Method, system, device, processor and storage medium thereof for realizing automatic management based on real information collection and application topology

Abstract

This invention relates to a method for automated management based on real-world information collection and application topology mapping, comprising the following steps: automated collection of real-world operational information; construction of an application topology map; and, before the execution of maintenance tasks, adaptive repair decisions based on the application topology map and task context. The method, system, device, processor, and computer-readable storage medium of this invention, based on real-world information collection and application topology mapping, significantly improve topology transparency and proactive prevention capabilities. By automatically collecting real-world information and constructing application topology maps, topology discovery coverage and accuracy are significantly improved, production safety assurance capabilities are upgraded, risk scoring and avoidance strategy recommendations based on collected information significantly improve the pre-warning rate of high-risk operations, and the secondary failure rate caused by misoperation is significantly reduced. The platform exhibits excellent scalability and compatibility.

Description

Technical Field

[0001] This invention relates to the field of multi-cloud architecture, and more particularly to the field of automated management of cross-cloud resources. Specifically, it refers to a method, system, device, processor, and computer-readable storage medium for achieving automated management based on real information collection and application topology diagrams. Background Technology

[0002] As digital transformation deepens, enterprise IT infrastructure continues to expand, significantly increasing operational complexity. With multi-cloud strategies becoming mainstream, organizations generally face core challenges such as resource fragmentation, tool isolation, and inefficiency. Industry research shows that enterprises adopting multi-cloud architectures use an average of more than five independent operation and maintenance management tools, leading to an increase in operating costs of over 30% and a significant increase in configuration drift risk.

[0003] The mainstream solutions currently on the market mainly fall into the following five categories: The first category is a simple wrapper around open-source automation tools (such as Ansible and SaltStack), which, while possessing basic script execution capabilities, lacks enterprise-level process control and audit traceability functions; the second category is the job module in commercial ITSM platforms (such as ServiceNow), whose advantage lies in work order integration and approval workflows, but whose architecture is cumbersome and difficult to adapt to the rapid iteration characteristics of cloud-native systems; the third category is cloud platform native services (such as AWS Systems Manager), which, although deeply integrated with specific clouds, have weak cross-cloud management capabilities; the fourth category is traditional job scheduling systems (such as Control-M), which have insufficient support for containerization and microservices; and the fifth category is self-developed integration systems, which typically splice together multiple existing components to form a "chimney-style" architecture, resulting in high maintenance costs.

[0004] In existing technologies, CN120111045A proposes a system for adaptive resource management in a multi-cloud environment. It achieves dynamic resource allocation by constructing a closed loop of resource acquisition, statistical analysis, and scheduling optimization, thus improving resource utilization flexibility. However, this scheme still relies on static thresholds for resource adjustment and does not introduce predictive algorithms, making it unable to cope with sudden traffic spikes or periodic load changes. Another patent, CN119645648A, focuses on DAG task scheduling and uses a backfilling algorithm to improve resource utilization. However, it only considers a single performance indicator in scheduling decisions and fails to achieve multi-objective collaborative optimization of SLA, cost, and latency.

[0005] In summary, existing technologies generally suffer from three major common defects: First, application topology mainly relies on manual maintenance of the CMDB or static configuration, resulting in delayed and inaccurate information updates, failing to accurately reflect production dependencies. Second, scheduling strategies are not intelligent; most systems rely on manual rules or alarm triggers, lacking the ability to comprehensively assess real-time situations and future loads. Third, automated repair is highly indiscriminate; when performing high-risk operations such as baseline repair and patch updates, there is a lack of proactive risk identification and avoidance mechanisms based on real-time information collection, easily leading to secondary failures. Therefore, there is an urgent need for a new resource management architecture that can automatically collect real-world information to construct application topology maps and proactively avoid production problems based on this information, in order to address the aforementioned technical bottlenecks. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, system, device, processor and computer-readable storage medium for automated management based on real information collection and application topology maps, which has high repair efficiency, strong security, and wide applicability.

[0007] To achieve the above objectives, the present invention provides a method, system, apparatus, processor, and computer-readable storage medium for automated management based on real information collection and application topology maps, as follows: This method for automated management based on real information collection and application topology maps is characterized by the following steps: (1) Conduct automated collection of real-time operational information, using a hybrid mechanism to continuously collect runtime data from cloud platforms, hosts, containers, service registry centers, application performance monitoring links, and network flow logs; (2) Construct an application topology graph. Based on the collected runtime data, the collected objects are uniformly abstracted into four types of entities. Through multi-source heterogeneous data fusion and topology reasoning engine, a computable and traceable application topology graph is generated. (3) Before the operation and maintenance work is executed, the graph traversal algorithm is used to identify the affected upstream and downstream business paths, assess the operational risks, and generate avoidance suggestions based on the application topology graph. (4) Based on the application topology and task context, the intelligent scheduling engine plans execution resources and paths for operation and maintenance tasks; (5) Make adaptive repair decisions. For baseline management tasks, generate repair schemes based on quadruple knowledge graphs and use Bayesian risk assessment models to quantify operational risks.

