A knowledge graph-based method and system for assessing the impact of operational changes.

Abstract

This invention relates to a knowledge graph-based method and system for assessing the impact of operational changes. By integrating configuration management databases, call chain data, and network connection data, a directed hardware and software knowledge graph is constructed using a graph database. A depth-first search algorithm is used to query the impact path of changes, and a graph visualization engine is applied to generate the change knowledge graph. This provides reviewers and operations personnel with clear and accurate upstream and downstream association information of the change object. Frequent item analysis is performed on historical abnormal indicators, and tag propagation calculations are performed on the abnormal indicator graph to generate a community propagation subgraph. This allows for more scientific and intelligent aggregation and association of potential and scattered abnormal information, providing a rapid tool for locating faults caused by changes. This improves the scientific rigor and accuracy of change assessments, effectively mitigates change risks, and enables rapid fault location when they occur.

Description

Technical Field

[0001] This invention relates to the field of IT operations and maintenance, specifically a knowledge graph-based method and system for assessing the impact of operations and maintenance changes. By employing graph algorithms and machine learning techniques, it conducts a comprehensive and scientific impact assessment of operations and maintenance changes, aiming to ensure the stable operation and efficient iteration of the system. Background Technology

[0002] With the rapid development of internet technology, the cloudification of IT infrastructure, the containerization of application runtime environments, and the microservice architecture of systems have led to an exponential increase in the types and numbers of system hardware and software devices and applications. This growth has resulted in frequent production changes, including changes to application systems such as information system launches, program deployments, configuration changes, business parameter adjustments, data maintenance, patch upgrades, account migrations, system switching, and version rollbacks; and changes to basic platforms such as data center migrations, equipment replacements, new module installations, upgrades and hardening of basic platform hardware and software, preventative maintenance, capacity increases, system performance improvements, and security measures.

[0003] However, the risks associated with these changes are becoming increasingly complex, insidious, and highly specialized. A change to a single component or even a single field can trigger a series of system anomalies and transaction failures, leading to unpredictable losses. Therefore, impact analysis of operational changes becomes particularly important.

[0004] Currently, the following problems exist in the operation and maintenance change review process: there is a lack of a visual knowledge graph of the change object to intuitively display the upstream and downstream dependencies and calling relationships of the change object; when multiple services or infrastructures in the same system are changed at the same time and fault alarms occur, it is difficult for operation and maintenance personnel to quickly locate which changes are related to the fault alarms; the massive amount of abnormal indicator information is filled with a lot of "noise", which affects the operation and maintenance personnel's judgment of effective information, and the correlation between abnormal indicators lacks visual connection.

[0005] To address the aforementioned issues, this invention proposes a knowledge graph-based method for assessing the impact of operational changes, aiming to provide a more comprehensive and scientific assessment tool to help operations personnel manage change risks more effectively. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention proposes a knowledge graph-based method and system for assessing the impact of operational changes.

[0007] To achieve the above objectives, the technical solution adopted by the present invention includes:

[0008] A knowledge graph-based method for assessing the impact of operational changes, characterized by the following steps:

[0009] S1. Integrate multi-source data and establish relationships to construct a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database data, call chain data, and network connection data;

[0010] S2. Input the change data, query the change impact path corresponding to the change data, and generate a change knowledge graph;

[0011] S3. Calculate the level weight for each path in the changed knowledge graph, sort the paths according to the level weight, and then use the Antv G6 graph visualization engine to visualize the changed knowledge graph.

[0012] S4. Use the Apriori algorithm to perform frequent item analysis on the historical abnormal indicator data of the changed object corresponding to the changed data, obtain a set of frequent abnormal indicator items with correlation, and mark the fault level.

[0013] S5. Collect and analyze health indicators for each object on the change knowledge graph, extract abnormal indicators, match them with the set of frequent abnormal indicator items, and generate an abnormal indicator knowledge graph.

[0014] S6. Perform tag propagation calculation based on the anomaly indicator knowledge graph to generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the anomaly indicator and the object of change to generate potential change impact paths.

[0015] Furthermore, S1 specifically includes:

[0016] S11. Based on the operation and maintenance object information in the configuration management database, classify the operation and maintenance objects into systems, services, processes, virtual machines, physical machines, and networks;

[0017] S12. Establish node associations between the network, physical machines, virtual machines, process layer, and service layer using physical link relationships;

[0018] S13. Utilize call chain data and network connection data to associate the call dependencies between services, and establish the association between microservices, middleware, and databases;

[0019] S14. Use the Nebula Graph database to store the operation and maintenance objects and their relationships, and construct a software and hardware knowledge graph.

