A real-time root cause analysis method based on operation and maintenance knowledge graph

Abstract

The application discloses a kind of real-time root cause analysis methods based on operation and maintenance knowledge graph, by constructing operation and maintenance knowledge graph ontology, the extraction of the content such as entity, relationship of concept is completed using natural language processing, machine learning technology, and the basic framework of knowledge graph is built;Device knowledge graph is constructed, and a renewable, maintainable device knowledge graph is established based on knowledge and data using the topology structure of digital device, the calling relationship between system applications;Construct fault knowledge graph, provide backup support for subsequent fault root cause analysis;Real-time fault convergence and root cause analysis, according to the corresponding category and the sequence mode indicated by alarm information, obtain causal relationship, and obtain root cause path;The application provides a kind of thought for real-time fault root cause positioning analysis of digital basic operation and maintenance facilities, and has the characteristics of strong expansibility, high availability of root cause positioning result.

Description

Technical Field

[0001] This invention relates to the field of fault analysis technology for data service support, and in particular to a real-time root cause analysis method based on operation and maintenance knowledge graph. Background Technology

[0002] With the rapid development of emerging digital technologies such as artificial intelligence, cloud computing, and 5G mobile communication, the scale of digital infrastructure is constantly expanding, and its role in national economic and social development is becoming increasingly important. However, digital infrastructure often brings problems such as dispersed data collection areas, poor remote operation and maintenance, heavy reliance on manual inspections, and inconsistent monitoring and management methods, posing high risks and significant cost pressures to the entities involved. In the daily operation, management, and maintenance of digital facilities and equipment, once infrastructure or network links fail, maintenance personnel need to spend a lot of time and energy to troubleshoot and repair them one by one. The slow speed of manual repairs inevitably affects normal service and production and operation activities. In particular, the operation and maintenance of digital infrastructure in key areas such as healthcare, government affairs, and finance is even more critical, and how to efficiently diagnose and analyze facility failures faces enormous challenges. Therefore, building an intelligent fault diagnosis and operation and maintenance system for new digital infrastructure has become a necessity for enterprises and a research hotspot both domestically and internationally.

[0003] Currently, research in fault diagnosis and root cause analysis mainly focuses on the current operating state of the system, and the analytical methods or specific system applications involved are relatively limited. When a system has faults or anomalies, the detection and root cause analysis capabilities for the target object are insufficient. Traditional data-based network fault diagnosis methods suffer from poor interpretability and low application performance. Summary of the Invention

[0004] To address the shortcomings and defects of existing technologies, this invention provides a real-time root cause analysis method based on an operations and maintenance knowledge graph. This invention combines knowledge graph technology to build an operations and maintenance knowledge graph for fault diagnosis and root cause analysis, which effectively improves the model's reasoning ability, increases fault location efficiency, and enhances its applicability in practical engineering.

[0005] To achieve the above objectives, the present invention provides the following technical solutions.

[0006] A real-time root cause analysis method based on operation and maintenance knowledge graph, characterized by the following steps:

[0007] Step S1: Establish a knowledge graph application architecture in the field of digital infrastructure, construct an operation and maintenance model structure, and organically combine multiple operation and maintenance objects together;

[0008] Step S2: Construct the ontology of the operation and maintenance knowledge graph, use natural language processing and machine learning techniques to complete the extraction, and build the basic framework of the knowledge graph;

[0009] Step S3: Knowledge extraction. A joint extraction algorithm that simultaneously extracts entities and relations is used on the existing data to solve potential problems such as transmission error, information redundancy, and ignoring the relationships between subtasks.

[0010] Step S4: Knowledge fusion, which eliminates knowledge redundancy through entity alignment and attribute alignment, establishes relationships, iteratively learns entities and relationships, and automatically captures deep-level knowledge features;

[0011] Step S5: Construct a device knowledge graph, and build an updatable and maintainable device knowledge graph based on knowledge and data;

[0012] Step S6: Construct a fault knowledge graph to provide backup support for subsequent root cause analysis of faults;

[0013] Step S7: Real-time root cause analysis based on operation and maintenance knowledge graph, focusing on the convergence of alarm data and real-time root cause localization.

