IT operation and maintenance service management method based on big data

Abstract

The present invention relates to an IT operation and maintenance service management method based on big data, comprising the following steps: S1: collecting data from logs, monitoring tools, and user behaviors, and performing preprocessing; S2: performing anomaly detection on the preprocessed data set, and performing secondary data cleaning; S3: predicting the trend of system performance indicators based on the data after secondary data cleaning; S4: constructing a static user portrait based on user behavior data using hierarchical clustering and cluster analysis, and dynamically updating the user portrait to adapt to the latest behavior data based on path dynamic analysis; S5: optimizing resource allocation and task scheduling using a reinforcement learning algorithm based on the trend of system performance indicators and user portraits; S6: integrating external security intelligence and using an adaptive strategy adjustment mechanism. The present invention not only effectively improves system operation efficiency and reliability, but also improves effective management in an environment of IT operation and maintenance complexity and dynamic changes.

Description

Technical Field

[0001] The present invention relates to the field of IT operation and maintenance management, and in particular to an IT operation and maintenance service management method based on big data. Background Art

[0002] In today's digital and information-intensive environment, an enterprise's IT infrastructure has become a fundamental pillar of its operations and strategies. IT operation and maintenance service management based on big data has gradually become an important means for organizations to ensure the stability, security and efficient operation of their systems. With the rapid development of the Internet of Things (IoT), cloud computing and big data technologies, the amount of data faced by enterprises has exploded, and the operating environment has become increasingly complex and dynamic. These changes have brought new challenges, including: how to effectively collect and process massive amounts of data, quickly detect system anomalies, accurately predict system performance trends, and make intelligent decisions in a changing environment. At the same time, the security and reliability of enterprise systems directly affect their market competitiveness and customer satisfaction. Summary of the invention

[0003] In order to solve the above problems, the purpose of the present invention is to provide an IT operation and maintenance service management method based on big data, which can not only effectively improve the system operation efficiency and reliability, but also improve the effective management of IT operation and maintenance in a complex and dynamically changing environment.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] A big data-based IT operation and maintenance service management method comprises the following steps:

[0006] S1: Collect data from logs, monitoring tools, and user behaviors, and use Python's Pandas library for preprocessing, including data cleaning and handling missing values;

[0007] S2: Combine the K-Means and DBSCAN preprocessed data sets for anomaly detection, and perform secondary data cleaning based on the anomaly detection results to optimize the data cleaning strategy;

[0008] S3: Based on the data after secondary data cleaning, the trend of system performance indicators is predicted based on the ARIMA model;

[0009] S4: Using the hierarchical clustering algorithm, a static user profile is constructed based on user behavior data, and based on path dynamic analysis, the user profile is dynamically updated to adapt to the latest behavior data;

[0010] S5: Based on the trends of system performance indicators and user profiles, use reinforcement learning algorithms to optimize resource allocation and task scheduling;

[0011] S6: Integrate external security intelligence and apply it to security incident analysis, using the adaptive policy adjustment mechanism to automatically modify the protection strategy based on the security situation.

[0012] Furthermore, S1 is specifically:

[0013] Use Logstash as a log collector to extract log data from different servers and applications and send the log data to Elasticsearch for storage and indexing;

[0014] Collect network and system performance metrics using Prometheus and Zabbix;

[0015] Export user access and interaction data from user behavior analysis tools;

[0016] Use Apache Kafka as a data streaming platform to transfer data from all data sources to the database in real time;

[0017] Use the Pandas library to load data from the database, and use the drop_duplicates() function of Pandas to remove duplicate values, filter out unnecessary rows or columns based on specific conditions, and use forward filling to handle missing values.

[0018] Furthermore, S2 is specifically:

[0019] Standardize the preprocessed data, use the K-Means algorithm to perform cluster analysis on the standardized data, select the number of clusters and initialize the cluster centers, and repeat the following steps until convergence:

[0020]

[0021] Among them, C j is the set of all member samples of cluster j, μ j is the jth cluster center; x i is the feature vector of the ith data point, c i The cluster assigned to the i-th data point;

[0022] Compute the Euclidean distance from each point to the center of its cluster:

[0023] ;

[0024] Among them, m represents the total dimension of the feature space; Represents data points The value in the kth dimension; Represents the cluster center μ j The value in the kth dimension;

[0025] Find outliers based on distance threshold;

[0026] ;

[0027] in, Represents data points The cluster to which it belongs; x d Indicates anomalies; d u represents the distance threshold;

[0028] The data is densely clustered using DBSCAN. For each data point, its The number of points in the neighborhood. If the number reaches min_samples, it is a core point. Points that do not meet the core point criteria but belong to the neighborhood of a core point are boundary points, otherwise they are noise points and are marked as abnormal.