[0020] Furthermore, step S2 specifically includes:

[0021] S21. Input the changed data and identify the changed object corresponding to the changed data;

[0022] S22. Starting from the object being changed, extract the information of the object being changed based on the change data;

[0023] S23. Combining the changed object information with a depth-first search algorithm, search for all related change impact paths from the layer where the changed object is located in the software and hardware knowledge graph, and generate a change knowledge graph.

[0024] Furthermore, step S3 specifically includes:

[0025] S31. Based on the end system layer nodes in the changed knowledge graph, assign system weights L to the changed knowledge graph path;

[0026] S32. Use a degree statistics algorithm to count the total degree of all nodes on the changed knowledge graph path, obtain the total degree D of each path, multiply the system level weight L by the total degree D as the level weight of each path, and sort them according to the level weight.

[0027] S33. Use a graph visualization engine to visualize the change knowledge graph.

[0028] Furthermore, step S4 specifically includes:

[0029] S41. Based on the historical abnormal indicator data of the object corresponding to the changed data, apply the Apriori algorithm to perform frequent item analysis on the abnormal indicators within the same time interval, and obtain a set of frequent abnormal indicator items with correlation.

[0030] S42. After verifying the authenticity of the set of frequent abnormal indicators, the abnormal indicators in the set of frequent abnormal indicators are marked with fault levels.

[0031] Furthermore, step S5 specifically includes:

[0032] S51. Collect the health index information of each object on the changed knowledge graph, and extract the set of abnormal indicators through the anomaly detection algorithm;

[0033] S52. Match the abnormal indicator set with the abnormal indicator frequent item set by indicator ID, filter out the existing frequent item sets, and connect the indicators in the existing frequent item sets in pairs to generate an abnormal indicator knowledge graph.

[0034] Furthermore, step S6 specifically includes:

[0035] S61. In the abnormal indicator knowledge graph, initialize the labeling for all unlabeled abnormal indicators;

[0036] S62. Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighboring nodes of the current node, and count the label frequency of each neighboring node.

[0037] S63. Based on the label frequency of neighboring nodes, select the label with the highest frequency as the new label for the current node, and update the label information;

[0038] S64. Repeat the above steps to propagate labels to all abnormal indicator nodes in the abnormal indicator knowledge graph until the preset number of iterations or label stability conditions are reached.

[0039] S65. Based on the tag information, nodes with the same tag are grouped into the same community, and a community propagation subgraph is generated. The community propagation subgraph is converged and merged according to the relationship between the abnormal indicators and the changed objects to generate potential change impact paths.

[0040] Furthermore, this invention also relates to a knowledge graph-based system for assessing the impact of operational changes, characterized in that it includes:

[0041] The knowledge graph construction module integrates multi-source data and establishes relationships to construct a software and hardware knowledge graph. The multi-source data includes: configuration management database data, call chain data, and network connection data.

[0042] The graph change module is used to query the change impact path corresponding to the input change data and generate a change knowledge graph based on the input change data.

[0043] The visualization module is used to calculate the level weight for each path in the change knowledge graph, sort the paths according to the level weight, and then use a graph visualization engine to visualize the change knowledge graph.

[0044] The abnormal indicator analysis module performs frequent item analysis on the historical abnormal indicator data of the changed object corresponding to the changed data based on the Apriori algorithm, obtains a set of frequently occurring abnormal indicators with correlation, and marks them with fault levels.

[0045] The anomaly matching module is used to collect and analyze health indicators for each object on the change knowledge graph, extract abnormal indicators, match them with the set of frequent abnormal indicator items, and generate an abnormal indicator knowledge graph.

[0046] The impact path prediction module is used to perform tag propagation calculations based on the anomaly indicator knowledge graph, generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the anomaly indicator and the object of change to generate potential change impact paths.

[0047] Furthermore, the present invention also relates to an electronic device, characterized in that it includes a processor and a memory;

[0048] The memory is used to store operation instructions;

[0049] The processor is configured to execute the above-described method by invoking the operation instructions.

[0050] Furthermore, the present invention also relates to a computer-readable storage medium, characterized in that the storage medium stores a computer program, which, when executed by a processor, implements the above-described method.