[0008] Preferably, step (1) specifically includes the following steps: A hybrid data collection mechanism, including agentless collection, lightweight probes, and interface subscriptions, is adopted to obtain real-time data from cloud platform APIs, host processes, container orchestration platforms, service registries, APM links, network flow logs, and configuration repositories. Specifically, agentless collection involves reading host metadata via SSH, WMI, or SNMP; lightweight probes are deployed on key gateway nodes to capture east-west traffic; and interface subscriptions connect to native interfaces to synchronize configuration changes and performance metrics.

[0009] Preferably, step (2) further includes multi-source data fusion through a topology inference engine, specifically including the following steps: (2.1) Entity alignment, that is, through the rule engine and fuzzy matching algorithm, the naming of the same logical component in different monitoring systems is unified and normalized into a standard entity identifier; (2.2) Fingerprint matching, which means generating a unique fingerprint for each application instance that includes port combination, startup parameters, image version and environment variables; (2.3) Temporal correlation, that is, using the call time window to match the requests and inbound traffic of upstream and downstream services, and combining the sliding window and causal inference model to determine the call dependency relationship; (2.4) Conflict resolution, that is, assigning confidence weights based on the historical accuracy of each data source and arbitrating data contradictions using a weighted voting mechanism.

[0010] Preferably, step (2) further includes the following steps: Calculate a confidence score for each topological relationship and optimize matching rules based on execution feedback self-learning; use a dual-channel incremental update of the application topology graph with periodic scanning and event-driven methods to automatically identify newly added or offline nodes, dependency drift, and abnormal communication paths.

[0011] Preferably, step (3) specifically includes the following steps: Locate the set of nodes involved in the operation and maintenance task, call the graph traversal algorithm to spread upstream and downstream along the application topology graph, and identify all reachable critical business paths; By combining node importance scores, SLA levels, and historical failure frequencies, the risk level of each path is assessed, and avoidance strategies such as detours, traffic restrictions, staggered releases, or canary releases are generated.

[0012] Preferably, the intelligent scheduling engine in step (4) includes an LSTM task duration prediction model, which estimates the job execution cycle, specifically: Calculate the job execution cycle using the following formula: in, To predict the execution cycle, For LSTM mapping functions, For the input feature matrix / tensor, This is the set of model parameters.

[0013] Preferably, the intelligent scheduling engine in step (4) includes a multi-objective reinforcement learning scheduler. The online scheduling decision is made through the multi-objective reinforcement learning scheduler, and the scheduling process is modeled as a Markov decision process. The reward function R is calculated as follows: Calculate the reward function R using the following formula: in, For the overall reward value, To normalize the SLA compliance rate, To normalize execution costs, To normalize execution delay, These are dynamic weighting coefficients.

[0014] Preferably, the state space of the multi-objective reinforcement learning scheduler includes topology health and dependency link risk information, and its action space is a set of selectable execution nodes. By incorporating the dependency link risk into the decision factors, high-risk execution paths are avoided.

[0015] Preferably, step (5) specifically includes the following steps: Construct a quadruple knowledge graph. When a vulnerability or configuration deviation is detected, call the graph traversal algorithm to identify all affected application systems and key business links, and generate a visual impact report.

[0016] Preferably, step (5) of quantifying operational risk using a Bayesian risk assessment model specifically includes the following steps: The failure probability of the repair operation is dynamically quantified by a Bayesian risk assessment model. When the failure probability exceeds a preset threshold, a manual confirmation mechanism is automatically triggered.

[0017] This system, which achieves automated management based on real information collection and application topology maps, is characterized by the following features: The real information automated collection and application topology construction engine is used to execute the real information automated collection steps and the application topology map construction steps, and output the application topology map. The intelligent scheduling engine is connected to the real information automated collection and application topology construction engine and is used to execute intelligent scheduling and execution steps. The adaptive repair strategy system is connected to the real information automated collection and application topology construction engine and the intelligent scheduling engine to execute the impact simulation and risk avoidance steps and the adaptive repair decision steps.

[0018] This device, which achieves automated management based on real information collection and application topology maps, is characterized by comprising: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the method described above for automated management based on real information acquisition and application topology maps.

[0019] The processor that enables automated management based on real information acquisition and application topology maps is characterized in that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the aforementioned method for automated management based on real information acquisition and application topology maps are implemented.

[0020] The main feature of this computer-readable storage medium is that it stores a computer program that can be executed by a processor to implement the various steps of the above-described method for automated management based on real information collection and application topology maps.

