Root cause analysis implementation method in intelligent operation and maintenance system and intelligent operation and maintenance system

Abstract

The invention provides a root cause analysis implementation method in an intelligent operation and maintenance system and the intelligent operation and maintenance system. The method comprises the steps of collecting original data of different dimensions of an IT system needing operation and maintenance in real time; performing data preprocessing including data cleaning, feature extraction and normalization on each piece of original data to obtain corresponding multi-dimensional feature data; using the multi-dimensional feature data as input data, using a pre-trained typical mode recognition model to recognize whether the IT system is in a typical mode during normal operation, and when the degree of deviation of the multi-dimensional feature data from the typical mode exceeds a preset threshold, judging that the IT system is in an abnormal mode; when the IT system is in the abnormal mode, predicting and identifying a fault type index causing the abnormal mode by using a pre-trained fault type identification model; and building and dynamically updating a knowledge graph by using the multi-dimensional feature data, analyzing an abnormal mode and a fault type index by using the knowledge graph, and generating a root cause analysis result.

Description

Technical Field

[0001] The present invention relates to the field of intelligent operation and maintenance technology, and in particular to a root cause analysis implementation method in an intelligent operation and maintenance system and an intelligent operation and maintenance system. Background Art

[0002] As IT systems become more complex, traditional operation and maintenance methods can no longer meet the needs of quickly locating and solving problems. Intelligent operation and maintenance technology has emerged as the times require. Intelligent operation and maintenance is an automated operation and maintenance method that uses machine learning, big data analysis and other technologies to monitor the operating status of IT systems, predict faults, and handle faults.

[0003] Root Cause Analysis (RCA) in the intelligent operation and maintenance system refers to building a knowledge graph for the business architecture or system architecture, locating anomalies based on the merged anomaly sources, and providing possible repair solutions. Root cause analysis can be used to identify and solve the root cause of the problem to prevent it from happening again.

[0004] However, existing root cause analysis methods mostly rely on manual experience, have low analysis efficiency, poor accuracy, lack of automated processing capabilities, and are unable to quickly respond to complex IT system failures. They are also easily limited by personal abilities and limited data analysis capabilities, making it difficult to extract valuable information from massive data.

[0005] Therefore, how to provide an automated and intelligent root cause analysis method to improve the efficiency and accuracy of intelligent operation and maintenance is a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of this, an embodiment of the present invention provides a root cause analysis implementation method in an intelligent operation and maintenance system and an intelligent operation and maintenance system to eliminate or improve one or more defects existing in the prior art.

[0007] One aspect of the present invention provides a method for implementing root cause analysis in an intelligent operation and maintenance system, the method comprising the following steps: collecting raw data of different dimensions of an IT system that requires operation and maintenance in real time; wherein the raw data includes: system component information, service dependency, and service interaction records; performing data preprocessing including data cleaning, feature extraction, and normalization on each raw data to obtain corresponding multi-dimensional feature data; using the multi-dimensional feature data as input data, using a pre-trained typical pattern recognition model to identify whether the IT system is in a typical mode during normal operation, and when the degree to which the multi-dimensional feature data deviates from the typical mode exceeds a preset threshold, judging that the IT system is in an abnormal mode; wherein the typical pattern recognition model is trained with different typical modes as labels and with corresponding multi-dimensional feature data as input data; when the IT system is in an abnormal mode, using a pre-trained fault type recognition model to predict and identify the fault type indicator that causes the abnormal mode; wherein the fault type recognition model is trained with known fault type indicators as labels and with corresponding multi-dimensional feature data as input data; using the multi-dimensional feature data to build and dynamically update a knowledge graph, using the knowledge graph to analyze abnormal modes and fault type indicators, and generating a root cause analysis result.

[0008] In some embodiments of the present invention, the original data also includes log data, performance indicators, configuration information and multiple dependent service status; the typical pattern recognition model and the fault type recognition model belong to machine learning models, and the types of machine learning models include classification algorithm models, clustering algorithm models and anomaly detection algorithm models.

[0009] In some embodiments of the present invention, the method further includes: using the multi-dimensional feature data as input data, and utilizing a pre-trained abnormal pattern recognition model to identify that the IT system is in an abnormal mode; wherein the abnormal pattern recognition model is pre-trained using an unsupervised learning method.

