A method and system for IT operation and maintenance management based on deep learning

Abstract

This application provides an IT operations and maintenance management method and system based on deep learning, relating to the technical field of information technology operations and maintenance. The method includes steps such as data acquisition, modeling, first extraction, prediction, first judgment, and maintenance. The system includes a data acquisition module, a modeling module, a first extraction module, a prediction module, a first judgment module, and a maintenance module. This application utilizes image data, environmental data, and log data to construct a more comprehensive and accurate predictive maintenance system.

Description

Technical Field

[0001] The present application relates to the technical field of information technology operation and maintenance, and in particular to an IT operation and maintenance management method and system based on deep learning. Background Art

[0002] In the modern information society, IT equipment has become the core support for business operations and daily life. With the rapid development of technology, the complexity and integration of IT equipment are increasing, and its safe and stable operation is of great significance to ensuring data security and business continuity. Especially in key areas such as finance and medical care, extremely high requirements are placed on the security and reliability of IT equipment.

[0003] However, traditional IT equipment maintenance methods often rely on regular inspections and post-failure repairs, which is not only inefficient, but also difficult to effectively prevent before failures occur. With the rise of technologies such as big data and artificial intelligence, predictive maintenance has gradually become possible. The Chinese invention patent with an application publication date of April 30, 2024 and an application publication number of CN117952599A discloses a cloud computing-based smart computer room platform operation and maintenance management system, including collecting comprehensive status data, generating an operation and maintenance status index, determining whether the selected host has entered the management state, selecting a primary management mode or a secondary management mode, marking the data to be adjusted, and in the primary management mode, formulating adjustment priorities and adjusting the data to be adjusted one by one. In the secondary management mode, formulating adjustment unit values ​​and adjusting the data to be adjusted synchronously. The data in this application is based on the comprehensive status data of the host operation, which includes the change value of the power load, the operating temperature climbing rate, the idle space ratio and the response processing speed. However, this data framework ignores the potential impact of environmental data and software operation status on the host performance when it is constructed. If these factors are not taken into consideration, it will lead to a one-sided understanding of the host's operating status, which will in turn affect the formulation and execution efficiency of maintenance strategies. Summary of the invention

[0004] In order to build a more comprehensive and accurate predictive maintenance system and improve the automation and efficiency of process execution, this application provides an IT operation and maintenance management method and system based on deep learning.

[0005] In the first aspect, the present application provides an IT operation and maintenance management method based on deep learning, which adopts the following technical solutions:

[0006] A deep learning-based IT operation and maintenance management method includes: building a database storing solutions, and the method further includes the following steps:

[0007] Data collection: including image collection, environment collection and log collection;

[0008] Image acquisition: collect real-time image data of IT equipment;

[0009] Environmental collection: collect real-time environmental data of IT equipment;

[0010] Log collection: collect historical log data and real-time log data of IT equipment;

[0011] Modeling: Establishing a prediction model based on a deep learning algorithm, wherein the prediction model includes a CNN sub-model and a BI-LSTM sub-model;

[0012] First extraction: input the real-time image data and real-time environment data into the CNN sub-model and output m working status features;

[0013] Prediction: Input all working status features, historical log data, and real-time log data into the BI-LSTM sub-model and output the prediction results;

[0014] First judgment: judge whether the prediction result meets the expectation. If yes, execute the data collection step; if no, execute the maintenance step;

[0015] Maintenance: including first calculation, second judgment, equipment replacement and adjustment;

[0016] First calculation: Calculate the risk index. The calculation model is as follows:

[0017] ;

[0018] in, is a risk indicator; is the weight of the i-th working state feature; is the i-th working state feature;

[0019] Second judgment: judging whether the risk index exceeds the preset index threshold, if so, executing the step of replacing the equipment; if not, executing the step of adjusting;

[0020] Replace equipment: activate spare equipment;

[0021] Adjustment: Use the prediction results to match the solution and obtain the adjustment object and adjustment plan.

[0022] By adopting the above technical solution, the present application can capture the relevant image data of IT equipment in real time, which is helpful to timely discover abnormal conditions such as physical damage of IT equipment and indicator light status changes; the present application can evaluate whether the operating environment of IT equipment is suitable based on environmental parameters, and obtain the impact of the environment on the performance of IT equipment; the present application can collect the operation log of IT equipment, which is helpful to analyze the hardware or software operation status and operation error records of IT equipment. The prediction model of the present application includes a CNN sub-model and a BI-LSTM sub-model. The CNN sub-model can process image data, automatically learn and extract useful features, and improve the prediction accuracy. The BI-LSTM sub-model can process time series data (real-time environmental data and various log data), and can also capture long-term dependencies in time series data to improve the timeliness of the prediction results. The sub-model combines historical log data and real-time log data, as well as the working status features extracted by CNN for prediction and obtains the prediction results. This application determines whether the prediction results meet the expected judgment results and whether the IT equipment needs maintenance, thereby realizing the preliminary screening of predictive maintenance and reducing unnecessary maintenance operations; this application calculates the risk index to quantify the risk level of IT equipment, and decides whether to replace the equipment (hardware problem) or make adjustments (software problem) based on the comparison results between the risk index and the preset index threshold. If the prediction results do not meet expectations due to hardware, the step of replacing the equipment is executed; otherwise, the step of adjusting is executed. This application performs predictive maintenance on IT equipment from three aspects: image, environment, and operation log, and determines whether the hardware or software needs maintenance by calculating the risk index of the working status characteristics, which can significantly improve the reliability and stability of IT equipment, effectively reduce the risk of business interruption caused by sudden failures, and save a lot of maintenance costs and time resources.

[0023] Optionally, after executing the second judgment step and before executing the device replacement step, the method further includes:

[0024] Data retrieval: Retrieve data from IT equipment i The historical image data and historical environment data at the time are recorded as the first historical data;

[0025] Second extraction: Input the first historical data into the CNN sub-model and output t i m historical state features at the moment;

[0026] Second calculation: Using the risk indicator calculation model, calculate t i Risk indicators at the moment;

[0027] The third judgment: judge t iWhether the risk index at the moment exceeds the preset index threshold, if so, execute the step of replacing the equipment; if not, execute the step of maintaining;

[0028] Maintain: Continue to use the current IT equipment and perform data collection to the third judgment step.