[0014] Compared with existing technologies, this invention enables rapid fault location and root cause analysis of real-time alarm information by constructing an operation and maintenance knowledge graph composed of equipment knowledge graph and fault knowledge graph. This invention combines knowledge graph technology to build an operation and maintenance knowledge graph oriented towards fault diagnosis and root cause analysis, which effectively improves the model reasoning ability, increases fault location efficiency, and enhances its applicability in practical engineering.

[0015] Furthermore, in step S1, the application architecture of the knowledge graph in the digital infrastructure field includes a data layer, a core layer, and an application layer. The data layer is responsible for aggregating data from different data sources and performing in-depth analysis and fusion. The core layer constructs an ontology based on expert knowledge in the field of digital infrastructure diagnosis and the needs of knowledge graph applications, and determines the entities and relationship types contained in the equipment knowledge graph and the fault knowledge graph.

[0016] Knowledge graph representation technology can not only represent related entities, relationships, and attributes, but also represent real-time fault sequences, providing a guarantee for subsequent real-time root cause analysis.

[0017] Furthermore, in step S2, the method for constructing the operation and maintenance knowledge graph ontology is as follows:

[0018] Step S21: Input various types of statements and parse the input statements to obtain valid syntactic information data;

[0019] Step S22: Extract the entity, relation, and attribute content from the syntactic information data using natural language processing and machine learning techniques;

[0020] Step S23: Manually screen and supervise the processed ontology, relation, and attribute content to control the quality of the data added to the knowledge base;

[0021] Step S24: After content selection and verification, the information is stored in the designated database.

[0022] This method significantly reduces manual costs during data collection when constructing the basic framework of a knowledge graph, while also significantly improving the overall efficiency of the construction process.

[0023] Furthermore, in step S3, the entity extraction specifically refers to the entity extraction module using a self-attention mechanism to represent the entity relationships within the statement, obtaining the encoded feature vector, and then using a fully connected layer and a convolutional neural network to extract the entities, and forming a candidate entity set from the extracted entities.

[0024] Furthermore, in step S3, relation extraction refers to using the extracted entity feature vector as input after the entity module extracts features, and predicting the relationship between entities through a self-attention layer and a fully connected layer. The model training uses a random sampling method to obtain training data and uses the Adam algorithm to optimize the model parameters.

[0025] By using a pre-trained model of text statements in the digital foundational fault domain and extracting entities and their relationships, the target triples can be obtained directly, thus solving the problems of pipelined methods.

[0026] Furthermore, in step S5, the data of the device knowledge graph includes configuration management database data, call chain data, and physical device network connection data; the construction of the device knowledge graph starts with data, and the specific steps are as follows:

[0027] Step S51: Construct a relationship graph based on the configuration management database data, extract key variables from the logs, and then perform remote annotation and manual screening to semi-automatically generate the configuration management data and obtain the software knowledge graph;

[0028] Step S52: Construct a knowledge graph based on the call chain or physical device network connection data. Using a method similar to step S51, first perform topic-based clustering on the log information, then use the Smith-Waltman algorithm to identify variables in the text, extract high-confidence variables, and generate a hardware knowledge graph.

[0029] Step S53: Merge the software knowledge graph obtained in step S51 and the hardware knowledge graph generated in step S52 using NetworkX and store them in the graph database to obtain the final device knowledge graph.

[0030] Furthermore, in step S6, the specific steps for constructing the fault knowledge graph are as follows:

[0031] Step S61: Based on the convolutional neural network method, the alarm information is first segmented into words, then word vectors are calculated, and the word vectors are used as input to train the model to classify the alarm data;

[0032] Step S62: Classify all alarms as causal nodes. With each virtual machine alarm record as the center, given an alarm time slice, find the set of related alarm records within each virtual machine alarm time slice as a causal discovery sample.

[0033] Step S63: Calculate the weight of the causal edge. The weight of the causal edge is the ratio of the number of times the result node alarms under the condition that the cause node alarms to the total number of alarms that the cause node has.

[0034]

[0035] Where, m i Let M be the number of times the result node triggers an alarm given that the cause node triggers an alarm on causal edge i, and let W be the total number of alarms triggered by the cause node. i Let i be the weight of the edge i in the factor node.