[0010] In some embodiments of the present invention, the knowledge graph is used to analyze abnormal patterns and fault type indicators to generate root cause analysis results, including: analyzing and counting abnormal system components during the period when the IT system is in abnormal mode based on multi-dimensional feature data collected in real time and identified fault type indicators; searching the knowledge graph for service dependencies and service interaction records between abnormal components, and determining the key abnormal system components that cause the IT system to be in abnormal mode through the service dependencies between components; and generating root cause analysis results including the key abnormal system components.

[0011] In some embodiments of the present invention, the knowledge graph is used to analyze abnormal patterns and fault type indicators to generate root cause analysis results, which also includes: using causal inference to determine the causal relationship between the generation of abnormal patterns and fault type indicators, and the generated root cause analysis results also include the causal relationship between the generation of abnormal patterns and fault type indicators.

[0012] In some embodiments of the present invention, the knowledge graph is used to analyze abnormal patterns and fault type indicators to generate root cause analysis results, which also includes: using the service dependencies and service interaction records between components contained in the knowledge graph to generate a critical path for all system components with associated abnormalities; the generated root cause analysis results also include the critical path and the impact range of the abnormal pattern, and the impact range of the abnormal pattern includes all system components that are statistically abnormal during the period when the IT system is in abnormal mode.

[0013] In some embodiments of the present invention, for the generated root cause analysis results, the method further includes: integrating the root cause analysis results to generate an intelligent operation and maintenance analysis report, so as to intuitively display the intelligent operation and maintenance analysis report to the user through a result display module.

[0014] Corresponding to the above method, the present invention also provides an intelligent operation and maintenance system, including: a data collection module, used to collect original data of different dimensions of the IT system that needs operation and maintenance in real time; wherein the original data includes: system component information, service dependency and service interaction record; a data preprocessing module, used to perform data preprocessing including data cleaning, feature extraction and normalization on each original data to obtain corresponding multi-dimensional feature data; a machine learning module, used to use the multi-dimensional feature data as input data, use a pre-trained typical pattern recognition model to identify whether the IT system is in a typical mode during normal operation, and when the multi-dimensional feature data deviates from the typical mode, the machine learning module When the degree of the pattern exceeds a preset threshold, it is judged that the IT system is in an abnormal mode; wherein the typical pattern recognition model is trained with different typical patterns as labels and corresponding multi-dimensional feature data as input data; when the IT system is in an abnormal mode, a pre-trained fault type recognition model is used to predict and identify the fault type indicators that cause the abnormal pattern; wherein the fault type recognition model is trained with known fault type indicators as labels and corresponding multi-dimensional feature data as input data; a root cause analysis module is used to build and dynamically update a knowledge graph using the multi-dimensional feature data, and use the knowledge graph to analyze abnormal patterns and fault type indicators to generate root cause analysis results.

[0015] Corresponding to the above method, the present invention also provides an electronic device, including a processor, a memory, and a computer program / instructions stored in the memory, wherein the processor is used to execute the computer program / instructions, and when the computer program / instructions are executed, the electronic device implements the steps of the method described in any one of the above embodiments.

[0016] Corresponding to the above method, the present invention also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method described in any one of the above embodiments are implemented.

[0017] The root cause analysis implementation method in the intelligent operation and maintenance system proposed by the present invention can quickly and accurately locate the root cause of the problem through automated data collection, data preprocessing, intelligent analysis and pattern recognition, thereby improving the efficiency, accuracy and system stability of root cause analysis. Pre-trained typical pattern recognition models and fault type recognition models based on machine learning are used to ensure the accuracy of anomaly detection and pattern recognition. Through the design of the root cause analysis method, the root cause of the problem can be quickly located from complex data.

[0018] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0019] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of the present application, and do not constitute a limitation of the present invention. In the drawings:

[0021] Figure 1 The present invention is a flowchart of a method for implementing root cause analysis in one embodiment of the present invention.

[0022] Figure 2 Schematic diagram of the structure of an intelligent operation and maintenance system in one embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0024] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0025] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0026] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection with an intermediate.

[0027] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0028] In order to overcome the problems existing in the prior art, the present invention proposes a root cause analysis implementation method and an intelligent operation and maintenance system in an intelligent operation and maintenance system. The solution can quickly and accurately locate the root cause of the problem through automated data collection, intelligent analysis and pattern recognition, thereby improving operation and maintenance efficiency and system stability.