[0029] By adopting the above technical solution, this application retrieves t i The historical image data and historical environmental data at the moment are collected and input into the CNN sub-model to output the historical status features at the moment. The risk index at the moment is then calculated based on the historical status features. The risk index at the moment is then compared with the preset index threshold to determine whether the risk index is continuously greater than the preset index threshold. If so, it indicates that there is a problem with the hardware. Otherwise, it means that the IT equipment was operating normally before the current moment, and the current event is just an accident. The current IT equipment can continue to be used for work, and then the data collection step is performed to collect data at the next moment for re-judgment. The present application determines whether the hardware of the IT equipment has actually failed by determining whether the risk index is continuously greater than the preset risk index threshold. If it is just an accident, the current IT equipment continues to be used for work, and the data collection step to the third judgment step is re-executed at the next moment to reduce misjudgment.

[0030] Optionally, the prediction model further includes a self-attention sub-model, and after performing the first extraction step and before performing the prediction step, further includes:

[0031] The third calculation: Pearson correlation coefficient algorithm is used to calculate the correlation between each working status feature and the real-time log data;

[0032] Assign weights: Input the work status features and the corresponding relevance into the self-attention sub-model, and output the weight of each work status feature, which is recorded as the first weight;

[0033] Feature update: perform a product operation on each working state feature and the corresponding first weight to obtain a weighted working state feature, and use the weighted working state feature as a new working state feature.

[0034] By adopting the above technical solution, the present application calculates the correlation between each working status feature and the real-time log data, and assigns weights accordingly, which can more accurately focus on the key features that have an important impact on the prediction results. The present application uses the first weight to update the working status features, which is actually a weighted processing of the original features, so that important working status features are more reflected in the subsequent prediction process, which helps to improve the sensitivity of the prediction model to the status of IT equipment and the accuracy of the prediction results. The present application uses real-time log data to calculate feature correlation, which helps the prediction model to better adapt to the dynamic changes of the equipment status, improves the robustness and generalization ability of the prediction model, and enables it to maintain stable prediction performance under different environments and conditions.

[0035] Optionally, the BI-LSTM sub-model includes a group of LSTMs, recorded as the first network, and after performing the step of updating the features and before performing the step of predicting, further includes:

[0036] Screening features: obtaining a working state feature whose first weight is greater than a preset weight threshold, and recording the working state feature whose first weight is greater than the preset weight threshold as the first feature;

[0037] First screening: extracting the part associated with the first feature from the real-time log data as new real-time log data; extracting the part associated with the working status feature in the step of screening features from the historical log data as new historical log data;

[0038] In the prediction step, the first feature, the new real-time log data, and the new historical log data are used as inputs of the first network, and a first prediction result is output, and the first prediction result is used as a new prediction result.

[0039] By adopting the above-mentioned technical scheme, the present application screens the working status features whose first weights are greater than the preset weight threshold according to the first weight calculated in the step of allocating weights, and records the screened working status features as the first features. Then, the parts of the real-time log data and the historical log data that are strongly correlated with these screened first features are calculated as new real-time log data and new historical log data. Then, the first feature, the new real-time log data, and the new historical log data are input into the first network, and the first prediction result is output, so that the BI-LSTM sub-model can focus on the key first feature, reduce noise interference, and enable the prediction model to more accurately locate the cause of hardware failure and improve maintenance efficiency.

[0040] Optionally, the BI-LSTM sub-model further includes another group of LSTMs, recorded as a second network, which, after executing the prediction step and before executing the first judgment step, further includes:

[0041] Second screening: record the remaining part of the real-time log data as the first data; record the remaining part of the historical log data as the second data;

[0042] Re-prediction: taking the first data and the second data as inputs of the second network and outputting a second prediction result;

[0043] Integration: The first prediction result and the second prediction result are processed together to obtain a processing result, and the processing result is used as a new prediction result.

[0044] By adopting the above technical solution, this application introduces a second network for re-prediction. The BI-LSTM sub-model can capture the characteristics of log data at different levels (various log data that are weakly correlated with the first feature, that is, various log data in software), thereby providing more comprehensive prediction information. This multi-level prediction helps to improve the accuracy and robustness of the prediction model. This application also integrates the first prediction result and the second prediction result into a new prediction result, which can comprehensively consider the outputs of the two networks, further reduce the prediction error, and improve the prediction accuracy.

[0045] Optionally, after executing the second judgment step and before executing the device replacement step, the method further includes:

[0046] Authentication: Determine whether the username and password match. If so, execute the permission determination step; if not, execute the feedback step;

[0047] Authority judgment: judge whether the user's authority is administrator authority. If so, execute the device judgment step; if not, execute the device replacement step;

[0048] Equipment judgment: Collect the performance parameters of IT equipment and judge whether the performance parameters are within the preset parameter range. If so, execute the data collection step; if not, execute the equipment replacement step;

[0049] Feedback: Signals that the username and password do not match.

[0050] By adopting the above technical solution, the present application first verifies the user name and password, so that only legitimate users can continue to perform subsequent operations, effectively preventing unauthorized users from accessing or operating the device, and enhancing security. The present application also distinguishes the operating permissions of ordinary users and managers by judging whether the user's authority is the administrator's authority, so that only users with administrator authority can perform key operations, such as replacing equipment, solving user problems or adjusting parameters, making various operations more standardized. The present application can also monitor the performance parameters of IT equipment in real time and judge whether they are within the normal range. If the risk index is greater than the preset risk index threshold, but the performance parameters of the IT equipment are within the preset parameter range, it indicates that the current risk index is allowed to appear and does not belong to the risk caused by hardware failure. Then, the data collection step is performed; otherwise, the step of replacing the equipment needs to be performed. The present application can make further judgments when the risk index is greater than the preset risk threshold, reducing the situation of false alarms and improving the utilization rate of the equipment.

