A method and system for handling abnormal events based on operation and maintenance knowledge graph

Abstract

This invention provides a method and system for abnormal event association processing based on an operation and maintenance knowledge graph, belonging to the field of operation and maintenance management technology. The method includes: taking each abnormal event entity in a structured abnormal event sequence as an input node set; based on the topological mapping position of the input node set in a preset operation and maintenance knowledge graph, aggregating the k-order adjacency topological features and business semantic embedding features of each input node to obtain a graph event representation vector; performing pairwise comparison and temporal alignment of the feature vectors representing different abnormal event entities in the graph event representation vector; iteratively calculating the temporal lag correlation index and state transition probability matrix between each abnormal event entity; and converging to obtain a candidate abnormal event association subgraph based on the state transition probability matrix and a preset association confidence threshold. This invention realizes abnormal event association and handling instruction generation, improving operation and maintenance efficiency and the accuracy of fault root cause location.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance management technology, and in particular to a method and system for handling abnormal events based on an operation and maintenance knowledge graph. Background Technology

[0002] In the operation and maintenance management scenario of financial-grade cloud data centers, with the continuous evolution of system architecture, the telemetry data reported by multi-source monitoring agent nodes mostly exhibit characteristics such as massive volume, heterogeneity, and high concurrency. The commonly used abnormal event correlation processing methods currently rely heavily on static threshold rules or basic time-series correlation algorithms to assist in fault analysis and root cause localization. It should be noted that while these methods can achieve certain results in most cases in actual production applications, they may also expose some aspects that deserve further attention and improvement in certain specific situations.

[0003] For example, some monitoring data sometimes lacks a sufficiently deep correlation mapping capability with the topology of the underlying infrastructure and the semantic information of upper-layer business. Specifically, when anomalies occur, existing methods mostly rely on single-dimensional indicator values, such as CPU utilization, memory usage, or network latency, to make judgments. It is difficult to effectively integrate fault signals with specific topology node locations, upstream and downstream dependencies, and business implications. This relatively singular representation method may not be sufficient to depict the coupling relationships between different entities in a complex cloud environment. In other words, due to the lack of layer-by-layer mapping from data to underlying topology and then to business semantics, the contextual information of anomalies is relatively limited, making it difficult for operations and maintenance personnel to accurately reconstruct the actual propagation path and impact range of faults between infrastructure and business logic during the analysis process. Summary of the Invention

[0004] This invention provides a method and system for handling abnormal events based on an operation and maintenance knowledge graph, which realizes the association of abnormal events and the generation of handling instructions, thereby improving operation and maintenance efficiency and the accuracy of fault root cause location.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: Firstly, an abnormal event association processing method based on an operations and maintenance knowledge graph, the method comprising: Step 1: Take each abnormal event entity in the structured abnormal event sequence as the input node set. Based on the topological mapping position of the input node set in the preset operation and maintenance knowledge graph, aggregate the k-order adjacency topological features and business semantic embedding features of each input node to obtain the graph event representation vector. Step 2: Perform pairwise comparison and temporal alignment of the feature vectors representing different abnormal event entities in the event representation vector of the graph, and iteratively calculate the temporal lag correlation index and state transition probability matrix between each abnormal event entity; based on the state transition probability matrix and the preset association confidence threshold, converge to obtain the candidate abnormal event association subgraph. Step 3: Map the temporal propagation window and topological influence domain of each abnormal event entity in the candidate abnormal event association subgraph to a two-dimensional feature polygon. Perform intersection and difference operations on the two-dimensional feature polygon to obtain the effective overlapping area. Based on the effective overlapping area, remove pseudo-correlated concurrent branch paths and feedback loop interference data to reconstruct the fault propagation causal chain. Step 4: Extract the terminal aggregation node features and topology in-degree cumulative index of the fault propagation causal chain, and locate the unique identifier of the corresponding root cause abnormal event entity in the operation and maintenance knowledge graph; using the unique identifier of the root cause abnormal event entity as the retrieval anchor point, traverse the preset handling strategy knowledge base in the operation and maintenance knowledge graph to obtain the target abnormal event associated handling instructions.

[0006] Secondly, an anomaly event association processing system based on an operations and maintenance knowledge graph includes: The feature aggregation module is used to take each abnormal event entity in the structured abnormal event sequence as an input node set, and based on the topological mapping position of the input node set in the preset operation and maintenance knowledge graph, aggregate the k-order adjacency topological features and business semantic embedding features of each input node to obtain the graph event representation vector. The association subgraph module is used to perform pairwise comparison and temporal alignment of the feature vectors representing different abnormal event entities in the event representation vector of the graph, iteratively calculate the temporal lag correlation index and state transition probability matrix between each abnormal event entity, and converge to obtain the candidate abnormal event association subgraph based on the state transition probability matrix and the preset association confidence threshold. The causal chain reconstruction module is used to map the temporal propagation window and topological influence domain of each abnormal event entity in the candidate abnormal event association subgraph to a two-dimensional feature polygon. The intersection and difference operations are performed on the two-dimensional feature polygon to obtain the effective overlapping area. Based on the effective overlapping area, pseudo-correlated concurrent branch paths and feedback loop interference data are removed to reconstruct the fault propagation causal chain. The location and handling module is used to extract the terminal aggregation node characteristics and topology in-degree cumulative index of the fault propagation causal chain, locate the unique identifier of the corresponding root cause abnormal event entity in the operation and maintenance knowledge graph; use the unique identifier of the root cause abnormal event entity as the retrieval anchor point, traverse the preset handling strategy knowledge base in the operation and maintenance knowledge graph, and obtain the associated handling instructions of the target abnormal event.

[0007] The above-described solution of the present invention has at least the following beneficial effects: By integrating the k-order adjacency topology features of abnormal event entities with business semantic embedding features, a graph event representation vector is constructed to characterize the topological relationships and business attributes of abnormal events in the operation and maintenance system, thereby improving the completeness and recognizability of abnormal event feature representation. Based on the temporal lag correlation index and the state transition probability matrix, candidate abnormal event association subgraphs are generated through iterative convergence. This adaptively matches the temporal correlation patterns of abnormal events under different operation and maintenance scenarios. By mapping the temporal propagation window and the topological influence domain to two-dimensional feature polygons and performing intersection operations, pseudo-correlated concurrent branch paths and feedback loop interference data are eliminated, achieving reliable reconstruction of the fault propagation causal chain. Relying on the terminal aggregation node features and the topological in-degree accumulation index, the root cause abnormal event entity is located. Combined with the handling strategy knowledge base in the operation and maintenance knowledge graph, associated handling instructions are automatically matched, shortening the time spent on abnormal event investigation and handling, and improving the automation and response efficiency of operation and maintenance fault handling. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating an abnormal event association processing method based on an operation and maintenance knowledge graph, provided by an embodiment of the present invention.

[0009] Figure 2 This is a schematic diagram of an abnormal event association processing system based on an operation and maintenance knowledge graph, provided by an embodiment of the present invention.

[0010] Figure 3 This is a correlation distribution diagram of event pairs under different lag windows provided by an embodiment of the present invention.

[0011] Figure 4 This is a diagram illustrating the convergence process of iterative pruning of candidate correlation subgraphs provided in an embodiment of the present invention.

[0012] Figure 5 This is a diagram showing the relationship between the overlapping area of ​​the feature polygons and the reconstruction quality of the causal chain, provided by an embodiment of the present invention.

[0013] Figure 6 This is a comparison chart of root cause localization accuracy at different map scales provided in the embodiments of the present invention.

[0014] Figure 7 This is a comparison chart of the overall effects of abnormal event association processing provided by the embodiments of the present invention. Detailed Implementation

[0015] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0016] like Figure 1 As shown, an embodiment of the present invention proposes an abnormal event association processing method based on an operation and maintenance knowledge graph, the method comprising the following steps: Step 1: Take each abnormal event entity in the structured abnormal event sequence as the input node set. Based on the topological mapping position of the input node set in the preset operation and maintenance knowledge graph, aggregate the k-order adjacency topological features and business semantic embedding features of each input node to obtain the graph event representation vector. Step 2: Perform pairwise comparison and temporal alignment of the feature vectors representing different abnormal event entities in the event representation vector of the graph, and iteratively calculate the temporal lag correlation index and state transition probability matrix between each abnormal event entity; based on the state transition probability matrix and the preset association confidence threshold, converge to obtain the candidate abnormal event association subgraph. Step 3: Map the temporal propagation window and topological influence domain of each abnormal event entity in the candidate abnormal event association subgraph to a two-dimensional feature polygon. Perform intersection and difference operations on the two-dimensional feature polygon to obtain the effective overlapping area. Based on the effective overlapping area, remove pseudo-correlated concurrent branch paths and feedback loop interference data to reconstruct the fault propagation causal chain. Step 4: Extract the terminal aggregation node features and topology in-degree cumulative index of the fault propagation causal chain, and locate the unique identifier of the corresponding root cause abnormal event entity in the operation and maintenance knowledge graph; using the unique identifier of the root cause abnormal event entity as the retrieval anchor point, traverse the preset handling strategy knowledge base in the operation and maintenance knowledge graph to obtain the target abnormal event associated handling instructions.

[0017] In this embodiment of the invention, a graph event representation vector is constructed by fusing the k-order adjacency topology features of abnormal event entities with business semantic embedding features. This vector characterizes the topological relationships and business attributes of abnormal events in the operation and maintenance system, improving the completeness and recognizability of abnormal event feature representation. Based on the iterative convergence of temporal lag correlation indicators and state transition probability matrices, candidate abnormal event association subgraphs are generated. This adaptively matches the temporal correlation patterns of abnormal events under different operation and maintenance scenarios. By mapping the temporal propagation window and the topological influence domain to two-dimensional feature polygons and performing intersection operations, pseudo-correlated concurrent branch paths and feedback loop interference data are eliminated, achieving reliable reconstruction of the fault propagation causal chain. The root cause abnormal event entity is located based on the terminal aggregation node features and topological in-degree accumulation indicators. Combined with the handling strategy knowledge base in the operation and maintenance knowledge graph, associated handling instructions are automatically matched, shortening the time spent on abnormal event investigation and handling, and improving the automation and response efficiency of operation and maintenance fault handling.

[0018] In a preferred embodiment of the present invention, raw operation and maintenance telemetry data reported by multi-source monitoring agent nodes in each availability zone of a financial-grade cloud data center are obtained, and the raw operation and maintenance telemetry data is processed to obtain a structured sequence of abnormal events, which may include: In this embodiment of the invention, a full-coverage deployment of multi-source monitoring agent nodes is achieved across all availability zones of a financial-grade cloud data center, ensuring comprehensive monitoring without blind spots and meeting the comprehensive operational data requirements of financial-grade scenarios. The monitoring agent nodes are categorized by deployment location and monitored objects, primarily including three types: first, hardware monitoring agents deployed on underlying infrastructure such as servers, switches, and storage devices in each availability zone; second, middleware monitoring agents deployed on the cloud platform virtualization layer and container clusters; and third, business monitoring agents deployed on core business systems. Each monitoring agent node reports according to a preset frequency based on the importance of the monitored objects: core businesses and critical infrastructure report every 1-5 seconds, while ordinary devices report every 10-30 seconds, collecting raw operational data. Telemetry data is pushed to a unified data acquisition gateway in real time via an encrypted transmission channel, and a scheduled backup mechanism is supported to prevent data loss due to network fluctuations. The collected raw telemetry data covers three core types: first, infrastructure operation indicators, including CPU utilization, memory usage, disk I / O rate, network bandwidth, and number of port connections; second, business operation indicators, including business response time, transaction success rate, interface call frequency, and error code distribution; and third, log data, including device operation logs, system error logs, business operation logs, and anomaly alarm logs. All data carries unique identification information, including the availability zone ID, monitoring node ID, and collection timestamp, to ensure data traceability.