[0036] Furthermore, in step S61, the input training model for the alarm data includes an input layer, a convolutional layer, a pooling layer, and a fully connected layer;

[0037] Each input data vector in the input layer can be pre-trained or obtained by training the current neural network model; the convolutional layer is the core part of the alarm data classification model, and the sizes of the three convolutional layers are set to 2, 3 and 4 respectively to extract progressively richer feature information, as shown in the following mathematical expression:

[0038]

[0039] Where w i(i,j) The weights of the input nodes of the convolution kernel at the i-th node in the output matrix represent the weights of y. i,j The values ​​of nodes in the convolution kernel; h i It is the result of the final convolutional layer.

[0040] The pooling layer allows the model to focus on certain necessary features and reduces the size of the feature vector and parameters, thus achieving dimensionality reduction; the output vectors in the fully connected layer are all input into the Softmax classifier to complete the classification task of the final result; 0 indicates that the signal is not disturbed, and 1 indicates that the signal is disturbed.

[0041] The alarm classification method based on convolutional neural networks has high accuracy and effectively classifies alarm data.

[0042] Furthermore, in step S7, the specific steps for the convergence of alarm data and real-time root cause localization are as follows:

[0043] Step S71: Set the time slice granularity and acquire alarm data within the time slice in real time;

[0044] Step S72: Based on the original alarm data, and in conjunction with the specific alarm information and monitoring items, classify the original alarm data from three aspects: HOST, VM, and SOFTWARE according to the trained classification model.

[0045] Step S73: Query the software and hardware knowledge graph to converge alarms on a system-by-system basis;

[0046] Step S74: Based on the alarm convergence results, query the connection subgraph between all nodes under each system in the graph database according to the system level to obtain the alarm cause-effect graph between the nodes under a certain system;

[0047] Step S75: Based on the alarm cause-effect graph generated in step S74 and the weights, calculate the suspected paths and sort them to give the root cause paths. Attached Figure Description

[0048] Figure 1 This is an architecture diagram of an operations and maintenance knowledge graph based on the field of digital infrastructure faults.

[0049] Figure 2 A flowchart for establishing the architecture;

[0050] Figure 3 To construct the ontology flowchart of the operation and maintenance knowledge graph;

[0051] Figure 4 This is a flowchart for knowledge extraction. Detailed Implementation

[0052] To enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention will be further described below in conjunction with the accompanying drawings and this embodiment.

[0053] like Figure 1 As shown, Figure 1This is an architecture diagram of an operations and maintenance knowledge graph based on the domain of digital infrastructure failures. Figure 2 The flowchart for building the architecture is as follows:

[0054] Step S1: Establish a knowledge graph application architecture for the digital infrastructure domain. The application architecture for the knowledge graph in the digital infrastructure domain designed in this invention includes a data layer, a core layer, and an application layer.

[0055] Among them, the data layer is responsible for aggregating data from different data sources and performing in-depth analysis and fusion. The core data layer constructs the ontology based on expert knowledge in the field of digital infrastructure diagnosis and the needs of knowledge graph applications, and determines the entities and relationship types contained in the equipment knowledge graph and fault knowledge graph. It is a key component of the three-layer structure.

[0056] Step S2: Construct an operations and maintenance knowledge graph ontology, use natural language processing and machine learning techniques to extract the knowledge, and build the basic framework of the knowledge graph.

[0057] This invention employs a semi-automated construction method, and the method for constructing the knowledge graph ontology for operation and maintenance is as follows: Figure 3 As shown:

[0058] Step S21: Input various types of statements and parse the input statements to obtain valid syntactic information data;

[0059] Step S22: Extract the entity, relation, and attribute content from the syntactic information data using natural language processing and machine learning techniques;

[0060] Step S23: Manually screen and supervise the processed ontology, relation, and attribute content to control the quality of the data added to the knowledge base;

[0061] Step S24: After content selection and verification, the information is stored in the designated database.

[0062] This method significantly reduces manual costs during data collection when constructing the basic framework of a knowledge graph, while also significantly improving the overall efficiency of the construction process.

[0063] Step S3: Knowledge extraction. After constructing the ontology, a joint extraction algorithm that simultaneously extracts entities and relations is used on the existing data to solve potential problems such as transmission error, information redundancy, and ignoring the relationships between subtasks.