[0051] Optionally, after executing the step of determining the authority and before executing the step of determining the device, the method further includes:

[0052] Obtaining life indicators: Obtaining life indicators of IT equipment, the life indicators including usage time and failure frequency;

[0053] Fourth judgment: judge whether the usage time is less than the preset time and the failure frequency is less than the preset frequency threshold. If so, execute the device judgment step; if not, execute the device replacement step.

[0054] By adopting the above technical solution, the present application further analyzes the remaining life indicators of IT equipment. If the usage time is less than the preset time and the failure frequency is less than the preset frequency threshold, the equipment judgment step is executed; otherwise, it indicates that the current IT equipment is close to being scrapped, and there is no need to execute the equipment judgment step, and new IT equipment can be directly replaced. The present application simplifies the operational process of equipment management, reduces operational complexity, and improves work efficiency.

[0055] Optionally, after performing the identity authentication step and before performing the permission determination step, the method further includes:

[0056] The third extraction: Based on computer recognition technology, the expression features and behavior features of the registrant are extracted;

[0057] Fourth calculation: Calculate the risk level of the registrant. The calculation model is as follows:

[0058] ;

[0059] in, is the risk level; p is the number of expression features; is the weight of the i-th expression feature; is the i-th expression feature; q is the number of behavioral features; is the weight of the kth behavior feature; is the kth behavior feature;

[0060] Fifth judgment: judging whether the risk level is greater than a preset alarm threshold, if so, executing the alarm step; if not, executing the authority judgment step;

[0061] Alarm: Send out an alarm signal.

[0062] By adopting the above technical solution, the third extraction step set by the present application provides an additional layer of security protection, which can identify and block potential malicious login attempts even if the attacker is able to bypass identity authentication or has certain permissions. The present application can more comprehensively evaluate the true intentions of the registrant by extracting the expression features and behavioral features of the registrant, and then calculate the risk level based on the expression features and behavioral features. This expression and behavior-based analysis helps to identify abnormal behavior patterns, such as tension, anxiety or fraudulent behavior, thereby improving security.

[0063] Optionally, after performing the third extraction step and before performing the fourth calculation step, the method further includes:

[0064] Fifth calculation: calculating the correlation between the expression features and the behavior features, the calculation model of the correlation is as follows:

[0065] ;

[0066] Among them, h is the correlation degree; is the correlation coefficient between the i-th expression feature and the k-th behavior feature, and the correlation coefficient is calculated using the corrcoef function in the NumPy library. ;

[0067] Third screening: screening out the expression features and behavior features with a correlation greater than a preset correlation threshold as new expression features and behavior features.

[0068] By adopting the above technical solution, the fifth calculation step set by the present application can evaluate the correlation between expression features and behavioral features, which helps to identify abnormal feature combinations generated in different situations, thereby enhancing the security of the system. By screening features with higher correlation, the present application can focus more on those features that are more closely related to the true intentions of the registrant, which helps to improve the accuracy of risk calculation and can more accurately assess the risk of the registrant. Feature screening before the fourth calculation step helps to reduce the number of features that need to be processed, thereby reducing the consumption of computing resources, helping to improve overall efficiency, especially when processing a large number of login requests, improving computing efficiency.

[0069] In the second aspect, this application provides an IT operation and maintenance management system based on deep learning, which adopts the following technical solutions:

[0070] A deep learning-based IT operation and maintenance management system includes a database building module for building a database storing solutions, and the system also includes:

[0071] A data acquisition module, including an image acquisition unit, an environment acquisition unit and a log acquisition unit;

[0072] An image acquisition unit, used to acquire real-time image data of IT equipment;

[0073] Environmental collection unit, used to collect real-time environmental data of IT equipment;

[0074] Log collection unit, used to collect historical log data and real-time log data of IT equipment;

[0075] A modeling module, used to establish a prediction model using a deep learning algorithm, wherein the prediction model includes a CNN sub-model and a BI-LSTM sub-model;

[0076] The first extraction module is used to input the real-time image data and the real-time environment data into the CNN sub-model and output m working state features;

[0077] The prediction module is used to input all working status features, historical log data and real-time log data into the BI-LSTM sub-model and output the prediction results;

[0078] The first judgment module is used to judge whether the prediction result meets the expectation. If the prediction result meets the expectation, the data collection module is triggered; otherwise, the maintenance module is triggered;

[0079] A maintenance module, comprising a first calculation unit, a second judgment unit, a device replacement unit and an adjustment unit;

[0080] The first calculation unit is used to calculate the risk index. The calculation model is as follows:

[0081] ;

[0082] in, is a risk indicator; is the weight of the i-th working state feature; is the i-th working state feature;

[0083] The second judgment unit is used to judge whether the risk index exceeds the preset index threshold value. If the risk index exceeds the preset index threshold value, the device replacement unit is triggered; otherwise, the adjustment unit is triggered;

[0084] Replacement equipment unit to enable spare equipment;

[0085] The adjustment unit is used to match the solution with the prediction result to obtain the adjustment object and the adjustment plan.

[0086] By adopting the above technical solution, this application realizes real-time monitoring and automated management of IT equipment by comprehensively collecting data, extracting features, making predictions and automated decisions, which helps to improve the reliability and stability of equipment and reduce the risk of business interruption.

[0087] In summary, the present application includes at least one of the following beneficial technical effects:

[0088] 1. This application can capture relevant image data of IT equipment in real time, which helps to promptly discover abnormal conditions such as physical damage to IT equipment and changes in indicator light status; this application can evaluate whether the operating environment of IT equipment is suitable based on environmental parameters, and obtain the impact of the environment on the performance of IT equipment; this application can collect the operation logs of IT equipment, which helps to analyze the hardware or software operating status and operation error records of IT equipment.