[0029] The present invention aims to provide a root cause analysis implementation method and an intelligent operation and maintenance system in an intelligent operation and maintenance system, which realizes rapid and accurate diagnosis of IT system failures by comprehensively utilizing machine learning, big data analysis, pattern recognition and other technologies. Among them, big data analysis is a technology that analyzes large amounts of data to discover patterns and correlations.

[0030] Figure 1 This is a flow chart of a method for implementing root cause analysis in one embodiment of the present invention. The method comprises the following steps:

[0031] Step S110: collecting original data of different dimensions of the IT system that needs operation and maintenance in real time; wherein the original data includes: system component information, service dependency and service interaction records.

[0032] Step S120: performing data preprocessing including data cleaning, feature extraction and normalization on each item of original data to obtain corresponding multi-dimensional feature data.

[0033] Step S130: Using the multi-dimensional feature data as input data, a pre-trained typical pattern recognition model is used to identify whether the IT system is in a typical mode during normal operation; when the degree to which the multi-dimensional feature data deviates from the typical mode exceeds a preset threshold, the IT system is judged to be in an abnormal mode; wherein the typical pattern recognition model is trained using different typical patterns as labels and the corresponding multi-dimensional feature data as input data.

[0034] Step S140: When the IT system is in an abnormal mode, a pre-trained fault type recognition model is used to predict and identify the fault type indicators that cause the abnormal mode; wherein the fault type recognition model is trained using known fault type indicators as labels and corresponding multi-dimensional feature data as input data.

[0035] Step S150: Build and dynamically update a knowledge graph using the multi-dimensional feature data, analyze abnormal patterns and fault type indicators using the knowledge graph, and generate root cause analysis results.

[0036] The root cause analysis implementation method in the intelligent operation and maintenance system proposed by the present invention can quickly and accurately locate the root cause of the problem through automated data collection, data preprocessing, intelligent analysis and pattern recognition, thereby improving the efficiency, accuracy and system stability of root cause analysis. Pre-trained typical pattern recognition models and fault type recognition models based on machine learning are used to ensure the accuracy of anomaly detection and pattern recognition. Through the design of the root cause analysis method, the root cause of the problem can be quickly located from complex data.

[0037] In some embodiments of the present invention, the original data also includes multiple types of log data, performance indicators, configuration information and dependent service status.

[0038] In some embodiments of the present invention, the typical pattern recognition model and the fault type recognition model belong to machine learning models, and the types of machine learning models include classification algorithm models, clustering algorithm models and anomaly detection algorithm models.

[0039] In other embodiments of the present invention, the collected raw data may also include social media data, user feedback, etc.

[0040] By adopting the embodiment of the invention, sufficient original data can be provided, thereby ensuring the accuracy of the root cause analysis results.

[0041] In some embodiments of the present invention, for multi-dimensional feature data, the method further includes: using the multi-dimensional feature data as input data, and utilizing a pre-trained abnormal pattern recognition model to identify that the IT system is in an abnormal mode; wherein the abnormal pattern recognition model is pre-trained using an unsupervised learning method.

[0042] By using the embodiments of the invention, it is possible to process massive amounts of data in an automated manner and quickly extract valuable insights from a large amount of information. By using automated data collection and preprocessing, it is possible to ensure the quality and consistency of the data and provide accurate input data for root cause analysis based on machine learning models.

[0043] In some embodiments of the present invention, the knowledge graph is used to analyze abnormal modes and fault type indicators to generate root cause analysis results, including: (1) analyzing and counting abnormal system components during the period when the IT system is in abnormal mode based on multi-dimensional feature data collected in real time and identified fault type indicators; (2) searching the knowledge graph for service dependencies and service interaction records between abnormal components, and determining the key abnormal system components that cause the IT system to be in abnormal mode through the service dependencies between components, that is, determining the root cause of the abnormal mode or fault; (3) generating root cause analysis results including the key abnormal system components.

[0044] By adopting the embodiment of the invention, the root cause of the problem can be accurately located through causal reasoning and association rule mining.

[0045] In other embodiments of the present invention, the knowledge graph is used to analyze abnormal patterns and fault type indicators to generate root cause analysis results, which also includes: using causal inference to determine the causal relationship between the generation of abnormal patterns and fault type indicators, and the generated root cause analysis results also include the causal relationship between the generation of abnormal patterns and fault type indicators.

