Knowledge graph-based operation and maintenance change influence assessment method and system

Abstract

The invention relates to an operation and maintenance change influence assessment method and system based on a knowledge graph, and the method comprises the steps: integrating a configuration management database, call chain data and network connection data, constructing a directed software and hardware knowledge graph through a graph database, querying a change influence path through a depth-first search algorithm, and carrying out the operation and maintenance change influence assessment. A graph visualization engine is applied to generate a change knowledge graph, and clear and accurate upstream and downstream associated information of a change object is provided for review and operation and maintenance personnel; according to the method, frequent item analysis is carried out on historical abnormal indexes, label propagation calculation is carried out on an abnormal index map, and a community propagation sub-graph is generated, so that potential and dispersed abnormal information can be aggregated and associated more scientifically and intelligently, and a rapid positioning auxiliary tool is provided for faults caused by changes; the scientificity and accuracy of change evaluation are improved, the change risk is effectively avoided, and quick positioning can be performed when a fault occurs.

Description

Technical Field

[0001] The present invention relates to the field of IT operation and maintenance, and specifically to a knowledge graph-based operation and maintenance change impact assessment method and system. By using graph algorithms and machine learning techniques, a comprehensive and scientific impact assessment of operation and maintenance changes is performed, aiming to ensure the stable operation and efficient iteration of the system. Background Art

[0002] With the rapid development of Internet technology, the cloudification of IT infrastructure, the containerization of application operating environments, and the microservices of system architectures have led to an exponential growth in the types and numbers of system hardware and software equipment and applications. This growth has led to frequent production changes, including changes in application systems such as information system launch, program commissioning, configuration changes, business parameter adjustments, data maintenance, patch upgrades, account migration, system switching, version rollbacks, as well as changes in basic platforms such as computer room migration, equipment replacement, new module installation, basic platform hardware and software upgrades and reinforcement, preventive maintenance, capacity increase, system performance improvement, and security precautions.

[0003] However, the risks brought by these changes are becoming more complex, hidden, and highly professional. A change in a component or even a field may trigger a series of system anomalies and transaction failures, resulting in unpredictable losses. Therefore, impact analysis of operation and maintenance changes becomes particularly important.

[0004] At present, the following problems exist in the operation and maintenance change review process: there is a lack of a visual change object knowledge graph to intuitively display the upstream and downstream dependencies and calling relationships of the change objects; when multiple services or infrastructures in the same system are changed at the same time and fault alarms occur, it is difficult for operation and maintenance personnel to quickly locate which changes are related to the fault alarms; the massive amount of abnormal indicator information is filled with a lot of "noise", which affects the operation and maintenance personnel's judgment of effective information, and the correlation between abnormal indicators lacks visual connection.

[0005] In response to the above problems, the present invention proposes an operation and maintenance change impact assessment method based on knowledge graph, aiming to provide a more comprehensive and scientific assessment method to help operation and maintenance personnel manage change risks more effectively. Summary of the invention

[0006] In order to address the deficiencies of the prior art, the present invention proposes a method and system for evaluating the impact of operation and maintenance changes based on knowledge graphs.

[0007] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0008] A method for evaluating the impact of operation and maintenance changes based on a knowledge graph, characterized by comprising the following steps:

[0009] S1. Integrate multi-source data and establish associations to build a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database data, call chain data, and network connection data;

[0010] S2. Input the change data, query the change impact path corresponding to the change data, and generate a change knowledge graph;

[0011] S3. Calculate the grade weight for each path in the change knowledge graph, sort the paths according to the grade weight, and visualize the change knowledge graph using the Antv G6 graph visualization engine;

[0012] S4. Use the Apriori algorithm to perform frequent item analysis on the historical abnormal indicator data of the change object corresponding to the change data, obtain a set of frequent items of abnormal indicators with associated relationships, and mark the fault level;

[0013] S5. Collect and analyze the health index of each object on the change knowledge graph, extract abnormal indicators, match them with the abnormal indicator frequent item set, and generate an abnormal indicator knowledge graph;

[0014] S6. Perform label propagation calculation according to the abnormal indicator knowledge graph to generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the abnormal indicator and the change object to generate a potential change impact path.

[0015] Further, the S1 specifically includes:

[0016] S11. According to the operation and maintenance object information in the configuration management database data, the operation and maintenance objects are classified by system, service, process, virtual machine, physical machine, and network;

[0017] S12. Use physical link relationships to establish node association relationships between the network, physical machines, virtual machines, process layers, and service layers;

[0018] S13. Use the call chain data and network connection data to associate the call dependencies between services, and establish the association between microservices and middleware and database;

[0019] S14. Use the Nebula Graph graph database to store the operation and maintenance objects and the association relationships to build a software and hardware knowledge graph.

