Intelligent operation and maintenance management system of data center monitoring equipment based on internet of things

Abstract

This invention discloses an intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things (IoT), specifically relating to the field of monitoring equipment operation and maintenance management technology. It aims to solve the problems of data silos, alarm storms, and difficulties in locating the root cause of faults in heterogeneous devices. The system includes a device semantic access module, which transforms multi-source device data into a unified semantic stream through protocol parsing and an adaptive fingerprint database; an edge health assessment module, which performs feature extraction and health calculation at edge nodes, achieving local intelligence and simplified data upload; and a root cause analysis module, which constructs a dynamic Bayesian network based on device topology to perform temporal reasoning on multi-source abnormal events, locate the root cause of faults, and predict risk propagation. This invention achieves plug-and-play functionality, intelligent root cause diagnosis, and proactive early warning for devices, significantly improving the automation level and reliability of data center operation and maintenance.

Description

Technical Field

[0001] This invention relates to the field of monitoring equipment operation and maintenance management technology, and more specifically, to an intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things. Background Technology

[0002] With the widespread application of Internet of Things (IoT) technology in modern data centers, real-time monitoring of infrastructure through the deployment of numerous sensors and intelligent devices (such as precision air conditioners, UPS systems, power distribution cabinets, and environmental sensors) has become an industry standard. This trend has shifted operations and maintenance management from traditional manual inspections to data-driven automation and intelligence. Various monitoring devices are connected through IoT gateways, enabling the digital acquisition of physical status. However, this widespread access of multi-source, heterogeneous devices, while enhancing monitoring capabilities, also brings significant complexity to system integration and data processing.

[0003] Currently, typical operation and maintenance management systems mostly adopt an architecture of "data acquisition - centralized storage - threshold alarm". This model has revealed a series of shortcomings in practical applications: First, when facing devices from different vendors and using different protocols (such as Modbus, BACnet, SNMP, etc.), the system lacks a unified understanding and description of data semantics, leading to the formation of "data silos" and high integration and governance costs. Second, alarm mechanisms based on fixed thresholds are prone to generating a large number of isolated and repetitive alarm events in complex and dynamic data center environments, triggering an "alarm storm" that makes it difficult for operation and maintenance personnel to identify the real faults, resulting in a dilemma of passive response and information overload. Finally, due to the lack of explicit modeling and analysis capabilities for the physical and logical relationships between devices, when a single core device failure triggers a chain reaction, existing systems cannot quickly and accurately locate the root cause of the fault, only presenting a large number of superficial phenomena, severely prolonging the mean time to repair (MTTR).

[0004] To address the aforementioned issues, existing technologies offer several improvements, such as introducing a unified data bus for protocol conversion or utilizing simple rule engines for alarm compression. However, these solutions often fail to fundamentally resolve core challenges like heterogeneous data semantics, lack of edge intelligence, and insufficient fault propagation reasoning capabilities. Therefore, the industry urgently needs a next-generation intelligent data center operations and maintenance management system that enables plug-and-play devices, possesses edge collaborative intelligence, and allows for precise root cause analysis to improve operational efficiency, ensure business continuity, and enhance data center energy efficiency. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide an intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things.

[0006] To achieve the above objectives, the present invention provides the following technical solution: The IoT-based intelligent operation and maintenance management system for data center monitoring equipment includes the following modules: The device semantic access module transforms data from physical monitoring devices of different protocols and models into a standardized data stream with a unified semantic description through protocol parsing, semantic tag mapping, and template matching. The edge health assessment module is used to perform real-time feature extraction and lightweight anomaly detection on standardized data at edge nodes close to the device. It integrates multi-source features and calculates the real-time health of the device through an ensemble learning model. It only uploads features and events to achieve local intelligence and bandwidth optimization. The root cause analysis module constructs a dynamic Bayesian network based on the device topology, uses multi-source abnormal events as evidence for temporal reasoning, locates the most likely root cause of the failure and predicts the risk propagation path, and generates an early warning with confidence level and impact range. The operation and maintenance visualization and interaction module maps the health status and early warning information of equipment in real time in a 3D twin scene, provides root cause localization visualization and fault propagation simulation, and supports one-click generation of intelligent operation and maintenance work orders.