[0019] After receiving data reported by each agent node, the data acquisition gateway performs a unified data format conversion, transforming heterogeneous data output from different monitoring agents into a standardized format, defining the meaning and format specifications of data fields, and removing and correcting invalid information in the original data. This includes: 1) removing duplicate data, i.e., deleting duplicate data reported by the same monitoring node at the same timestamp to avoid data redundancy; 2) handling missing data, using interpolation of adjacent timestamps to fill in missing values ​​for key indicators, and directly removing the corresponding data entries for missing data of non-key indicators; and 3) correcting abnormal data, removing data that clearly exceeds reasonable limits, as such data often indicates monitoring agent malfunctions. Data obtained due to faults or transmission errors is not of reference value. Because different types of telemetry data vary significantly in size, data normalization is necessary to map all indicator data to the same numerical range. Simultaneously, to address minor differences in reporting times between different monitoring agent nodes, time-series alignment is performed to uniformly align all data to a preset time granularity, ensuring that various types of data within the same time dimension can be correlated and analyzed. Based on the monitoring object type and data purpose, the pre-processed data is categorized and aggregated into three main categories: infrastructure data, business data, and log data. Each main category is further subdivided according to specific monitoring objects, and partitioned according to their respective availability zones.

[0020] Based on the operational characteristics of financial-grade cloud data centers, dynamic baseline thresholds are set for various monitoring indicators, which can be automatically adjusted according to business peaks and equipment load changes. For example, the baseline threshold for CPU utilization is set to 70% during business off-peak hours and adjusted to 85% during peak hours. Simultaneously, for time-series data, anomaly judgment criteria are set; if an indicator experiences significant fluctuations within a short period, even if it does not exceed a static threshold, it is considered abnormal. A multi-dimensional fusion detection approach is adopted to avoid the limitations of single-indicator detection. Firstly, threshold detection based on indicator values ​​identifies abnormal data exceeding dynamic baseline thresholds; secondly, anomaly detection based on time-series trends... The system employs several methods: first, identifying abnormal trends in metrics; second, detecting anomalies based on log content by extracting abnormal information from log data through keyword matching; and third, detecting anomalies based on related metrics, such as simultaneously detecting the number of port connections and service response time of the corresponding server when network latency is abnormal, to determine if there are any related anomalies. The detected abnormal data is then extracted as events, with each event corresponding to a complete anomaly record. The core information extracted includes the time of occurrence of the anomaly, the availability zone to which the anomaly belongs, the anomaly monitoring node ID, the anomaly object, the anomaly type, the specific anomaly metric, and the anomaly level, ensuring that each anomaly event is complete and traceable.

[0021] For multiple related anomalies caused by the same anomaly, they are merged, retaining the core anomaly and eliminating redundant derivative anomalies to avoid duplicate analysis; at the same time, false alarms are eliminated to ensure the accuracy of the sequence. Each anomaly is formatted according to a pre-defined structured template, unifying field names and data formats. The structured template includes fixed fields: unique event identifier, occurrence timestamp, availability zone ID, monitoring node ID, anomaly object type, anomaly object identifier, anomaly type, anomaly metric name, anomaly metric value, anomaly level, and anomaly description. All fields use standardized expressions to avoid ambiguity. All structured anomalies are sorted according to their occurrence timestamps to form a structured anomaly event sequence. Simultaneously, a time-series index is added to each anomaly event in the sequence to indicate the time interval between events, ultimately generating a structured anomaly event sequence.

[0022] In a preferred embodiment of the present invention, step 1 above, which uses each abnormal event entity in the structured abnormal event sequence as an input node set, and aggregates the k-order adjacency topology features and business semantic embedding features of each input node based on the topological mapping position of the input node set in a preset operation and maintenance knowledge graph, to obtain a graph event representation vector, may include: In this embodiment of the invention, step 110 involves mapping each abnormal event entity in the structured abnormal event sequence to a topological projection coordinate system to construct a basic topological polygon. Specifically, this includes: pre-setting a topological projection coordinate system for the operation and maintenance knowledge graph, establishing a two-dimensional Cartesian coordinate system with the root node of the knowledge graph as the origin, the topological level as the x-axis, and the business relevance as the y-axis. The scale of this coordinate system is set according to the topological complexity and number of business levels of the financial-grade cloud data center to ensure that all abnormal event entities can be mapped within the coordinate system; and extracting the topological attribute information of each abnormal event entity from the structured abnormal event sequence, including the hierarchical position of the abnormal event entity in the operation and maintenance knowledge graph and its directly associated parent node. Based on the number of child nodes and these topological attribute information, the specific coordinates (x, y) of each abnormal event entity in the topological projection coordinate system are determined. The x value corresponds to the topological level of the abnormal event entity; the higher the level, the larger the x value. The y value corresponds to the correlation between the abnormal event entity and the core business; the higher the correlation, the larger the y value. After marking the coordinate points corresponding to all abnormal event entities in the topological projection coordinate system, adjacent coordinate points are connected sequentially according to the topological association relationship of the abnormal event entities to form a closed polygon structure. This closed polygon is the basic topological polygon. The number of sides of the basic topological polygon is consistent with the number of abnormal event entities in the structured abnormal event sequence, and each vertex corresponds to the coordinates of an abnormal event entity.

[0023] Step 111: Extract business parameters and time-series indicators of each abnormal event entity from the structured abnormal event sequence and the preset operation and maintenance knowledge graph attribute library, and fuse the business parameters and time-series indicators to obtain the dynamic expansion coefficient corresponding to each input node; specifically, this includes: extracting the time-series indicator corresponding to each abnormal event entity from the structured abnormal event sequence. The abnormal duration refers to the cumulative duration of the abnormal event from the time of occurrence to the current data processing time, in seconds. In combination with the operation and maintenance requirements of financial-grade cloud data centers, three duration thresholds are preset for subsequent standardization processing, namely, short duration threshold 30s, medium duration threshold 180s, and long duration threshold 360s; for example, if an abnormal event occurs at 10:00:00 and the current processing time is 10:03:20, its abnormal duration is 200s, which is between the medium duration (180s) and the long duration (360s).

[0024] The calculation method for the fluctuation range of abnormal indicators is the absolute value of the difference between the abnormal indicator value and the dynamic benchmark threshold of the indicator. The dynamic benchmark threshold is preset with specific values ​​based on financial-grade business scenarios to adapt to different monitoring indicators, as follows: CPU utilization dynamic benchmark threshold (70% during business downturn, 85% during business peak), memory usage dynamic benchmark threshold (80% during business downturn, 90% during business peak), network latency dynamic benchmark threshold (50ms for core business, 100ms for general business), and business response time dynamic benchmark threshold (200ms for core business, 500ms for general business). The formula for calculating the fluctuation range of abnormal indicators is as follows.

[0025] The fluctuation range of an abnormal indicator is calculated as |abnormal indicator value - corresponding dynamic benchmark threshold|. Preset fluctuation range thresholds (5% for core indicators, 10% for ordinary indicators) are used to differentiate the degree of fluctuation. For example, if the abnormal CPU utilization value of a core business server is 90%, and the peak business dynamic benchmark threshold is 85%, then its fluctuation range = |90% - 85%| = 5%, reaching the core indicator fluctuation threshold. The frequency of anomalies refers to the number of times the abnormal event occurs within a preset time window. The preset time window is set in conjunction with the monitoring frequency. The time window for core business and critical infrastructure is 5 minutes (300s), and the time window for ordinary equipment is 15 minutes (900s). Preset frequency thresholds are also provided: 3 times / 5 minutes for core business and 5 times / 15 minutes for ordinary equipment. For example, if an abnormal event occurs 4 times within 5 minutes for a certain core business interface, its abnormal occurrence frequency = 4 times, exceeding the core business frequency threshold of 3 times / 5 minutes.

[0026] The business parameters corresponding to the abnormal event entity are extracted from the pre-set operation and maintenance knowledge graph attribute library. The specific value range, threshold standard and classification basis of each parameter are determined to conform to the characteristics of financial-grade business. Specifically, the business priority is divided into 1 to 5 levels according to the importance of financial-grade business, with level 1 being the highest and level 5 being the lowest. The business type and specific value corresponding to each level are determined. Specifically, level 1 is core transaction business, such as transfer and payment; level 2 is important business, such as account query and bill generation; level 3 is general business, such as information modification and notification push; level 4 is auxiliary business, such as log statistics; and level 5 is redundant business, such as backup verification. Each level corresponds to a fixed value of 1-5, which is directly used as the basic value of business priority.

[0027] Service Level Agreement (SLA) thresholds refer to the minimum performance requirements for the normal operation of the service. Combining the high reliability and low latency requirements of financial-grade services, specific thresholds are preset: Core business SLA thresholds: Transaction success rate ≥ 99.99%, Response time ≤ 200ms, System availability ≥ 99.99%; Important business SLA thresholds: Transaction success rate ≥ 99.9%, Response time ≤ 500ms, System availability ≥ 99.9%; General and lower-level business SLA thresholds: Transaction success rate ≥ 99%, Response time ≤ 1000ms, System availability ≥ 99%. During extraction, the corresponding SLA threshold is matched as the base value for this parameter based on the business type of the abnormal event entity. The number of associated businesses refers to the number of other business modules directly affected by the abnormal event entity. Preset thresholds are used to classify the degree of association: few associations (1-2), medium associations (3-5), and many associations (6 or more). For example, if a core payment business anomaly directly affects three business modules—account verification, transaction recording, and SMS notification—the number of associated businesses is 3, which is considered medium association.

[0028] The extracted business parameters and time-series indicators are standardized using the min-max standardization method, which maps all parameter and indicator values ​​to the range of 0 to 1, thus eliminating the influence of different magnitudes. The specific standardization formula is: Standardized value = (Original value - Minimum value of the indicator) ÷ (Maximum value of the indicator - Minimum value of the indicator), where the minimum and maximum values ​​of each indicator are determined in conjunction with the preset thresholds mentioned above.

[0029] The minimum fluctuation range of the abnormal indicator is 0%, and the maximum is 15% (preset maximum fluctuation threshold). For example, the standardized value after 5% = (5... -0)÷(15-0)≈0.33; Frequency of anomalies: minimum 0 times for core business, maximum 10 times / 5 minutes; minimum 0 times for ordinary equipment, maximum 15 times / 15 minutes. For example, the standardized value of 4 times / 5 minutes = (4-0)÷(10-0)=0.4; Business priority: minimum 1 (level 1), maximum 5 (level 5). For example, the standardized value of level 1 = (1-1)÷(5-1)=0, and the standardized value of level 5 = (5-1)÷(5-1)=1; Service level agreement threshold: standardized according to specific indicators. Taking transaction success rate as an example, the minimum is 99% and the maximum is 99.99%. For example, the standardized value of 99.99% = (99.99-99)÷(99.99-99)=1; Number of associated businesses: minimum 1 and maximum 10 (preset maximum number of associated businesses). For example, the standardized value of 3 businesses = (3-1)÷(10-1)≈0.22.

[0030] After standardization, a weighted summation method is used to integrate business parameters and time-series indicators to obtain the dynamic expansion coefficient corresponding to each input node. This ensures that the expansion coefficient can accurately reflect the impact range and importance of the abnormal event entity. The specific calculation method and weight settings are as follows: Dynamic expansion coefficient = Preset weight of business priority × Standardized business priority + Preset weight of abnormal indicator fluctuation range × Standardized abnormal indicator fluctuation range + Preset weight of number of related businesses × Standardized number of related businesses; The system uses a weighted average of 0.3 for business priority, 0.4 for abnormal indicator fluctuation, and 0.3 for the number of related businesses, with a total weight of 1. These weights are set based on financial-grade operational requirements. Abnormal indicator fluctuation directly reflects the severity of the anomaly and has the highest weight (0.4). Business priority and the number of related businesses determine the scope of the anomaly's impact, each with a weight of 0.3, used to balance the influence of different parameters on the dynamic expansion coefficient. For example, in a core transaction business with a business priority of level 1, an abnormal event with a standardized value of 0 has an abnormal indicator fluctuation of 5%, a standardized value of 0.33, and 3 related businesses, with a standardized value of 0.22. Its dynamic expansion coefficient = 0.3×0 + 0.4×0.33 + 0.3×0.22 = 0 + 0.132 + 0.066 = 0.198, indicating that the impact of this abnormal event is relatively small and its severity is moderate. For example, in a core payment business, with a business priority of level 1 and an abnormal event with a standardized value of 0, the abnormal indicator fluctuation range is 10%, the standardized value is 0.67, and the number of related businesses is 6, the standardized value is 0.56. Its dynamic expansion coefficient = 0.3×0 + 0.4×0.67 + 0.3×0.56 = 0 + 0.268 + 0.168 = 0.436, indicating that the impact of this abnormal event is relatively large and its severity is high.