[0089] 2. The prediction model of the present application includes a CNN sub-model and a BI-LSTM sub-model. The CNN sub-model can process image data, automatically learn and extract features that are useful for IT equipment status prediction, and improve prediction accuracy. The BI-LSTM sub-model can process time series data (real-time environmental data and various log data), capture long-term dependencies in time series data, and improve the timeliness of prediction results. This sub-model combines historical log data and real-time log data, as well as working status features extracted by CNN for prediction, to obtain more accurate prediction results. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 This is a flow chart from S1 data collection to S6 maintenance in Example 1 of the present application;

[0091] Figure 2This is a flow chart of the data retrieval from S65 to S69 maintenance in Example 1 of the present application;

[0092] Figure 3 is a flow chart of Example 2 of the present application;

[0093] Figure 4 This is a flow chart of Example 3 of the present application. DETAILED DESCRIPTION

[0094] The following combination Figures 1 to 4 This application is described in further detail.

[0095] Embodiment 1: This embodiment discloses an IT operation and maintenance management method based on deep learning, the method comprising: building a database storing solutions, referring to Figure 1 The method further includes: S1 data collection, S2 modeling, S3 first extraction, S4 prediction, S5 first judgment and S6 maintenance. First, various data are collected, then a prediction model is established, and then the collected data is input into the prediction model to obtain a prediction result. Then, it is judged whether the prediction result meets the expectation. If so, S1 data collection is executed. If not, S6 maintenance is executed to replace the hardware or maintain the software. This embodiment includes the following steps:

[0096] S1 data collection, including S11 image collection, S12 environment collection and S13 log collection.

[0097] S11 image acquisition, obtains real-time image data of IT equipment through cameras, webcams or surveillance videos.

[0098] These image data can intuitively reflect the physical status of IT equipment, such as whether there is damage, fan stoppage, cable connection errors, etc.

[0099] By analyzing these images, potential problem points in IT equipment hardware can be identified, such as fan stalling, loose or missing parts, etc.

[0100] S12 environmental collection collects real-time environmental data of IT equipment through various sensors, such as temperature, humidity, air pressure, electromagnetic interference, etc. These environmental factors have an important impact on the operating stability and service life of IT equipment.

[0101] The sensor network can acquire these environmental data in real time and analyze them. For example, too high an ambient temperature may lead to poor heat dissipation of the device, causing equipment failure; while too high humidity may cause a short circuit. The collection of environmental data helps to discover potential hardware risks in advance and take corresponding preventive measures.

[0102] S13 log collection, collects the operation logs of IT equipment, and the operation logs include: historical log data and real-time log data. These logs record the operation track, error prompts, performance parameters and other information of the equipment.

[0103] By analyzing log data, you can understand the operating status of the equipment, performance bottlenecks, and potential security risks. Historical log data provides rich historical data support, which helps to discover the long-term trends and laws of equipment operation; while real-time log data reflects the current operating status of IT equipment.

[0104] S2 modeling, establishing a prediction model based on a deep learning algorithm, wherein the prediction model includes a CNN sub-model and a BI-LSTM sub-model.

[0105] The CNN sub-model is good at processing image data and can extract working status features in images; the BI-LSTM sub-model is good at processing time series data and can capture the time dependency between log data and working status features.

[0106] S3 first extracts and inputs the real-time image data and real-time environmental data into the CNN sub-model. The CNN sub-model extracts the key features in the image and environmental data through multi-layer convolution and pooling operations, and outputs m working status features.

[0107] S4 prediction inputs all working status features, historical log data, and real-time log data into the BI-LSTM sub-model. The BI-LSTM sub-model uses these input data, combined with its powerful time series processing capabilities, to predict the future status of IT equipment, i.e., the prediction result.

[0108] S5 is the first judgment to determine whether the prediction result is in line with expectations. If so, it means that the IT equipment is in good condition, and then S1 data collection is executed to analyze and predict the data at the next moment; if not, it means that there is a problem with the IT equipment or it is about to fail, and S6 maintenance analysis is required to determine whether it is a hardware problem or a software problem.

[0109] The prediction result being in line with expectations means that: IT equipment is operating normally, environmental data is normal, and log data is normal.

[0110] S6 maintenance, including S61 first calculation, S62 second judgment, S63 equipment replacement and S64 adjustment.

[0111] S61 first calculates the risk index at the current moment, and the calculation model is as follows:

[0112] ;

[0113] in, It is a risk indicator used to quantify the current risk level of IT equipment; is the weight of the i-th working state feature; is the i-th working status feature; m is the number of working status features (i.e., m among the m working status features mentioned in the first extraction of S3).

[0114] S62 is the second judgment, judging whether the risk index at the current moment exceeds the preset index threshold. If so, it means that there is a problem with the hardware of the IT equipment, and it is necessary to execute S63 to replace the equipment; if not, it means that there is a problem with the software of the IT equipment, and it is necessary to execute S64 to adjust.

[0115] S63 replaces the device, starts the backup device, and uses the backup device to replace the current device.

[0116] S64 adjustment, using the prediction result to match the solution, obtain the adjustment object and the adjustment plan, and adjust the adjustment object according to the adjustment plan.

[0117] The solutions are stored in a preset database, each of which stores an adjustment object and an adjustment scheme. The solutions in the database correspond to different software problems, and the corresponding solutions can be matched by the software problems.

[0118] For example, when a server is running, its cooling fan suddenly stops running. This abnormal situation is captured in real time through the image acquisition step. At the same time, the environment acquisition step also collects the temperature data of the area where the server is located. In the log collection step, the real-time log data records the fan stop time, the temperature exceeding the normal range, the temperature rise rate, etc.

[0119] In the first extraction step, the real-time image data and real-time environmental data are input into the CNN sub-model, and the output working status features are: 0 (indicating no physical damage), 1 (indicating fan abnormality), 0 (indicating normal wiring), 1 (indicating abnormal temperature), 0 (indicating normal humidity), 0 (indicating normal air pressure), and 0 (indicating no electromagnetic interference).

[0120] In the prediction step, the above working status features, historical log data and real-time log data are input into BI-LSTM, and the prediction result is output: the internal temperature of the server continues to rise due to the stop of the cooling fan, and it is expected to reach a dangerous level in the next few minutes, which may cause hardware failure or system crash.