[0007] Specifically, the device semantic access module performs the following operations: When a device is connected, protocol sniffing is performed based on its network port and data frame characteristics to match known drivers and load the corresponding predefined point table template. If no matching template is found, the system enters a semi-automatic learning mode, assigns standard semantic labels to the device registers through human-computer interaction, and automatically infers adjacent or function-related registers to generate complete mapping rules for the device model. An adaptive protocol fingerprint library is built and maintained. When a new device has no matching template, its communication characteristics are collected to generate a protocol fingerprint. The similarity between this fingerprint and historical case fingerprints is calculated. For new devices with similarity exceeding a threshold, matching historical device templates are automatically recommended.

[0008] Specifically, the maintenance of the adaptive protocol fingerprint database also includes: Each successfully mapped new device fingerprint is associated with and stored in relation to its final determined device template type. Based on historical matching records, the weights of each feature dimension of the fingerprint and the similarity matching threshold are dynamically adjusted so that the matching accuracy of the fingerprint database can be adaptively improved with the number of uses.

[0009] Specifically, the edge health assessment module performs the following operations: Statistical features were extracted from the time series of standardized parameters for each device, and lightweight anomaly detection was performed using an exponentially weighted moving average control chart. A pre-trained gradient boosting decision tree model is used, which integrates the device's own multi-parameter features and contextual features exchanged from neighboring nodes, to calculate the device's real-time local health index. When the rate of decline of the health index exceeds the threshold, the advanced event of sudden health drop is triggered. Only the cleaned and compressed feature vectors, health values, and event markers are uploaded to the central cloud platform.

[0010] Specifically, the root cause analysis module performs the following operations: Construct a global device topology graph with devices as nodes and physical connections and logical dependencies as edges; A dynamic Bayesian network is constructed based on the topology graph, and the network nodes and their conditional probability tables are initialized. Anomalies occurring in a time series are input into a dynamic Bayesian network as observational evidence. The posterior failure probability of each device node is calculated through an inference algorithm to locate the most likely root cause device and generate a failure propagation chain. A graded warning system with accompanying confidence level is generated based on the root cause probability and severity.

[0011] Specifically, the root cause analysis module also performs proactive defense operations: Using the currently inferred root causes and evidence status as the initial conditions of the dynamic Bayesian network, multi-step forward simulation reasoning is performed to predict the failure probability of downstream nodes at each future time step. A dynamic risk heat map is generated based on the predicted failure probability to identify equipment whose risk level will exceed the threshold in the future and the expected time. The dynamic risk heat map and the list of future high-risk equipment are added to the early warning report as supplementary information.

[0012] Specifically, the initialization of the conditional probability table of the dynamic Bayesian network is as follows: The prior probability of failure of the root node is set to the average historical failure rate of this device type; The conditional probability of a child node is determined by both domain knowledge and historical data, and the strength of a coding fault propagated from the parent node to that node is determined by the strength of the fault. The delay effect of fault propagation is encoded by the transition probability between time slices.

[0013] Specifically, the operation and maintenance visualization interaction module performs the following operations: In the 3D visualization scene, the real-time health status of the device is mapped by color gradient, the warning level is displayed by icons, and drill-down is supported to view detailed device parameters and historical trends; When a root cause warning is received, the root cause device is highlighted in the 3D scene, and the propagation path of the fault along the topology is simulated in the form of animation. The system can generate intelligent operation and maintenance work orders with one click based on root cause warnings, pre-fill fault information and recommend handling plans, and track the status of work orders to form a closed loop.