[0020] Further, the step S2 specifically includes:

[0021] S21. Input the change data and identify the change object corresponding to the change data;

[0022] S22. Taking the changed object as the starting point, extracting the changed object information according to the changed data;

[0023] S23. Combine the change object information with the depth-first search algorithm to traverse and search all the change impact paths with related relationships from the layer where the change object is located in the software and hardware knowledge graph to generate a change knowledge graph.

[0024] Further, the step S3 specifically includes:

[0025] S31. According to the terminal system layer node in the changed knowledge graph, a system weight L is marked for the changed knowledge graph path;

[0026] S32. Count the total degrees of all nodes on the changed knowledge graph path using a degree statistics algorithm to obtain the total degree D of each path, multiply the system level weight L by the total degree D as the level weight of each path, and sort them according to the level weight;

[0027] S33. Use the graph visualization engine to visualize the change knowledge graph.

[0028] Further, the step S4 specifically includes:

[0029] S41. Based on the historical abnormal index data of the changed object corresponding to the changed data, the Apriori algorithm is applied to perform frequent item analysis on the abnormal indexes within the same time interval to obtain a set of frequent items of abnormal indexes with associated relationships;

[0030] S42. After verifying the authenticity of the abnormal indicator frequent item set, mark the fault level of the abnormal indicator in the abnormal indicator frequent item set.

[0031] Further, the step S5 specifically includes:

[0032] S51. Collect the health index information of each object on the change knowledge graph, and extract the abnormal index set through the abnormal detection algorithm;

[0033] S52. Match the abnormal indicator set with the abnormal indicator frequent item set by indicator ID, filter out existing frequent item sets, and connect the indicators in the existing frequent item sets in pairs to generate an abnormal indicator knowledge graph.

[0034] Further, the step S6 specifically includes:

[0035] S61. In the abnormal indicator knowledge graph, all unlabeled abnormal indicators are initialized and marked;

[0036] S62. Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighbor nodes of the current node, and count the label frequency of each neighbor node;

[0037] S63. According to the label frequency of neighboring nodes, select the label with the highest frequency as the new label of the current node, and update the label information;

[0038] S64. Repeat the above steps to perform label propagation on all abnormal indicator nodes in the abnormal indicator knowledge graph until a preset number of iterations or label stability condition is reached;

[0039] S65. According to the label information, nodes with the same label are classified into the same community, and a community propagation subgraph is generated. According to the relationship between the abnormal indicator and the changed object, the community propagation subgraph is converged and merged to generate a potential change impact path.

[0040] In addition, the present invention also relates to an operation and maintenance change impact assessment system based on a knowledge graph, which is characterized by comprising:

[0041] A knowledge graph construction module integrates multi-source data and establishes associations to construct a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database data, call chain data, and network connection data;

[0042] A graph change module is used to query the change impact path corresponding to the input change data and generate a change knowledge graph;

[0043] A visualization module, used to calculate a grade weight for each path in the change knowledge graph, sort the paths according to the grade weight, and then visualize the change knowledge graph using a graph visualization engine;

[0044] The abnormal index analysis module performs frequent item analysis on the historical abnormal index data of the change object corresponding to the change data based on the Apriori algorithm, obtains a set of abnormal index frequent items with associated relationships, and performs fault level marking;

[0045] An abnormal matching module is used to collect and analyze the health index of each object on the change knowledge graph, extract abnormal indicators, match them with the abnormal indicator frequent item set, and generate an abnormal indicator knowledge graph;

[0046] The impact path prediction module is used to perform label propagation calculation based on the abnormal indicator knowledge graph to generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the abnormal indicator and the change object to generate a potential change impact path.

[0047] In addition, the present invention also relates to an electronic device, characterized in that it comprises a processor and a memory;

[0048] The memory is used to store operation instructions;

[0049] The processor is used to execute the above method by calling the operation instruction.

[0050] In addition, the present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and the computer program implements the above method when executed by a processor.