[0029] The anomaly datasets obtained from K-Means and DBSCAN are combined, the intersection and independent parts are analyzed, and secondary cleaning is performed to improve the quality of the dataset.

[0030] Furthermore, the abnormal data sets obtained from K-Means and DBSCAN are combined to analyze the intersection and independent parts, and a secondary cleaning is performed to improve the quality of the data set, as follows: the data points marked as abnormal by both K-Means and DBSCAN are identified as clear abnormal points, and the numerical data are modified using a data correction strategy; for data points only identified as abnormal by K-Means, check whether the data points belong to marginal values, and filter them if they do not affect the analysis; for data points only identified as abnormal by DBSCAN, confirm that the data is normal and retain them; for abnormal data that cannot be corrected or is invalid for analysis, remove them from the data set;

[0031] Furthermore, S3 is specifically:

[0032] The stationarity of the data was tested by ADF. If it was non-stationary, the difference operation was applied to remove the trend and seasonal effects;

[0033] Divide the data into training set and test set, where the training set is used for model fitting and the test set is used for model verification;

[0034] According to the behavioral characteristics of the autocorrelation function ACF and the partial autocorrelation function PACF, select appropriate parameters (p, d, q); p is the order of the autoregressive part; d is the degree of difference; q is the order of the moving average part;

[0035] Use the selected parameters to build an ARIMA model, fit the denoised training data, use the training set to train the model, and obtain parameter estimation and model fitting results;

[0036] ;

[0037] in, is the observed value of the time series at time t; c is a constant term; is the coefficient of the autoregressive part; p is the order of the autoregressive part, is the corresponding index variable; for Observation value of order; is the coefficient of the moving average part, q is the order of the moving average part, is the corresponding index variable; is the past error term; The error term at time t;

[0038] The Ljung-Box test was used to test whether the residuals were white noise to confirm that the model captured the structure of the data;

[0039] ;

[0040] Where Q is the Ljung-Box statistic; n is the sample size, that is, the number of observations of the time series data; is the autocorrelation coefficient of the residual, lag The autocorrelation coefficient of ; h is the number of lags tested.

[0041] Furthermore, S4 is specifically:

[0042] Extract key features from user behavior logs and construct them into feature vectors for cluster analysis;

[0043] Use Ward variance minimization method to analyze user behavior data and obtain clustering results;

[0044] According to the clustering results, users are classified into different groups, and the feature mean of each group is calculated to form a feature set representing the group portrait, and a static user portrait is obtained;

[0045] Analyze the user's behavior path, identify the user's interaction pattern by modeling the user behavior as a state transition process, and add it to the static user profile as a dynamic feature to obtain a dynamic user profile;

[0046] Use the real-time data update mechanism to adjust the user portrait, dynamically update it using the weighted average method, and merge new and old data:

[0047] Updated_Profile=α×Old_Profile+(1−α)×New_Data;

[0048] Among them, Updated_Profile represents the updated user profile, Old_Profile represents the original user profile, New_Data represents the new data, and α is the weight.

[0049] Furthermore, the Ward variance minimization method is used to analyze the user behavior data and obtain the clustering results, as follows:

[0050] Extract key behavioral features, including session duration, page visits, and click-through rate, to form a feature matrix

[0051] X; and use Euclidean distance as the standard distance measurement method to calculate the distance between different users and construct a distance matrix;

[0052] According to the calculated distance matrix, the Ward algorithm is used for clustering. Clustering is performed by calculating the discreteness of each cluster. Two clusters are merged each iteration to minimize the increment of the square error sum WCSS within the merged cluster. A clustering tree is generated and a dendrogram is constructed.