[0014] Specifically, the operation and maintenance visualization interaction module also performs model optimization operations: Collect the reasons chosen by maintenance personnel for closing work orders and generate tagged feedback cases; Periodically use cases marked as confirmed root causes as positive samples to fine-tune the conditional probabilities of corresponding edges in the dynamic Bayesian network; By using cases labeled as false positives as negative samples, the relevant conditional probability can be reduced or the sensitivity of edge feature extraction can be adjusted.

[0015] The technical effects and advantages of this invention are as follows: A mapping layer from physical devices to unified semantic descriptions was constructed. Utilizing an adaptive protocol fingerprint library and a semi-automatic learning mechanism, plug-and-play understanding across vendor devices was achieved, fundamentally breaking down data silos. Combined with edge collaborative computing, feature extraction and health assessment were completed near the device, significantly reducing network bandwidth pressure and central cloud load. Simultaneously, multi-model fusion improved the robustness of state determination. Secondly, an innovative temporal reasoning mechanism based on dynamic Bayesian networks was introduced, combining discrete alarms with topological relationships. This enabled a leap from symptom alarms to root cause localization and the ability to predict fault propagation paths, transforming passive response into proactive defense.

[0016] Ultimately, through the 3D visualization twin and intelligent work order closed loop, an intuitive and efficient interactive interface is provided, and the inference model is continuously optimized by utilizing operation and maintenance feedback, forming an autonomous system of perception, analysis, decision-making, and optimization, which significantly improves operation and maintenance efficiency and the overall availability of the data center. Attached Figure Description

[0017] Figure 1 This is a system block diagram of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, the modules of the IoT-based intelligent operation and maintenance management system for data center monitoring equipment are as follows: The device semantic access module transforms data from physical monitoring devices of different protocols and models into a standardized data stream with a unified semantic description through protocol parsing, semantic tag mapping, and template matching. This solves the data heterogeneity problem and enables plug-and-play functionality. The process is as follows: When a device is connected, the gateway reads its raw data stream (such as Modbus register address and value, SNMP OID and value).

[0020] In the semantic knowledge base, standardized semantic labels (such as Location: Aisle03_Rack12, ParameterType:Temperature, Position: Inlet, Unit: Celsius) are assigned to each data point through predefined or machine learning-generated protocol-semantic mapping rules. For unknown protocols, a learning mode is activated, and new mapping rules are generated and the knowledge base is enriched through human-computer interaction or comparison with data patterns from similar devices.

[0021] The specific process of generating and matching mapping rules is as follows: The core of the semantic knowledge base is a triple rule base: (protocol type, protocol-specific path, standardized semantic tag). For example: (Modbus-TCP, 40001-40002, Rack_A1_Inlet_Temp).

[0022] When a new device is connected, the system first attempts to sniff the protocol and match templates: it matches known drivers (such as Modbus and BACnet) based on the device's IP port and the characteristics of the returned data frames, and loads the corresponding predefined point table template. This template has been pre-configured by experts with mappings of all register addresses to standard semantics. If no matching template is found, enter semi-automatic learning mode: Request to read the full data from the device over a period of time and display a list of register addresses where the values ​​changed; Operations and maintenance personnel can manually drag and drop a standard semantic label (such as inlet air temperature) to registers with obvious physical meaning (such as periodically fluctuating temperature values) through a graphical interface. This manual association is recorded, and adjacent or functionally related registers are automatically inferred. For example, if an inlet air temperature is associated, the system will indicate that the outlet air temperature register may be located at a subsequent address and request confirmation. After several manual confirmations, a complete mapping rule for this model of equipment is generated and stored in the knowledge base for future reuse.