[0051] The solution provided in this application integrates the Configuration Management Database (CMDB), call chain data, and network connection data. It utilizes the Nebula Graph database to construct a directed hardware and software knowledge graph. A depth-first search (DFS) algorithm is used to query the impact paths of changes, and the Antv G6 graph visualization engine is applied to generate the change knowledge graph. This provides reviewers and operations personnel with clear and accurate upstream and downstream relationship information of the changed objects. The Apriori algorithm is used to perform frequent item analysis on historical anomaly indicators, and label propagation calculations are performed on the anomaly indicator graph to generate a community propagation subgraph. This allows for more scientific and intelligent aggregation and association of potential and scattered anomaly information, providing a rapid tool for locating faults caused by changes. This improves the scientific rigor and accuracy of change assessment, effectively mitigates change risks, and enables rapid fault location when they occur. Attached Figure Description

[0052] Figure 1 A flowchart illustrating a knowledge graph-based method for assessing the impact of operational changes, provided as an embodiment of this application;

[0053] Figure 2 This is a schematic diagram of the structure of the software and hardware knowledge graphs provided in the embodiments of this application;

[0054] Figure 3 A schematic diagram of the structure of a knowledge graph-based operation and maintenance change impact assessment system provided in this application embodiment;

[0055] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0056] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting the invention.

[0057] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. The terms “first,” “second,” etc., are merely for clarification of the subject matter and do not limit the subject matter itself. Of course, the subjects defined by “first” and “second” may be the same terminal, device, and user, or the same type of terminal, device, and user. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. The term “and / or” as used herein includes all or any unit and all combinations of one or more associated listed items.

[0058] The technical solutions of this application and how the technical solutions of this application solve the above-mentioned technical problems are described in detail below with specific embodiments. The following embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0059] Figure 1 This application provides a flowchart illustrating a knowledge graph-based method for assessing the impact of operational changes, which specifically includes:

[0060] S1. Integrate multi-source data and establish relationships to construct a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database (CMDB) data, call chain data, and network connection data;

[0061] In an optional embodiment, step S1 specifically includes:

[0062] S11. Based on the operation and maintenance object information in the configuration management database, classify the operation and maintenance objects from top to bottom into six layers: system, service (including but not limited to microservices, middleware clusters, database clusters, etc.), process (including but not limited to middleware instance processes such as Nginx, Kafka, and Redis, database instance processes such as MySQL and Elasticsearch, and pod instances corresponding to microservices), virtual machine, physical machine, and network. Figure 2 As shown;

[0063] S12. Establish node associations between the network, physical machines, virtual machines, process layer, and service layer using physical link relationships. These physical link relationships mainly include, but are not limited to: physical machines running virtual machines; virtual machines hosted on physical machines; microservices deployed on virtual machines; middleware and databases installed on virtual machines or physical machines; physical machines connected to switches; and switches connected to routers.

[0064] S13. Using call chain data and network connection data, associate the call dependencies between services and establish the association between microservices, middleware, and database. The call chain data is mainly collected by using the Skywalking full-link tracing tool to collect data from application services. It mainly includes basic service information and call information of services accessing other services. Microservices and applications are pre-defined to belong to a certain system in the CMDB, thus associating the service layer with the system layer.

[0065] S14. Use the Nebula Graph database to store the operation and maintenance objects and their relationships, and construct a software and hardware knowledge graph.

[0066] S2. Input the change data, query the change impact path corresponding to the change data, and generate a change knowledge graph;

[0067] In an optional embodiment, step S2 specifically includes:

[0068] S21. Input the changed data and identify the changed object corresponding to the changed data;

[0069] S22. Starting from the object being changed, extract the information of the object being changed based on the change data;

[0070] S23. Combining the changed object information with a depth-first search algorithm, search for all related change impact paths from the layer where the changed object is located in the software and hardware knowledge graph from bottom to top. The bottom-up traversal relationship is mainly that the next object of the current object depends on the current object. For example, if the current service A is called by service B, then service B is a traversable object. If the current service A calls service C, then service C is an object that does not need to be traversed. This process continues until the system layer is reached, generating a change knowledge graph.

[0071] S3. Calculate the level weight for each path in the changed knowledge graph, sort the paths according to the level weight, and then use the Antv G6 graph visualization engine to visualize the changed knowledge graph.

[0072] In an optional embodiment, step S3 specifically includes:

[0073] S31. Based on the end system layer nodes in the changed knowledge graph, mark the system weight L for the changed knowledge graph path, where the higher the system importance level, the larger the corresponding weight value, such as setting the weight of the account system to 10 and the weight of the OA system to 2.

[0074] S32. Use a degree statistics algorithm to count the total degree of all nodes on the path of the changed knowledge graph, and obtain the total degree D of each path. Multiply the system level weight L by the total degree D as the level weight of each path, and sort them according to the level weight. The higher the degree, the more related entities there are and the greater the influence.

[0075] S33. Use Antv G6 graph visualization engine to visualize the change knowledge graph.

[0076] Specifically, the Antv G6 graph visualization engine is used to visualize the changes, and the knowledge graph provides reviewers and operations personnel with clear and accurate upstream and downstream relationship information of the changed objects, exposing potential change risks, improving change assessment efficiency, and ensuring change quality.