[0121] In the first judgment step, based on the above prediction result, it is judged that it does not meet expectations and maintenance steps need to be performed.

[0122] In the first calculation step, the risk indicator is calculated as follows:

[0123] ;

[0124] In the second judgment step, assuming that the preset indicator threshold is 0.45, and the risk indicator is 0.55, which is obviously greater than 0.45, it is necessary to perform the step of replacing the equipment.

[0125] This embodiment realizes real-time monitoring and risk management of IT equipment through steps such as data collection, modeling, first extraction, prediction, first judgment and maintenance. This embodiment uses the working status characteristics to calculate the risk index at the current moment. If the risk index is greater than the preset index threshold, it indicates that there is a problem with the hardware, and the IT equipment can be automatically replaced. Otherwise, it indicates that there is a problem with the software, and a matching solution is required to automatically adjust the adjustment object.

[0126] Reference Figure 2 In other embodiments, after executing the second judgment in S62 and before executing S63 to replace the device, the method further includes:

[0127] S65 data retrieval, retrieve IT equipment in t i The historical image data and historical environment data at the moment are recorded as the first historical data.

[0128] The i The time refers to the moment before or several moments before the current moment.

[0129] S66 second extraction, input the first historical data into the CNN sub-model, and output it at t i This step also uses the CNN sub-model to extract features from the first historical data. Since the same model is used, the number of historical state features finally output is also m.

[0130] S67 second calculation, using the calculation model of the risk indicator in S61 first calculation, calculate t i Risk indicators at the moment.

[0131] S68 The third judgment, judgment t i Whether the risk index at the moment exceeds the preset index threshold. If so, it indicates that the risk index has exceeded the preset index threshold for several consecutive moments, and the hardware of the IT equipment is faulty, and it is necessary to execute S63 to replace the equipment; if not, it indicates that the risk index value in the second judgment of S62 is greater than the preset index threshold for the first time, and the IT equipment is temporarily considered to be safe, and execute S69 to maintain.

[0132] S69: maintain, continue to use the current IT equipment to work, and execute S1 data collection to S68 third judgment, to judge whether the risk index at the next moment is greater than the preset risk index threshold.

[0133] In this embodiment, under the premise that the risk index at the current moment is greater than the preset index threshold, whether the risk index at one or several previous moments is greater than the preset index threshold is further analyzed. If so, it indicates that the risk index at several consecutive moments is greater than the preset index threshold, indicating that there is a hardware problem with the IT equipment and it is necessary to activate the backup equipment; otherwise, the current IT equipment is temporarily considered to be safe, and the data collection is executed to the third judgment step to analyze whether the risk index at the next moment is greater than the preset index threshold. This embodiment can link the risk indicators of the previous and next moments, so that the equipment will be replaced only when the risk index is greater than the preset index threshold continuously, thereby reducing the situation where accidental events trigger alarms and improving the utilization rate of the equipment.

[0134] Example 2: Reference Figure 3 , the difference between this embodiment and embodiment 1 is that the prediction model also includes a self-attention sub-model, the BI-LSTM sub-model in embodiment 1 includes a group of LSTMs, namely: forward LSTM and reverse LSTM, and the BI-LSTM sub-model in this embodiment includes two groups of LSTMs, each group of LSTMs includes a forward LSTM and a reverse LSTM, one group of LSTMs is recorded as the first network, and the other group of LSTMs is recorded as the second network, and after executing S3 first extraction and before executing S4 prediction, it also includes: S71 third calculation to S75 first screening, after executing S4 prediction and before executing S5 first judgment, it also includes S76 second screening to S78 integration, the specific process of this embodiment is as follows:

[0135] S71 The third calculation is to calculate the correlation between each working status feature and the real-time log data using statistical methods or machine learning algorithms. The correlation may be a Pearson correlation coefficient, a Spearman rank correlation coefficient, or the like.

[0136] For example, the working status feature is the speed of the server fan. The correlation calculation model between the speed and the real-time log data is as follows:

[0137] ;

[0138] in, is the correlation between the working status characteristics and the real-time log data; is the i-th working state characteristic, that is, the i-th fan speed; is the speed of the fan recorded in the i-th real-time log data; is the average value of all working status characteristics (fan speed); It is the average value of the fan speed recorded in the real-time log data; is a constant whose value is 1.

[0139] S72 assigns weights, inputs the working state features and the corresponding relevance into the self-attention sub-model, and the self-attention sub-model determines the weight of each working state feature according to the relevance, and records it as the first weight.

[0140] The working status feature with a high first weight is more critical or has a higher prediction value in the current feature set, and the greater the correlation, the higher the first weight.

[0141] S73: feature update, performing a product operation on each working state feature and the corresponding first weight to obtain a weighted working state feature, and using the weighted working state feature as a new working state feature.

[0142] This step can strengthen those working status features with high first weights, while weakening those working status features with low first weights, thereby obtaining a new set of features that are more focused on key information.

[0143] S74 filters the features, obtains the working status feature whose first weight is greater than the preset weight threshold, and uses it as the first feature.

[0144] S75 is the first screening, based on the first feature screened out in S74 screening features, extracting the part associated with the first feature in the real-time log data as new real-time log data; extracting the part associated with the first feature in the historical log data as new historical log data.

[0145] This association can be direct (such as changes in feature values ​​are directly related to certain fields in the entries of log data) or indirect (such as associations discovered through some recognition algorithm).

[0146] Examples of direct associations are as follows:

[0147] The first feature: The IT equipment is running, but the fan speed suddenly increases from the normal 600 RPM to 1200 RPM, indicating that the fan is abnormal. At this time, the value corresponding to the first feature is 0.8, that is, when the first feature value is 0.8, it indicates that the fan speed has increased abnormally.

[0148] Real-time log data: At the same time or at the next time, a message appeared in the log: "CPU temperature is too high, triggering the fan acceleration protection mechanism."

[0149] In this example, the increase in fan speed is directly correlated to a specific message in the log. The correlation is direct because the log entry clearly states the reason for the fan speed increase - high CPU temperature.