[0023] Simultaneously, an adaptive protocol fingerprint database is constructed and maintained, which not only stores known protocol templates but also records the device communication feature fingerprints of each failed matching case in the historical semi-automatic learning mode and the template type of the final successful match; the specific process is as follows: Protocol fingerprint generation: When a new device connects and does not match a predefined template, the gateway passively collects its communication interaction characteristics while reading the raw data stream and generates a multi-dimensional feature vector called the protocol fingerprint p. This fingerprint includes: Histogram of data packet length distribution : Statistically analyze the distribution of request and response packet lengths within a specific time period; Response Delay Pattern Vector Record typical response time series characteristics (such as mean and variance) under different function codes (such as Modbus 03 / 04 codes) queries. Address space detection features : Identify the address range and distribution pattern (continuous or discrete) of device response registers through lightweight active scanning. Fingerprint similarity matching and template recommendation: Calculating fingerprint vectors for new devices fingerprint vectors of historical failed cases in the fingerprint database The similarity is calculated using an improved cosine similarity method based on feature weights.

[0024] in, The similarity score is given by n, where n is the total number of dimensions of the fingerprint features. These represent different feature dimensions (length, latency, address). The preset weights for this dimension feature (e.g., the weights for address distribution features are usually higher). This is the direct Euclidean distance between the corresponding feature vectors. Feature normalization parameters. The exponential term is used to penalize cases with excessively large differences on key features; Select similarity Exceeding the set threshold A historical case set (e.g., 0.85). If the set is not empty, the device templates corresponding to the cases in the set that have been successfully confirmed by humans will be automatically recommended to the operation and maintenance personnel after being sorted by the number of successful matches, or the template with the highest confidence will be automatically selected for trial loading according to the policy.

[0025] Adaptive updates to the fingerprint database: Whether automatically loaded through fingerprint matching or manually mapped using a subsequent "semi-automatic learning mode," the fingerprints of this new device will be updated accordingly. With its final determined equipment template type As a new record, it is associated and stored in the fingerprint database. Simultaneously, the weights are dynamically adjusted. and similarity threshold The adjustment is based on the contribution of each feature dimension to the final correct template classification in historical matching records (obtained through information gain or feature importance analysis), so that the matching accuracy of the fingerprint database adaptively improves with the number of uses.

[0026] Based on semantic tags, a device template is dynamically created or matched, defining the set of monitoring parameters, normal value range, and association with other devices for this type of device (e.g., a cooling device is associated with the area being cooled); specifically: The device template is defined in JSON Schema format and includes: device_type (e.g., precision air conditioner), manufacturer, and the expected_parameters array (each parameter contains semantic labels, units, normal value range, and alarm threshold logic). When the semantic tag set of a new device (such as compressor operating frequency, return air temperature, and supply air temperature) matches the expected_parameters of a certain device type (such as precision air conditioner) in the knowledge base with a matching degree exceeding a set threshold (such as 85%), the template will be automatically applied. After matching, the system automatically verifies whether the parameters reported by the device cover the key monitoring parameters defined in the template (such as the compressor status of the air conditioner). If any are missing, a configuration warning is generated.

[0027] The system outputs structured data points with globally unique semantic IDs, timestamps, normalized values, and data quality identifiers for use by upper-layer modules. This process decouples data access from data understanding.

[0028] The edge health assessment module performs real-time feature extraction and lightweight anomaly detection on standardized data at edge nodes close to the device. It fuses multi-source features and calculates the device's real-time health (LHI) using an ensemble learning model, uploading only features and events to achieve local intelligence and bandwidth optimization. The specific execution steps are as follows: Receives a standardized data stream from Module 1. For each device, maintains a sliding window of its recent data at the edge node.

[0029] Lightweight time series analysis algorithms (such as statistical process control and lightweight LSTM autoencoders) are executed in parallel at the edge to extract key features (such as mean drift, volatility abrupt changes, and periodic pattern deviations) and detect preliminary local anomalies, generating edge anomaly event markers. The specific process of edge feature extraction includes: For each time series window of a standardized parameter (e.g., the most recent hour, one point per minute), the edge nodes perform two computations in parallel: Statistical feature extraction: Calculates the mean, standard deviation, slope (for linear fitting), and correlation coefficient with the previous window of the same length for the data within the window. Used to capture slow drift and abrupt changes; Lightweight anomaly detection: Employs an Exponentially Weighted Moving Average (EWMA) control chart. An EWMA value is maintained for each parameter. When the difference between the latest reading and the EWMA value exceeds a certain multiple (e.g., 3σ) of its historical standard deviation, a statistical anomaly marker is generated. This algorithm has extremely low computational complexity, making it suitable for edge deployment. The extracted feature set F is: F = {mean, std, slope, correlation, ewma} residual ,is ewma}