[0051] The solution provided in this application is adopted to integrate the configuration management database (CMDB), call chain data and network connection data, use the Nebula Graph graph database to build a directed software and hardware knowledge graph, use the depth-first search algorithm (DFS) to query the change impact path, and apply the Antv G6 graph visualization engine to generate a change knowledge graph, so as to provide reviewers and operation and maintenance personnel with clear and accurate upstream and downstream correlation information of the change objects; the Apriori algorithm is used to perform frequent item analysis on historical abnormal indicators, and label propagation calculation is performed on the abnormal indicator graph to generate a community propagation subgraph, which can aggregate and associate potential and scattered abnormal information in a more scientific and intelligent way, and provide an auxiliary tool for quickly locating faults caused by changes, thereby improving the scientificity and accuracy of change evaluation, effectively avoiding change risks, and being able to quickly locate faults when they occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of a flow chart of a method for evaluating the impact of operation and maintenance changes based on a knowledge graph provided in an embodiment of the present application;

[0053] Figure 2 A schematic diagram of the structure of the software and hardware knowledge graph in the embodiment provided in the embodiment of the present application;

[0054] Figure 3 A schematic diagram of the structure of an operation and maintenance change impact assessment system based on a knowledge graph provided in an embodiment of the present application;

[0055] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present invention.

[0057] Those skilled in the art can understand that, unless otherwise stated, the singular forms "one", "an", "said" and "the" used herein may also include plural forms, and the "first", "second", etc., are only used to distinguish and define objects for the purpose of introducing the scheme clearly, and do not limit the objects themselves. Of course, the objects defined by "first" and "second" may be the same terminal, device, user, etc., or the same type of terminal, device and user. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0058] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0059] Figure 1 The flowchart of the operation and maintenance change impact assessment method based on the knowledge graph provided by the embodiment of the present application is shown, which specifically includes:

[0060] S1. Integrate multi-source data and establish associations to build a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database (CMDB) data, call chain data, and network connection data;

[0061] In an optional embodiment, the step S1 specifically includes:

[0062] S11. According to the operation and maintenance object information in the configuration management database data, the operation and maintenance objects are classified from top to bottom according to six layers: system, service (including but not limited to microservices, middleware clusters, database clusters, etc.), process (including but not limited to middleware instance processes such as Nginx, Kafka, Redis and database instance processes such as mysql, Elasticsearch and pod instances corresponding to microservices), virtual machine, physical machine, and network, such as Figure 2 As shown;

[0063] S12. Use physical link relationships to establish node association relationships between the network, physical machines, virtual machines, process layers, and service layers, where physical link relationships mainly include but are not limited to: physical machines are installed with virtual machines; virtual machines are hosted on physical machines; microservices are deployed on virtual machines; middleware and databases are installed on virtual machines or physical machines; physical machines are connected to switches; switches are connected to routers, etc.;

[0064] S13. Use call chain data and network connection data to associate the call dependencies between services, and establish the association between microservices, middleware, and databases. The call chain data mainly uses the skywalking full-link tracking tool to collect application services, mainly including basic service information, call information of services accessing other services, and microservices, applications, etc. are preset in the CMDB to belong to a certain system, and the service layer is associated with the system layer;

[0065] S14. Use the Nebula Graph graph database to store the operation and maintenance objects and the association relationships to build a software and hardware knowledge graph.

[0066] S2. Input the change data, query the change impact path corresponding to the change data, and generate a change knowledge graph;

[0067] In an optional embodiment, the step S2 specifically includes:

[0068] S21. Input the change data and identify the change object corresponding to the change data;

[0069] S22. Taking the changed object as the starting point, extracting the changed object information according to the changed data;

[0070] S23. Combine the changed object information with the depth-first search algorithm to find the layer where the changed object is located in the software and hardware knowledge graph, and traverse from bottom to top to search for all change impact paths with related relationships, where the bottom-up traversal relationship is mainly that the next object of the current object depends on the current object. For example, if the current service A is called by service B, then service B is a traversable object. If the current service A calls service C, then service C is an object that does not need to be traversed, until the system layer is traversed to generate a change knowledge graph.

[0071] S3. Calculate the grade weight for each path in the change knowledge graph, sort the paths according to the grade weight, and visualize the change knowledge graph using the Antv G6 graph visualization engine;

[0072] In an optional embodiment, the step S3 specifically includes:

[0073] S31. According to the terminal system layer node in the changed knowledge graph, a system weight L is marked for the changed knowledge graph path, wherein the higher the system importance level, the greater the corresponding weight value, such as setting the weight of the account system to 10 and the weight of the OA system to 2;

[0074] S32. Count the total degrees of all nodes on the changed knowledge graph path using a degree statistics algorithm to obtain the total degree D of each path, multiply the system level weight L by the total degree D as the level weight of each path, and sort them according to the level weight, wherein the more degrees there are, the more associated entities there are and the greater the impact;

[0075] S33. Use Antv G6 graph visualization engine to visualize the change knowledge graph.