[0064] like Figure 1As shown, the data sources for knowledge extraction are quite extensive, mainly including structured data, semi-structured data, and unstructured data, with a relatively small amount of distributed data packets. For the extraction of structured data, data can be directly extracted based on metadata and the constructed ontology. For semi-structured or unstructured data, it is necessary to design corresponding extraction algorithms based on the content and structure of the corpus. This invention adopts a joint extraction algorithm that simultaneously extracts entities and relations from existing data after the ontology is constructed, which can directly obtain the target triples and solve the problems existing in pipeline methods.

[0065] The entity extraction module uses a self-attention mechanism to represent the entity relationships within a statement, obtains encoded feature vectors, and then uses fully connected layers and convolutional neural networks to extract entities, forming a candidate entity set.

[0066] The model uses QANet's pointer network to extract entities. For the output sequence h = (h1, h2, ..., h...) of the attention layer... n The result is fed into a fully connected layer and activated by a sigmoid function to obtain the final predicted sequence P of the entity's head and tail. s =(s1,s2,…,s n ) and P e =(e1,e2,…,e n ).

[0067] This module uses binary cross-entropy as the loss function:

[0068] Loss = L(P s )+L(P e )

[0069] Among them, L(P s L(P) is the binary cross-entropy between the entity head and the true result. e ) is the binary cross-entropy of the entity tail and the true result, and the sum of these two is the total loss.

[0070] After features are extracted by the entity module, the extracted entity feature vectors are used as input to predict the relationships between entities through a self-attention layer and a fully connected layer. The prediction logic is as follows:

[0071] P(s,r,o)=P(s)P(s|r)P(o|s,r)

[0072] Here, r represents the corresponding relation, s represents the entity extracted in the previous module, and o represents the entity of s under the corresponding relation p. Then, the existence of the relation is calculated using an activation function:

[0073] a = sigmoid(w TH)

[0074] The system sequentially checks whether each relation r exists in the input text and determines whether the corresponding relation exists between the corresponding entities based on calculations. Training data is obtained through random sampling, and the Adam algorithm is used to optimize the model parameters.

[0075] Step S4: Eliminate knowledge redundancy through entity alignment and attribute alignment, and perform knowledge fusion.

[0076] This invention proposes a knowledge fusion framework for the field of digital infrastructure, which can iteratively learn entities and relationships, automatically capture deep-level knowledge features, and improve the accuracy of knowledge fusion; such as Figure 4 As shown, the steps of knowledge fusion are as follows:

[0077] Step S41: Filter the knowledge database into a set of entities to be aligned and a small number of entity pairs to be aligned;

[0078] Step S42: The filtered knowledge data is combined with the graph for learning, and a part of it forms a training set under the graph representation, while the other part forms an alignment set under the graph representation;

[0079] Step S43: The training set under the graph representation can be further divided into the attribute-level training set and the relation-level training set; the attribute-level training set is continuously aligned with attributes to form an attribute-level model, and then continues to learn to form the alignment set under the graph representation.

[0080] Step S44: The alignment set under the graph representation will automatically capture deep-level knowledge features, forming a new training set at the attribute level and a training set at the relation level.

[0081] Step S45: After the training set at the relational level is formed, continue learning to form a new, deeper training set at the relational level.

[0082] Step S5: Construct a device knowledge graph. Based on knowledge and data, establish an updatable and maintainable device knowledge graph.

[0083] This invention constructs a device knowledge graph starting with data. The specific steps are as follows:

[0084] Step S51: Construct a relationship graph based on the configuration management database data. First, connect to the original device and collect network device syslog data; then, perform topic-type-based clustering on the log information. The joint probability of the topic-type-based clustering model is specifically represented as follows:

[0085]

[0086] Where d represents a specific log file, w represents a specific keyword, K represents the total number of topics, and z k This represents the k-th topic.

[0087] Clustering of configuration management database log information is performed using a topic-type-based clustering algorithm. Then, the Smith-Waltman algorithm is used to identify variables and find high-similarity confidence variables among multiple sequences. Assume the sequences to be compared are X = x1x2, Y = y1y2…y m , where n and m represent the lengths of sequences X and Y, respectively.

[0088] Create a new score matrix H and initialize its first row and first column. The matrix has n+1 rows and m+1 columns. Score the matrix from left to right and from top to bottom, filling the remaining part of matrix H.