[0030] Based on the parameter weights defined in the device template, the feature vectors of multiple parameters (such as temperature stability, power consumption change rate, compressor operating frequency, etc.) are fused, and a pre-trained evaluation model (such as gradient boosting tree) is used to calculate the device's real-time local health index (LHI, 0-100 points).

[0031] The Local Health Index (LHI) model uses a pre-trained Gradient Boosting Decision Tree (GBDT) regression model; after being trained in the central cloud using historical normal and fault data, it is distributed to the edge nodes. The model's input is a multi-dimensional feature vector: it includes not only the current feature set F1, F2...Fn of the device's own multiple parameters, but also contextual features exchanged from neighboring nodes, such as the current average supply air temperature of the other three air conditioners in the same cold aisle. This reflects collaboration; The model outputs a score from 0 to 100. During training, the LHI target value for historical normal data segments is set to 90-100, while the target value for data segments N minutes prior to the known failure linearly decreases to 0-20. The model learns the mapping from complex features to health scores. Edge nodes calculate the LHI every 5 minutes and compare it with the value of the previous period. If the LHI decrease rate exceeds the threshold (e.g., a decrease of 20 points in 10 minutes), a high-level health drop event is triggered.

[0032] Instead of all the raw data, cleaned and compressed feature vectors, LHI values, and edge anomaly event tags are uploaded to the central cloud platform. Simultaneously, key status information (such as the total heat load of the region) is exchanged with neighboring edge nodes, enabling lightweight collaborative sensing between edges.

[0033] The root cause analysis module constructs a dynamic Bayesian network (DBN) based on device topology relationships. It uses multi-source anomaly events as evidence for temporal reasoning to locate the most likely root cause of the failure and predict the risk propagation path, generating accurate early warnings with accompanying confidence levels and impact ranges. The process is as follows: Receive feature data, LHI (Local Hierarchical Information), and events from each edge node. Construct a global device topology graph, where nodes represent devices and edges represent physical connections, spatial proximity, or logical dependencies (e.g., an air conditioner's cooling object is a row of cabinets).

[0034] Root cause analysis is triggered when multiple spatiotemporally close anomalous events or LHI drop signals are received. Nodes (devices) in the topology graph are identified as potential root causes, and observed events are used as evidence.

[0035] Initialize a dynamic Bayesian network (DBN) with a topology graph. The node state represents the probability of device failure, and the conditional probability table (CPT) on the edge encodes the strength and delay of fault propagation (e.g., the probability of an air conditioner failure causing an increase in regional temperature is 0.95, with an average delay of 5 minutes). The construction and initialization process of a Dynamic Bayesian Network (DBN) is as follows: Network Structure: Each device in the topology graph is a node in the DBN. Directed edges between nodes are determined by physical dependencies, with the direction being cause -> effect. For example: air conditioner node -> data center temperature and humidity node, PDU node -> rack power consumption node. Each node has two defined states: normal and faulty.

[0036] Conditional probability table (CPT) initialization: Root node (device without a parent node): Its prior probability of failure P (failure) is set to the average historical failure rate of this device type (e.g., 0.1%). Child nodes (devices with parent nodes): Their CPT (Critical Temperature Propagation) is determined by domain knowledge and historical data. For example, for the data center temperature node, its parent node is the air conditioner. It can be initially defined as follows: if the air conditioner is working properly, the probability of a normal temperature is 0.99; if the air conditioner malfunctions, the probability of an abnormal (high) temperature is 0.8 (leaving a margin for other cooling factors). This 0.8 represents the fault propagation strength. The transition probabilities between time slices encode the delayed propagation of faults. For example, P(Air Conditioner(t) = Fault | Air Conditioner(t-1) = Fault) = 0.95 (fault persists), while P(Temperature(t) = High | Air Conditioner(t-1) = Fault) = 0.7 and P(Temperature(t) = High | Air Conditioner(t) = Fault) = 0.8, reflecting the delayed effect from air conditioner fault to temperature rise.