[0053] ;

[0054] Where WCSS is the WCSS increment; x is the number of cells belonging to the cluster user; cluster The mean of

[0055] Based on the dendrogram, the number of clusters is determined by the CH index and Dunn index:

[0056]

[0057] in, is the inter-cluster scatter matrix, is the intra-cluster scatter matrix; is the number of clusters; is the total number of data;

[0058] The Dunn index is the ratio of the minimum distance between the two most adjacent clusters to the maximum cluster diameter.

[0059] Furthermore, the user's behavior path is analyzed, and the user's interaction pattern within the application is identified by modeling the user's behavior as a state transition process (such as a Markov chain); all possible user behaviors are determined as states in the Markov chain;

[0060] Count the frequency of each behavior transition and calculate the transition probability between states;

[0061]

[0062] in, Status Transfer to state The probability of; C(.) is the transfer counter; Indicates the acquisition status Total number of transfers;

[0063] Based on the calculated transition probabilities between states, a transition matrix is ​​constructed, and the transition matrix is ​​used to identify high-frequency transition paths and determine user interaction patterns.

[0064] Furthermore, S5 is specifically:

[0065] Define the state space as a combination of system load level and user path location, and define the action set as resource adjustment and user guidance strategy; combine user profile information with system state characteristics to form the state input of reinforcement learning, making scheduling decisions more personalized; adjust the action space according to different user groups;

[0066] The reward function R(s,a) combines resource utilization and path completion rate:

[0067] R(s,a)=w1×Resource_Efficiency(s,a)+w2×Path_Completion_Success(s);

[0068] Among them, Resource_Efficiency(s,a) is the resource utilization rate; Path_Completion_Success(s) is the path completion rate; w1 and w2 are the corresponding weights;

[0069] Q value update:

[0070] ;

[0071] Where Q(s,a) is the estimated value of performing action a in state ss; α is the learning rate; γ is the discount factor, which weighs the present value of future rewards and ranges from 0≤γ<1; is the maximum expected Q value for all possible actions a′ at the next state s′;

[0072] Collect behavioral data and performance indicators, adjust strategies through Q-Learning, obtain optimization strategies through training, and improve resource allocation efficiency and user experience based on the optimization strategies;

[0073] Implemented in real-time stream processing -Balanced action selection in the greedy policy boosting model.

[0074] Furthermore, S6 is specifically:

[0075] Use Flink's CEP module to set performance and experience thresholds, analyze data streams in real time, and trigger alarms or automatically adjust rules when anomalies occur.

[0076] Encapsulate feedback information into the Flink pipeline and automatically adjust it according to the trigger rules , learning rate, and update frequency of state features.

[0077] The present invention has the following beneficial effects:

[0078] 1. The present invention not only effectively improves system operation efficiency and reliability, but also improves effective management in an environment with complex and dynamically changing IT operation and maintenance.

[0079] 2. The present invention uses a multi-stage data optimization method to identify and correct abnormal data through secondary cleaning, and improves the overall quality of the data set through deletion or expansion operations, ensuring that the data is more accurately and efficiently attached to the analysis process for decision-making, and realizing efficient and accurate anomaly detection and intelligent improvement of data cleaning;

[0080] 3. The present invention can effectively identify different user behavior patterns by using the Ward method for clustering, and build user portraits on this basis, and combine precise feature extraction and Euclidean distance to achieve efficient data segmentation and group analysis. By introducing path analysis, it can not only dynamically respond to the user's static frequency and quantitative state changes, but also identify the user's behavior pattern in the system, and reflect it in user portrait updates and resource optimization decisions. Finally, combined with Markov processes and reinforcement learning algorithms, it can cope with user experience and performance coordination problems in complex application environments, realize personalized resource management and user guidance mechanisms, thereby improving system performance and user satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0082] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0083] refer to Figure 1 In this embodiment, a method for IT operation and maintenance service management based on big data is provided, comprising the following steps:

[0084] S1: Collect data from multiple sources including logs, monitoring tools, and user behaviors (system logs, application logs, network monitoring tools (such as Prometheus, Zabbix), and user behavior logs), and use Python's Pandas library for preprocessing, including data cleaning and handling of missing values;

[0085] S2: Combine the K-Means and DBSCAN preprocessed data sets for anomaly detection, and perform secondary data cleaning based on the anomaly detection results to optimize the data cleaning strategy;

[0086] S3: Based on the data after secondary data cleaning, the trend of system performance indicators is predicted based on the ARIMA model;

[0087] S4: Using the hierarchical clustering analysis algorithm, a static user profile is constructed based on user behavior data, and based on path dynamic analysis, the user profile is dynamically updated to adapt to the latest behavior data;

[0088] S5: Based on the trends of system performance indicators and user profiles, use reinforcement learning algorithms (such as Q-Learning) to optimize resource allocation and task scheduling;

[0089] S6: Integrate external security intelligence (CTI) for security incident analysis, and use the adaptive policy adjustment mechanism to automatically modify the protection strategy based on the security situation.