[0076] Specifically, the Antv G6 graph visualization engine is used to visualize the changes, and the knowledge graph is used to provide reviewers and operation and maintenance personnel with clear and accurate upstream and downstream correlation information of the change objects, exposing possible change risks, improving change assessment efficiency, and ensuring change quality.

[0077] S4. Use the Apriori algorithm to perform frequent item analysis on the historical abnormal indicator data of the change object corresponding to the change data, obtain a set of frequent items of abnormal indicators with associated relationships, and mark the fault level;

[0078] In an optional embodiment, the step S4 specifically includes:

[0079] S41. Based on the historical abnormal index data of the changed object corresponding to the changed data, the Apriori algorithm is applied to perform frequent item analysis on the abnormal indexes within the same time interval to obtain a set of frequent items of abnormal indexes with associated relationships;

[0080] S42. After verifying the authenticity of the abnormal indicator frequent item set, mark the fault level of the abnormal indicator in the abnormal indicator frequent item set.

[0081] Specifically, the main indicators and formulas of the Apriori algorithm are:

[0082] About support:

[0083]

[0084] It represents the probability of event A and event B occurring simultaneously;

[0085] About confidence:

[0086]

[0087] It represents the ratio of the probability of event A and event B occurring simultaneously to the probability of event A occurring.

[0088] The mining process of the Apriori algorithm: the first step is to set the minimum support threshold, find all frequent item sets and the number of occurrences of each item must be greater than or equal to the minimum support threshold; the second step is to generate strong association rules from the frequent item sets: rules that satisfy both the minimum support and minimum confidence.

[0089] The main steps of the Apriori algorithm are the connection step and the pruning step:

[0090] (1) Connection step: Use Lk-1 to perform self-connection to obtain K item sets Ck. When connecting, only item sets that differ only in the last item can be connected;

[0091] (2) Pruning step: Based on the Ck candidate set, remove the item sets whose frequency is less than the minimum support, and remove the candidate sets whose subsets are not frequent item sets.

[0092] In an optional embodiment, there are 5 abnormal index items in a certain interval: M1, M2, M3, M4, M5. There are 5 events in the historical abnormal index data of this interval, and each event is a transaction, as follows:

[0093] TRANSACTION_ID Abnormal indicator list T1 M1,M2 T2 M2,M4,M5 T3 M1,M3,M5 T4 M1,M4,M5 T5 M1,M4,M5,M2

[0094] (1) First set the minimum support threshold to 2;

[0095] (2) Scan the entire data set and count the frequency of occurrence of each abnormal indicator to obtain C1 = {M1: 4, M2: 3, M3: 1, M4: 3, M5: 4};

[0096] (3) Compare with the minimum support threshold and remove invalid items to obtain L1 = {M1: 4, M2: 3, M4: 3, M5: 4};

[0097] (4) Perform self-connection and counting on L1 to obtain

[0098] C2={(M1,M2):2,(M1,M4):2,(M1,M5):3,(M2,M4):2,(M2,M5):2,(M4,M5):3};

[0099] (5) After comparing with the minimum support threshold and sorting, we get L2 = {(M1, M5): 3, (M4, M5): 3, (M1, M2): 2, (M1, M4): 2, (M2, M4): 2, (M2, M5): 2};

[0100] (6) Perform self-connection on L2 and count the results

[0101] C3={(M1,M4,M5):2,(M1,M2,M5):1,(M1,M2,M4):1,(M2,M4,M5):2};

[0102] (7) After comparing with the minimum support threshold, we get L3 = {(M1, M4, M5): 2, (M2, M4, M5): 2};

[0103] (8) After self-connection of L3, it is found that C4 = {(M1, M2, M4, M5): 1}, and the frequency is less than the minimum support threshold, so L3 = {(M1, M4, M5): 2, (M2, M4, M5): 2} is selected as the frequent itemset;

[0104] At the same time, based on expert experience, frequent itemsets are verified as real events, and abnormal indicators are marked to improve algorithm stability and reduce the number of iterations. In an optional embodiment, (M1, M4, M5) are confirmed by expert experience to be real events that occur at the same time, and they can be marked with the same label, while (M2, M4, M5) are not marked with labels because there is no expert experience judgment. At the same time, the abnormal indicators are marked with fault levels, and the fault levels from high to low can be emergency level, severe level, fault level, warning level, and notification level.