[0037] The events occurring in the time series are input into the DBN as observational evidence. Inference algorithms (such as particle filtering and approximate inference) are run to calculate the posterior failure probability of each potential root cause node and generate the failure propagation path with the highest probability.

[0038] The reasoning process is as follows: The received time-series evidence (such as the air conditioner LHI drop event at time t1; the computer room temperature exceeding the standard event at time t2 (t1+5min); the server fan speed-up event at time t2) is transformed into the observation status of the corresponding DBN node at different time slices; Using approximate inference algorithms (such as particle filtering or variational inference), forward-backward inference is performed in a DBN containing the time dimension to calculate the posterior probability that each device node is in a fault state at time t1 (the first point of anomaly). Based on the posterior failure probabilities of all nodes at time t1, the device with the highest probability exceeding the confidence threshold (e.g., 60%) is identified as the most likely root cause. The inference engine also outputs the fault propagation chain with the highest probability (e.g., air conditioner compressor failure -> cooling capacity decrease -> data center temperature rise -> server heat load intensifies -> fan speed increases).

[0039] Based on the root cause probability and severity, tiered warnings are generated (e.g., root cause warning: A03 precision air conditioning compressor failure, resulting in an expected increase in PUE of 0.15), rather than simple alerts. Warning information includes inference confidence and impact scope.

[0040] Furthermore, by utilizing proactive defense mechanisms to move the early warning threshold forward, proactive defense can be achieved. The process is as follows: The set of most likely root cause nodes determined by the current inference, their posterior states, and all observed evidence states are used as the initial conditions for the Dynamic Bayesian Network (DBN). ; Forward propagation simulation: Perform M steps (e.g., M=6, corresponding to the next 30 minutes, with a time step size Δt of 5 minutes) of forward propagation inference on a dynamic Bayesian network (DBN). For the m-th future step (m=1,2,...,M), compute each non-root cause node. Probability of being in a faulty state The state of a child node is calculated recursively from its parent node's state at step m-1 in the DBN, combined with the conditional probability table (CPT) and state transition probabilities. Specifically, for a child node... Its parent node set is Then, the probability estimate of its being in a fault state during forward propagation is:

[0041] in, For the Mth time step node The probability of being in a faulty state, where m is the time step index and x is the combination of states of the parent node set. For nodes The set of parent nodes, This represents all possible combinations of the parent node's state. Indicates the parent node The probability of being in a specific state at step m-1.

[0042] Dynamic risk heatmap generation: Predicting failure probabilities for all nodes at each future time step. This generates a dynamic risk heatmap. Based on a topology map, the map uses color depth (e.g., from light yellow to dark red) to visually represent devices at different points in the future. The projected risk level. Risk level Defined as Monotonically increasing function:

[0043] in: , This is a risk concern threshold, with a value range of 0 < <1 (e.g., 0.3), Values ​​range from 1 to 10, representing risks from low to high. This indicates the risk level within the next M steps. Devices that first exceed a high-risk threshold (e.g., 7) and their corresponding times .

[0044] Predictive Information Attachment and Alarms: The dynamic risk heatmap and the list of identified high-risk devices (including device identification, expected risk level, and expected risk occurrence time) are attached as supplementary information to the generated tiered early warning report. Simultaneously, if it is predicted that certain critical devices (such as core switches and backbone air conditioners) will reach a high-risk state within a short period (e.g., within the next 10 minutes), the system generates an independent proactive intervention suggestion alarm, such as "Prediction: The temperature of rack A10 will exceed the threshold in 8 minutes; it is recommended to check the operating status of air conditioner A03 or adjust its load in advance."