[0150] Examples of such indirect associations are as follows:

[0151] The first feature: the IT equipment is running, but the fan speed is 0, indicating that the fan is abnormal. At this time, the first feature is 1, that is, when the first feature value is 1, it indicates that the fan has stopped.

[0152] Real-time log data: At the same time or immediately after, a message appeared in the log: "CPU running slow."

[0153] In this example, there is no direct, clear connection between the fan speed of 0 and the message in the log. However, through some identification algorithm (such as machine learning model, statistical analysis, etc.), it can be found that there is a statistical correlation between the fan speed of 0 and the CPU running slower. This association is indirect because it is not established through direct description in the log, but revealed through data analysis.

[0154] Both the new real-time log data and the new historical log data are associated with the first feature, indicating that these log data represent hardware problems.

[0155] This embodiment also deletes the parts of the original real-time log data and the original historical log data that are associated with the first feature whose first weight is less than the preset weight threshold.

[0156] In the prediction of S4, the first feature in the first screening of S75, the new real-time log data, and the new historical log data are used as inputs of the first network, and a first prediction result is output, and the first prediction result is used as a new prediction result.

[0157] S76: second screening, recording the remaining part of the original real-time log data as the first data; recording the remaining part of the original historical log data as the second data.

[0158] The first data and the second data are not associated with the first feature, indicating that the first data and the second data represent software issues.

[0159] S77 predicts again, uses the first data and the second data as inputs of the second network, and outputs a second prediction result.

[0160] S78 integrates and processes the first prediction result and the second prediction result to obtain a processing result, and uses the processing result as a new prediction result.

[0161] For example, the first prediction result is 0 (indicating normal hardware), and the second prediction result is 1 (indicating software abnormality). Through the OR operation, that is, there is an abnormal result between the first prediction result and the second prediction result, then the new prediction result is abnormal.

[0162] This embodiment can monitor the hardware status of IT equipment in real time and predict potential hardware and software failures based on real-time and historical log data. Through feature screening and weight allocation, this embodiment can focus on key information and improve the accuracy and efficiency of prediction. At the same time, the method of integrating the two prediction results further improves the accuracy and robustness of the final prediction, providing a strong guarantee for the stable operation of the data center.

[0163] Example 3: Reference Figure 4 The difference between this embodiment and the first embodiment is that after executing the second judgment in S62 and before executing the device replacement in S63, the present embodiment further includes:

[0164] S81 identity verification, determines whether the user name and password match. If so, it indicates that the identity of the user logging in is legal, and then executes S82 third extraction; if not, it indicates that the identity of the user logging in is illegal, and needs to execute S92 feedback.

[0165] If the user is a new user, he / she needs to register and provide verification information during registration. The verification information includes: user name, login password, confirmation password, user name, contact information and unit information. After registration, he / she returns to the login interface and performs S81 identity verification.

[0166] After the user identity authentication is passed, the information and usage of the IT equipment can be displayed by selecting the IT equipment type and operating system, and the information and usage of the IT equipment are also stored in the database. The information of the IT equipment includes: the CPU information of the IT equipment (including name, number of cores, frequency and CPU usage), the memory information of the IT equipment (including total memory, available memory, cache, swap partition free amount, free memory and memory usage), the disk information of the IT equipment (including disk name, total amount, usage and disk usage), terminal name, IP address, MAC address, operating system, CPU type of IT equipment, CPU architecture of IT equipment, unit, user, contact information, current status, number of boots yesterday, total duration yesterday and the most recent boot time.

[0167] S82 The third extraction is to extract the facial expression features and behavioral features of the registrant based on computer recognition technology.

[0168] S83 fifth calculation, calculating the correlation between the expression feature and the behavior feature, the calculation model of the correlation is as follows:

[0169] ;

[0170] Among them, h is the correlation degree; is the correlation coefficient between the i-th expression feature and the k-th behavior feature.

[0171] The correlation coefficient uses the corrcoef function in the NumPy library to calculate the correlation coefficient matrix C between the two features, and extracts the value of the i-th row and k-th column as the required correlation coefficient, for example,

[0172] ;

[0173] ;

[0174] .

[0175] S84 is a third screening, screening out the expression features and behavior features whose correlation is greater than a preset correlation threshold as new expression features and behavior features.

[0176] S85 The fourth calculation is to calculate the risk level of the registrant. The calculation model is as follows:

[0177] ;

[0178] in, is the risk level; p is the number of expression features; is the weight of the i-th expression feature; is the i-th expression feature; q is the number of behavioral features; is the weight of the kth behavior feature; is the kth behavior feature.

[0179] S86 is the fifth judgment, judging whether the risk level is greater than a preset alarm threshold, if so, executing S87 to raise an alarm; if not, executing S88 to judge the authority.

[0180] S87 alarms and sends out an alarm signal.

[0181] S88 authority determination, determining whether the user's authority is an administrator's authority, if so, executing S89 to obtain a life indicator; if not, executing S63 to replace the device.

[0182] When the user's authority is administrator authority, he will jump to the administrator interface, where he can handle issues submitted by other users, initiate processes, view process instance status, claim tasks, etc.

[0183] When the user's authority is ordinary use authority, that is, a customer, the user will be redirected to the customer interface, where the customer can view pending processes, processing nodes, and completed processes, etc.

[0184] S89 obtains a life indicator, which is a life indicator of the IT equipment. The life indicator includes a usage time and a failure frequency, which are obtained by statistical analysis.

[0185] S90 is the fourth judgment, judging whether the usage time is less than the preset time and the failure frequency is less than the preset frequency threshold. If so, it means that the current IT equipment still has a certain service life and does not meet the scrapping conditions, and then execute S91 equipment judgment; if not, it means that the current IT equipment meets the scrapping conditions, do not perform S91 equipment judgment, and directly execute S63 to replace the equipment.