[0089] H k0 =H 0l =0 (0≤k≤n,0≤l≤m)

[0090]

[0091] Among them, H i-1,j-1 +s(x i ,y i ) indicates that x i and y i Similarity score of the comparison, H i-k,j -W k x represents i The score H is the result of deleting a segment of length k at the end of the deletion. i,j-l -W l Indicates y j The score at the end of a deletion of length l, where 0 represents x. i and y i No similarity. Repeat step S51 until an element with a score of 0 is encountered.

[0092] After extracting key variables from the logs, remote annotation and manual filtering are performed to semi-automatically generate management data and create a software knowledge graph.

[0093] Step S52: Construct a knowledge graph based on the call chain or physical device network connection data. The call chain data is mainly used to obtain the distribution unit, the call relationship between the system, the mapping relationship between the distribution unit and the IP address, and the logical relationship of the middleware. The physical devices mainly include physical machines, switches and routers. This section uses a similar method to step S51 to extract high-confidence variables and generate a hardware knowledge graph.

[0094] Step S53: Merge the configuration management database, call chain, and physical device knowledge graph obtained above through networkx and store them in the graph database Neo4j to finally obtain the device knowledge graph, which is mainly divided into single-system and inter-system graphs.

[0095] Step S6: The specific steps for constructing the fault knowledge graph are as follows:

[0096] Step S61: Using a convolutional neural network-based method, the alarm information is first segmented into words, then word vectors are calculated, and the word vectors are used as input to train the model to classify the alarm data; the model includes an input layer, a convolutional layer, a pooling layer, and a fully connected layer.

[0097] The data vector for each input in the input layer can be pre-trained or obtained by training the current neural network model;

[0098] The convolutional layer is the core component of the alarm data classification model. The three convolutional layers are set to sizes of 2, 3, and 4 respectively, extracting progressively richer feature information. The mathematical expression is as follows:

[0099]

[0100] Where w i(i,j) The weights of the input nodes of the convolution kernel at the i-th node in the output matrix represent the weights of y. i,j The values ​​of nodes in the convolution kernel; h i It is the result of the final convolutional layer.

[0101] The main function of the pooling layer is to allow the model to focus on certain necessary features and reduce the size of the feature vector and parameters, thereby achieving dimensionality reduction. This invention uses the max pooling method.

[0102] The output vectors of the fully connected layer are all input into the Softmax classifier to complete the classification task of the final result; 0 indicates that the signal is not disturbed, and 1 indicates that the signal is disturbed.

[0103] Experimental results show that the alarm classification method based on convolutional neural networks has high accuracy and is effective in classifying alarm data.

[0104] Step S62: Classify all alarms as causal nodes. With each virtual machine alarm record as the center, given an alarm time slice, find the set of related alarm records within each virtual machine alarm time slice as a causal discovery sample.

[0105] This invention employs a fraction-based causal algorithm, which performs conditional tests on variables and variable sets to obtain possible causal edges. The first step of the fraction-based causal algorithm is to perform a traversal and edge-pruning operation starting from a completely connected undirected graph, ultimately obtaining a graph skeleton G. Its algorithmic principle relies on the property that the conditional independence between variables under the fidelity assumption is equivalent to the directed separation of corresponding vertices in the graph model. By calculating all possible conditional independences between any two variables and relying on this conditional independence to determine the directed separation property, the purpose of deleting false edges is achieved. The steps are as follows:

[0106] Connect all the variables in the variable set to construct a complete undirected graph.

[0107] Step S621: Starting from the undirected graph, arbitrarily select a pair of adjacent variables X and Y. If X⊥Y|Q is separated, that is, X and Y are unconditionally independent, delete this edge XY from the directed acyclic graph; where Q is the set of nodes with adjacency relationship.

[0108] Step S622: Given node Q, there are undirected edges connecting each node, and all other nodes are conditionally independent of each other, i.e., X⊥Y|Q; therefore, step S621 can be repeated to remove all edges that are not connected to node Q.

[0109] Step S623: In the undirected graph after removing all edges not in node Q, the connection path for any variable nodes X, Y, Z is XZY. Perform edge orientation on the connection path. If X and Y are not adjacent nodes in the acyclic graph, and Z is not in the separation condition set of (X,Y), then the direction of the edge of the XZY path is X→Z←Y.