[0105] S5. Collect and analyze the health index of each object on the change knowledge graph, extract abnormal indicators, match them with the abnormal indicator frequent item set, and generate an abnormal indicator knowledge graph;

[0106] In an optional embodiment, step S5 specifically includes:

[0107] S51. Collect the health index information of each object on the change knowledge graph, and extract the abnormal index set through the abnormal detection algorithm, wherein the health index information includes but is not limited to the service transaction success rate of the change object, the number of error logs, the service balance response time, CPU usage, memory usage, cluster health status, CPU load and other operation and maintenance object index information, each indicator has a unique ID;

[0108] S52. Match the indicator ID of the abnormal indicator set with the abnormal indicator frequent item set, filter out the existing frequent item sets, connect the indicators in the existing frequent item sets in pairs to generate an abnormal indicator knowledge graph, and further connect the abnormal indicators that are not associated but have a changed entity object association relationship, and finally generate an abnormal indicator knowledge graph.

[0109] S6. Generate a community propagation subgraph based on the label propagation calculation performed on the abnormal indicator knowledge graph using the Label Propagation algorithm, and converge and merge the community propagation subgraphs according to the relationship between the abnormal indicator and the changed object to generate a potential change impact path.

[0110] In an optional embodiment, the step S6 specifically includes:

[0111] S61. Use the Label Propagation algorithm to initialize the labels of all unlabeled abnormal indicators in the abnormal indicator knowledge graph;

[0112] S62. Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighbor nodes of the current node, and count the label frequency of each neighbor node;

[0113] S63. According to the label frequency of neighboring nodes, select the label with the highest frequency as the new label of the current node, and update the label information;

[0114] S64. Repeat the above steps to perform label propagation on all abnormal indicator nodes in the abnormal indicator knowledge graph until a preset number of iterations or label stability condition is reached;

[0115] S65. According to the label information, nodes with the same label are classified into the same community, and a community propagation subgraph is generated. According to the relationship between the abnormal indicator and the changed object, the community propagation subgraph is converged and merged to generate a potential change impact path.

[0116] The solution provided in this application is adopted to integrate the configuration management database (CMDB), call chain data and network connection data, use the Nebula Graph graph database to build a directed software and hardware knowledge graph, use the depth-first search algorithm (DFS) to query the change impact path, and apply the Antv G6 graph visualization engine to generate a change knowledge graph, so as to provide reviewers and operation and maintenance personnel with clear and accurate upstream and downstream correlation information of the change objects; the Apriori algorithm is used to perform frequent item analysis on historical abnormal indicators, and label propagation calculation is performed on the abnormal indicator graph to generate a community propagation subgraph, which can aggregate and associate potential and scattered abnormal information in a more scientific and intelligent way, and provide an auxiliary tool for quickly locating faults caused by changes, thereby improving the scientificity and accuracy of change evaluation, effectively avoiding change risks, and being able to quickly locate faults when they occur.

[0117] based on Figure 1 The invention discloses a method for evaluating the impact of operation and maintenance changes based on a knowledge graph, and also relates to an evaluation system for the impact of operation and maintenance changes based on a knowledge graph, the structure of which is as follows: Figure 3 As shown, including:

[0118] The knowledge graph construction module 301 integrates multi-source data and establishes associations to construct a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database (CMDB) data, call chain data, and network connection data;

[0119] A graph change module 302 is used to query the change impact path corresponding to the input change data and generate a change knowledge graph;

[0120] A visualization module 303 is used to calculate a grade weight for each path in the change knowledge graph, sort the paths according to the grade weight, and then visualize the change knowledge graph using a graph visualization engine;

[0121] The abnormal index analysis module 304 performs frequent item analysis on the historical abnormal index data of the change object corresponding to the change data based on the Apriori algorithm, obtains a set of abnormal index frequent items with associated relationships, and performs fault level marking;

[0122] The abnormal matching module 305 is used to collect and analyze the health index of each object on the change knowledge graph, extract the abnormal index, match it with the abnormal index frequent item set, and generate the abnormal index knowledge graph;

[0123] The impact path prediction module 306 is used to perform label propagation calculation according to the abnormal indicator knowledge graph to generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the abnormal indicator and the change object to generate a potential change impact path.