[0077] S4. Use the Apriori algorithm to perform frequent item analysis on the historical abnormal indicator data of the changed object corresponding to the changed data, obtain a set of frequent abnormal indicator items with correlation, and mark the fault level.

[0078] In an optional embodiment, step S4 specifically includes:

[0079] S41. Based on the historical abnormal indicator data of the object corresponding to the changed data, apply the Apriori algorithm to perform frequent item analysis on the abnormal indicators within the same time interval, and obtain a set of frequent abnormal indicator items with correlation.

[0080] S42. After verifying the authenticity of the set of frequent abnormal indicators, the abnormal indicators in the set of frequent abnormal indicators are marked with fault levels.

[0081] Specifically, the main metrics and formulas of the Apriori algorithm are as follows:

[0082] Regarding support:

[0083]

[0084] This represents the probability that events A and B occur simultaneously.

[0085] Regarding confidence level:

[0086]

[0087] This represents the ratio of the probability of events A and B occurring simultaneously to the probability of event A occurring at all.

[0088] The Apriori algorithm's mining process is as follows: First, set a minimum support threshold and find all frequent itemsets, each of which must appear more than or equal to the minimum support threshold. Second, generate strong association rules from the frequent itemsets: rules that simultaneously satisfy both minimum support and minimum confidence.

[0089] The main steps of the Apriori algorithm are the connection step and the pruning step:

[0090] (1) Join step: Use Lk-1 to perform a self-join to obtain K itemsets Ck. When joining, only itemsets that differ only in the last item can be joined.

[0091] (2) Pruning step: Based on the Ck candidate set, remove itemsets with a frequency less than the minimum support, and remove candidate sets whose subsets are not frequent itemsets.

[0092] In an optional embodiment, there are 5 abnormal indicator items in a certain interval: M1, M2, M3, M4, and M5. This interval contains 5 events in the historical abnormal indicator data, and each event is a transaction, as follows:

[0093] TRANSACTION_ID List of abnormal indicators T1 M1, M2 T2 M2, M4, M5 T3 M1, M3, M5 T4 M1, M4, M5 T5 M1, M4, M5, M2

[0094] (1) First set the minimum support threshold to 2;

[0095] (2) Scan the entire dataset and count the occurrence frequency of each abnormal indicator to obtain C1 = {M1:4,M2:3,M3:1,M4:3,M5:4};

[0096] (3) After comparing with the minimum support threshold and removing invalid terms, we get L1 = {M1:4, M2:3, M4:3, M5:4};

[0097] (4) Perform self-connection and counting on L1 to obtain...

[0098] C2={(M1,M2):2,(M1,M4):2,(M1,M5):3,(M2,M4):2,(M2,M5):2,(M4,M5):3};

[0099] (5) After comparing and sorting with the minimum support threshold, we get L2={(M1,M5):3,(M4,M5):3,(M1,M2):2,(M1,M4):2,(M2,M4):2,(M2,M5):2};

[0100] (6) Perform a self-connection on L2 and count the results.

[0101] C3={(M1,M4,M5):2,(M1,M2,M5):1,(M1,M2,M4):1,(M2,M4,M5):2};

[0102] (7) After comparing with the minimum support threshold, we get L3 = {(M1,M4,M5):2,(M2,M4,M5):2};

[0103] (8) After performing a self-join on L3, it was found that C4={(M1,M2,M4,M5):1} has a frequency less than the minimum support threshold. Therefore, L3={(M1,M4,M5):2,(M2,M4,M5):2} was selected as the frequent itemset.

[0104] Meanwhile, based on expert experience, events that are verified as real for frequent itemsets are labeled to improve algorithm stability and reduce the number of iterations. In an optional embodiment, events (M1, M4, M5) that are confirmed by expert experience to be real and occur simultaneously can be labeled with the same tag, while events (M2, M4, M5) that have not yet been determined by expert experience are not labeled. Additionally, abnormal indicators are labeled with fault levels, ranging from high to low: emergency level, severe level, fault level, alarm level, and notification level.

[0105] S5. Collect and analyze health indicators for each object on the change knowledge graph, extract abnormal indicators, match them with the set of frequent abnormal indicator items, and generate an abnormal indicator knowledge graph.

[0106] In an optional embodiment, step S5 specifically includes:

[0107] S51. Collect the health index information of each object on the knowledge graph of the change, and extract the set of abnormal indicators through the anomaly detection algorithm. The health index information includes, but is not limited to, the service transaction success rate, number of error logs, average service response time, CPU utilization, memory utilization, cluster health status, CPU load and other operation and maintenance object index information of the changed object. Each index has a unique ID.