[0031] Step 112: Determine the normal offset distance of each vertex of the basic topological polygon based on the dynamic expansion coefficient. Perform parallel translation operation along the outward normal direction of each edge of the basic topological polygon to obtain the initial offset contour. Perform topological trimming and arc transition processing on the self-intersection regions and sharp corners of the edges caused by outward expansion in the initial offset contour to obtain the initial expanded polygon. Specifically, this includes: setting a preset basic offset coefficient k0, which is set according to the node density of the operation and maintenance knowledge graph, with a value range of 0.5 to 1.5, to unify the benchmark scale of the offset distance and ensure that the offset amplitude of different abnormal event entities is comparable. Calculate the normal offset distance of each vertex of the basic topological polygon based on the dynamic expansion coefficient of each input node. The calculation method is as follows: Normal offset distance = Dynamic expansion coefficient × Basic offset coefficient. That is, the offset distance of each vertex is positively correlated with the dynamic expansion coefficient of the corresponding anomalous event entity. The larger the dynamic expansion coefficient, the larger the offset distance, meaning the wider the influence range of the anomalous event entity. After determining the normal offset distance of each vertex, a parallel shift operation is performed on each vertex along the outward normal direction of each side of the basic topological polygon. The shift distance is the normal offset distance of the corresponding vertex. During the shift, the length of each side and the angle between adjacent sides remain unchanged. After the shift is completed, all shifted vertices are connected to form the initial offset contour. Topology optimization processing is performed on the initial offset contour. First, the edge lines generated by outward expansion in the initial offset contour are identified. In the intersecting region, the ray method is used to determine the location and extent of self-intersection. Multiple feature sampling points are selected at fixed intervals along all edges of the initial offset contour. The spacing of the feature sampling points is adaptively set according to the overall size of the initial offset contour to ensure coverage of the entire contour edge area. Using each feature sampling point as the emission starting point, an infinitely extending detection ray is emitted along the positive horizontal direction of the topological projection coordinate system. The number of intersections between this detection ray and the remaining edges of the initial offset contour is detected one by one. The total number of intersections between each detection ray and the contour edge is counted. If the number of intersections of the detection ray corresponding to a certain sampling point is an even number greater than 2, or if the number of intersections is odd and the intersection coordinates are repeated, then it is determined that the ray passes through an area where the edges self-intersect. For regions where self-intersections are identified, coordinate positioning is performed, recording the start and end coordinates of the intersecting edges and the precise coordinates of the intersection point. The two self-intersecting edges are then segmented using the intersection point coordinates, distinguishing between the effective outer edges and redundant internal intersection edges of the contour. Based on the segmented edge coordinates, the redundant internal intersection edges are removed, retaining only the effective outer edges that can form a complete closed region, thus completing the clipping and removal of self-intersecting regions. After clipping the self-intersecting regions, the initial offset contour is further smoothed and optimized by traversing the angle values ​​of all vertices of the contour, identifying sharp corners with an angle less than 30 degrees, and using a rounded transition for these sharp corners, with the radius of the rounded transition set to 0 times the normal offset distance of the corresponding vertex.Multiply by 3, using the vertex of the sharp corner as the center, draw a transition arc with a set radius to replace the original sharp-angled edges, making the contour edges connect more smoothly. The neat closed contour after self-intersecting edge trimming and sharp-corner arc transition processing is the initial expanded polygon.

[0032] Step 113 involves spatially overlaying and matching the initial extended polygon with the preset k-order adjacency topology boundary in the operation and maintenance knowledge graph to obtain an extended influence domain polygon covering the k-order adjacency relationships. Specifically, this includes: determining the range of the k-order adjacency topology boundary. The value of k is set based on the topology hierarchy and business complexity of the financial-grade cloud data center, typically ranging from 2 to 3. The k-order adjacency topology boundary refers to the topology region boundary formed by the input node set as the core, including all first-order adjacency nodes, second-order adjacency nodes, ... up to k-order adjacency nodes. This boundary is extracted from the preset operation and maintenance knowledge graph and presented in polygon form. The results obtained in Step 112... The initial extended polygon is spatially overlaid and matched with the k-order adjacency topology boundary. The matching process uses spatial intersection operation. First, the intersection area of ​​the two polygons is determined. Then, the part of the initial extended polygon that exceeds the k-order adjacency topology boundary is clipped and removed. The overlapping area between the initial extended polygon and the k-order adjacency topology boundary is retained. At the same time, the area within the k-order adjacency topology boundary that is not covered by the initial extended polygon but has a direct relationship with the input node is supplemented. The final closed polygon is the extended influence domain polygon that covers the k-order adjacency relationship. This polygon includes the influence range of the input node and completely covers the topology area where its k-order adjacency node is located.

[0033] Step 114: Within the spatial range defined by the extended influence domain polygon, retrieve matching adjacent nodes, extract the business attribute labels and state evolution sequences of each adjacent node, and perform feature weighted fusion on the business attribute labels and state evolution sequences to obtain the business semantic embedding features of each input node; specifically, within the spatial range defined by the extended influence domain polygon obtained in Step 113, retrieve all matching adjacent nodes according to the coordinate range of the topological projection coordinate system. These adjacent nodes are the k-order adjacent nodes of the input node, including all direct and indirect adjacent nodes from order 1 to k. During the retrieval process, coordinate matching is used to ensure that no adjacent node within the extended influence domain is missed; extract the business attribute labels and time sequence of each adjacent node. The state evolution sequence includes business attribute labels such as the device type, business line, maintenance department, and operating status level of adjacent nodes. Each business attribute label is quantified and encoded; for example, in device type, server is encoded as 1, switch as 2, and storage device as 3. The time-series state evolution sequence is the operating status change data of adjacent nodes over a preset time period, such as 10 minutes, including the core operating indicator values ​​and status markers (normal, abnormal, warning) at each moment. For each input node, the business attribute labels of all its k-order adjacent nodes are fused with the time-series state evolution sequence using feature weighting to obtain the business semantic embedding feature of that input node. The fusion process uses a feature vector weighted summation method, and the specific calculation formula is as follows: ,in For the first The business semantic embedding feature vector of each input node; For the first The total number of k-order adjacent nodes of each input node; For the first The weight of each adjacent node is negatively correlated with the order of the adjacent nodes. The weight of a first-order adjacent node is 0.6, the weight of a second-order adjacent node is 0.3, and the weight of a third-order adjacent node is 0.1. The higher the order, the smaller the weight, ensuring that directly related nodes have a greater influence. For the first The first input node Quantized vectors of business attribute labels for each adjacent node; The weight of the business attribute tag is 0.4; For the first The first input node The temporal state evolution sequence feature vector of each neighboring node; The weight is 0.6 for the time-series state evolution sequence; the sum of the weights is 1.0, which can be adjusted according to the needs of the operation and maintenance scenario.

[0034] Step 115 involves spatially aligning and tensor-concatenating the adjacency topology features corresponding to the extended influence domain polygon with the business semantic embedding features to obtain a graph event representation vector. Specifically, this includes: extracting the adjacency topology features corresponding to the extended influence domain polygon obtained in Step 113. These features include the topological coordinates of all adjacent nodes within the extended influence domain, the connectivity relationships between adjacent nodes, and the topological distance between the input node and its adjacent nodes. This topology information is then vectorized to obtain an adjacency topology feature vector, the dimension of which is positively correlated with the number of adjacent nodes within the extended influence domain. Spatial alignment is then performed between the adjacency topology feature vector and the business semantic embedding feature vector obtained in Step 114, adjusting the two feature vectors... The dimensions and coordinate system are consistent to ensure that the spatial dimensions of the two are consistent. Specifically, the coordinate system of the adjacent topology feature vector is uniformly mapped to the topological projection coordinate system set in step 110, so that the two feature vectors are in the same spatial dimension and avoid feature misalignment caused by the difference in coordinate system. Tensor concatenation operation is performed on the spatially aligned adjacent topology feature vector and the business semantic embedding feature vector. The concatenation method is to concatenate the two feature vectors in dimensional order. The vector obtained after concatenation is the graph event representation vector. The dimension of this vector is equal to the sum of the dimension of the adjacent topology feature vector and the dimension of the business semantic embedding feature vector. It contains both the topological association information of the input node and the business semantic and adjacent node state information.

[0035] By mapping abnormal event entities to topological polygons and adaptively expanding the scope of influence using dynamic expansion coefficients, the actual propagation boundary of abnormal events in financial-grade cloud data centers is matched. By retrieving k-order adjacent nodes and weighted fusion of business and state features, a deep binding between topological structure and business semantics is achieved.

[0036] In a preferred embodiment of the present invention, step 2 above involves pairwise comparison and temporal alignment of the feature vectors representing different anomalous event entities in the graph event representation vector, iteratively calculating the temporal lag correlation index and state transition probability matrix between each anomalous event entity; and converging to obtain the candidate anomalous event association subgraph based on the state transition probability matrix and a preset association confidence threshold, which may include: In this embodiment of the invention, step 220 involves reconstructing the graph event representation vectors using time-series slicing to build an initial comparison matrix representing the cross-time-period features of abnormal event entities; performing time-series offset alignment processing on the initial comparison matrix to obtain a time-series aligned feature sequence; specifically, this includes: considering the real-time and business continuity requirements of fault propagation in financial-grade cloud data centers, setting the unified time-series analysis granularity to 1 second, and performing time-series slicing processing on the graph event representation vectors corresponding to all abnormal event entities at this fixed time interval, splitting the continuous high-dimensional graph event representation vectors into several independent time-slice units according to the chronological order of the timestamps of the abnormal events. Each time slice unit fully preserves the topological and business semantic features of a single abnormal event entity at the corresponding time point, ensuring that the feature information after slicing is neither lost nor distorted. After completing the time-series slicing, all abnormal event entities are paired without repetition. Taking each pair of abnormal event entities as the analysis object, the feature values ​​of the two paired abnormal events in each consecutive time slice are sequentially filled into a two-dimensional data structure in ascending order of time to construct an initial comparison matrix. The row dimension of this matrix is ​​used to distinguish different abnormal event entity pairs, and the column dimension of the matrix corresponds to the consecutive time slice sequences. Each element in the matrix is ​​a pair of abnormal events. The feature values ​​corresponding to the entity pairs of common events at the same time point fully present the feature change patterns of different abnormal events across time periods. Because abnormal events in financial-grade cloud data centers propagate step-by-step along the underlying infrastructure, virtualization middleware, and upper-layer business systems, there is an inherent time lag between the triggering times of different abnormal events. Directly using the initial comparison matrix for feature comparison will result in significant temporal misalignment, leading to distorted correlation analysis results. Therefore, it is necessary to perform refined temporal offset alignment processing on the initial comparison matrix. First, a time offset range of ±5 seconds is preset, and the feature sequence of the abnormal event that occurred earlier in the entity pair is selected as the baseline sequence. The other... The feature sequence of the abnormal event slides segment by segment within a preset offset range with a step size of 1 second. After each slide, the sum of squared differences of the feature values ​​at corresponding positions of the two sequences is calculated point by point. The smaller the sum of squared differences, the higher the feature fit. After traversing all offset positions, the offset position with the highest fit is selected as the final offset result. The two sets of feature sequences at this offset position are aligned and integrated. Invalid time slice data with no matching head or tail caused by the sliding offset are removed. Valid feature segments with consistent length and corresponding time sequence are retained. Finally, a time-aligned feature sequence with completely matched time position and no feature misalignment is generated for each pair of abnormal event entities.