[0124] Furthermore, the knowledge graph construction module 301 is specifically used for:

[0125] According to the operation and maintenance object information in the configuration management database data, the operation and maintenance objects are classified from top to bottom according to six layers: system, service (including but not limited to microservices, middleware clusters, database clusters, etc.), process (including but not limited to middleware instance processes such as Nginx, Kafka, Redis and database instance processes such as mysql, Elasticsearch and pod instances corresponding to microservices), virtual machine, physical machine, and network;

[0126] The physical link relationship is used to establish the node association relationship between the network, physical machine, virtual machine, process layer and service layer. The physical link relationship mainly includes but is not limited to: the physical machine is installed with the virtual machine; the virtual machine is hosted on the physical machine; the microservice is deployed on the virtual machine; the middleware and database are installed on the virtual machine or physical machine; the physical machine is connected to the switch; the switch is connected to the router, etc.

[0127] Use call chain data and network connection data to associate the call dependencies between services, and establish the association between microservices, middleware, and databases. The call chain data mainly uses the skywalking full-link tracking tool to collect application services, mainly including basic service information and call information of services accessing other services. Microservices, applications, etc. are preset in CMDB to belong to a certain system, and the service layer is associated with the system layer.

[0128] The Nebula Graph database is used to store the operation and maintenance objects and the association relationships to build a software and hardware knowledge graph.

[0129] Furthermore, the map changing module 302 is specifically used for:

[0130] Inputting change data and identifying the change object corresponding to the change data;

[0131] Taking the changed object as a starting point, extracting the changed object information according to the changed data;

[0132] The changed object information is combined with a depth-first search algorithm to search the layer where the changed object is located in the software and hardware knowledge graph from the bottom to the top for all change impact paths with associated relationships, where the bottom-up traversal relationship is mainly that the next object of the current object depends on the current object. For example, if the current service A is called by service B, then service B is a traversable object. If the current service A calls service C, then service C is an object that does not need to be traversed, until the system layer is traversed to generate a change knowledge graph.

[0133] Furthermore, the visual display module 303 is specifically used for:

[0134] According to the terminal system layer node in the changed knowledge graph, a system weight L is marked for the changed knowledge graph path, wherein the higher the system importance level, the greater the corresponding weight value;

[0135] The total degree of all nodes on the change knowledge graph path is counted using a degree statistics algorithm to obtain the total degree D of each path. The result of multiplying the system level weight L by the total degree D is used as the level weight of each path, and the paths are sorted according to the level weight. The more degrees there are, the more related entities there are and the greater the impact.

[0136] The Antv G6 graph visualization engine is used to visualize the change knowledge graph.

[0137] Furthermore, the abnormal indicator analysis module 304 is specifically used for:

[0138] Based on the historical abnormal indicator data of the changed object corresponding to the changed data, the Apriori algorithm is applied to perform frequent item analysis on the abnormal indicators within the same time interval to obtain a set of abnormal indicator frequent items with associated relationships;

[0139] After the authenticity of the abnormal indicator frequent item set is verified, the abnormal indicators in the abnormal indicator frequent item set are marked with fault levels.

[0140] Furthermore, the abnormal matching module 305 is specifically used for:

[0141] Collect the health indicator information of each object on the change knowledge graph, and extract the abnormal indicator set through the abnormal detection algorithm, where the health indicator information includes but is not limited to the service transaction success rate of the change object, the number of error logs, the service balance response time, CPU usage, memory usage, cluster health status, CPU load and other operation and maintenance object indicator information, and each indicator has a unique ID;

[0142] The abnormal indicator set is matched with the abnormal indicator frequent item set by indicator ID, the existing frequent item sets are screened out, the indicators in the existing frequent item sets are connected in pairs to generate an abnormal indicator knowledge graph, and the abnormal indicators that are not associated but have a changed entity object association relationship can be further connected to finally generate an abnormal indicator knowledge graph.

[0143] Furthermore, the impact path prediction module 306 is specifically used for:

[0144] The Label Propagation algorithm is used to initialize the labels of all unlabeled abnormal indicators in the abnormal indicator knowledge graph;

[0145] Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighbor nodes of the current node, and count the label frequency of each neighbor node;

[0146] According to the label frequency of neighboring nodes, select the label with the highest frequency as the new label of the current node and update the label information;

[0147] Repeat the above steps to perform label propagation on all abnormal indicator nodes in the abnormal indicator knowledge graph until a preset number of iterations or label stability condition is reached;

[0148] According to the label information, nodes with the same label are classified into the same community, and a community propagation subgraph is generated. According to the relationship between the abnormal indicator and the changed object, the community propagation subgraph is converged and merged to generate a potential change impact path.

[0149] By using this system, the above method can be executed and the corresponding technical effects can be achieved.