[0108] S52. Match the abnormal indicator set with the abnormal indicator frequent item set by indicator ID, filter out the existing frequent item sets, connect the indicators in the existing frequent item sets in pairs to generate an abnormal indicator knowledge graph, and further connect abnormal indicators that are not related but have changed entity object relationship, and finally generate an abnormal indicator knowledge graph.

[0109] S6. Based on the anomaly indicator knowledge graph, a community propagation subgraph is generated using the Label Propagation algorithm. The community propagation subgraph is then converged and merged according to the relationship between the anomaly indicator and the object of change, generating potential change impact paths.

[0110] In an optional embodiment, step S6 specifically includes:

[0111] S61. The Label Propagation algorithm is used to initialize the labeling of all unlabeled abnormal indicators in the abnormal indicator knowledge graph;

[0112] S62. Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighboring nodes of the current node, and count the label frequency of each neighboring node.

[0113] S63. Based on the label frequency of neighboring nodes, select the label with the highest frequency as the new label for the current node, and update the label information;

[0114] S64. Repeat the above steps to propagate labels to all abnormal indicator nodes in the abnormal indicator knowledge graph until the preset number of iterations or label stability conditions are reached.

[0115] S65. Based on the tag information, nodes with the same tag are grouped into the same community, and a community propagation subgraph is generated. The community propagation subgraph is converged and merged according to the relationship between the abnormal indicators and the changed objects to generate potential change impact paths.

[0116] The solution provided in this application integrates the Configuration Management Database (CMDB), call chain data, and network connection data. It utilizes the Nebula Graph database to construct a directed hardware and software knowledge graph. A depth-first search (DFS) algorithm is used to query the impact paths of changes, and the Antv G6 graph visualization engine is applied to generate the change knowledge graph. This provides reviewers and operations personnel with clear and accurate upstream and downstream relationship information of the changed objects. The Apriori algorithm is used to perform frequent item analysis on historical anomaly indicators, and label propagation calculations are performed on the anomaly indicator graph to generate a community propagation subgraph. This allows for more scientific and intelligent aggregation and association of potential and scattered anomaly information, providing a rapid tool for locating faults caused by changes. This improves the scientific rigor and accuracy of change assessment, effectively mitigates change risks, and enables rapid fault location when they occur.

[0117] based on Figure 1 This paper presents a knowledge graph-based method for assessing the impact of operational changes, and also relates to a knowledge graph-based system for assessing the impact of operational changes, the structure of which is as follows. Figure 3 As shown, it includes:

[0118] The knowledge graph construction module 301 integrates multi-source data and establishes relationships to construct a software and hardware knowledge graph. The multi-source data includes: configuration management database (CMDB) data, call chain data, and network connection data.

[0119] The graph change module 302 is used to query the change impact path corresponding to the input change data and generate a change knowledge graph based on the input change data.

[0120] The visualization module 303 is used to calculate the level weight for each path in the change knowledge graph, sort the paths according to the level weight, and then use a graph visualization engine to visualize the change knowledge graph.

[0121] The abnormal indicator analysis module 304 performs frequent item analysis on the historical abnormal indicator data of the changed object corresponding to the changed data based on the Apriori algorithm, obtains a set of frequently occurring abnormal indicators with correlation, and marks the fault level.

[0122] The anomaly matching module 305 is used to collect and analyze health indicators for each object on the change knowledge graph, extract abnormal indicators, match them with the set of frequent abnormal indicator items, and generate an abnormal indicator knowledge graph.

[0123] The impact path prediction module 306 is used to perform tag propagation calculation based on the anomaly indicator knowledge graph, generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the anomaly indicator and the object of change to generate potential change impact paths.

[0124] Furthermore, the knowledge graph construction module 301 is specifically used for:

[0125] Based on the operation and maintenance object information in the configuration management database, the operation and maintenance objects are classified from top to bottom into six layers: system, service (including but not limited to microservices, middleware clusters, database clusters, etc.), process (including but not limited to middleware instance processes such as Nginx, Kafka, Redis, and database instance processes such as mysql, Elasticsearch, and pod instances corresponding to microservices), virtual machine, physical machine, and network.

[0126] Physical link relationships are used to establish node associations between the network, physical machines, virtual machines, process layer, and service layer. These physical link relationships mainly include, but are not limited to: physical machines running virtual machines; virtual machines hosted on physical machines; microservices deployed on virtual machines; middleware and databases installed on virtual machines or physical machines; physical machines connected to switches; and switches connected to routers.