[0021] The present invention employs a method, system, device, processor, and computer-readable storage medium for automated management based on real-time information collection and application topology maps. This significantly improves topology transparency and proactive prevention capabilities. By automatically collecting real-time information and constructing application topology maps, topology discovery coverage and accuracy are significantly enhanced, allowing production risks to be identified and avoided before operations are executed. Fault response and repair efficiency are improved; with the help of real-time topology, knowledge graphs, and impact surface analysis, fault location time is reduced to minutes, and MTTR (Mean Time To Repair) decreases by more than 60%. Production safety assurance capabilities are upgraded; based on risk scoring and avoidance strategy recommendations using collected information, the pre-warning rate for high-risk operations is significantly improved, and the secondary failure rate caused by misoperation is significantly reduced. The platform exhibits excellent scalability and compatibility; based on a unified data acquisition adapter and topology abstraction model, the access cycle to new cloud platforms is shortened from weeks to hours, supporting rapid adaptation to various domestic IT software and hardware environments. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the adaptive repair decision tree based on knowledge graphs, which is the method for automated management based on real information collection and application topology graphs according to the present invention.

[0023] Figure 2 This invention relates to a method for achieving automated management based on real information collection and application topology maps. Detailed Implementation

[0024] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0025] The present invention provides a method for automated management based on real information collection and application topology maps, comprising the following steps: (1) Conduct automated collection of real-time operational information, using a hybrid mechanism to continuously collect runtime data from cloud platforms, hosts, containers, service registry centers, application performance monitoring links, and network flow logs; (2) Construct an application topology graph. Based on the collected runtime data, the collected objects are uniformly abstracted into four types of entities. Through multi-source heterogeneous data fusion and topology reasoning engine, a computable and traceable application topology graph is generated. (3) Before the operation and maintenance work is executed, the graph traversal algorithm is used to identify the affected upstream and downstream business paths, assess the operational risks, and generate avoidance suggestions based on the application topology graph. (4) Based on the application topology and task context, the intelligent scheduling engine plans execution resources and paths for operation and maintenance tasks; (5) Make adaptive repair decisions. For baseline management tasks, generate repair schemes based on quadruple knowledge graphs and use Bayesian risk assessment models to quantify operational risks.

[0026] In a preferred embodiment of the present invention, step (1) specifically includes the following steps: A hybrid data collection mechanism, including agentless collection, lightweight probes, and interface subscriptions, is adopted to obtain real-time data from cloud platform APIs, host processes, container orchestration platforms, service registries, APM links, network flow logs, and configuration repositories. Specifically, agentless collection involves reading host metadata via SSH, WMI, or SNMP; lightweight probes are deployed on key gateway nodes to capture east-west traffic; and interface subscriptions connect to native interfaces to synchronize configuration changes and performance metrics.

[0027] In a preferred embodiment of the present invention, step (2) further includes multi-source data fusion through a topology inference engine, specifically including the following steps: (2.1) Entity alignment, that is, through the rule engine and fuzzy matching algorithm, the naming of the same logical component in different monitoring systems is unified and normalized into a standard entity identifier; (2.2) Fingerprint matching, which means generating a unique fingerprint for each application instance that includes port combination, startup parameters, image version and environment variables; (2.3) Temporal correlation, that is, using the call time window to match the requests and inbound traffic of upstream and downstream services, and combining the sliding window and causal inference model to determine the call dependency relationship; (2.4) Conflict resolution, that is, assigning confidence weights based on the historical accuracy of each data source and arbitrating data contradictions using a weighted voting mechanism.

[0028] In a preferred embodiment of the present invention, step (2) further includes the following steps: Calculate a confidence score for each topological relationship and optimize matching rules based on execution feedback self-learning; use a dual-channel incremental update of the application topology graph with periodic scanning and event-driven methods to automatically identify newly added or offline nodes, dependency drift, and abnormal communication paths.

[0029] In a preferred embodiment of the present invention, step (3) specifically includes the following steps: Locate the set of nodes involved in the operation and maintenance task, call the graph traversal algorithm to spread upstream and downstream along the application topology graph, and identify all reachable critical business paths; By combining node importance scores, SLA levels, and historical failure frequencies, the risk level of each path is assessed, and avoidance strategies such as detours, traffic restrictions, staggered releases, or canary releases are generated.

[0030] In a preferred embodiment of the present invention, the intelligent scheduling engine in step (4) includes an LSTM task duration prediction model, which estimates the job execution cycle, specifically: Calculate the job execution cycle using the following formula: in, To predict the execution cycle, For LSTM mapping functions, For the input feature matrix / tensor, This is the set of model parameters.

[0031] In a preferred embodiment of the present invention, the intelligent scheduling engine in step (4) includes a multi-objective reinforcement learning scheduler. The online scheduling decision is made through the multi-objective reinforcement learning scheduler, and the scheduling process is modeled as a Markov decision process. The reward function R is calculated as follows: Calculate the reward function R using the following formula: in, For the overall reward value, To normalize the SLA compliance rate, To normalize execution costs, To normalize execution delay, These are dynamic weighting coefficients.