[0110] Step S624: X and Z are adjacent variables, while X and Y are not adjacent variables; after step S623, if the path direction of XZ is determined to be X→Z, then according to directional propagation, the direction of all remaining edges can be determined; the path direction of ZY is Z→Y.

[0111] Step S63: Calculation of causal edge weights. The weights of causal edges are calculated using conditional probability. That is, based on the causal discovery sample data and the causal discovery algorithm, the causal edge (including two causal nodes) is weighted by the ratio of the number of times the result node triggers an alarm when the cause node triggers an alarm to the total number of alarms triggered by the cause node.

[0112]

[0113] Where, m i Let M be the number of times the result node triggers an alarm given that the cause node triggers an alarm on causal edge i, and let W be the total number of alarms triggered by the cause node. iLet i be the weight of the edge i in the factor node.

[0114] Step S7: Real-time root cause analysis based on operation and maintenance knowledge graph; the specific steps for alarm data convergence and real-time root cause localization are as follows:

[0115] Step S71: Set the time slice granularity and acquire alarm data within the time slice in real time;

[0116] Step S72: Alarm classification. Based on the original alarm data, combined with specific alarm information and monitoring items, the original alarm data is classified from three aspects: HOST, VM, and SOFTWARE according to the trained classification model.

[0117] Step S73: Alarm convergence, query the software and hardware knowledge graph to converge alarms on a system-by-system basis;

[0118] Step S74: Construction of alarm cause-effect graph. Based on the alarm convergence results, query the connection subgraph between all nodes under each system in the graph database according to the system level, and input the results into networkx to obtain the final connection relationship between the nodes under a certain system, i.e., the alarm cause-effect graph.

[0119] Step S75: Characterize the root cause path. Based on the alarm cause-effect graph generated in step S74 and the weights, calculate the suspected paths and sort them to give the root cause paths.

[0120] After completing steps S1 to S7, based on the identified instance or service anomaly, the root cause of the anomaly is determined to be an anomaly in the application system. Then, the fault solution knowledge base is invoked to output the corresponding root cause solution.

[0121] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions that fall within the scope of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A real-time root cause analysis method based on operation and maintenance knowledge graph, characterized in that: Includes the following steps: Step S1: Establish a knowledge graph application architecture in the field of digital infrastructure, construct an operation and maintenance model structure, and organically combine multiple operation and maintenance objects together; Step S2: Construct the ontology of the operation and maintenance knowledge graph, use natural language processing and machine learning techniques to complete the extraction, and build the basic framework of the knowledge graph; Step S3: Knowledge extraction. A joint extraction algorithm that simultaneously extracts entities and relations is used on the existing data to solve potential problems such as propagation error, information redundancy, and ignoring the relationships between subtasks. Step S4: Knowledge fusion, which eliminates knowledge redundancy through entity alignment and attribute alignment, establishes relationships, iteratively learns entities and relationships, and automatically captures deep-level knowledge features; Step S5: Construct a device knowledge graph. Based on knowledge and data, establish an updatable and maintainable device knowledge graph to enhance relationship processing and root cause localization capabilities. Step S6: Construct a fault knowledge graph to provide backup support for subsequent root cause analysis of faults; Step S7: Real-time root cause analysis based on operation and maintenance knowledge graph, focusing on the convergence of alarm data and real-time root cause localization; In step S6, the specific steps for constructing the fault knowledge graph are as follows: Step S61: Based on the convolutional neural network method, the alarm information is first segmented into words, then word vectors are calculated, and the word vectors are used as input to train the model to classify the alarm data; Step S62: Classify all alarms as causal nodes. With each virtual machine alarm record as the center, given an alarm time slice, find the set of related alarm records within each virtual machine alarm time slice as a causal discovery sample. Step S63: Calculate the weight of the causal edge. The weight of the causal edge is the ratio of the number of times the result node alarms under the condition that the cause node alarms to the total number of alarms that the cause node has. in, Causal edge The number of times a node generates an alarm under the condition that the node generates an alarm. This represents the total number of alarms that occurred due to the node. For this causal edge The weights; In step S61, the input training model for the alarm data includes an input layer, a convolutional layer, a pooling layer, and a fully connected layer. Each input data vector in the input layer is pre-trained or obtained from the current neural network model; the convolutional layer is the core part of the alarm data classification model, with the three convolutional layers set to sizes of 2, 3, and 4 respectively, extracting progressively richer feature information, as shown in the following mathematical expression: in Indicates the nth element in the output matrix The weights of the input nodes to the convolutional kernel of each node represent the weights of the input nodes. The values ​​of nodes in the convolution kernel; It is the result of the final convolutional layer; The pooling layer allows the model to focus on certain necessary features and reduces the size of the feature vector and parameters, thus achieving dimensionality reduction; the output vectors in the fully connected layer are all input into the Softmax classifier to complete the classification task of the final result; 0 indicates that the signal is not disturbed, and 1 indicates that the signal is disturbed; In step S7, the specific steps for the convergence of alarm data and real-time root cause localization are as follows: Step S71: Set the time slice granularity and acquire alarm data within the time slice in real time; Step S72: Based on the original alarm data, and in conjunction with the specific alarm information and monitoring items, classify the original alarm data from three aspects: HOST, VM, and SOFTWARE according to the trained classification model; Step S73: Query the software and hardware knowledge graph to converge alarms on a system-by-system basis; Step S74: Based on the alarm convergence results, query the connection subgraph between all nodes under each system in the graph database according to the system level to obtain the alarm cause-effect graph between the nodes under a certain system; Step S75: Based on the alarm cause-effect graph generated in step S74 and the weights, calculate the suspected paths and sort them to give the root cause paths.