[0090] In this embodiment, S1 is specifically:

[0091] Use Logstash as a log collector to extract log data from different servers and applications and send the log data to Elasticsearch for storage and indexing;

[0092] Collect network and system performance metrics using Prometheus and Zabbix;

[0093] Export user access and interaction data from user behavior analysis tools;

[0094] Use Apache Kafka as a data streaming platform to transfer data from all data sources to the database in real time;

[0095] Use the Pandas library to load data from the database, and use the drop_duplicates() function of Pandas to remove duplicate values, filter out unnecessary rows or columns based on specific conditions, and use forward filling to handle missing values.

[0096] In this embodiment, S2 is specifically:

[0097] Standardize the preprocessed data, use the K-Means algorithm to perform cluster analysis on the standardized data, select the number of clusters and initialize the cluster centers, and repeat the following steps until convergence:

[0098]

[0099] Among them, Cj is the set of all member samples of cluster j, μ j is the jth cluster center; x i is the feature vector of the ith data point, c i The cluster assigned to the i-th data point;

[0100] Compute the Euclidean distance from each point to the center of its cluster:

[0101] ;

[0102] Among them, m represents the total dimension of the feature space; Represents data points The value in the kth dimension; Represents the cluster center μ j The value in the kth dimension;

[0103] Find outliers based on distance threshold;

[0104] ;

[0105] in, Represents data points The cluster to which it belongs; x d Indicates anomalies; d u represents the distance threshold;

[0106] The data is densely clustered using DBSCAN. For each data point, its The number of points in the neighborhood. If the number reaches min_samples, it is a core point. Points that do not meet the core point criteria but belong to the neighborhood of a core point are boundary points, otherwise they are noise points and are marked as abnormal.

[0107] The anomaly datasets obtained from K-Means and DBSCAN are combined, the intersection and independent parts are analyzed, and secondary cleaning is performed to improve the quality of the dataset.

[0108] In this embodiment, the abnormal data sets obtained from K-Means and DBSCAN are combined, the intersection and independent parts are analyzed, and secondary cleaning is performed to improve the quality of the data set, specifically as follows: the data points marked as abnormal by both K-Means and DBSCAN are identified as clear abnormal points, and the numerical data are modified using data correction strategies (such as interpolation and median substitution); for data points only identified as abnormal by K-Means, check whether the data points belong to edge values, and filter them if they do not affect the analysis; for data points only identified as abnormal by DBSCAN, confirm that the data is normal and retain them; for abnormal data that cannot be corrected or is invalid for analysis, remove them from the data set;

[0109] In this embodiment, S3 is specifically:

[0110] The stationarity of the data was tested by ADF. If it was non-stationary, the difference operation was applied to remove the trend and seasonal effects;

[0111] Divide the data into training set and test set, where the training set is used for model fitting and the test set is used for model verification;

[0112] According to the behavioral characteristics of the autocorrelation function ACF and the partial autocorrelation function PACF, select appropriate parameters (p, d, q); p is the order of the autoregressive part; d is the degree of difference; q is the order of the moving average part;

[0113] Use the selected parameters to build an ARIMA model, fit the denoised training data, use the training set to train the model, and obtain parameter estimation and model fitting results;

[0114] ;

[0115] in, is the observed value of the time series at time t; c is a constant term; is the coefficient of the autoregressive part; p is the order of the autoregressive part, is the corresponding index variable; for Observation value of order; is the coefficient of the moving average part, q is the order of the moving average part, is the corresponding index variable; is the past error term; The error term at time t;

[0116] The Ljung-Box test was used to test whether the residuals were white noise to confirm that the model captured the structure of the data;

[0117] ;

[0118] Q is the Ljung-Box statistic; n is the sample size, that is, the number of observations of the time series data; is the autocorrelation coefficient of the residual, lag The autocorrelation coefficient of ; h is the number of lags tested.