[0032] In a preferred embodiment of the present invention, the state space of the multi-objective reinforcement learning scheduler includes topology health and dependency link risk information, and its action space is a set of selectable execution nodes. By incorporating the dependency link risk into the decision factor, high-risk execution paths are avoided.

[0033] In a preferred embodiment of the present invention, step (5) specifically includes the following steps: Construct a quadruple knowledge graph. When a vulnerability or configuration deviation is detected, call the graph traversal algorithm to identify all affected application systems and key business links, and generate a visual impact report.

[0034] As a preferred embodiment of the present invention, step (5) of quantifying operational risk using a Bayesian risk assessment model specifically includes the following steps: The failure probability of the repair operation is dynamically quantified by a Bayesian risk assessment model. When the failure probability exceeds a preset threshold, a manual confirmation mechanism is automatically triggered.

[0035] The present invention discloses a system for automated management based on real information collection and application topology maps, wherein the system includes: The real information automated collection and application topology construction engine is used to execute the real information automated collection steps and the application topology map construction steps, and output the application topology map. The intelligent scheduling engine is connected to the real information automated collection and application topology construction engine and is used to execute intelligent scheduling and execution steps. The adaptive repair strategy system is connected to the real information automated collection and application topology construction engine and the intelligent scheduling engine to execute the impact simulation and risk avoidance steps and the adaptive repair decision steps.

[0036] The present invention relates to an automated management device based on real information collection and application topology maps, wherein the device comprises: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the method described above for automated management based on real information acquisition and application topology maps.

[0037] The processor of the present invention, which realizes automated management based on real information collection and application topology map, is configured to execute computer-executable instructions. When the computer-executable instructions are executed by the processor, the various steps of the above-mentioned method for realizing automated management based on real information collection and application topology map are implemented.

[0038] The computer-readable storage medium of the present invention stores a computer program thereon, which can be executed by a processor to implement the various steps of the above-described method for automated management based on real information collection and application topology maps.

[0039] To address the problems in existing technologies, such as reliance on manual maintenance of application relationships, outdated and distorted topology information, and difficulty in proactively identifying risks associated with production changes, this invention aims to provide a cross-cloud resource automation management system centered on automatically collecting real-world operational information and constructing application topology maps. Specifically, this invention addresses three key technical challenges: first, how to continuously and automatically collect real-world information such as hosts, containers, middleware, processes, call chains, and network connections in multi-cloud, hybrid cloud, and domestically developed heterogeneous environments to form an accurate and updatable topology foundation; second, how to conduct intelligent scheduling based on real-time topology relationships and task context to achieve global optimization of resource allocation; and third, how to proactively identify high-risk dependency links and conflicting changes based on collected information before job execution to avoid production interruptions, performance degradation, and cascading failures.

[0040] To achieve the above objectives, this invention provides an automated management system and method for cross-cloud heterogeneous resources based on automated real-world information collection and application topology construction. Its core innovation lies in: constructing an application topology map using automatically collected real-world information, and performing risk identification, impact assessment, and mitigation strategy recommendation based on the collected information before job execution. The system includes the following three innovative modules: 1. Real-world information automated collection and application topology construction engine This invention designs an automated data collection system for production environments, employing a hybrid mechanism of "agentless collection + lightweight probe + interface subscription" to continuously acquire real-time data from cloud platform APIs, host processes, container orchestration platforms, service registries, APM links, network flow logs, and configuration repositories. The system uniformly abstracts the collected objects into four types of entities: application nodes, component nodes, resource nodes, and connection edges, and records key attributes such as version, instance status, dependency type, communication protocol, and timing characteristics.

[0041] Furthermore, this invention constructs a multi-source heterogeneous data fusion and topology inference engine. Through entity alignment, fingerprint matching, temporal correlation, and conflict resolution algorithms, it merges information from multiple sources into a computable and traceable application topology graph. This engine calculates a confidence score for each topological relationship and can optimize matching rules based on execution feedback self-learning, thereby maintaining the accuracy and integrity of the topology structure in scenarios of dynamic scaling, canary releases, and cross-cloud migration.

[0042] Furthermore, this invention establishes a mechanism for continuous topology verification and proactive production risk avoidance. The system uses a dual-channel incremental update of the topology map through periodic scanning and event-driven methods to automatically identify newly added / deactivated nodes, dependency drift, and abnormal communication paths. Before job execution, it performs a topology impact simulation and provides advance avoidance suggestions such as detours, flow control, peak shifting, and gray-scale deployment, thereby significantly reducing the probability of production environment failures.