[0037] Step 221: Based on the time-aligned feature sequence, calculate the feature mutual information value of each abnormal event entity pair within a preset lag time window. Normalize and iteratively update the feature mutual information value to obtain a time-lag correlation index characterizing the intensity of causal transmission delay. Specifically, this includes: setting the lag time window length to 3 to 10 seconds based on the typical lag time of infrastructure fault transmission to the business system in a financial-grade cloud data center, fixing the sliding step size at 1 second, and traversing the time-aligned feature sequence segment by segment within this lag time window. For each step, calculate the feature mutual information value of the abnormal event entity pair at the current offset position. Accurately quantify the nonlinear correlation between the features of two abnormal events using the feature mutual information. The feature mutual information calculation formula is as follows: ,in This represents the temporal alignment feature sequence of preceding abnormal events in an abnormal event entity pair. A temporally aligned feature sequence representing subsequent anomalous events; For sequence The individual feature takes discrete values. For sequence The individual feature takes discrete values; Indicates the feature value and The joint probability distribution of simultaneous occurrences is obtained by calculating the feature co-occurrence frequency within the statistical time slice; Indicates the feature value Marginal probability distribution of independent occurrence Indicates the feature value Marginal probability distribution of independent occurrence; The mutual information value at the current offset position represents the characteristic mutual information value. The larger the value, the stronger the correlation and the higher the probability of transmission between the two anomalous events. After calculating the characteristic mutual information of all offset positions within the lag time window, a minimum-maximum normalization mapping is performed on all mutual information values ​​to uniformly map the values ​​to the interval between 0 and 1. The normalization calculation method is to subtract the minimum value among all mutual information values ​​from the current mutual information value, and then divide by the difference between the maximum value and the minimum value among all mutual information values ​​to eliminate the computational magnitude deviation caused by different value intervals. According to the time sliding order, the normalized mutual information values ​​are updated cumulatively and iteratively. The initial value of the iteration is 0. In each iteration, the normalized mutual information value of the current sliding position is added to the cumulative result of the previous iteration until the entire lag time window is completely traversed. The final cumulative value obtained after the iteration ends is the time-series lag correlation index. This index is specifically used to quantify the delayed intensity and directionality of causal transmission between two anomalous events. The closer the index value is to 1, the stronger the transmission correlation, lag directionality, and credibility between the anomalous events.

[0038] Step 222: Based on the temporal lag correlation index and the historical frequency distribution of the states of each anomalous event entity extracted from the structured anomalous event sequence at different time periods, construct a prior distribution of state evolution; based on the prior distribution of state evolution, iteratively update the state transition frequency between each anomalous event entity in combination with the temporal lag correlation index, and perform probability normalization processing on the updated transition frequency to converge to obtain the state transition probability matrix; specifically, this includes: extracting the running state of each anomalous event entity in each time slice from the structured anomalous event sequence, and uniformly classifying the running state into normal, pre- Three levels of anomalies are identified: alert, severe anomaly, and critical anomaly. Using time slices as statistical units, the total frequency of each state of each anomaly entity is counted for each time period. After removing duplicate and invalid statistics, the historical frequency distribution of the states corresponding to each anomaly entity is obtained. The time-lag correlation index and the historical frequency distribution of states are weighted and fused to construct a prior distribution of state evolution among anomaly entities. Specifically, the time-lag correlation index is multiplied by the historical frequency of the corresponding state, and all weighted results are summed and then normalized to bring the total value of the prior distribution to 1. This prior distribution is used to characterize anomalies. The initial probability law of normal states before propagation is fully integrated with temporal correlation characteristics and historical state patterns. Using the prior distribution of state evolution as the initial iteration basis, a fixed number of iterations (5 to 10) are performed on the state transition frequency between each pair of anomalous event entities. During the iteration process, a temporal lag correlation index is introduced to weight and strengthen the state transition frequency. The higher the temporal lag correlation index of the anomalous event pair, the greater the increase in its state transition frequency update, thus highlighting the propagation weight of highly correlated anomalous events and weakening the interference of weakly correlated events. After the iteration is completed, all states... The state transition frequency is subjected to probability normalization. The normalization method is to divide the state transition frequency of each pair of anomalous events by the sum of the state transition frequencies of all anomalous event pairs, so that all processed values ​​converge to the interval between 0 and 1. The final two-dimensional matrix is ​​the state transition probability matrix. The rows of the matrix represent the starting anomalous event entity for state propagation, and the columns of the matrix represent the target anomalous event entity for state propagation. Each element in the matrix corresponds to the probability value of state propagation from the starting anomalous event entity to the target anomalous event entity, thus fully depicting the state evolution law between anomalous events.

[0039] Step 223: Using a preset association confidence threshold as the filtering benchmark, the state transition probability values ​​in the state transition probability matrix are truncated and filtered to obtain an initial association adjacency table. Specifically, this includes: combining the requirements of financial-grade cloud data center operation and maintenance management, and considering the fault sensitivity and operation and maintenance efficiency of core businesses, the association confidence threshold is set between 0.7 and 0.9. This threshold is used to strictly distinguish between real and valid anomaly propagation relationships and randomly generated weak or pseudo-associations; each state transition probability value in the state transition probability matrix is ​​compared with the preset association confidence threshold, retaining state transition relationships with probability values ​​greater than or equal to the association confidence threshold, and directly eliminating weak or meaningless propagation relationships with probability values ​​less than the association confidence threshold; after filtering, all retained valid state transition relationships are organized and categorized according to the format of starting anomaly event entity number, target anomaly event entity number, and corresponding state transition probability value, and sorted from high to low probability values ​​to form an initial association adjacency table containing only high-confidence propagation relationships. Each record in the table corresponds to a set of credible directed association relationships of anomaly events.

[0040] Step 224: Reconstruct the directed connection topology between abnormal event entities based on the initial association adjacency list. Traverse the connected components in the directed connection topology, remove isolated entity nodes and unidirectional broken paths, and obtain a preliminary association subgraph structure. Specifically, this includes: using the initial association adjacency list as the core construction basis, rebuild the directed connection topology structure between abnormal event entities. Each node in the topology uniquely corresponds to an abnormal event entity, and each directed edge in the topology corresponds to the state transition relationship in the initial association adjacency list. The direction of the directed edges strictly follows the propagation direction of the state transition probability matrix, representing the propagation path of the abnormal state from the starting node to the target node. After the topology is constructed, use a depth-first traversal to traverse all connected components in the directed connection topology, one by one. Invalid nodes and invalid paths in the topology are identified. Isolated entity nodes are defined as nodes with both in-degree and out-degree of 0, meaning they exist independently without any incoming or outgoing edges. One-way broken paths are defined as paths where the out-degree of the terminal node is 0 and there is only a single incoming edge, or paths where the in-degree of the starting node is 0 and there is only a single outgoing edge. Such paths cannot form continuous fault propagation logic and are considered invalid topologies. Identified isolated entity nodes are removed directly from the topology. At the same time, all associated edges and terminal invalid nodes corresponding to one-way broken paths are deleted, leaving only topologies with continuous propagation characteristics and interconnected nodes. The regularized topology after invalid structure removal is the preliminary associated subgraph structure.

[0041] Step 225 involves performing multiple rounds of iterative pruning and confidence recalibration on the initial association subgraph structure until the minimum state transition probability values ​​between all entity nodes in the initial association subgraph structure meet the association confidence threshold and the topological connection relationship remains stable, thus obtaining the candidate abnormal event association subgraph. Specifically, this includes: performing multiple rounds of iterative pruning on the initial association subgraph structure, setting the maximum number of iterations to 15 to avoid infinite iteration; in each iteration, re-extracting the state transition probability values ​​corresponding to all directed edges in the subgraph; removing association edges whose probability values ​​are still lower than the association confidence threshold from the topology; and simultaneously recalibrating the confidence of the association transmission strength between the remaining nodes after pruning. The recalibration method is based on the topological values ​​of the remaining nodes. The connection weights and temporal lag correlation indices are used to recalculate the state transition probabilities between nodes using a weighted average, correcting for changes in overall propagation weights caused by pruning associated edges. After each iteration, a dual convergence condition check is performed on the topology. The first check condition is that the minimum state transition probability between all entity nodes in the subgraph is greater than or equal to the association confidence threshold. The second check condition is that the number of nodes and the connection relationships of associated edges in the subgraph do not change for three consecutive iterations. The pruning and confidence recalibration process is repeated until both check conditions are met, at which point the topology enters a stable convergence state and no longer undergoes any structural changes. The regular topology that has converged at this point is the candidate abnormal event association subgraph.

[0042] By aligning time-series slices with the final offset, feature comparisons of different anomalies are established on a time-series basis. Relying on the time-series lag correlation index calculated by the lag time window and feature mutual information, the causal transmission delay between anomalies is captured. Combined with the state transition probability matrix constructed by time-series correlation and historical states, the true evolution law of anomalies in the financial cloud environment can be objectively reflected.

[0043] In a preferred embodiment of the present invention, step 3 above maps the temporal propagation window and topological influence domain of each abnormal event entity in the candidate abnormal event association subgraph to a two-dimensional feature polygon, performs intersection and difference operations on the two-dimensional feature polygon to obtain an effective overlapping region; based on the effective overlapping region, spurious related concurrent branch paths and feedback loop interference data are removed, and the fault propagation causal chain is reconstructed, which may include: In this embodiment of the invention, step 330 involves extracting the temporal propagation window parameters and topological influence domain boundary data of each abnormal event entity in the candidate abnormal event association subgraph; mapping the temporal propagation window parameters to linear intervals in the time axis dimension, mapping the topological influence domain boundary data to geometric contours in the spatial dimension, and fusing the linear intervals and geometric contours to construct a two-dimensional feature polygon; specifically, after the candidate abnormal event association subgraph is determined, each abnormal event entity in the subgraph is traversed one by one, and two types of core data are extracted from the structured abnormal event sequence, the temporal alignment feature sequence, and the previously generated extended influence domain data; the first type is the temporal propagation window parameters, specifically including abnormal The event start time stamp, the duration of the abnormal event's own continuous impact, the maximum propagation lag time of the abnormal event within the cloud data center, and the end time stamp when the abnormal event completely dissipates are all included. The end time stamp is obtained by adding the start time stamp, the duration of its own continuous impact, and the maximum propagation lag time, which fully covers the entire time cycle of the abnormal event from triggering, propagation, to dissipation. The second category is the topological influence domain boundary data, which is the coordinates of all vertices of the extended influence domain polygon obtained in step 113. This coordinate system adopts the topological projection coordinate system constructed in step 110 and can characterize the spatial coverage boundary of physical devices and business nodes within the k-order adjacency range of the abnormal event in the operation and maintenance knowledge graph.

[0044] A unified two-dimensional spatiotemporal mapping coordinate system is constructed, with the horizontal axis set as the time axis and the scale using second-level timestamps consistent with operation and maintenance monitoring. The vertical axis continues the spatial axis of the topology projection coordinate system, used to characterize the topology hierarchy and business correlation strength of abnormal events. The extracted time-series propagation window parameters are mapped to the time axis, forming a linear interval in the time dimension. The left boundary value of this interval is the start timestamp of the abnormal event, and the right boundary value is the end timestamp of the complete dissipation of the abnormal event. The length of the interval directly corresponds to the overall time span of the abnormal event's impact. The topology influence domain boundary data is mapped to the spatial axis, and the vertical coordinates of all vertices of the extended influence domain polygon in the topology projection coordinate system are extracted. The minimum and maximum values ​​of the vertical coordinates are calculated and used as the upper and lower boundaries of the spatial geometric contour. The lateral extension of the contour is perfectly aligned with the linear time interval. In the two-dimensional spatiotemporal mapping coordinate system, the left and right endpoints of the linear time interval and the upper and lower extreme points of the spatial geometric contour are used as basic vertices. Then, the middle contour vertices of the extended influence domain polygon are introduced. All vertices are connected in sequence according to the coordinate order to form an irregular polygon structure with closed ends. This structure is the two-dimensional feature polygon corresponding to a single abnormal event entity. The lateral dimension of each two-dimensional feature polygon corresponds to the temporal propagation range of the abnormal event, and the vertical dimension corresponds to the topological influence range of the abnormal event. The internal region of the polygon completely covers all possible spatiotemporal influence positions of the abnormal event in the financial-grade cloud data center. Moreover, each abnormal event entity corresponds to only one two-dimensional feature polygon, and there is no coordinate conflict or contour overlap ambiguity.