2. The real-time root cause analysis method based on operation and maintenance knowledge graph according to claim 1, characterized in that: In step S1, the application architecture of the knowledge graph in the digital infrastructure field includes a data layer, a core layer, and an application layer. The data layer is responsible for aggregating data from different data sources and performing in-depth analysis and fusion. The core layer constructs an ontology based on expert knowledge in the field of digital infrastructure diagnosis and the needs of knowledge graph applications, and determines the entities and relationship types contained in the equipment knowledge graph and the fault knowledge graph.

3. The real-time root cause analysis method based on operation and maintenance knowledge graph according to claim 1, characterized in that: In step S2, the method for constructing the operation and maintenance knowledge graph ontology is as follows: Step S21: Input various types of statements and parse the input statements to obtain valid syntactic information data; Step S22: Extract the entity, relation, and attribute content from the syntactic information data using natural language processing and machine learning techniques; Step S23: Manually screen and supervise the processed ontology, relation, and attribute content to control the quality of the data added to the knowledge base; Step S24: After content selection and verification, the information is stored in the designated database.

4. The real-time root cause analysis method based on operation and maintenance knowledge graph according to claim 1, characterized in that: In step S3, the entity extraction specifically refers to the entity extraction module using a self-attention mechanism to represent the entity relationships within the statement, obtaining the encoded feature vector, and then using a fully connected layer and a convolutional neural network to extract the entities, forming a candidate entity set from the extracted entities.

5. The real-time root cause analysis method based on operation and maintenance knowledge graph according to claim 1, characterized in that: In step S3, relation extraction refers to using the extracted entity feature vector as input after the entity module extracts features, and predicting the relationship between entities through a self-attention layer and a fully connected layer. The model training uses a random sampling method to obtain training data and uses the Adam algorithm to optimize the model parameters.

6. The real-time root cause analysis method based on operation and maintenance knowledge graph according to claim 1, characterized in that: In step S5, the data of the device knowledge graph includes configuration management database data, call chain data, and physical device network connection data; the construction of the device knowledge graph starts with data, and the specific steps are as follows: Step S51: Construct a relationship graph based on the configuration management database data, extract key variables from the logs, and then perform remote annotation and manual screening to semi-automatically generate the configuration management data and obtain the software knowledge graph; Step S52: Construct a knowledge graph based on the call chain or physical device network connection data. Using the method in step S51, first perform topic-based clustering on the log information, then use the Smith-Waltman algorithm to identify variables in the text, extract high-confidence variables, and generate a hardware knowledge graph. Step S53: Merge the software knowledge graph obtained in step S51 and the hardware knowledge graph generated in step S52 using networkx and store them in the graph database to obtain the final device knowledge graph.

Images