[0127] By using call chain data and network connection data, the call dependencies between services are associated, and the association between microservices, middleware, and databases is established. The call chain data is mainly collected by using the Skywalking full-link tracing tool to collect data from application services. This includes basic service information and call information of services accessing other services. Microservices and applications are pre-defined to belong to a certain system in the CMDB, thus associating the service layer with the system layer.

[0128] The operation and maintenance objects and their relationships are stored using the Nebula Graph database to construct a software and hardware knowledge graph.

[0129] Furthermore, the map modification module 302 is specifically used for:

[0130] Input the changed data and identify the object to be changed corresponding to the changed data;

[0131] Starting with the object being changed, extract the information of the object being changed based on the change data;

[0132] The changed object information is combined with a depth-first search algorithm to traverse the layer where the changed object is located in the software and hardware knowledge graph from bottom to top, searching for all related change impact paths. The bottom-up traversal relationship is mainly that the next object of the current object depends on the current object. For example, if service A is called by service B, then service B is a traversable object. If service A calls service C, then service C is an object that does not need to be traversed, until the system layer is reached, generating a change knowledge graph.

[0133] Furthermore, the visualization module 303 is specifically used for:

[0134] Based on the end system layer node in the changed knowledge graph, the system weight L is marked for the path of the changed knowledge graph, where the higher the importance level of the system, the larger the corresponding weight value.

[0135] The total degree of all nodes on the path of the changed knowledge graph is counted using a degree statistics algorithm to obtain the total degree D of each path. The system level weight L is multiplied by the total degree D as the level weight of each path, and the paths are sorted according to the level weight. The higher the degree, the more related entities there are and the greater the influence.

[0136] The Antv G6 graph visualization engine was used to visualize the change knowledge graph.

[0137] Furthermore, the abnormal indicator analysis module 304 is specifically used for:

[0138] Based on the historical abnormal indicator data of the corresponding changed object, the Apriori algorithm is applied to perform frequent item analysis on the abnormal indicators within the same time interval to obtain a set of frequent abnormal indicator items with correlation.

[0139] After verifying the authenticity of the set of frequent abnormal indicators, the abnormal indicators in the set of frequent abnormal indicators are marked with a fault level.

[0140] Furthermore, the anomaly matching module 305 is specifically used for:

[0141] The health index information of each object on the knowledge graph is collected, and the set of abnormal indicators is extracted by an anomaly detection algorithm. The health index information includes, but is not limited to, the service transaction success rate, number of error logs, average service response time, CPU utilization, memory utilization, cluster health status, CPU load and other operation and maintenance object index information of the changed object. Each index has a unique ID.

[0142] The abnormal indicator set is matched with the abnormal indicator frequent item set by indicator ID, and the existing frequent item sets are filtered out. The indicators in the existing frequent item sets are connected in pairs to generate an abnormal indicator knowledge graph. Furthermore, abnormal indicators that are not related but have changed entity object relationship can be connected to generate the abnormal indicator knowledge graph.

[0143] Furthermore, the influence path prediction module 306 is specifically used for:

[0144] The Label Propagation algorithm is used to initialize the labeling of all unlabeled anomalous indicators in the anomalous indicator knowledge graph;

[0145] Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighbor nodes of the current node, and count the label frequency of each neighbor node.

[0146] Based on the label frequency of neighboring nodes, select the label with the highest frequency as the new label for the current node, and update the label information;

[0147] Repeat the above steps to propagate labels to all abnormal indicator nodes in the abnormal indicator knowledge graph until the preset number of iterations or label stability conditions are reached.

[0148] Based on the tag information, nodes with the same tag are grouped into the same community, and a community propagation subgraph is generated. The community propagation subgraph is then converged and merged based on the relationship between the abnormal indicators and the changed objects to generate potential change impact paths.

[0149] By using this system, the above methods can be executed and the corresponding technical effects can be achieved.

[0150] Embodiments of the present invention also provide an electronic device for performing the above-described method, which, as an implementation apparatus for the method, includes a processor and a memory;

[0151] Memory, used to store operation instructions;

[0152] The processor is used to execute the knowledge graph-based operation and maintenance change impact assessment method provided in any embodiment of this application by invoking operation instructions.

[0153] As an example, Figure 4 This diagram illustrates the structure of an electronic device to which this application applies. The electronic device 400 includes a processor 401 and a memory 403. The processor 401 and the memory 403 are connected, for example, via a bus 402. Optionally, the electronic device 400 may also include a transceiver 404. It should be noted that in practical applications, the transceiver 404 is not limited to one. It is understood that the structure illustrated in this embodiment does not constitute a specific limitation on the specific structure of the electronic device 400. In other embodiments of this application, the electronic device 400 may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components. The illustrated components may be implemented as hardware, software, or a combination of software and hardware. Optionally, the electronic device may also include a display screen 405 for displaying images or receiving user operation commands when needed.