[0043] 2. Intelligent Scheduling Engine This invention designs a topology-driven, multi-level intelligent scheduling engine to replace the passive response mechanism based on fixed thresholds in traditional systems. The engine consists of three key components: an LSTM task duration prediction model, a multi-objective reinforcement learning scheduler (MORL-Scheduler), and an adaptive elastic scaling controller. The LSTM task duration prediction model is used to estimate the time required for upcoming jobs in advance. The system collects historical task execution data and integrates real-time collected feature vectors such as resource load, dependency link stability, and abnormal event frequency to train a long short-term memory neural network model. For newly submitted tasks, the model can predict the execution cycle based on its features. The formula is as follows: The prediction results, combined with the real-time topology status, are used for pre-reservation of resources and conflict avoidance, preventing queuing delays and production fluctuations caused by resource contention or reliance on congestion.

[0044] Building upon this foundation, this invention proposes a Multi-Objective Reinforcement Learning Scheduler (MORL-Scheduler) for online optimization of scheduling decisions. This scheduler models the scheduling process as a Markov Decision Process (MDP). The state space S, in addition to cluster load, task queue, and remaining SLA time, also includes topology health and dependency link risk information. The action space A represents the set of selectable execution nodes. The reward function R comprehensively considers three core metrics: Among them, dynamic weight coefficient It can be dynamically adjusted according to business priorities. Through strategy learning via Deep Q Network (DQN), the system can maximize resource utilization efficiency and minimize operating costs while ensuring the timely completion of critical tasks, and proactively avoid high-risk dependency links to avoid production problems in advance.

[0045] Meanwhile, this invention achieves cross-cloud affinity-aware scheduling and adaptive elastic scaling control. The former selects the optimal execution location by constructing a "scheduling affinity" scoring model, which comprehensively considers factors such as regional latency, bandwidth cost, security domain isolation, and real-time topology risk heat. The latter combines sliding window average load and burst detection algorithms to dynamically adjust the scaling threshold, effectively suppressing resource oscillations and avoiding potential fault domains in advance.

[0046] 3. Adaptive Repair Strategy System This invention constructs a complete adaptive remediation strategy system for handling baseline management tasks such as vulnerability remediation, patch updates, and configuration correction. The core of this system is a "vulnerability-patch-system-business" four-tuple knowledge graph. By integrating real-time application topology and security policy databases generated through automated data collection, it constructs a network of influence relationships between nodes. When a high-risk vulnerability is detected on a host, the system invokes a graph traversal algorithm to identify all affected application systems and critical business links, generating a visualized impact surface report.

[0047] Based on this, the present invention designs a multi-path repair decision tree, which generates multiple repair solutions for the same deviation. For example, for an emergency patch update, the system can recommend three paths: immediate restart, canary release, or delayed processing. Each path is scored based on factors such as current system load, business time period, and change window period, and the optimal option is ultimately recommended.

[0048] More importantly, this invention introduces a Bayesian risk assessment model to dynamically quantify the failure probability of repair operations. This model integrates multiple factors, including asset importance, backup status, change history, real-time link jitter, and the stability of related services, to output a risk score P_{risk}. When P_{risk} exceeds a preset threshold, the system automatically triggers a manual confirmation mechanism and generates a risk warning report and mitigation plan for operations and maintenance personnel to make prudent decisions.

[0049] Finally, the system establishes a closed loop for feedback on repair results, feeding back the actual effectiveness (success / failure / side effects) of each repair to the scheduling model and risk assessment model. Through continuous learning, it continuously optimizes future decisions and achieves self-evolving operation and maintenance capabilities.

[0050] In specific embodiments of the present invention, the operation flow of the system of the present invention is described in detail in conjunction with specific application scenarios. Suppose that a financial business system discovers a high-risk vulnerability, CVE-2025-XXXX, in a core trading server during a routine scan, requiring urgent remediation.

[0051] First, the monitoring module detects the vulnerability and generates an alert event, which is then pushed to the baseline management module. The system then triggers an automated real-time information collection process, pulling the processes, containers, call chains, connection sessions, and performance metrics of the server and related links in real time to construct the latest application topology graph. Subsequently, it calls the knowledge graph engine to load the "vulnerability-patch-system-business" quadruple graph, executes a breadth-first search algorithm to identify key applications, upstream and downstream dependent services, and related database instances, and generates a complete impact analysis report.

[0052] Subsequently, the operation center initiated the repair process, invoking the intelligent scheduling engine for resource planning. Based on the LSTM model, the scheduling engine predicted that the repair operation would take approximately 12 minutes. Combining real-time topology risk intensity and cluster load data, it selected a low-risk backup resource pool located within the same city's availability zone as the execution environment, ensuring low latency and high availability.

[0053] Next, the adaptive remediation strategy system intervenes in the decision-making process. The system generates three remediation paths: Path 1 is to immediately restart and install the patch, which has the advantage of thorough remediation but may cause business interruption; Path 2 is a canary release, first verifying patch compatibility on shadow instances and then gradually switching traffic, which has lower risk; Path 3 is to postpone processing, executing it during off-peak hours at night, suitable for scenarios that tolerate short-term exposure. Based on real-time collected information, the system predicts the production impact and scores the avoidance of each path. Ultimately, Path 2 has the highest overall score and is recommended as the preferred solution.