[0045] Step 331: Based on two-dimensional feature polygons, perform intersection operations on the two-dimensional feature polygons corresponding to the temporally adjacent and topologically connected anomaly entities in the candidate anomaly event association subgraph to extract overlapping coverage areas, and perform subtraction operations on the non-overlapping independent divergent areas to obtain effective overlapping regions. Specifically, in the candidate anomaly event association subgraph, first, all anomaly event entities are paired and filtered, retaining only entity pairs that simultaneously satisfy temporal adjacency and topological connectivity. The criterion for temporal adjacency is that the linear time intervals of two anomaly events are continuously connected or partially overlapped, and the overlap length is not less than the minimum allowable duration of fault propagation in a financial-grade cloud data center. This duration is set to 1 second based on actual operation and maintenance experience to ensure that the two anomaly events have temporal propagation correlation. The criterion for topological connectivity is that two anomaly event entities have a direct directed connection edge in the candidate anomaly event association subgraph, possessing the topological basis for state propagation. Entity pairs without a direct connection edge are directly excluded and do not participate in subsequent geometric operations.

[0046] Spatial intersection operation is performed on the two sets of selected two-dimensional feature polygons. Specifically, the operation involves traversing all edges of the two polygons, calculating the coordinates of the intersection points for each set of edges, and retaining the set of coordinate points simultaneously located within both polygons. These intersection points, along with a common vertex, form a closed region, which represents the overlapping area of ​​the spatiotemporal impacts of the two anomalous events. The area of ​​intersection of these overlapping areas is calculated using a double integral formula. ,in Let be the intersection area of ​​two two-dimensional feature polygons. The first part is a closed integration region that overlaps with two polygonal spaces. This region is continuously enclosed by the intersection points of the edges and common vertices. The integration result is the actual geometric area of ​​the overlapping coverage area. After completing the intersection operation, the difference operation is performed on the non-overlapping independent divergence regions of the two polygons. The first set of independent divergence areas is the total area of ​​the first two-dimensional feature polygon minus the intersection area, and the second set of independent divergence areas is the total area of ​​the second two-dimensional feature polygon minus the intersection area. These two independent divergence regions only represent the independent diffusion regions of a single anomalous event and do not have mutual fault transmission correlation. They are redundant regions with no analytical value. The above two sets of independent divergence regions are completely removed from the overall spatiotemporal operation region, and only the closed coordinate region corresponding to the intersection area is retained. This region is the effective overlapping region. On this basis, the area ratio of the effective overlapping region is calculated by dividing the area of ​​the effective overlapping region by the total area of ​​the larger polygon in the two sets of two-dimensional feature polygons. The ratio is used to quantify the coupling tightness of the spatiotemporal influence between the two anomalous events. The higher the ratio, the stronger the fault transmission correlation between the two anomalous events. The lower the ratio, the weaker the correlation between the two.

[0047] Step 332: Based on the geometric connectivity features and area ratio of the effective overlapping regions, identify branch path nodes and closed-loop feedback nodes in the candidate abnormal event association subgraph. Concurrent branches with an area ratio lower than a preset interference threshold and located on a non-main propagation timeline are marked as pseudo-correlated branch paths. Closed topologies that trigger timeline backflow and state loop jumps are marked as feedback loop interference data. Pseudo-correlated branch paths and feedback loop interference data are extracted from the candidate abnormal event association subgraph. Specifically, this includes: combining the high stability and low interference operation and maintenance requirements of financial-grade cloud data centers, a preset interference threshold is set. This threshold is obtained through training on massive historical fault data and is set to 0.25 to distinguish between effective coupling associations and random weak interference associations. The effective overlapping regions of all abnormal event entity pairs are traversed one by one, and the geometric connectivity features and area ratio values ​​of the regions are extracted. The geometric connectivity features include the number of connected components in the effective overlapping regions, whether the region outline is a single connected structure, whether it forms a closed loop structure with the beginning and end connected, and whether the spatiotemporal direction of the region edge is consistent with the main propagation timeline.

[0048] First, identify the branch path nodes in the candidate abnormal event association subgraph. Branch path nodes are abnormal event entity nodes with a topological out-degree greater than or equal to two. These nodes will simultaneously propagate abnormal states to multiple topological directions, forming multiple concurrent branch paths. For each concurrent branch, first determine the area ratio of its corresponding effective overlapping region. Branches with an area ratio lower than a preset interference threshold are marked as weakly coupled branches. Then, further determine the temporal direction of the branch. The main propagation temporal axis is the core propagation path in the candidate abnormal event association subgraph that extends continuously in time, has the highest topological connection density, and has an overall effective overlapping region area ratio higher than the interference threshold. If the temporal direction of a weakly coupled branch deviates from the main propagation temporal axis and there is no continuous spatiotemporal coupling relationship to support fault propagation, then all abnormal event entity nodes and directed connection edges contained in the branch are uniformly marked as pseudo-related branch paths. These branches are mostly randomly generated irrelevant anomalies and do not participate in the real fault propagation process.

[0049] Identify closed-loop feedback nodes, which are abnormal event entities that can form directed closed loops with upstream or downstream nodes. If the two-dimensional feature polygons of multiple abnormal events form a closed loop structure through effective overlapping areas, further verify the timing and state characteristics within the loop. When a backflow phenomenon occurs, i.e., the later-occurring abnormal event points back to the earlier-occurring abnormal event, and the abnormal state exhibits cyclical jumps between loop nodes without a tendency to converge towards the terminal node, the entire closed topology is marked as feedback loop interference data. Such loops can cause confusion in fault propagation logic and fail to reflect the true propagation path. After marking the pseudo-correlated branch paths and feedback loop interference data, locate all abnormal event entity nodes and directed connection edges corresponding to the above two types of interference structures in the candidate abnormal event association subgraph, perform a removal operation, and completely strip away all interference nodes and connection relationships, retaining only the core topology propagation structure with an effective overlapping area ratio higher than the interference threshold, a timing direction completely consistent with the main propagation timing axis, and no closed loop structure.

[0050] Step 333 involves performing path backtracking and directional convergence processing on the remaining topology after removing interference data. The core event entity nodes are connected in series along the temporal evolution direction to reconstruct the fault propagation causal chain. Specifically, this includes: performing path backtracking processing on the remaining core topology after removing interference data; firstly, selecting terminal convergence nodes in the core topology; the criteria for determining terminal convergence nodes are that the topology out-degree is zero, there are no subsequent propagation target nodes, and they are the final objects affected by fault propagation; taking all terminal convergence nodes as the backtracking starting point, tracing upstream layer by layer along the reverse path of the directed connection edge, traversing the intermediate propagation nodes in turn, until tracing back to the initial abnormal node with a topology in-degree of zero and no upstream propagation source. This initial abnormal node is the potential source of fault propagation. In this way, all complete fault propagation paths with continuous spatiotemporal coupling relationships are sorted out.

[0051] All identified transmission paths undergo directional convergence processing. The matching degree between the node transmission order of each path and the occurrence sequence of abnormal events is verified one by one. The transmission direction of each path is uniformly corrected to ensure that the transmission direction of all paths is completely consistent with the evolution direction from early to late time. Scattered paths with contradictory transmission directions and temporal sequences are eliminated, adjacent paths with highly matched spatiotemporal characteristics are merged, and recurring intermediate transmission nodes are integrated to eliminate topological redundancy. This ensures that all retained transmission paths are logically singular, coherent, and conflict-free. According to the chronological evolution sequence, the initial abnormal node, intermediate transmission nodes at all levels, and terminal convergence node are sequentially and orderly connected to form a linear topology structure with no pseudo-correlated branches, no feedback loops, and unidirectional orderly transmission. This structure completely restores the entire process of the fault being triggered from the initial source, propagating step by step along the infrastructure, middleware, and business system, and finally converging to the terminal abnormal node. The directed connection relationship between nodes strictly corresponds to the real fault transmission logic, with no redundant associations or logical distortions. This is the reconstructed fault propagation causal chain.

[0052] By integrating the temporal propagation range and topological influence range of abnormal events into a two-dimensional spatiotemporal feature polygon, a geometric quantitative expression of abnormal correlation is achieved, which can intuitively distinguish between real fault propagation and random concurrent anomalies. Based on the area ratio and geometric connectivity characteristics of the effective overlapping region, pseudo-correlated branches and feedback loops of temporal backflow can be identified and eliminated. The fault propagation causal chain reconstructed through path backtracking and directional convergence is clear in time sequence and rigorous in transmission logic, which can truly restore the complete propagation path of financial-grade cloud data center faults.

[0053] In a preferred embodiment of the present invention, step 4 above, which extracts the terminal aggregation node features and topology in-degree accumulation index of the fault propagation causal chain, locates the unique identifier of the corresponding root cause abnormal event entity in the operation and maintenance knowledge graph; and uses the unique identifier of the root cause abnormal event entity as the retrieval anchor point to traverse the preset handling strategy knowledge base in the operation and maintenance knowledge graph to obtain the target abnormal event associated handling instruction, may include: In this embodiment of the invention, step 440 involves performing reverse topological backtracking on the fault propagation causal chain, extracting the temporal convergence characteristics and state anomaly amplitude parameters of the terminal nodes, and accumulating the topological connection weights of each upstream node layer by layer along the propagation path of the fault propagation causal chain to calculate the topological in-degree accumulation index. Specifically, this includes: in the reconstructed fault propagation causal chain, firstly locating the terminal convergence node through dual judgment conditions. The first judgment condition is that the topological out-degree is zero, that is, the node does not have any outwardly extending directed connection edges and cannot continue to propagate the abnormal state to other nodes; the second judgment condition is that the temporal convergence terminates, that is, the node... The abnormal state of a point no longer changes within multiple consecutive time slices, and the abnormal indicators tend to stabilize, making it the final convergence node of the entire fault propagation path. After the location is completed, the terminal aggregation node is used as the backtracking starting point to perform a reverse topology backtracking operation. The backtracking direction is completely opposite to the actual physical and business propagation direction of the fault. It traverses upstream layer by layer along the directed connection edges between nodes, passing through intermediate propagation nodes at each level in turn, until it reaches the initial trigger node in the fault propagation causal chain where the topological in-degree is zero and there is no upstream abnormal propagation source, ensuring complete coverage of all nodes and connections in the entire fault propagation path.

[0054] Throughout the reverse topology backtracking process, the temporal convergence characteristics of the terminal aggregation nodes are extracted synchronously. These characteristics include four refined quantitative indicators: temporal convergence duration, temporal deviation convergence amplitude, temporal stability fluctuation frequency, and temporal convergence matching degree. The temporal convergence duration is the actual time taken for the terminal node to go from the first occurrence of an abnormal state to the point where the abnormal indicator no longer changes. The temporal deviation convergence amplitude is the specific value at which the difference between the actual occurrence time of the terminal node and the benchmark time of the core financial business gradually narrows. The temporal stability fluctuation frequency is the number of fluctuations per second of the abnormal indicator after the abnormal state has converged and stabilized. The temporal convergence matching degree is the degree of fit between the terminal node's stable temporal state and the normal operation time standard of the financial business. Simultaneously, the state anomaly amplitude parameter of the terminal node is extracted. This parameter is obtained by subtracting the dynamic benchmark threshold from the actual value of the abnormal indicator and taking the absolute value. This absolute value is then multiplied by the anomaly duration to obtain the comprehensive state anomaly amplitude parameter. A larger value indicates a higher degree of deviation and impact of the node's anomaly.