[0119] In this embodiment, S4 is specifically:

[0120] Extract key features from user behavior logs, such as session length, page dwell time, number of clicks, etc., and construct them into feature vectors for cluster analysis;

[0121] Use Ward variance minimization method to analyze user behavior data and obtain clustering results;

[0122] According to the clustering results, users are classified into different groups, and the feature mean of each group is calculated to form a feature set representing the group portrait, and a static user portrait is obtained; (the user portrait includes demographic characteristics, consumption habits, traffic usage patterns, and personalized interest preferences, etc.);

[0123] Analyze the user's behavior path, identify the user's interaction pattern by modeling the user behavior as a state transition process (such as Markov chain), and add it to the static user profile as a dynamic feature to obtain a dynamic user profile;

[0124] (Update feature matrix and state transition probability in real time, adjust user portrait) Use real-time data update mechanism to adjust user portrait, dynamically update by weighted average method, and merge new and old data:

[0125] Updated_Profile=α×Old_Profile+(1−α)×New_Data;

[0126] Among them, Updated_Profile represents the updated user profile, Old_Profile represents the original user profile, New_Data represents the new data, and α is the weight.

[0127] In this embodiment, the Ward variance minimization method is used to analyze the user behavior data to obtain clustering results, which are as follows:

[0128] Extract key behavioral features, including session duration, page visits, and click-through rate, to form a feature matrix

[0129] X; and use Euclidean distance as the standard distance measurement method to calculate the distance between different users and construct a distance matrix;

[0130] According to the calculated distance matrix, the Ward algorithm is used for clustering. Clustering is performed by calculating the discreteness of each cluster. Two clusters are merged each iteration to minimize the increment of the square error sum WCSS within the merged cluster. A clustering tree is generated and a dendrogram is constructed.

[0131] ;

[0132] Where WCSS is the WCSS increment; x is the number of cells belonging to the cluster user; cluster The mean of

[0133] Based on the dendrogram, the number of clusters is determined by the CH index and Dunn index:

[0134]

[0135] in, is the inter-cluster scatter matrix, is the intra-cluster scatter matrix; is the number of clusters; is the total number of data;

[0136] The Dunn index is the ratio of the minimum distance between the two most adjacent clusters to the maximum cluster diameter.

[0137] In this embodiment, the user's behavior path is analyzed, and the user's interaction pattern within the application is identified by modeling the user's behavior as a state transition process (such as a Markov chain); all possible user behaviors are determined as states in the Markov chain;

[0138] Count the frequency of each behavior transition and calculate the transition probability between states;

[0139]

[0140] in, Status Transfer to state The probability of; C(.) is the transfer counter; Indicates the acquisition status Total number of transfers;

[0141] Based on the calculated transition probabilities between states, a transition matrix is ​​constructed, and the transition matrix is ​​used to identify high-frequency transition paths and determine user interaction patterns.

[0142] In this embodiment, S5 is specifically:

[0143] Define the state space as a combination of system load level and user path location, and define the action set as resource adjustment and user guidance strategy; combine user profile information with system state characteristics to form the state input of reinforcement learning, making scheduling decisions more personalized; adjust the action space according to different user groups;

[0144] The reward function R(s,a) combines resource utilization and path completion rate:

[0145] R(s,a)=w1×Resource_Efficiency(s,a)+w2×Path_Completion_Success(s);

[0146] Among them, Resource_Efficiency(s,a) is the resource utilization rate; Path_Completion_Success(s) is the path completion rate; w1 and w2 are the corresponding weights;

[0147] Q value update:

[0148] ;

[0149] Where Q(s,a) is the estimated value of performing action a in state s; α is the learning rate; γ is the discount factor, which weighs the present value of future rewards and ranges from 0≤γ<1; is the maximum expected Q value for all possible actions a′ at the next state s′;

[0150] Collect behavioral data and performance indicators, adjust strategies through Q-Learning, obtain optimization strategies through training, and improve resource allocation efficiency and user experience based on the optimization strategies;

[0151] Implemented in real-time stream processing -Balanced action selection in the greedy policy boosting model.

[0152] In this embodiment, S6 is specifically:

[0153] Use Flink's CEP (complex event processing) module to set performance and experience thresholds, analyze data streams in real time, and trigger alarms or automatically adjust rules when anomalies occur.