[0054] The system adopted the recommended path, deploying a shadow instance in the test environment and performing patch installation. The execution engine monitored operation logs and performance metrics throughout the process. Once no anomalies were confirmed, the patch was rolled out in batches to the production environment. Throughout the process, the patch result feedback module continuously collected execution data for subsequent model optimization.

[0055] Ultimately, the execution log module generates a complete operation log chain, including timestamps, operators, change details, before-and-after status comparisons, and risk assessment reports, supporting full-process traceability and auditing. This embodiment fully demonstrates the collaborative advantages of this invention, which centers on "automatically collecting real information, constructing application topology maps, and proactively avoiding production problems," achieving an efficient, secure, and reliable automated operation and maintenance closed loop.

[0056] The key points that this invention needs to protect are as follows: 1. Significantly improved topology transparency and proactive prevention capabilities: By automatically collecting real-world information and constructing application topology maps, the coverage and accuracy of topology discovery are significantly improved, and production risks can be identified and avoided before operations are executed; 2. Enhanced fault response and repair efficiency: With the help of real-time topology, knowledge graph and impact surface analysis, fault location time is shortened to the minute level, and MTTR (mean time to repair) is reduced by more than 60%; 3. Upgraded production safety assurance capabilities: Based on risk scoring and avoidance strategy recommendations using collected information, the pre-warning rate for high-risk operations has been significantly improved, and the secondary failure rate caused by misoperation has been significantly reduced; 4. Excellent platform scalability and compatibility: Based on a unified acquisition adapter and topology abstraction model, the access cycle of the new cloud platform has been shortened from weekly to hourly, supporting rapid adaptation to various domestic IT innovation software and hardware environments.

[0057] The core innovation of this invention lies in the organic closed loop of "automated real-world information collection—intelligent application topology construction—pre-emptive risk avoidance execution." While data collection, scheduling optimization, or risk assessment may involve similar technologies in their respective fields, the technical solution that unifies them into a real-time linkage system and forms a pre-emptive risk avoidance capability is unique. In particular, the fusion of multi-source real-world information and the topology reasoning mechanism solve the fundamental problem of distortion in cross-cloud dependencies, topology-driven intelligent scheduling achieves multi-objective optimization and risk avoidance, and knowledge graph-driven repair strategies ensure that high-risk operations are explainable, interventionable, and traceable.

[0058] This invention aims to address key technical bottlenecks in traditional IT operations and maintenance systems, such as lagging application topology information, distorted dependencies, and difficulty in proactively identifying production change risks. Addressing the "topology drift" problem caused by existing technologies' reliance on manually maintained Configuration Management Databases (CMDBs) or static policies, this invention proposes a closed-loop technical architecture centered on "real-world information collection—intelligent application topology construction—proactive risk avoidance execution." This architecture continuously acquires runtime data, including hosts, containers, middleware, processes, call chains, and network connections, from multi-cloud, hybrid cloud, and domestically developed heterogeneous environments through automated means, and generates a computable and traceable application topology map based on multi-source heterogeneous data fusion and inference mechanisms.

[0059] Building upon this foundation, the system further integrates three major functional modules: impact simulation, intelligent scheduling, and adaptive repair, forming a complete technical chain from state perception to decision optimization and risk avoidance. It is particularly noteworthy that the "application topology map" constructed in this invention is not a product of mathematical modeling, but rather a physical mapping of real dependencies. Its dynamic updating capability and high confidence level ensure the technical effectiveness of all subsequent analysis actions. This technical approach fundamentally differs from the passive management model based on threshold alarms or post-event responses in existing technologies, achieving for the first time the ability to proactively identify and avoid potential fault propagation paths before operation execution.

[0060] This invention focuses on "prevention and control." Its technical goal is not to predict the overall platform status, but to accurately identify the local chain reactions that specific operations may trigger. For example, before executing a patch update or resource configuration change, the system will simulate the impact of the change based on a real-time constructed "application topology map," automatically identify high-risk nodes on critical business paths, and recommend avoidance strategies such as detours, rate limiting, or canary releases.

[0061] The "application topology map" in this invention is generated by a "real information automated collection and application topology construction engine." Its data sources include APM link tracing, network flow logs, service registry centers, and container orchestration platform APIs, which directly reflect runtime dependencies. Through entity alignment, fingerprint matching, and time-series association algorithms, the system can accurately reconstruct the real topology relationships, such as whether service A calls service B, and whether container C depends on database D.

[0062] The "application topology graph" construction process proposed in this invention includes four core technical steps, forming a complete reasoning loop: (1) Entity alignment: This addresses the issue of inconsistent naming of the same logical component across different monitoring systems. For example, "order service" might be labeled as order-svc in Prometheus, but displayed as deploy-order-service-v2 in Kubernetes. The system uses a rule engine and fuzzy matching algorithm to unify and normalize these into a standard entity identifier.