[0055] Following the reverse backtracking propagation path, the topological connection weight between each upstream node and its corresponding downstream node is extracted layer by layer. This topological connection weight is directly taken from the corresponding state transition probability value in the state transition probability matrix calculated in step 222. The higher the state transition probability value, the stronger the fault propagation correlation between the two nodes, and the larger the corresponding topological connection weight. The topological connection weights of all traversed upstream nodes are accumulated layer by layer. The accumulation method is to add the topological connection weight of the currently traversed node to the sum of the weights of all previously traversed nodes. The accumulation result is updated after each node traversal is completed, until the weights of all nodes from the initial node to the terminal convergence node are accumulated. The final total accumulated value is the topological in-degree accumulation index, calculated using the following formula: ,in This is the cumulative in-degree metric for the topology. The total number of nodes in the fault propagation causal chain, from the initial node to the terminal node. The first in the fault propagation path The topology connection weight corresponding to each node. The higher the value of this indicator, the higher the degree of core convergence of the node in the fault propagation link, and the greater the possibility of it being the root cause of the fault.

[0056] Step 441: Encode the temporal convergence features and the topology in-degree cumulative index using feature vectorization to obtain the root cause localization retrieval vector. Based on the root cause localization retrieval vector, perform feature space similarity matching in the entity index of the operation and maintenance knowledge graph to filter out the candidate root cause entity set with similarity higher than the preset matching threshold. Specifically, this includes: performing min-max normalization on the extracted four temporal convergence features (temporal convergence duration, temporal deviation convergence amplitude, temporal stability fluctuation frequency, and temporal convergence matching degree), as well as six feature data (state anomaly amplitude parameter and topology in-degree cumulative index). The normalization method is to subtract the minimum value of the current feature value from the minimum value of that type of feature, and then divide by the maximum value of that type of feature. Subtracting the minimum value, all feature values ​​are uniformly mapped to the range of 0 to 1, eliminating the magnitude differences and numerical deviations between different feature indicators. Following a fixed and uniform dimensional order, feature vectorization encoding is performed on the six normalized feature data. The order is as follows: time series convergence duration, time series deviation convergence amplitude, time series stability fluctuation frequency, time series convergence matching degree, state anomaly amplitude parameter, and topological in-degree cumulative index. The six normalized values ​​are then concatenated sequentially to form a continuous and complete six-dimensional feature vector. This vector is the root cause localization retrieval vector. Each dimension in the vector corresponds to the core features of fault propagation and node status, with no redundant dimensions or invalid information.

[0057] Using the root cause localization retrieval vector as the matching benchmark, cosine similarity is calculated for the standard feature vectors of all abnormal event entities in the entity index of the operation and maintenance knowledge graph. The similarity value measures the degree of matching between the retrieval vector and the entity features. The specific calculation formula is as follows: ,in The similarity value is the feature space value. For root cause localization retrieval vector number 1 dimensional feature values, For the standard feature vector of abnormal event entities in the operation and maintenance knowledge graph entity index library The closer the similarity value of the feature values ​​is to 1, the higher the feature matching degree between the two entities, and the greater the likelihood that the entity is the root cause of the fault. In combination with the operation and maintenance requirements of financial-grade cloud data centers for high-precision and low-false-judgment root cause location, the feature matching threshold is set to 0.85. The similarity values ​​of all abnormal event entities are calculated and compared with the matching threshold one by one. All abnormal event entities with similarity values ​​greater than or equal to 0.85 are screened out and summarized to form a candidate root cause entity set. All entities in the set are highly matched with the fault transmission characteristics and have a high credibility as the root cause of the fault.

[0058] Step 442: Based on the cumulative in-degree index, perform a confidence-weighted ranking of each candidate entity in the candidate root cause entity set, and determine the candidate entity ranked first as the root cause anomalous event entity. Specifically, this includes: for each candidate entity in the candidate root cause entity set, using its corresponding cumulative in-degree index as the core weighting criterion, calculate the root cause confidence score of the entity. The calculation method is to multiply the cumulative in-degree index by a fixed weighting coefficient of 1.0, and directly use the cumulative in-degree index value as the root cause confidence score. The higher the cumulative in-degree index value, the higher the corresponding root cause confidence score. If there are multiple candidate entities... If the cumulative in-degree index values ​​are the same, the state anomaly amplitude parameter is further compared. Entities with higher parameter values ​​have higher confidence scores. All candidate entities in the candidate root cause entity set are sorted in descending order of root cause confidence scores. After sorting, the candidate entity ranked first in the sorting results is selected as the final root cause anomaly event entity. This entity is the core node with the highest degree of transmission and convergence, the highest feature matching degree, and the strongest correlation with the entire fault link in the fault propagation causal chain. It is also the original root node that triggers all subsequent derivative anomalies and constitutes the complete fault propagation causal chain.

[0059] Step 443: Using the root cause anomaly entity as the query benchmark, extract the corresponding unique identifier of the root cause anomaly entity from the node attribute structure of the operation and maintenance knowledge graph. Specifically, each anomaly entity in the operation and maintenance knowledge graph corresponds to an independent and complete node attribute structure. This structure contains four core contents: entity topology attribution information, business association information, status monitoring information, and globally unique identifier information. Among them, the globally unique identifier information is the core field that distinguishes different anomaly entities. Using the identified root cause anomaly entity as the query benchmark, locate the corresponding node attribute structure of the entity in the operation and maintenance knowledge graph and extract the globally unique root cause anomaly entity identifier from it. This entity unique identifier is generated using a multi-level standardized combination coding rule, and is composed of six parts in sequence: availability zone code, monitoring agent node number, anomaly object type code, anomaly type code, anomaly occurrence timestamp sequence number, and random check code. All codes use a unified number and letter combination format, which has global uniqueness in the entire financial-grade cloud data center operation and maintenance knowledge graph. This can achieve unambiguous location of the root cause entity and also serve as the unique retrieval anchor point for retrieval and handling strategies, without duplicate, conflict, or retrieval deviation issues.

[0060] Step 444: Using the unique identifier of the root cause anomaly entity as the retrieval anchor, perform an association mapping query in the pre-set handling strategy knowledge base of the operation and maintenance knowledge graph to obtain the initial handling strategy set bound to the root cause anomaly entity and the associated impact scope tags. Specifically, the operation and maintenance knowledge graph pre-builds and stores a handling strategy knowledge base adapted to financial-grade cloud data centers. The knowledge base stores standardized handling strategies for all scenarios according to anomaly type, anomaly object, device level, and business type. Each handling strategy is bound one-to-one with the unique identifier of a specific anomaly entity. The strategy content covers infrastructure fault repair, middleware service restart, business traffic switching, alarm information reporting, and permission isolation and control. The entire process of operation and maintenance is carried out; using the unique identifier of the root cause anomaly entity as the retrieval anchor, a correlation mapping query is performed in the handling strategy knowledge base to match all handling strategies directly bound to the identifier. All successfully matched handling strategies are summarized and integrated to form an initial handling strategy set adapted to the current root cause anomaly; at the same time, the associated impact scope label attached to each handling strategy in the initial handling strategy set is extracted. The label contains detailed fields, namely, the type of affected business link, the associated infrastructure level, the coverage availability zone range, the impact scope of core financial transactions, the operation and maintenance permission level, the strategy execution risk level, and the strategy applicable scenario, which are used to clearly define the execution boundary, applicable objects, and control scope of each handling strategy.

[0061] Step 445: Based on the topology coverage area and associated impact area labels of the fault propagation causal chain, perform spatial overlay comparison to filter out a subset of handling strategies covering the currently affected service links from the initial handling strategy set. Specifically, this includes: extracting the complete topology coverage area corresponding to the fault propagation causal chain, which includes the topology coordinates and attribution information of all abnormal event entities, associated physical servers, network switches, storage devices, virtualization containers, core business interfaces, and financial transaction links within the causal chain, fully covering the actual affected areas of this fault at the infrastructure layer, middleware layer, and business layer; and performing multi-dimensional spatial comparison between this topology coverage area and the associated impact area labels of each strategy in the initial handling strategy set. The comparison process involves four dimensions: availability zone range, infrastructure level, business link type, and transaction impact range. During the comparison, strategies that completely or partially overlap with the fault topology coverage area are retained. These strategies can accurately target the service links and device nodes currently affected by the fault. Irrelevant strategies that have no overlap with the fault topology coverage area and are only applicable to other business scenarios or device areas are removed. Redundant strategies that have an impact range far exceeding the actual fault area and are likely to cause excessive maintenance and business interference after execution are also removed. After layer-by-layer screening and elimination, all remaining effective strategies together form a subset of strategies adapted to the current fault scenario.

[0062] Step 446: Based on the state anomaly amplitude parameters of each abnormal event entity and the execution priority rules in the handling strategy subset, perform dependency parsing and timing arrangement on the handling strategy subset to obtain a standardized handling operation sequence. Specifically, this includes: based on the state anomaly amplitude parameters of each abnormal event entity in the fault propagation causal chain, combined with the preset execution priority rules of the handling strategy subset, performing a five-level priority division on all handling strategies within the strategy subset. The priority determination rule is as follows: the handling strategy for the core business node with the highest state anomaly amplitude parameter is given first-level priority; the infrastructure fault repair strategy is given second-level priority; the middleware anomaly recovery strategy is given third-level priority; the business traffic adjustment strategy is given fourth-level priority; and the alarm notification and log recording strategy is given fifth-level priority. The smaller the priority value, the earlier the execution order. All handling strategies within the handling strategy subset are then executed. Dependency analysis categorizes the execution relationships between strategies into three types: pre-dependencies, parallel execution relationships, and post-dependencies. Pre-dependencies mean that a strategy can only start after another strategy has been executed. Parallel execution relationships mean that multiple strategies have no execution dependencies and can operate simultaneously. Post-dependencies mean that the strategy must be executed after all core handling strategies have been executed. Following a priority order from level one to five, and combining the analyzed dependencies, the handling strategies are sequentially arranged. Level one pre-dependencies are prioritized, followed by parallel strategies of the same level, and then level two to five strategies are arranged in sequence. The execution object, execution steps, execution timing, and execution duration of each operation are determined, forming a continuous and orderly operation process without execution conflicts, logical confusion, and conforming to the operational standards of financial-grade cloud data centers. This process is the standardized handling operation sequence.

[0063] Step 447 involves encapsulating the standardized handling operation sequence into an instruction format and adding corresponding root cause localization identifiers and impact scope parameters to obtain the target abnormal event-related handling instructions. Specifically, this includes: encapsulating the standardized handling operation sequence in a unified format according to the general instruction format specifications of the financial-grade cloud data center operation and maintenance automation management platform; converting each handling operation into instruction statements that the operation and maintenance execution terminal can directly recognize, parse, and execute; unifying the instruction's field names, parameter formats, calling interfaces, execution permissions, and return formats to ensure that the instructions fully adapt to the operation and maintenance platform's interaction standards; and including the encapsulated instruction body... Add root cause identification and fault impact range parameters. The root cause identification is the unique identifier of the root cause abnormal event entity extracted in step 443, used to mark the root cause of the fault corresponding to the instruction, so that operation and maintenance personnel can quickly locate the core of the problem. The fault impact range parameter includes information such as the affected availability zone number, the list of faulty device nodes, the name of the core business link, the duration of the abnormal impact, and the topology coverage, used to limit the execution scope of the instruction and avoid business risks caused by execution beyond the scope. After completing the format encapsulation, identification addition and parameter configuration, the final standardized target abnormal event associated handling instruction that can be directly issued to the automated execution terminal is generated.

[0064] By extracting multi-dimensional fault features through reverse topology backtracking and combining them with topology in-degree cumulative indicators, root cause localization is achieved, pinpointing the original root cause of the fault. The actual fault propagation range is combined to screen handling strategies, eliminating irrelevant and redundant solutions to avoid missing handling or excessive maintenance. The handling process is arranged according to the magnitude of the anomaly and execution dependencies, ensuring that the operation sequence fully conforms to the fault propagation logic and operation and maintenance management requirements of financial-grade cloud data centers. The final standardized handling instructions can be directly and automatically executed, shortening the fault response and handling time and improving the efficiency of anomaly handling.