[0150] An embodiment of the present invention further provides an electronic device for executing the above method, as an implementation device of the method, comprising a processor and a memory;

[0151] A memory, used for storing operation instructions;

[0152] A processor is used to execute the operation and maintenance change impact assessment method based on the knowledge graph provided in any embodiment of the present application by calling an operation instruction.

[0153] As an example, Figure 4 A schematic diagram of the structure of an electronic device applicable to an embodiment of the present application is shown, and the electronic device 400 includes: a processor 401 and a memory 403. The processor 401 and the memory 403 are connected, such as being connected through a bus 402. Optionally, the electronic device 400 may also include a transceiver 404. It should be noted that in actual applications, the transceiver 404 is not limited to one. It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the specific structure of the electronic device 400. In other embodiments of the present application, the electronic device 400 may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware. Optionally, the electronic device may also include a display screen 405 for displaying images, or receiving user operation instructions when necessary.

[0154] The processor 401 is applied in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 404 may include a receiver and a transmitter. The transceiver 404 is applied in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0155] Processor 401 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 401 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0156] The processor 401 may also include one or more processing units, for example: the processor 401 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), a controller, a memory, a video codec, a digital signal processor (digital signal processor, DSP), a baseband processor, and / or a neural network processor (Neural-network Processing Unit, NPU), etc. Different processing units can be independent devices or integrated into one or more processors. Among them, the controller can be the nerve center and command center of the electronic device 400. The controller can generate an operation control signal according to the instruction opcode and the timing signal to complete the control of fetching and executing instructions. A memory can also be set in the processor 401 for storing instructions and data. In some embodiments, the memory in the processor 401 is a cache memory. The memory can save instructions or data that the processor 401 has just used or circulated.

[0157] Processor 401 can run the operation and maintenance change impact assessment method based on knowledge graph provided in the embodiment of the present application. Processor 401 may include different devices. For example, when integrating CPU and GPU, the CPU and GPU can cooperate to execute the operation and maintenance change impact assessment method based on knowledge graph provided in the embodiment of the present application. Part of the algorithm is executed by the CPU, and the other part of the algorithm is executed by the GPU to obtain faster processing efficiency.

[0158] The bus 402 may include a path to transmit information between the above components. The bus 402 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 402 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0159] The memory 403 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory), or may include a high-speed random access memory, or may include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0160] Optionally, the memory 403 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 401. The processor 401 is used to execute the application code stored in the memory 403 to implement the operation and maintenance change impact assessment method based on the knowledge graph provided in any embodiment of the present application.

[0161] The memory 403 can be used to store computer executable program codes, which include instructions. The processor 401 executes various functional applications and data processing of the electronic device 400 by running the instructions stored in the memory 403. The memory 403 may include a program storage area and a data storage area. Among them, the program storage area may store the code of the operating system, application program, etc. The data storage area may store data created during the use of the electronic device 400 (such as images, videos, etc. collected by the camera application), etc.

[0162] The memory 403 may also store one or more computer programs corresponding to the operation and maintenance change impact assessment method based on the knowledge graph provided in the embodiment of the present application. The one or more computer programs are stored in the above-mentioned memory 403 and are configured to be executed by the one or more processors 401. The one or more computer programs include instructions, and the above-mentioned instructions can be used to execute each step in the above-mentioned corresponding embodiment.

[0163] Of course, the code of the operation and maintenance change impact assessment method based on knowledge graph provided in the embodiment of the present application can also be stored in an external memory.

[0164] The display screen 405 includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a Miniled, a MicroLed, a Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 400 may include 1 or N display screens 405, where N is a positive integer greater than 1. The display screen 405 may be used to display information input by a user or information provided to a user and various graphical user interfaces (GUIs). For example, the display screen 405 may display photos, videos, web pages, or files, etc.

[0165] The electronic device provided in the embodiment of the present application is applicable to any embodiment of the above method. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, which will not be repeated here.

[0166] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.

[0167] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0168] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0169] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0170] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0171] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for evaluating the impact of operation and maintenance changes based on knowledge graph, characterized in that: The following steps are involved: S1. Integrate multi-source data and establish associations to build a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database data, call chain data, and network connection data; S2. Input the change data, query the change impact path corresponding to the change data, and generate a change knowledge graph; S3. Calculate the level weight for each path in the change knowledge graph, sort the paths according to the level weight, and visualize the change knowledge graph using a graph visualization engine; S4. Use the Apriori algorithm to perform frequent item analysis on the historical abnormal indicator data of the change object corresponding to the change data, obtain a set of frequent items of abnormal indicators with associated relationships, and mark the fault level; S5. Collect and analyze the health index of each object on the change knowledge graph, extract abnormal indicators, match them with the abnormal indicator frequent item set, and generate an abnormal indicator knowledge graph; S6. Perform label propagation calculation according to the abnormal indicator knowledge graph to generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the abnormal indicator and the change object to generate a potential change impact path.