[0154] In this embodiment, processor 401 is used to implement the method shown in the above method embodiment. Transceiver 404 may include a receiver and a transmitter. Transceiver 404 is used in this embodiment to enable the electronic device of this embodiment to communicate with other devices during execution.

[0155] Processor 401 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 401 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0156] Processor 401 may also include one or more processing units, such as an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). Different processing units can be independent devices or integrated into one or more processors. The controller can be the central nervous system and command center of the electronic device 400. The controller can generate operation control signals based on instruction opcodes and timing signals to control instruction fetching and execution. Processor 401 may also include memory for storing instructions and data. In some embodiments, the memory in processor 401 is a cache memory. This memory can store instructions or data that the processor 401 has recently used or is recurring.

[0157] The processor 401 can run the knowledge graph-based operation and maintenance change impact assessment method provided in the embodiments of this application. The processor 401 may include different devices, such as when integrating a CPU and a GPU, the CPU and GPU can cooperate to execute the knowledge graph-based operation and maintenance change impact assessment method provided in the embodiments of this application. Some algorithms are executed by the CPU and other algorithms are executed by the GPU to obtain faster processing efficiency.

[0158] Bus 402 may include a pathway for transmitting information between the aforementioned components. Bus 402 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 402 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0159] The memory 403 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory), or high-speed random access memory. It may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), or other optical disc storage, optical disk storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0160] Optionally, the memory 403 is used to store application code that executes the solution of this application, and the execution is controlled by the processor 401. The processor 401 is used to execute the application code stored in the memory 403 to implement the knowledge graph-based operation and maintenance change impact assessment method provided in any embodiment of this application.

[0161] The memory 403 can be used to store computer executable program code, which includes instructions. The processor 401 executes various functional applications and data processing of the electronic device 400 by running the instructions stored in the memory 403. The memory 403 may include a program storage area and a data storage area. The program storage area can store the operating system, application code, etc. The data storage area can store data created during the use of the electronic device 400 (such as images and videos captured by a camera application).

[0162] The memory 403 may also store one or more computer programs corresponding to the knowledge graph-based operation and maintenance change impact assessment method provided in the embodiments of this application. These one or more computer programs are stored in the memory 403 and configured to be executed by the one or more processors 401. The one or more computer programs include instructions that can be used to perform the various steps in the corresponding embodiments described above.

[0163] Of course, the code for the knowledge graph-based operation and maintenance change impact assessment method provided in this application embodiment can also be stored in external storage.

[0164] The display screen 405 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a minimized LED, a microLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 400 may include one or N displays 405, where N is a positive integer greater than 1. The display screen 405 can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces (GUIs). For example, the display screen 405 can display photos, videos, web pages, or documents.

[0165] The electronic device provided in this application is applicable to any of the above-described methods. Therefore, the beneficial effects it can achieve can be referred to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0166] Embodiments of the present invention also provide a computer-readable storage medium capable of implementing all the steps of the methods in the above embodiments, wherein the computer-readable storage medium stores a computer program that, when executed by a processor, implements all the steps of the methods in the above embodiments.

[0167] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0168] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0169] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0170] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0171] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A knowledge graph-based method for assessing the impact of operational changes, characterized in that, Includes the following steps: S1. Integrate multi-source data and establish relationships to construct a software and hardware knowledge graph, wherein the multi-source data includes: configuration management database data, call chain data, and network connection data; S2. Input the change data, query the change impact path corresponding to the change data, and generate a change knowledge graph; S3. Calculate the level weight for each path in the changed knowledge graph, sort the paths according to the level weight, and then use a graph visualization engine to visualize the changed knowledge graph. S4. Use the Apriori algorithm to perform frequent item analysis on the historical abnormal indicator data of the changed object corresponding to the changed data, obtain a set of frequent abnormal indicator items with correlation, and mark the fault level. S5. Collect and analyze health indicators for each object on the change knowledge graph, extract abnormal indicators, match them with the set of frequent abnormal indicator items, and generate an abnormal indicator knowledge graph. S6. Perform tag propagation calculation based on the anomaly indicator knowledge graph to generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the anomaly indicator and the object of change to generate potential change impact paths; Step S6 specifically includes: S61. In the abnormal indicator knowledge graph, initialize the labeling for all unlabeled abnormal indicators; S62. Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighboring nodes of the current node, and count the label frequency of each neighboring node. S63. Based on the label frequency of neighboring nodes, select the label with the highest frequency as the new label for the current node, and update the label information; S64. Repeat the above steps to propagate labels to all abnormal indicator nodes in the abnormal indicator knowledge graph until the preset number of iterations or label stability conditions are reached. S65. Based on the tag information, nodes with the same tag are grouped into the same community, and a community propagation subgraph is generated. The community propagation subgraph is converged and merged according to the relationship between the abnormal indicators and the changed objects to generate potential change impact paths.