[0065] like Figure 2 As shown, embodiments of the present invention also provide an anomaly event association processing system based on an operation and maintenance knowledge graph, including: The feature aggregation module is used to take each abnormal event entity in the structured abnormal event sequence as an input node set, and based on the topological mapping position of the input node set in the preset operation and maintenance knowledge graph, aggregate the k-order adjacency topological features and business semantic embedding features of each input node to obtain the graph event representation vector. The association subgraph module is used to perform pairwise comparison and temporal alignment of the feature vectors representing different abnormal event entities in the event representation vector of the graph, iteratively calculate the temporal lag correlation index and state transition probability matrix between each abnormal event entity, and converge to obtain the candidate abnormal event association subgraph based on the state transition probability matrix and the preset association confidence threshold. The causal chain reconstruction module is used to map the temporal propagation window and topological influence domain of each abnormal event entity in the candidate abnormal event association subgraph to a two-dimensional feature polygon. The intersection and difference operations are performed on the two-dimensional feature polygon to obtain the effective overlapping area. Based on the effective overlapping area, pseudo-correlated concurrent branch paths and feedback loop interference data are removed to reconstruct the fault propagation causal chain. The location and handling module is used to extract the terminal aggregation node characteristics and topology in-degree cumulative index of the fault propagation causal chain, locate the unique identifier of the corresponding root cause abnormal event entity in the operation and maintenance knowledge graph; use the unique identifier of the root cause abnormal event entity as the retrieval anchor point, traverse the preset handling strategy knowledge base in the operation and maintenance knowledge graph, and obtain the associated handling instructions of the target abnormal event.

[0066] It should be noted that this system is a system corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0067] Experimental example: Experiment Overview This experimental case addresses the accuracy requirements of abnormal event correlation analysis and fault root cause localization in financial-grade cloud data center operation and maintenance scenarios. It verifies the effectiveness of the abnormal event correlation processing method based on operation and maintenance knowledge graph. The experiment was conducted in the cloud data center environment of a large financial institution. This data center is deployed in 3 availability zones and carries key financial businesses such as core transaction system, clearing system and risk management platform.

[0068] The experiment collected six months of historical operation and maintenance monitoring data, covering 12,860 structured abnormal event records. The operation and maintenance knowledge graph contains 4,268 entity nodes and 18,356 relationship edges, covering three operation and maintenance dimensions: infrastructure layer, middleware layer, and business layer. The experiment focuses on verifying the processing effect of each step and the accuracy of the final root cause location and the effectiveness of the handling instructions.

[0069] Experimental conditions The experiment was conducted in a financial-grade cloud data center production environment, and the specific experimental configuration is shown in Table 1.

[0070] Table 1 Experimental Conditions Configuration items Parameter value Data collection cycle March-September 2025 (6 months) Total number of abnormal events 12,860 items Number of available zones 3 (North China A / B / C) Knowledge graph entity nodes 4268 Knowledge graph relation edges 18,356 k-order optimal adjacency order k=3 Association confidence threshold 0.85 Disposal Strategy Knowledge Base Entries 1256 items Comparison Methods Association rule mining, pure graph neural networks, expert experience judgment, CMDB topology III. Experimental Procedures and Results Step 1, Aggregation of Graph Event Representation Vectors: Each entity in the 12,860 structured anomaly events was mapped to the topological projection coordinate system of the operation and maintenance knowledge graph to construct a basic topological polygon. Business parameters and time-series indicators of each entity were extracted from the anomaly event sequence and the knowledge graph attribute library. Dynamic expansion coefficients were calculated, and parallel shift operations were performed to generate initial extended polygons. The extended polygons were spatially overlaid and matched with the preset k-order adjacency topological boundary to extract adjacency node information. Business attribute labels and state evolution sequences were weighted and fused. Finally, the graph event representation vector was obtained by tensor splicing. The experimental results are shown in Table 2.

[0071] Table 2 Results of topological feature aggregation in Step 1 k-order adjacency Feature Dimension Node coverage (%) Semantic embedding F1(%) Calculation time (ms) 1st order 64 42.5 78.3 12 2nd order 128 68.3 85.6 28 3rd order 256 85.7 92.1 45 4th order 448 93.2 93.8 72 5th level 640 97.1 94.0 108 6th order 832 98.8 94.1 156 Step 2, Construction of temporal lag correlation and candidate association subgraphs: The event representation vectors in the graph are reconstructed by temporal slicing to build an initial alignment matrix for anomalous event entity pairs, and temporal offset alignment is performed. The feature mutual information values ​​of each event pair are calculated within a preset lag time window, and after normalization mapping and cumulative iterative updates, a temporal lag correlation index is obtained. Based on this index and the historical frequency distribution of states, a prior distribution of state evolution is constructed. The state transition frequency is iteratively updated and probability normalized, converging to obtain the state transition probability matrix. A truncation and screening process is performed using an association confidence threshold (0.85) as the filtering benchmark. After multiple rounds of iterative pruning and confidence recalibration, a candidate anomalous event association subgraph is obtained. The experimental results are shown in Tables 3 and 4.

[0072] Table 3 Results of Time Lag Correlation Analysis in Step 2 Event type Events on quantity Optimal lag window (min) Average correlation index Separability Causal relationship 3256 5 0.91 high spurious correlation pairs 1842 15 0.21 high Independent events 2135 1 0.08 high Concurrent triggering reach 892 3 0.62 middle Table 4 shows the convergence results of candidate correlation subgraph pruning in step 2. Test Project initial value Convergence value Pruning cycle Number of nodes in the subgraph 48 10 10 rounds Subgraph edge count 86 12 10 rounds Minimum transition probability 0.32 0.85 10 rounds Number of orphaned nodes removed — 6 — Number of unidirectional fracture paths removed — 8 — like Figure 3 As shown, the correlation index of causal event pairs is highest (0.91) when the lag window is 5 minutes, while the correlations of spurious event pairs and independent event pairs are only 0.21 and 0.08, respectively. The three types of event pairs can be clearly distinguished, as shown below. Figure 4 As shown, after 10 rounds of iterative pruning, the subgraph converged from the initial 48 nodes and 86 edges to 10 nodes and 12 edges, and the minimum state transition probability increased from 0.32 to the association confidence threshold of 0.85, while the topology remained stable.

[0073] Step 3, Causal Chain Reconstruction The temporal propagation window parameters and topological influence domain boundary data of each anomalous event entity in the candidate correlation subgraph are extracted. The temporal window is mapped to a linear time interval, and the topological influence domain is mapped to a spatial geometric contour. A two-dimensional feature polygon is constructed by fusing these parameters. For temporally adjacent and topologically connected events, the intersection operation is performed on the corresponding two-dimensional feature polygons to extract the overlapping coverage area. For non-overlapping independent divergent areas, the difference operation is performed to obtain the effective overlapping region. Based on the geometric connectivity features and area ratio of the effective overlapping region, pseudo-correlation branch paths and feedback loop interference data are identified and removed, and the fault propagation causal chain is reconstructed. The experimental results are shown in Table 5.

[0074] Table 5 Results of Causal Chain Reconstruction in Step 3 Test Project numerical values Accuracy of causal chain reconstruction 94.6% Causal chain reconstruction recall rate 91.8% Causal chain reconstruction F1 value 93.2% Number of pseudo-related branch paths removed 23 articles Number of feedback loop interference data removed 8 Average percentage of effective overlapping area 62.5% Preset interference threshold 35% Average length of a causal chain (number of nodes) 6.3 like Figure 5As shown, the quality of causal chain reconstruction is positively correlated with the proportion of effective overlap area. When the overlap area exceeds 35% (preset interference threshold), precision, recall, and F1 score all rise rapidly and tend to stabilize (F1>90%). When the overlap area is in the range of 60% to 80%, the reconstruction F1 score reaches the final range (93% to 95%), indicating that the overlap operation of feature polygons in this range can most effectively distinguish between true causal propagation and spurious correlation interference.

[0075] Step 4: Root cause identification and treatment instruction generation The terminal aggregation node characteristics and topology in-degree cumulative index of the fault propagation causal chain are extracted. Reverse topology backtracking is performed in the operation and maintenance knowledge graph to locate the unique identifier of the corresponding root cause abnormal event entity. Using this identifier as the retrieval anchor point, the preset handling strategy knowledge base is traversed. Multi-dimensional spatial overlay comparison is performed in combination with the fault topology coverage to filter out the subset of handling strategies covering the currently affected service links. Dependency relationship parsing and time sequence arrangement are performed according to the state abnormality amplitude parameters and execution priority rules of each event entity. Finally, standardized target abnormal event associated handling instructions are encapsulated and generated. The experimental results are shown in Table 6.

[0076] Table 6 Results of Root Cause Locator and Treatment in Step 4 Test Project This application Association rule mining Pure graph neural networks Expert experience assessment CMDB Topology Root cause localization accuracy 93.5% 68.2% 75.8% 62.3% 70.5% Average response time 4.2 min 15.8 min 8.5 min 22.6 min 12.3 min False alarm rate 3.8% 18.5% 12.2% 25.3% 15.8% Effectiveness of the treatment 91.2% 65.3% 72.8% 58.5% 68.2% Automation rate of handling instructions 96.5% 45.2% 78.3% 12.5% 52.8% like Figure 6 As shown, during the expansion of the knowledge graph from 500 nodes to 20,000 nodes, the root cause localization accuracy of this application consistently remained above 87.3%, far superior to traditional rule matching (53.5%) and random walk (44.2%). Figure 7 As shown, based on the comprehensive comparison of the four-dimensional indicators, this application is significantly better than the four comparison methods in terms of root cause localization accuracy (93.5%), false alarm rate (3.8%), average response time (4.2 minutes), and treatment effectiveness (91.2%).

[0077] IV. Experimental Conclusions A graph event representation vector generation method based on k-order adjacency topology feature aggregation achieves a final balance between feature dimension (256 dimensions) and node coverage (85.7%) when k=3, with a semantic embedding F1 score of 92.1%, laying a high-quality feature foundation for subsequent association analysis. The temporal lag correlation analysis method calculates feature mutual information values ​​through a sliding window, effectively distinguishing causal event pairs (correlation 0.91) from pseudo-correlation / independent event pairs (correlation <0.21), achieving the best distinction effect in the final lag window of 5 minutes. An iterative pruning strategy based on association confidence thresholds converges within 10 rounds, reducing the candidate subgraph from 48 nodes to 10 nodes. A two-dimensional feature polygon overlap operation method, through joint temporal-spatial dual-dimensional judgment, effectively identifies and... After removing 23 pseudo-related branch paths and 8 feedback loop interference data, the causal chain reconstruction F1 score reached 93.2%, significantly outperforming single-dimensional judgment methods. The root cause localization method, which combines reverse topology backtracking with the cumulative topology in-degree index, still maintains an accuracy of over 87.3% on a graph with 20,000 nodes, improving by 32.0% compared to traditional rule matching and 17.7% compared to pure graph neural networks. This fully verifies the robustness of the proposed method in a large-scale knowledge graph environment. The proposed method reduces the average fault response time to 4.2 minutes (81.4% lower than expert experience judgment), reduces the false alarm rate to 3.8%, achieves a handling effectiveness of 91.2%, and an automation rate of 96.5% for handling instructions, realizing a fully intelligent closed loop from abnormal event correlation analysis to standardized handling instruction generation.