[0045] The operation and maintenance visualization and interaction module maps device health status and early warning information in real time in a 3D twin scene, provides root cause localization visualization and fault propagation simulation, and supports one-click generation of intelligent operation and maintenance work orders, forming a closed-loop management of "early warning-handling-feedback", as follows: Construct a 3D visualization scene of the data center to accurately map physical devices to their virtual twins (generated virtual devices).

[0046] In the 3D view, the real-time status of the device is intuitively rendered: LHI is represented by colors (green → yellow → red), and warning levels are displayed by icons. Clicking on a device allows you to drill down and view all its standardized parameters and historical health trends.

[0047] When a root cause warning is received from Module 3, the root cause device is highlighted in the scene, and the fault propagation path is simulated in the form of animation (such as a red pulse spreading from the faulty air conditioner to the associated cabinet).

[0048] Provides a closed-loop management interface for operation and maintenance work orders. Root cause alerts can be generated into intelligent work orders with a single click, pre-filled with the faulty equipment, possible causes, and scope of impact, and corresponding handling plans or knowledge base articles are recommended. The execution status of work orders is tracked, and the final handling results are fed back to Module 3 to optimize the CPT parameters in DBN, enabling system self-evolution; the specific evolution process is as follows: When a work order generated by a root cause warning is closed, the maintenance personnel must select the reason for closure: confirmed to be this cause and has been fixed, other cause, or false alarm and the equipment is normal; The system collects these tagged cases into a feedback case library; Start model optimization tasks regularly (e.g., weekly): For cases marked as confirmed to be the cause, the sequence of events on the root cause device and propagation path is used as a positive sample to fine-tune the conditional probability of the corresponding edge in the DBN (e.g., slightly increasing the CPT value of air conditioning failure leading to high temperature). Cases marked as false alarms are used as negative samples to reduce the relevant CPT value or adjust the sensitivity of edge feature extraction (e.g., adjusting the σ factor of the EWMA control chart). The optimization process employs Bayesian update or online learning algorithms to gradually make DBN inference more consistent with the actual physical characteristics of data centers while ensuring model stability.

[0049] The above formulas are all dimensionless calculations. Dimensionless calculations can be performed using various methods such as standardization, which will not be elaborated here. The formulas are derived from software simulations based on a large amount of collected data, and the preset parameters in the formulas can be set by those skilled in the art according to the actual situation.

[0050] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, ATA hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state ATA hard disk.

[0051] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0052] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0053] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0054] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0055] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0056] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable ATA hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0057] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things, characterized in that, Includes the following modules: The device semantic access module transforms data from physical monitoring devices of different protocols and models into a standardized data stream with a unified semantic description through protocol parsing, semantic tag mapping, and template matching. The edge health assessment module is used to perform real-time feature extraction and lightweight anomaly detection on standardized data at edge nodes close to the device. It integrates multi-source features and calculates the real-time health of the device through an ensemble learning model. It only uploads features and events to achieve local intelligence and bandwidth optimization. The root cause analysis module constructs a dynamic Bayesian network based on the device topology, uses multi-source abnormal events as evidence for temporal reasoning, locates the most likely root cause of the failure and predicts the risk propagation path, and generates an early warning with confidence level and impact range. The operation and maintenance visualization and interaction module maps the health status and early warning information of equipment in real time in a 3D twin scene, provides root cause localization visualization and fault propagation simulation, and supports one-click generation of intelligent operation and maintenance work orders.

2. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things as described in claim 1, characterized in that, The device semantic access module performs the following operations: When a device is connected, protocol sniffing is performed based on its network port and data frame characteristics to match known drivers and load the corresponding predefined point table template. If no matching template is found, the system enters a semi-automatic learning mode, assigns standard semantic labels to the device registers through human-computer interaction, and automatically infers adjacent or function-related registers to generate complete mapping rules for the device model. An adaptive protocol fingerprint library is built and maintained. When a new device has no matching template, its communication characteristics are collected to generate a protocol fingerprint. The similarity between this fingerprint and historical case fingerprints is calculated. For new devices with similarity exceeding a threshold, matching historical device templates are automatically recommended.

3. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things as described in claim 2, characterized in that, The maintenance of the adaptive protocol fingerprint database also includes: Each successfully mapped new device fingerprint is associated with and stored in relation to its final determined device template type. Based on historical matching records, the weights of each feature dimension of the fingerprint and the similarity matching threshold are dynamically adjusted so that the matching accuracy of the fingerprint database can be adaptively improved with the number of uses.

4. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things as described in claim 1, characterized in that, The edge health assessment module performs the following operations: Statistical features were extracted from the time series of standardized parameters for each device, and lightweight anomaly detection was performed using an exponentially weighted moving average control chart. A pre-trained gradient boosting decision tree model is used, which integrates the device's own multi-parameter features and contextual features exchanged from neighboring nodes to calculate the device's real-time local health index. When the rate of decline of the health index exceeds the threshold, the advanced event of sudden health drop is triggered. Only the cleaned and compressed feature vectors, health values, and event markers are uploaded to the central cloud platform.

5. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things as described in claim 1, characterized in that, The root cause analysis module performs the following operations: Construct a global device topology graph with devices as nodes and physical connections and logical dependencies as edges; A dynamic Bayesian network is constructed based on the topology graph, and the network nodes and their conditional probability tables are initialized. Anomalies occurring in a time series are input into a dynamic Bayesian network as observational evidence. The posterior failure probability of each device node is calculated through an inference algorithm to locate the most likely root cause device and generate a failure propagation chain. A graded warning system with accompanying confidence level is generated based on the root cause probability and severity.

6. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things as described in claim 5, characterized in that, The root cause analysis module also performs proactive defense operations: Using the currently inferred root causes and evidence status as the initial conditions of the dynamic Bayesian network, multi-step forward simulation reasoning is performed to predict the failure probability of downstream nodes at each future time step. A dynamic risk heat map is generated based on the predicted failure probability to identify equipment whose risk level will exceed the threshold in the future and the expected time. The dynamic risk heat map and the list of future high-risk equipment are added to the early warning report as supplementary information.

7. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things as described in claim 5, characterized in that, The initialization of the conditional probability table of the dynamic Bayesian network is specifically as follows: The prior probability of failure of the root node is set to the average historical failure rate of this device type; The conditional probability of a child node is determined by both domain knowledge and historical data, and the strength of a coding fault propagated from the parent node to that node is determined by the strength of the fault. The delay effect of fault propagation is encoded by the transition probability between time slices.

8. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things according to claim 1, characterized in that, The operation and maintenance visualization interaction module performs the following operations: In the 3D visualization scene, the real-time health status of the device is mapped by color gradient, the warning level is displayed by icons, and drill-down is supported to view detailed device parameters and historical trends; When a root cause warning is received, the root cause device is highlighted in the 3D scene, and the propagation path of the fault along the topology is simulated in the form of animation. The system can generate intelligent operation and maintenance work orders with one click based on root cause warnings, pre-fill fault information and recommend handling plans, and track the status of work orders to form a closed loop.

9. The intelligent operation and maintenance management system for data center monitoring equipment based on the Internet of Things as described in claim 8, characterized in that, The operation and maintenance visualization interaction module also performs model optimization operations: Collect the reasons chosen by maintenance personnel for closing work orders and generate tagged feedback cases; Periodically use cases marked as confirmed root causes as positive samples to fine-tune the conditional probabilities of corresponding edges in the dynamic Bayesian network; By using cases labeled as false positives as negative samples, the relevant conditional probability can be reduced or the sensitivity of edge feature extraction can be adjusted.

Images