[0186] S91 device judgment collects the performance parameters of the IT equipment, such as CPU usage, memory occupancy, disk read and write speed, etc., to determine whether the performance parameters are within the preset parameter range. If so, it means that the IT equipment has good performance, and then S1 data collection is executed; if not, it means that the IT equipment has a fault and it is necessary to execute S63 to replace the equipment.

[0187] S92 feedback, sends feedback signal.

[0188] Before the step of replacing the device, this embodiment sets up multiple steps such as identity authentication, feature extraction, risk calculation and authority judgment. Firstly, it verifies whether the identity of the current user is legal and whether the legal user has administrator authority, so that only the administrator can modify the system settings and answer questions. This embodiment also analyzes the user's expression and behavior to improve security. Secondly, the life indicator of IT equipment is determined. When the life of IT equipment with hardware failure reaches the expiration date, the equipment judgment step is no longer executed, and the spare equipment is directly replaced to improve the automation level of the entire process.

[0189] Embodiment 4: This embodiment discloses an IT operation and maintenance management system based on deep learning, including a database building module for building a database storing solutions, and the system also includes:

[0190] The data acquisition module includes an image acquisition unit, an environment acquisition unit and a log acquisition unit.

[0191] Image acquisition unit is used to capture real-time image data of IT equipment. These image data include the appearance of the equipment, indicator status, display screen content, etc. Through high-definition cameras or intelligent monitoring devices, this unit can record the operating status of the equipment in real time, providing intuitive visual information for subsequent feature extraction and status analysis.

[0192] Environmental collection unit: This unit is responsible for collecting real-time environmental data of IT equipment, such as temperature, humidity, air cleanliness, electromagnetic radiation, etc. These data are of great significance for evaluating whether the equipment operating environment is suitable and predicting potential failures.

[0193] The log collection unit focuses on collecting historical log data and real-time log data of IT equipment. Historical log data records the past operating status, fault records, maintenance history, etc. of the equipment, while real-time log data records the current operating status, operation records, warning information, etc. of the IT equipment in real time.

[0194] The modeling module is used to establish a prediction model using a deep learning algorithm, wherein the prediction model includes a CNN sub-model and a BI-LSTM sub-model.

[0195] The first extraction module is connected to the data acquisition module and the modeling module for inputting real-time image data and real-time environment data into the CNN sub-model and outputting m working state features.

[0196] The prediction module is communicated with the data acquisition module, the modeling module and the first extraction module, and is used to input the working status characteristics, historical log data and real-time log data into the BI-LSTM sub-model, and use the BI-LSTM sub-model's processing ability for time series data to obtain the prediction results.

[0197] The first judgment module is connected to the prediction module for judging whether the prediction result is in line with expectations. If the prediction result is in line with expectations, it indicates that the equipment is currently in good operating condition and triggers the data acquisition module; otherwise, the maintenance module is triggered.

[0198] The maintenance module is connected in communication with the first extraction module, the first judgment module and the database building module, and includes a first calculation unit, a second judgment unit, a device replacement unit and an adjustment unit.

[0199] The first calculation unit is used to calculate the risk index. The calculation model is as follows:

[0200] ;

[0201] in, is a risk indicator; is the weight of the i-th working state feature; is the i-th working state feature.

[0202] The second judgment unit is used to judge whether the risk index exceeds the preset index threshold. If the risk index exceeds the preset index threshold, it means that the device has a high risk of hardware failure, triggering the device replacement unit; otherwise, it means that the device has a high risk of software failure, triggering the adjustment unit.

[0203] Replace the equipment unit to start the spare equipment.

[0204] The adjustment unit is used to use the prediction results to match the solution, obtain the adjustment object and the adjustment plan, and perform specific adjustment operations on the adjustment object according to the adjustment plan, such as adjusting equipment parameters, optimizing the operating environment, etc., to reduce the risk of equipment failure and improve operating efficiency.

[0205] The data acquisition module of this embodiment includes three units: image acquisition, environment acquisition, and log acquisition, which are responsible for comprehensively collecting real-time images, environmental parameters, and historical and real-time log data of IT equipment. Subsequently, these data are input into the modeling module, which uses a deep learning algorithm (combined with a CNN sub-model and a BI-LSTM sub-model) for feature extraction and state prediction. The first extraction module uses the CNN sub-model to process image and environmental data and output working status features; the prediction module combines these features with historical and real-time log data to predict the equipment status through BI-LSTM. If the prediction result meets expectations, data collection continues; if not, the maintenance module is triggered. The maintenance module first calculates the risk index and determines whether it exceeds the preset threshold. If it exceeds, the replacement device unit is started. If it does not exceed, the adjustment unit matches the solution according to the prediction result to adjust and optimize the equipment. This embodiment takes into account parameters from multiple angles of images, environments, and logs to build a more comprehensive and accurate predictive maintenance system.