2. The method according to claim 1, characterized in that, Step S1 specifically includes: S11. Based on the operation and maintenance object information in the configuration management database, classify the operation and maintenance objects into systems, services, processes, virtual machines, physical machines, and networks; S12. Establish node associations between the network, physical machines, virtual machines, process layer, and service layer using physical link relationships; S13. Utilize call chain data and network connection data to associate the call dependencies between services, and establish the association between microservices, middleware, and databases; S14. Use a graph database to store the operation and maintenance objects and their relationships to construct a software and hardware knowledge graph.

3. The method according to claim 1, characterized in that, Step S2 specifically includes: S21. Input the changed data and identify the changed object corresponding to the changed data; S22. Starting from the object being changed, extract the object information based on the change data; S23. Combining the changed object information with a depth-first search algorithm, search for all change-affected paths with related relationships from the layer where the changed object is located in the software and hardware knowledge graph, and generate a change knowledge graph.

4. The method according to claim 1, characterized in that, Step S3 specifically includes: S31. Based on the end system layer nodes in the changed knowledge graph, assign system weights L to the changed knowledge graph path; S32. Use a degree statistics algorithm to count the total degree of all nodes on the changed knowledge graph path, obtain the total degree D of each path, multiply the system weight L by the total degree D as the level weight of each path, and sort them according to the level weight. S33. Use a graph visualization engine to visualize the change knowledge graph.

5. The method according to claim 1, characterized in that, Step S4 specifically includes: S41. Based on the historical abnormal indicator data of the object corresponding to the changed data, apply the Apriori algorithm to perform frequent item analysis on the abnormal indicators within the same time interval, and obtain a set of frequent abnormal indicator items with correlation. S42. After verifying the authenticity of the set of frequent abnormal indicators, the abnormal indicators in the set of frequent abnormal indicators are marked with fault levels.

6. The method according to claim 1, characterized in that, Step S5 specifically includes: S51. Collect the health index information of each object on the changed knowledge graph, and extract the set of abnormal indicators through the anomaly detection algorithm; S52. Match the abnormal indicator set with the abnormal indicator frequent item set by indicator ID, filter out the existing frequent item set, and connect the indicators in the existing frequent item set in pairs to generate an abnormal indicator knowledge graph.

7. A knowledge graph-based system for assessing the impact of operational changes, characterized in that, include: The knowledge graph construction module integrates multi-source data and establishes relationships to construct a software and hardware knowledge graph. The multi-source data includes: configuration management database data, call chain data, and network connection data. The graph change module is used to query the change impact path corresponding to the input change data and generate a change knowledge graph based on the input change data. The visualization module is used to calculate the level weight for each path in the change knowledge graph, sort the paths according to the level weight, and then use a graph visualization engine to visualize the change knowledge graph. The abnormal indicator analysis module performs frequent item analysis on the historical abnormal indicator data of the changed object corresponding to the changed data based on the Apriori algorithm, obtains a set of frequently occurring abnormal indicators with correlation, and marks them with fault levels. The anomaly matching module is used to collect and analyze health indicators for each object on the change knowledge graph, extract abnormal indicators, match them with the set of frequent abnormal indicator items, and generate an abnormal indicator knowledge graph. The impact path prediction module is used to perform tag propagation calculation based on the anomaly indicator knowledge graph, generate a community propagation subgraph, and converge and merge the community propagation subgraph according to the relationship between the anomaly indicator and the object of change to generate potential change impact paths. Specifically, the impact path prediction module is used for: In the anomaly indicator knowledge graph, all unlabeled anomaly indicators are initialized with labels; Randomly select an abnormal indicator node from the abnormal indicator knowledge graph as the current node, traverse all neighbor nodes of the current node, and count the label frequency of each neighbor node. Based on the label frequency of neighboring nodes, select the label with the highest frequency as the new label for the current node, and update the label information; Repeat the above steps to propagate labels to all abnormal indicator nodes in the abnormal indicator knowledge graph until the preset number of iterations or label stability conditions are reached. Based on the tag information, nodes with the same tag are grouped into the same community, and a community propagation subgraph is generated. The community propagation subgraph is then converged and merged based on the relationship between the abnormal indicators and the changed objects to generate potential change impact paths.

8. An electronic device, characterized in that, Including processor and memory; The memory is used to store operation instructions; The processor is configured to execute the method of any one of claims 1-6 by invoking the operation instructions.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method of any one of claims 1-6.

Images