[0154] Encapsulate feedback information into the Flink pipeline and automatically adjust it according to the trigger rules , learning rate, and update frequency of state features.

[0155] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0156] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0157] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0158] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0159] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. An IT operation and maintenance service management method based on big data, characterized in that: The following steps are involved: S1: Collect data from logs, monitoring tools, and user behaviors, and use Python's Pandas library for preprocessing, including data cleaning and handling missing values; S2: Combine K-Means and DBSCAN preprocessed data sets for anomaly detection, and perform secondary data cleaning based on the results of anomaly detection to optimize the data cleaning strategy; S3: Based on the data after secondary data cleaning, the trend of system performance indicators is predicted based on the ARIMA model; S4: Using the hierarchical clustering analysis algorithm, a static user profile is constructed based on user behavior data, and based on path dynamic analysis, the user profile is dynamically updated to adapt to the latest behavior data; S5: Based on the trends of system performance indicators and user profiles, use reinforcement learning algorithms to optimize resource allocation and task scheduling; S6: Integrate external security intelligence and apply it to security incident analysis, using the adaptive policy adjustment mechanism to automatically modify the protection strategy according to the security situation; The S4 is specifically: Extract key features from user behavior logs and construct them into feature vectors for cluster analysis; Use Ward variance minimization method to analyze user behavior data and obtain clustering results; According to the clustering results, users are classified into different groups, and the feature mean of each group is calculated to form a feature set representing the group portrait, and a static user portrait is obtained; Analyze the user's behavior path, identify the user's interaction pattern by modeling the user behavior as a state transition process, and add it to the static user profile as a dynamic feature to obtain a dynamic user profile; Use the real-time data update mechanism to adjust the user portrait, dynamically update it using the weighted average method, and merge new and old data: ； Among them, Updated_Profile represents the updated user profile, Old_Profile represents the original user profile, New_Data represents the new data, and α is the weight; Analyze the user's behavior path, model the user behavior as a state transition process, and use Markov chain to identify the user's interaction pattern within the application; determine all possible user behaviors as states in the Markov chain; Count the frequency of each behavior transition and calculate the transition probability between states; in, Status Transfer to state The probability of; C(.) is the transfer counter; Indicates the acquisition status Total number of transfers; Based on the transition probabilities between calculated states, a transition matrix is ​​constructed, and the transition matrix is ​​used to identify high-frequency transition paths and determine user interaction patterns; S5 is as follows: Define the state space as a combination of system load level and user path location, and define the action set as resource adjustment and user guidance strategy; combine user profile information with system state characteristics to form the state input of reinforcement learning, making scheduling decisions more personalized; adjust the action space according to different user groups; The reward function R(s,a) combines resource utilization and path completion rate: ； Among them, Resource_Efficiency(s,a) is the resource utilization rate; Path_Completion_Success(s) is the path completion rate; w1 and w2 are the corresponding weights; Q value update: ； Where Q(s,a) is the estimated value of performing action a in state s; α is the learning rate; γ is the discount factor; is the maximum expected Q value for all possible actions a′ at the next state s′; Collect behavioral data and performance indicators, adjust strategies through Q-Learning, obtain optimization strategies through training, and improve resource allocation efficiency and user experience based on the optimization strategies; Implemented in real-time stream processing Balancing action selection in the greedy policy boosting model.

2. The IT operation and maintenance service management method based on big data according to claim 1 is characterized in that: The S1 is specifically: Use Logstash as a log collector to extract log data from different servers and applications and send the log data to Elasticsearch for storage and indexing; Collect network and system performance metrics using Prometheus and Zabbix; Export user access and interaction data from user behavior analysis tools; Use Apache Kafka as a data streaming platform to transfer data from all data sources to the database in real time; Use the Pandas library to load data from the database, and use the drop_duplicates() function of Pandas to remove duplicate values, filter out unnecessary rows or columns based on specific conditions, and use forward filling to handle missing values.