[0206] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A deep learning-based IT operation and maintenance management method, comprising: Building a database: Building a database storing solutions, wherein the method further comprises: Data collection: including image collection, environment collection and log collection; Image acquisition: collect real-time image data of IT equipment; Environmental collection: collect real-time environmental data of IT equipment; Log collection: collect historical log data and real-time log data of IT equipment; Modeling: A prediction model is established based on a deep learning algorithm. The prediction model includes a CNN sub-model, a BI-LSTM sub-model, and a self-attention sub-model. The BI-LSTM sub-model includes a group of LSTMs, which is recorded as a first network. The BI-LSTM sub-model also includes another group of LSTMs, which is recorded as a second network. First extraction: input the real-time image data and real-time environment data into the CNN sub-model and output m working status features; Prediction: Input all working status features, historical log data, and real-time log data into the BI-LSTM sub-model and output the prediction results; First judgment: judge whether the prediction result meets the expectation. If yes, execute the data collection step; if no, execute the maintenance step; Maintenance: including first calculation, second judgment, equipment replacement and adjustment; First calculation: Calculate the risk index. The calculation model is as follows: ； in, is a risk indicator; For the The weight of each work status feature; For the Working status characteristics; Second judgment: judging whether the risk index exceeds the preset index threshold, if so, executing the step of replacing the equipment; if not, executing the step of adjusting; Replace equipment: activate spare equipment; Adjustment: Use the prediction results to match the solution and obtain the adjustment object and adjustment plan; After performing the first extraction step and before performing the prediction step, the method further includes: The third calculation: Pearson correlation coefficient algorithm is used to calculate the correlation between each working status feature and the real-time log data; Assign weights: Input the work status features and the corresponding relevance into the self-attention sub-model, and output the weight of each work status feature, which is recorded as the first weight; Feature update: performing a product operation on each working state feature and the corresponding first weight to obtain a weighted working state feature, and using the weighted working state feature as a new working state feature; After the step of performing feature update and before the step of performing prediction, it also includes: Screening features: obtaining a working state feature whose first weight is greater than a preset weight threshold, and recording the working state feature whose first weight is greater than the preset weight threshold as the first feature; First screening: extracting the part associated with the first feature from the real-time log data as new real-time log data; extracting the part associated with the working status feature in the step of screening features from the historical log data as new historical log data; In the prediction step, the first feature, the new real-time log data, and the new historical log data are used as inputs of the first network, a first prediction result is output, and the first prediction result is used as a new prediction result; After the step of performing the prediction and before the step of performing the first judgment, the method further includes: Second screening: record the remaining part of the real-time log data as the first data; record the remaining part of the historical log data as the second data; Re-prediction: taking the first data and the second data as inputs of the second network and outputting a second prediction result; Integration: The first prediction result and the second prediction result are processed together to obtain a processing result, and the processing result is used as a new prediction result.

2. The IT operation and maintenance management method based on deep learning according to claim 1 is characterized in that: After executing the second determination step and before executing the device replacement step, the method further includes: Data retrieval: Retrieve data from IT equipment i The historical image data and historical environment data at the time are recorded as the first historical data; Second extraction: Input the first historical data into the CNN sub-model and output t i m historical state features at the moment; Second calculation: Using the risk indicator calculation model, calculate t i Risk indicators at the moment; The third judgment: judge t i Whether the risk index at the moment exceeds the preset index threshold, if so, execute the step of replacing the equipment; if not, execute the step of maintaining; Maintain: Continue to use the current IT equipment and perform data collection steps to the third judgment.

3. The IT operation and maintenance management method based on deep learning according to claim 1 or 2, characterized in that: After executing the second determination step and before executing the device replacement step, the method further includes: Authentication: Determine whether the username and password match. If so, execute the permission determination step; if not, execute the feedback step; Authority judgment: judge whether the user's authority is administrator authority. If so, execute the device judgment step; if not, execute the device replacement step; Equipment judgment: Collect the performance parameters of IT equipment and judge whether the performance parameters are within the preset parameter range. If so, execute the data collection step; if not, execute the equipment replacement step; Feedback: Signals that the username and password do not match.

4. The IT operation and maintenance management method based on deep learning according to claim 3 is characterized in that: After executing the step of determining the authority and before executing the step of determining the device, the method further includes: Obtaining life indicators: Obtaining life indicators of IT equipment, the life indicators including usage time and failure frequency; Fourth judgment: judge whether the usage time is less than the preset time and the failure frequency is less than the preset frequency threshold. If so, execute the device judgment step; if not, execute the device replacement step.

5. The IT operation and maintenance management method based on deep learning according to claim 4 is characterized in that: After the identity authentication step and before the permission determination step, the following steps are also included: The third extraction: Based on computer recognition technology, the facial expression and behavior characteristics of the registrant are extracted; Fourth calculation: Calculate the risk level of the registrant. The calculation model is as follows: ； in, is the risk level; p is the number of expression features; For the The weight of each expression feature; For the facial features; q is the number of behavioral features; is the weight of the kth behavior feature; is the kth behavior feature; Fifth judgment: judging whether the risk level is greater than a preset alarm threshold, if so, executing the alarm step; if not, executing the authority judgment step; Alarm: Send out an alarm signal.

6. The IT operation and maintenance management method based on deep learning according to claim 5 is characterized in that: After performing the third extraction step and before performing the fourth calculation step, the method further includes: Fifth calculation: calculating the correlation between the expression features and the behavior features, the calculation model of the correlation is as follows: ； Among them, h is the correlation degree; For the The correlation coefficient between the kth expression feature and the kth behavior feature is calculated using the corrcoef function in the NumPy library. ; Third screening: screening out the expression features and behavior features with a correlation greater than a preset correlation threshold as new expression features and behavior features.

7. An IT operation and maintenance management system based on deep learning, the system being suitable for implementing the method described in any one of claims 1 to 6, comprising: A database building module is used to build a database storing solutions, wherein the system further comprises: A data acquisition module, including an image acquisition unit, an environment acquisition unit and a log acquisition unit; An image acquisition unit, used to acquire real-time image data of IT equipment; Environmental collection unit, used to collect real-time environmental data of IT equipment; Log collection unit, used to collect historical log data and real-time log data of IT equipment; A modeling module, used to establish a prediction model using a deep learning algorithm, wherein the prediction model includes a CNN sub-model and a BI-LSTM sub-model; The first extraction module is used to input the real-time image data and the real-time environment data into the CNN sub-model and output m working state features; The prediction module is used to input all working status features, historical log data and real-time log data into the BI-LSTM sub-model and output the prediction results; The first judgment module is used to judge whether the prediction result meets the expectation. If the prediction result meets the expectation, the data collection module is triggered; otherwise, the maintenance module is triggered; A maintenance module, comprising a first calculation unit, a second judgment unit, a device replacement unit and an adjustment unit; The first calculation unit is used to calculate the risk index. The calculation model is as follows: ； in, is a risk indicator; For the The weight of each work status feature; For the Working status characteristics; The second judgment unit is used to judge whether the risk index exceeds the preset index threshold value. If the risk index exceeds the preset index threshold value, the device replacement unit is triggered; otherwise, the adjustment unit is triggered; Replacement equipment unit to enable spare equipment; The adjustment unit is used to match the solution with the prediction result to obtain the adjustment object and the adjustment plan.

Images