[0063] (2) Fingerprint matching: A unique "fingerprint" is generated for each application instance, which combines port combination, startup parameters, image version, environment variables and other attributes to ensure accurate instance-level identification across environments. This mechanism effectively avoids misjudgment caused by identification based solely on IP or hostname.

[0064] (3) Temporal correlation: The system uses a call time window to match upstream and downstream relationships. When service A initiates an outbound request at time t, and service B receives the corresponding inbound traffic within the same time window, the system determines that there is a call dependency between the two. This method combines a sliding window and a causal inference model, which significantly reduces the probability of false connections.

[0065] (4) Conflict resolution: When there is a contradiction between the data from APM, NetFlow and the service registry (e.g., APM shows that there is a call but NetFlow does not capture the traffic), the system assigns confidence weights based on the historical accuracy of each data source and uses a weighted voting mechanism to complete the arbitration.

[0066] The above four steps together constitute a multi-source heterogeneous data fusion and topological reasoning engine. Its output is not only a static graph, but also a dynamic knowledge base with confidence scores, update timestamps and tracing paths.

[0067] This invention employs a hybrid data collection mechanism integrating "agentless collection + lightweight probe + interface subscription" to ensure data real-time performance and integrity. "Agentless collection" refers to directly reading host metadata via SSH, WMI, or SNMP, avoiding the performance overhead of deploying additional agents. "Lightweight probes" are deployed on key gateway nodes to capture east-west traffic and extract call chain information. "Interface subscription" connects to native interfaces such as the Kubernetes API Server, Consul, and Prometheus, synchronizing configuration changes and performance metrics in real time. This mechanism comprehensively covers data sources at all levels of IaaS, PaaS, and SaaS, solving the problem of insufficient coverage from single collection methods.

[0068] To maintain the accuracy of the "application topology map," this invention designs a dual-channel update mechanism of periodic scanning and event-driven updates. The system periodically performs full topology verification while monitoring events such as container scaling, service registration / deregistration, and network policy changes, triggering local topology reconstruction. For newly added nodes, the system automatically initiates fingerprint matching and dependency detection processes; for offline nodes, they are marked as "pending cleanup" and removed after confirming no active traffic. This mechanism effectively addresses the challenges posed by frequent changes in cloud-native environments, ensuring that the topology map remains synchronized with the production environment.

[0069] This invention integrates a feedback learning module into an "adaptive repair strategy system." After each repair operation, the system collects execution logs, performance change curves, and business indicator fluctuations to assess the actual impact. If an unexpected interruption or performance degradation occurs, this case will be labeled as a negative sample and injected into the training set to adjust the prior probability distribution and weight coefficients in the Bayesian model. With long-term operation, the system gradually accumulates domain experience, improves the accuracy of predicting future repair risks, and develops a sustainable evolutionary capability.

[0070] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0071] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0072] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0073] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0074] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0075] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0076] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0077] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0078] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0079] The present invention employs a method, system, device, processor, and computer-readable storage medium for automated management based on real-time information collection and application topology maps. This significantly improves topology transparency and proactive prevention capabilities. By automatically collecting real-time information and constructing application topology maps, topology discovery coverage and accuracy are significantly enhanced, allowing production risks to be identified and avoided before operations are executed. Fault response and repair efficiency are improved; with the help of real-time topology, knowledge graphs, and impact surface analysis, fault location time is reduced to minutes, and MTTR (Mean Time To Repair) decreases by more than 60%. Production safety assurance capabilities are upgraded; based on risk scoring and avoidance strategy recommendations using collected information, the pre-warning rate for high-risk operations is significantly improved, and the secondary failure rate caused by misoperation is significantly reduced. The platform exhibits excellent scalability and compatibility; based on a unified data acquisition adapter and topology abstraction model, the access cycle to new cloud platforms is shortened from weeks to hours, supporting rapid adaptation to various domestic IT software and hardware environments.