3. The IT operation and maintenance service management method based on big data according to claim 1 is characterized in that: The S2 is specifically: Standardize the preprocessed data, use the K-Means algorithm to perform cluster analysis on the standardized data, select the number of clusters and initialize the cluster centers, and repeat the following steps until convergence: Among them, C j is the set of all member samples of cluster j, is the jth cluster center; x i is the feature vector of the ith data point, c i The cluster assigned to the i-th data point; Compute the Euclidean distance from each point to the center of its cluster: ； Among them, m represents the total dimension of the feature space; Represents data points The value in the kth dimension; Represents the cluster center The value in the kth dimension; Find outliers based on distance threshold; ; in, Represents data points The cluster to which it belongs; x d Indicates anomalies; d u Indicates the distance threshold; The data is densely clustered using DBSCAN. For each data point, the number of points in its ε neighborhood is detected. If the number reaches min_samples, it is a core point. Points that do not meet the core point standard but belong to the neighborhood of a core point are boundary points, otherwise they are noise points, and the noise points are marked as abnormalities. The anomaly datasets obtained from K-Means and DBSCAN are combined, the intersection and independent parts are analyzed, and secondary cleaning is performed to improve the quality of the dataset.

4. The IT operation and maintenance service management method based on big data according to claim 3 is characterized in that: The method combines the abnormal data sets obtained from K-Means and DBSCAN, analyzes the intersection and independent parts, and performs secondary cleaning to improve the quality of the data set, specifically as follows: identifying data points marked as abnormal by both K-Means and DBSCAN, which are clear abnormal points, and using data correction strategies to modify numerical data; for data points only identified as abnormal by K-Means, check whether the data points belong to edge values, and filter them if they do not affect the analysis; for data points only identified as abnormal by DBSCAN, confirm that the data is normal and retain them; for abnormal data that cannot be corrected or is invalid for analysis, remove them from the data set.

5. The IT operation and maintenance service management method based on big data according to claim 1 is characterized in that: The S3 is specifically: The stationarity of the data was tested by ADF. If it was non-stationary, the difference operation was applied to remove the trend and seasonal effects; Divide the data into training set and test set, where the training set is used for model fitting and the test set is used for model verification; According to the behavioral characteristics of the autocorrelation function ACF and the partial autocorrelation function PACF, select appropriate parameters (p, d, q); p is the order of the autoregressive part; d is the degree of difference; q is the order of the moving average part; Use the selected parameters to build an ARIMA model, fit the denoised training data, use the training set to train the model, and obtain parameter estimation and model fitting results; ； in, is the observed value of the time series at time t; c is a constant term; is the coefficient of the autoregressive part; p is the order of the autoregressive part, is the corresponding index variable; for Observation value of order; is the coefficient of the moving average part, q is the order of the moving average part, is the corresponding index variable; is the past error term; The error term at time t; The Ljung-Box test was used to test whether the residuals were white noise to confirm that the model captured the structure of the data; ； Where Q is the Ljung-Box statistic; n is the sample size, that is, the number of observations of the time series data; is the autocorrelation coefficient of the residual, lag The autocorrelation coefficient of ; h is the number of lags tested.

6. The IT operation and maintenance service management method based on big data according to claim 1 is characterized in that: The S6 is specifically: Use Flink's CEP module to set performance and experience thresholds, analyze data streams in real time, and trigger alarms or automatically adjust rules when anomalies occur; Encapsulate the feedback information into the Flink pipeline and automatically adjust ϵ, learning rate, and update frequency of state features according to the triggering rules.

7. The IT operation and maintenance service management method based on big data according to claim 1 is characterized in that: The Ward variance minimization method is used to analyze the user behavior data to obtain the clustering results, as follows: Extract key behavioral features, including session duration, page visits, and click-through rate, to form a feature matrix X； And use Euclidean distance as the standard distance measurement method to calculate the distance between different users and construct a distance matrix; According to the calculated distance matrix, the Ward algorithm is used for clustering. Clustering is performed by calculating the discreteness of each cluster. Two clusters are merged each iteration to minimize the increment of the square error sum WCSS within the merged cluster. A clustering tree is generated and a dendrogram is constructed. ； in, is the WCSS increment; x is the number of clusters user; Cluster The mean of Based on the dendrogram, the number of clusters is determined by the CH index and Dunn index: in, is the inter-cluster scatter matrix, is the intra-cluster scatter matrix; is the number of clusters; is the total number of data; The Dunn index is the ratio of the minimum distance between the two most adjacent clusters to the maximum cluster diameter.

Images