learning are achieved through a retrieval-enhanced generation mechanism;

[0215] 5. Self-loop migration closed loop: Construct a "migration-adaptation-verification-rollback" mechanism to improve system robustness;

[0216] 6. Multi-agent collaborative architecture: Detection, diagnosis, and repair agents work collaboratively to achieve an intelligent closed loop;

[0217] 7. High adaptability of closed system: Supports fully offline operation, meeting the high security operation and maintenance needs of industries such as finance, energy, and telecommunications.

[0218] This invention achieves a compliant, traceable, and adaptive intelligent operation and maintenance closed loop in a closed system through the integrated innovation of "small sample learning + transfer learning + transfer identification", which has significant technological innovation and industrial application value.

[0219] A second aspect of this invention discloses an automated operation and maintenance system suitable for closed systems. The system employs the method described in either Embodiment 1 or Embodiment 2 of the first aspect. Figure 3 This is a structural diagram of an automated operation and maintenance system suitable for closed systems according to an embodiment of the present invention; as follows: Figure 3As shown, the system 100 includes:

[0220] The data and migration governance module 101 is used to generate migration identifiers containing unique identifiers (MIDs) and metadata for operation and maintenance data, models and inference results;

[0221] The portability assessment module 102 is used to calculate the portability score (Tscore) between the source domain and the target domain.

[0222] The model transfer and adaptation module 103 is used to dynamically determine the model transfer strategy and execute the model transfer based on the transferability score.

[0223] A multi-agent collaborative system 104 is used to execute closed-loop operation and maintenance tasks using the transferred target model. The multi-agent collaborative system includes:

[0224] A detection agent is used to perform anomaly detection;

[0225] A diagnostic agent is used to perform root cause diagnosis;

[0226] Repair agent, used to perform automated repairs.

[0227] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of an automated operation and maintenance method for a closed system according to any one of the first aspects of this invention.

[0228] Figure 4 This is a structural diagram of an electronic device according to an embodiment of the present invention, such as... Figure 4 As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0229] Those skilled in the art will understand that Figure 4The structure shown is merely a structural diagram of the part related to the technical solution of this disclosure and does not constitute a limitation on the electronic device to which the solution of this application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0230] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an automated operation and maintenance method for a closed system according to any one of the first aspects of this invention.

[0231] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An automated operation and maintenance method suitable for closed systems, characterized in that, Includes the following steps: Data and migration governance steps: Upon receiving operation and maintenance data, generate a migration identifier containing a unique identifier MID and metadata for the operation and maintenance data or the model and inference results generated based on the operation and maintenance data, so as to realize the full lifecycle traceability and governance of the operation and maintenance data, model and inference results; The transferability evaluation steps are as follows: Based on the source model trained on the source domain and the target data in the target domain, calculate the transferability score Tscore, which quantifies the fit between the source domain and the target domain. Model transfer and adaptation steps: Based on the transferability score, dynamically determine the model transfer strategy and transfer the source model to the target domain to obtain the target model; as well as Closed-loop operation and maintenance execution steps: Using the target model, perform operation and maintenance tasks including anomaly detection, root cause diagnosis and automated repair in the closed system, and update the newly generated knowledge in the operation and maintenance tasks to achieve adaptive evolution; The metadata of the migration identifier includes at least one of the following: Entity type information, source information, version information, migration strategy information, risk level information, or governance audit information; The version information includes the parent migration identifier number and a boolean identifier indicating whether it is a rollback point, so as to realize the tracing of the version chain and one-click rollback; The transferability score Tscore is calculated as follows: Where Sim(S,T) is the task similarity between the source domain S and the target domain T, Stab(S,T) is the prediction stability of the source model on the target domain data, and α and β are the weight coefficients of preset or adaptive learning. The steps for calculating the task similarity Sim(S,T) include: Extract the operation and maintenance logs of the source domain and the target domain respectively, and generate their respective log template sets; The log template set is converted into its respective domain feature vectors using feature engineering methods; Calculate the vector distance or similarity between the two domain feature vectors, and use it as the task similarity. The calculation steps for the predicted stability Stab(S,T) include: Test samples are obtained by sampling data from the target domain. The test samples are augmented to generate a set of perturbation samples; The source model is used to predict the test samples and the perturbation samples respectively; The prediction stability score is calculated based on the degree of consistency of the prediction results.

2. The method according to claim 1, characterized in that, The model transfer strategy includes adaptively selecting the proportion of frozen layers, fine-tuning methods, or lightweight adapter parameters of the model based on the numerical range of the transferability score.

3. The method according to claim 1, characterized in that, The closed-loop operation and maintenance execution steps further include a small-sample active learning process: Use the target model to infer the target domain data and calculate the confidence level of the prediction results; When the confidence level is lower than a preset threshold, the corresponding sample is submitted to the manual annotation pool; The target model is incrementally fine-tuned using high-value samples that have been manually labeled.

4. The method according to claim 1, characterized in that, The closed-loop operation and maintenance execution steps further include the steps of building and evolving a knowledge base: Alarms, root cause analysis results, and remediation solutions generated during operation and maintenance tasks are stored in a structured form in a knowledge base and associated with the corresponding migration identifiers; Periodically or based on preset rules, knowledge in the knowledge base is eliminated or downgraded. When performing root cause diagnosis, the Retrieval Enhancement Generation (RAG) mechanism is used to retrieve relevant historical knowledge from the knowledge base and dynamically generate optimized prompts to guide model reasoning.

5. An automated operation and maintenance system suitable for closed systems, wherein the system employs the method described in any one of claims 1-4, characterized in that, The system includes: The data and migration governance module is used to generate migration identifiers containing unique identifiers (MID) and metadata for operational data, models, and inference results. The portability assessment module is used to calculate the portability score Tscore between the source domain and the target domain; The model transfer and adaptation module is used to dynamically determine the model transfer strategy and execute the model transfer based on the transferability score. A multi-agent collaborative system is used to execute closed-loop operation and maintenance tasks using a transferred target model. The multi-agent collaborative system includes: A detection agent is used to perform anomaly detection; A diagnostic agent is used to perform root cause diagnosis; Repair agent, used to perform automated repairs.

Images