[0078] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for handling abnormal event association based on operation and maintenance knowledge graph, characterized in that, The method includes: Step 1: Take each abnormal event entity in the structured abnormal event sequence as the input node set. Based on the topological mapping position of the input node set in the preset operation and maintenance knowledge graph, aggregate the k-order adjacency topological features and business semantic embedding features of each input node to obtain the graph event representation vector. Step 2: Perform pairwise comparison and temporal alignment of the feature vectors representing different abnormal event entities in the event representation vector of the graph, and iteratively calculate the temporal lag correlation index and state transition probability matrix between each abnormal event entity; based on the state transition probability matrix and the preset association confidence threshold, converge to obtain the candidate abnormal event association subgraph. Step 3: Map the temporal propagation window and topological influence domain of each abnormal event entity in the candidate abnormal event association subgraph to a two-dimensional feature polygon. Perform intersection and difference operations on the two-dimensional feature polygon to obtain the effective overlapping area. Based on the effective overlapping area, remove pseudo-correlated concurrent branch paths and feedback loop interference data to reconstruct the fault propagation causal chain. Step 4: Extract the terminal aggregation node features and topology in-degree cumulative index of the fault propagation causal chain, and locate the unique identifier of the corresponding root cause abnormal event entity in the operation and maintenance knowledge graph; using the unique identifier of the root cause abnormal event entity as the retrieval anchor point, traverse the preset handling strategy knowledge base in the operation and maintenance knowledge graph to obtain the target abnormal event associated handling instructions.

2. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 1, characterized in that, Before step 1, the raw operation and maintenance telemetry data reported by the multi-source monitoring agent nodes in each availability zone of the financial-grade cloud data center is obtained, and the raw operation and maintenance telemetry data is processed to obtain a structured abnormal event sequence.

3. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 2, characterized in that, Step 1 includes: Map each anomalous event entity in the structured anomalous event sequence to the topological projection coordinate system to construct a basic topological polygon; From the structured abnormal event sequence and the preset operation and maintenance knowledge graph attribute library, the business parameters and time series indicators of each abnormal event entity are extracted, and the business parameters and time series indicators are fused to obtain the dynamic expansion coefficient corresponding to each input node. The normal offset distance of each vertex of the basic topological polygon is determined based on the dynamic expansion coefficient. Parallel translation operation is performed along the outward normal direction of each edge of the basic topological polygon to obtain the initial offset contour. Topological clipping and arc transition processing are performed on the self-intersection region of the edge lines and sharp corners caused by the outward expansion in the initial offset contour to obtain the initial extended polygon. Spatially overlay and match the initial extended polygon with the preset k-order adjacency topology boundary in the operation and maintenance knowledge graph to obtain an extended influence domain polygon covering the k-order adjacency relationship. Within the spatial range defined by the extended influence domain polygon, matching adjacent nodes are retrieved, and the business attribute labels and state evolution sequences of each adjacent node are extracted. The business attribute labels and state evolution sequences are then fused with feature weighting to obtain the business semantic embedding features of each input node. Spatially align and tensor-concatenate the adjacency topology features corresponding to the extended influence domain polygon with the business semantic embedding features to obtain the graph event representation vector.

4. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 3, characterized in that, The feature vectors representing different anomalous event entities in the event representation vector of the graph are compared pairwise and aligned temporally. The temporal lag correlation index and state transition probability matrix between each anomalous event entity are calculated iteratively, including: The event representation vectors in the graph are reconstructed by time-series slicing to build an initial alignment matrix representing the cross-time-series features of abnormal event entities; the initial alignment matrix is ​​then subjected to time-series offset alignment processing to obtain a time-series aligned feature sequence. Based on the time-aligned feature sequence, the feature mutual information value of each abnormal event entity pair is calculated by sliding within a preset lag time window. The feature mutual information value is normalized, mapped, and iteratively updated to obtain a time-lag correlation index that characterizes the intensity of causal transmission delay. Based on the temporal lag correlation index and the historical frequency distribution of the states of each anomalous event entity extracted from the structured anomalous event sequence at different time periods, a state evolution prior distribution is constructed. Based on the state evolution prior distribution, the state transition frequency between each anomalous event entity is iteratively updated in combination with the temporal lag correlation index, and the updated transition frequency is subjected to probability normalization processing to converge to obtain the state transition probability matrix.

5. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 4, characterized in that, Based on the state transition probability matrix and a preset association confidence threshold, a candidate abnormal event association subgraph is obtained through convergence, including: Using a preset association confidence threshold as the filtering criterion, the state transition probability values ​​in the state transition probability matrix are truncated and filtered to obtain the initial association adjacency list. Based on the initial association adjacency list, the directed connection topology between abnormal event entities is reconstructed. The connected components in the directed connection topology are traversed, and isolated entity nodes and unidirectional broken paths are removed to obtain the preliminary association subgraph structure. Multiple rounds of iterative pruning and confidence recalibration are performed on the initial association subgraph structure until the minimum state transition probability values ​​between each entity node in the initial association subgraph structure all meet the association confidence threshold and the topological connection relationship remains stable, thus obtaining the candidate abnormal event association subgraph.

6. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 5, characterized in that, The temporal propagation window and topological influence domain of each anomaly entity in the candidate anomaly event association subgraph are mapped to two-dimensional feature polygons. Intersection and difference operations are performed on these two-dimensional feature polygons to obtain the effective overlapping region. Based on the effective overlapping region, spurious correlated concurrent branch paths and feedback loop interference data are removed, and the fault propagation causal chain is reconstructed, including: Extract the temporal propagation window parameters and topological influence domain boundary data of each abnormal event entity in the candidate abnormal event association subgraph; map the temporal propagation window parameters to linear intervals in the time axis dimension, and map the topological influence domain boundary data to geometric contours in the spatial dimension; fuse the linear intervals and geometric contours to construct a two-dimensional feature polygon. Based on two-dimensional feature polygons, the intersection operation is performed on the two-dimensional feature polygons corresponding to the temporally adjacent and topologically connected anomaly entities in the candidate anomaly event association subgraph to extract the overlapping coverage area, and the difference operation is performed on the non-overlapping independent divergence area to obtain the effective overlapping area. Based on the geometric connectivity features and area ratio of the effective overlapping region, branch path nodes and closed-loop feedback nodes in the candidate abnormal event association subgraph are identified. Concurrent branches with an area ratio lower than the preset interference threshold and located on the non-main propagation time axis are marked as pseudo-correlated branch paths. Closed topologies that cause time-series backflow and state cycle jumps are marked as feedback loop interference data. Pseudo-correlated branch paths and feedback loop interference data are extracted from the candidate abnormal event association subgraph. After removing interference data, the remaining topology is processed by path backtracking and directional convergence. The core event entity nodes that are retained are connected in series along the temporal evolution direction to reconstruct the fault propagation causal chain.

7. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 6, characterized in that, Based on the geometric connectivity features and area proportions of the effective overlapping regions, branch path nodes and closed-loop feedback nodes are identified in the candidate anomaly event correlation subgraph. Concurrent branches with an area proportion lower than a preset interference threshold and located on a non-main propagation timeline are marked as pseudo-correlated branch paths. Closed topologies that trigger timeline backflow and state loop transitions are marked as feedback loop interference data. Pseudo-correlated branch paths and feedback loop interference data are extracted from the candidate anomaly event correlation subgraph, including: Based on the effective overlapping area, extract the geometric connectivity features of each connected component within the effective overlapping area and the area ratio between the area of ​​each connected component and the total area of ​​the corresponding two-dimensional feature polygon. Based on the geometric connectivity features and the area ratio, identify branch path nodes with concurrent divergence features and closed-loop feedback nodes with head-tail closure features in the candidate abnormal event association subgraph. Based on the branch path nodes, obtain the temporal propagation axis direction where the branch path nodes are located, and mark the concurrent branches with an area ratio lower than the preset interference threshold and whose temporal propagation axis direction is inconsistent with the main propagation temporal axis direction of the candidate abnormal event association subgraph as pseudo-related branch paths. Based on the closed-loop feedback nodes, obtain the timing transmission direction and state transition records in the closed topology structure formed by the closed-loop feedback nodes. Closed topologies with timing backflow characteristics or state cycle transition characteristics are marked as feedback loop interference data. Based on the pseudo-correlation branch paths and feedback loop interference data, locate all abnormal event entity nodes and connecting edges included in the pseudo-correlation branch paths and all abnormal event entity nodes and connecting edges included in the feedback loop interference data from the candidate abnormal event association subgraph, and perform node and edge removal operations to obtain the pseudo-correlation branch paths and feedback loop interference data stripped.

8. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 6, characterized in that, Extract the terminal aggregation node characteristics and topology in-degree cumulative index of the fault propagation causal chain, and locate the unique identifier of the corresponding root cause anomaly event entity in the operation and maintenance knowledge graph, including: Perform reverse topological backtracking on the fault propagation causal chain, extract the temporal convergence characteristics and state anomaly amplitude parameters of the terminal nodes, and accumulate the topological connection weights of each upstream node layer by layer along the propagation path of the fault propagation causal chain to calculate the topological in-degree cumulative index. The temporal convergence features and the topological in-degree accumulation index are encoded into feature vectors to obtain the root cause localization retrieval vector. Based on the root cause localization retrieval vector, feature space similarity matching is performed in the entity index of the operation and maintenance knowledge graph to filter out the candidate root cause entity set with similarity higher than the preset matching threshold. Based on the topological in-degree cumulative index, each candidate entity in the candidate root cause entity set is ranked by confidence weight, and the candidate entity ranked first is determined as the root cause anomalous event entity. Using the root cause anomaly event entity as the query benchmark, extract the unique identifier of the corresponding root cause anomaly event entity from the node attribute structure of the operation and maintenance knowledge graph.

9. The abnormal event association processing method based on operation and maintenance knowledge graph according to claim 8, characterized in that, Using the unique identifier of the root cause anomaly entity as the retrieval anchor, the pre-set handling strategy knowledge base in the operation and maintenance knowledge graph is traversed to obtain the associated handling instructions for the target anomaly, including: Using the unique identifier of the root cause abnormal event entity as the retrieval anchor point, perform an association mapping query in the pre-set handling strategy knowledge base of the operation and maintenance knowledge graph to obtain the initial handling strategy set and associated impact scope tags bound to the root cause abnormal event entity. Based on the spatial overlay comparison of the topological coverage and associated impact range labels of the fault propagation causal chain, a subset of handling strategies covering the currently affected service links is filtered out from the initial handling strategy set. Based on the state anomaly magnitude parameters of each abnormal event entity and the execution priority rules in the subset of handling strategies, the dependency relationship of the subset of handling strategies is parsed and the timing is arranged to obtain a standardized handling operation sequence. The standardized handling sequence is encapsulated into an instruction format, and corresponding root cause identification and impact range parameters are added to obtain the target abnormal event associated handling instructions.

10. An anomaly event association processing system based on an operation and maintenance knowledge graph, wherein the system implements the method as described in any one of claims 1 to 9, characterized in that, include: The feature aggregation module is used to take each abnormal event entity in the structured abnormal event sequence as an input node set, and based on the topological mapping position of the input node set in the preset operation and maintenance knowledge graph, aggregate the k-order adjacency topological features and business semantic embedding features of each input node to obtain the graph event representation vector. The association subgraph module is used to perform pairwise comparison and temporal alignment of the feature vectors representing different abnormal event entities in the event representation vector of the graph, iteratively calculate the temporal lag correlation index and state transition probability matrix between each abnormal event entity, and converge to obtain the candidate abnormal event association subgraph based on the state transition probability matrix and the preset association confidence threshold. The causal chain reconstruction module is used to map the temporal propagation window and topological influence domain of each abnormal event entity in the candidate abnormal event association subgraph to a two-dimensional feature polygon. The intersection and difference operations are performed on the two-dimensional feature polygon to obtain the effective overlapping area. Based on the effective overlapping area, pseudo-correlated concurrent branch paths and feedback loop interference data are removed to reconstruct the fault propagation causal chain. The location and handling module is used to extract the terminal aggregation node characteristics and topology in-degree cumulative index of the fault propagation causal chain, locate the unique identifier of the corresponding root cause abnormal event entity in the operation and maintenance knowledge graph; use the unique identifier of the root cause abnormal event entity as the retrieval anchor point, traverse the preset handling strategy knowledge base in the operation and maintenance knowledge graph, and obtain the associated handling instructions of the target abnormal event.

Images