2. The method according to claim 1, characterized in that The step S1 specifically includes: S11. According to the operation and maintenance object information in the configuration management database data, the operation and maintenance objects are classified by system, service, process, virtual machine, physical machine, and network; S12. Use physical link relationships to establish node association relationships between the network, physical machines, virtual machines, process layers, and service layers; S13. Use the call chain data and network connection data to associate the call dependencies between services, and establish the association between microservices and middleware and database; S14. Use a graph database to store the operation and maintenance objects and the association relationships to build a software and hardware knowledge graph.

3. The method according to claim 1, characterized in that The step S2 specifically includes: S21. Input the change data and identify the change object corresponding to the change data; S22. Taking the changed object as the starting point, extracting the changed object information according to the changed data; S23. Combine the change object information with the depth-first search algorithm to traverse and search all the change impact paths with related relationships from the layer where the change object is located in the software and hardware knowledge graph to generate a change knowledge graph.

4. The method according to claim 1, characterized in that: The step S3 specifically includes: S31. According to the terminal system layer node in the changed knowledge graph, a system weight L is marked for the changed knowledge graph path; S32. Count the total degrees of all nodes on the changed knowledge graph path using a degree statistics algorithm to obtain the total degree D of each path, multiply the system level weight L by the total degree D as the level weight of each path, and sort them according to the level weight; S33. Use the graph visualization engine to visualize the change knowledge graph.

5. The method according to claim 1, characterized in that The step S4 specifically includes: S41. Based on the historical abnormal index data of the changed object corresponding to the changed data, the Apriori algorithm is applied to perform frequent item analysis on the abnormal indexes within the same time interval to obtain a set of frequent items of abnormal indexes with associated relationships; S42. After verifying the authenticity of the abnormal indicator frequent item set, mark the fault level of the abnormal indicator in the abnormal indicator frequent item set.

6. The method according to claim 1, characterized in that The step S5 specifically includes: S51. Collect the health index information of each object on the change knowledge graph, and extract the abnormal index set through the abnormal detection algorithm; S52. Match the abnormal indicator set with the abnormal indicator frequent item set by indicator ID, filter out existing frequent item sets, and connect the indicators in the existing frequent item sets in pairs to generate an abnormal indicator knowledge graph.

7. The method according to claim 1, characterized in that The step S6 specifically includes: S61. In the abnormal indicator knowledge graph, all unlabeled abnormal indicators are initialized and marked; S62. Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighbor nodes of the current node, and count the label frequency of each neighbor node; S63. According to the label frequency of neighboring nodes, select the label with the highest frequency as the new label of the current node, and update the label information; S64. Repeat the above steps to perform label propagation on all abnormal indicator nodes in the abnormal indicator knowledge graph until a preset number of iterations or label stability condition is reached; S65. According to the label information, nodes with the same label are classified into the same community, and a community propagation subgraph is generated. According to the relationship between the abnormal indicator and the changed object, the community propagation subgraph is converged and merged to generate a potential change impact path.

8. An operation and maintenance change impact assessment system based on knowledge graph, characterized in that: include: A knowledge graph construction module integrates multi-source data and establishes associations to construct a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database data, call chain data, and network connection data; A graph change module is used to query the change impact path corresponding to the input change data and generate a change knowledge graph; A visualization module, used to calculate a grade weight for each path in the change knowledge graph, sort the paths according to the grade weight, and then visualize the change knowledge graph using a graph visualization engine; The abnormal index analysis module performs frequent item analysis on the historical abnormal index data of the change object corresponding to the change data based on the Apriori algorithm, obtains a set of abnormal index frequent items with associated relationships, and performs fault level marking; An abnormal matching module is used to collect and analyze the health index of each object on the change knowledge graph, extract abnormal indicators, match them with the abnormal indicator frequent item set, and generate an abnormal indicator knowledge graph; The impact path prediction module is used to perform label propagation calculation based on the abnormal indicator knowledge graph to generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the abnormal indicator and the change object to generate a potential change impact path.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store operation instructions; The processor is used to execute the method according to any one of claims 1 to 7 by calling the operation instruction.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images