[0080] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A method for realizing automatic management based on real information collection and application topology graph, characterized in that, The method includes the following steps: (1) Conduct automated collection of real-time operational information, using a hybrid mechanism to continuously collect runtime data from cloud platforms, hosts, containers, service registry centers, application performance monitoring links, and network flow logs; (2) Construct an application topology graph. Based on the collected runtime data, the collected objects are uniformly abstracted into four types of entities. Through multi-source heterogeneous data fusion and topology reasoning engine, a computable and traceable application topology graph is generated. (3) Before the operation and maintenance work is executed, the graph traversal algorithm is used to identify the affected upstream and downstream business paths, assess the operational risks, and generate avoidance suggestions based on the application topology graph. (4) Based on the application topology and task context, the intelligent scheduling engine plans execution resources and paths for operation and maintenance tasks; (5) Make adaptive repair decisions. For baseline management tasks, generate repair schemes based on quadruple knowledge graphs and use Bayesian risk assessment models to quantify operational risks. 2.The method of claim 1, wherein, Step (1) specifically includes the following steps: A hybrid data collection mechanism, including agentless collection, lightweight probes, and interface subscriptions, is adopted to obtain real-time data from cloud platform APIs, host processes, container orchestration platforms, service registries, APM links, network flow logs, and configuration repositories. Specifically, agentless collection involves reading host metadata via SSH, WMI, or SNMP; lightweight probes are deployed on key gateway nodes to capture east-west traffic; and interface subscriptions connect to native interfaces to synchronize configuration changes and performance metrics. 3.The method of claim 1, wherein, Step (2) further includes multi-source data fusion through a topology inference engine, specifically including the following steps: (2.1) Entity alignment, that is, through the rule engine and fuzzy matching algorithm, the naming of the same logical component in different monitoring systems is unified and normalized into a standard entity identifier; (2.2) Fingerprint matching, which means generating a unique fingerprint for each application instance that includes port combination, startup parameters, image version and environment variables; (2.3) Temporal correlation, that is, using the call time window to match the requests and inbound traffic of upstream and downstream services, and combining the sliding window and causal inference model to determine the call dependency relationship; (2.4) Conflict resolution, that is, assigning confidence weights based on the historical accuracy of each data source and arbitrating data contradictions using a weighted voting mechanism. 4.The method of claim 1, wherein, Step (2) further includes the following steps: Calculate a confidence score for each topological relationship and optimize matching rules based on execution feedback self-learning; use a dual-channel incremental update of the application topology graph with periodic scanning and event-driven methods to automatically identify newly added or offline nodes, dependency drift, and abnormal communication paths.

5. The method for realizing automatic management based on real information collection and application topology graph according to claim 1, characterized in that, Step (3) specifically includes the following steps: Locate the set of nodes involved in the operation and maintenance task, call the graph traversal algorithm to spread upstream and downstream along the application topology graph, and identify all reachable critical business paths; By combining node importance scores, SLA levels, and historical failure frequencies, the risk level of each path is assessed, and avoidance strategies such as detours, traffic restrictions, staggered releases, or canary releases are generated. 6.The method for realizing automatic management based on real information collection and application topology graph according to claim 1, characterized in that, The intelligent scheduling engine in step (4) includes an LSTM task duration prediction model, which estimates the job execution cycle, specifically: Calculate the job execution cycle using the following formula: wherein, is the predicted execution period, is the LSTM mapping function, is the input feature matrix / tensor, is the set of model parameters. 7.The method of claim 1, wherein, The intelligent scheduling engine in step (4) includes a multi-objective reinforcement learning scheduler. Online scheduling decisions are made through the multi-objective reinforcement learning scheduler, and the scheduling process is modeled as a Markov decision process. The reward function R is calculated as follows: Calculate the reward function R using the following formula: in, For the overall reward value, To normalize the SLA compliance rate, To normalize execution costs, To normalize execution delay, These are dynamic weighting coefficients.

8. The method for automated management based on real information collection and application topology maps according to claim 7, characterized in that, The state space of the multi-objective reinforcement learning scheduler includes topology health and dependency link risk information, and its action space is a set of selectable execution nodes. By incorporating the dependency link risk into the decision factor, high-risk execution paths are avoided.

9. The method for automated management based on real information collection and application topology maps according to claim 1, characterized in that, Step (5) specifically includes the following steps: Construct a quadruple knowledge graph. When a vulnerability or configuration deviation is detected, call the graph traversal algorithm to identify all affected application systems and key business links, and generate a visual impact report.

10. The method for automated management based on real information collection and application topology maps according to claim 1, characterized in that, Step (5) involves using a Bayesian risk assessment model to quantify operational risk, specifically including the following steps: The failure probability of the repair operation is dynamically quantified by a Bayesian risk assessment model. When the failure probability exceeds a preset threshold, a manual confirmation mechanism is automatically triggered.

11. A system for automated management based on real information collection and application topology maps to implement the method of claim 1, characterized in that, The system includes: The real information automated collection and application topology construction engine is used to execute the real information automated collection steps and the application topology map construction steps, and output the application topology map. The intelligent scheduling engine is connected to the real information automated collection and application topology construction engine and is used to execute intelligent scheduling and execution steps. The adaptive repair strategy system is connected to the real information automated collection and application topology construction engine and the intelligent scheduling engine to execute the impact simulation and risk avoidance steps and the adaptive repair decision steps.

12. A device for automated management based on a real information collection and application topology map, characterized in that, The device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the method for automated management based on a real information acquisition and application topology map as described in any one of claims 1 to 10.

13. A processor for automated management based on a real information collection and application topology map, characterized in that, The processor is configured to execute computer-executable instructions, which, when executed by the processor, implement the steps of the method for automated management based on real information acquisition and application topology map as described in any one of claims 1 to 10.

14. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method for automated management based on real information collection and application topology map as described in any one of claims 1 to 10.

Images