[0046] By adopting the embodiment of the invention, the causal relationship between the generation of abnormal mode and the fault type indicator can be determined by means of root cause analysis.

[0047] In other embodiments of the present invention, the knowledge graph is used to analyze abnormal patterns and fault type indicators to generate root cause analysis results, and further includes: using the service dependencies and service interaction records between components contained in the knowledge graph to generate a critical path for all system components with abnormalities.

[0048] Furthermore, the generated root cause analysis result may also include the critical path and the abnormal mode impact range, and the abnormal mode impact range includes all system components that are abnormal when the IT system is in the abnormal mode.

[0049] By adopting the embodiment of the invention, the critical path and the impact range of the abnormal mode can be analyzed by means of root cause analysis.

[0050] Based on the above embodiments of the invention, for the generated root cause analysis results, the method further includes: integrating the root cause analysis results to generate an intelligent operation and maintenance analysis report, so as to intuitively display the intelligent operation and maintenance analysis report to the user through a result display module.

[0051] By adopting the embodiment of the invention, a visual display of analysis results can be provided, making complex analysis results easy to understand and operate, facilitating operation and maintenance personnel to understand and take actions, and improving the decision-making efficiency of operation and maintenance personnel.

[0052] Figure 2 The figure is a schematic diagram of the structure of the intelligent operation and maintenance system in one embodiment of the present invention. The system includes: (1) a data collection module, which is used to collect raw data of different dimensions of the IT system that needs operation and maintenance in real time; wherein the raw data includes: system component information, service dependencies and service interaction records; (2) a data preprocessing module, which is used to perform data preprocessing including data cleaning, feature extraction and normalization on each raw data to obtain corresponding multi-dimensional feature data; (3) a machine learning module, which is used to use the multi-dimensional feature data as input data and use a pre-trained typical pattern recognition model to identify whether the IT system is in a typical mode during normal operation. When the degree of deviation of the multi-dimensional feature data from the typical mode exceeds a preset value, the machine learning module generates a typical pattern recognition model. Threshold, judging that the IT system is in abnormal mode; wherein the typical pattern recognition model is trained with different typical patterns as labels and corresponding multi-dimensional feature data as input data; when the IT system is in abnormal mode, the pre-trained fault type recognition model is used to predict and identify the fault type indicator that causes the abnormal mode; wherein the fault type recognition model is trained with known fault type indicators as labels and corresponding multi-dimensional feature data as input data; (4) root cause analysis module, used to build and dynamically update the knowledge graph using the multi-dimensional feature data, and use the knowledge graph to analyze abnormal patterns and fault type indicators to generate root cause analysis results.

[0053] During the specific implementation process, it also includes a result display module, which is used to intuitively display the intelligent operation and maintenance analysis report to the user.

[0054] The following is a detailed technical solution in an embodiment of the present invention, which describes the functions of each module:

[0055] Module 210: Data collection module.

[0056] This module is responsible for real-time monitoring and collection of various raw data of the IT system, including but not limited to: log data, performance indicators, configuration information and dependent services (including service dependencies, service interaction records and / or dependent service status), etc. These raw data will provide raw materials for subsequent intelligent operation and maintenance root cause analysis. The data collection module used in the embodiment of the present invention has a high degree of compatibility and scalability to adapt to different types of data sources and data formats.

[0057] Module 220: Module data preprocessing module.

[0058] Since the raw data collected by the data collection module often contains noise and inconsistency, it is necessary to use the data preprocessing module to clean and normalize the data. The data preprocessing module will perform operations such as data cleaning, feature extraction, and normalization on the raw data from different sources to obtain multi-dimensional feature data from different sources with improved quality.

[0059] Module 230: Machine Learning Module.

[0060] The machine learning module includes a variety of pre-trained machine learning models. The types of machine learning models include but are not limited to: classification algorithm models, clustering algorithm models, and anomaly detection algorithm models. The machine learning framework can be TensorFlow, PyTorch, etc., and the machine learning algorithm can be deep learning or reinforcement learning.

[0061] The above machine learning models are used to conduct in-depth analysis of the multi-dimensional feature data processed by the data preprocessing module to achieve pattern recognition and anomaly detection, and can identify potential abnormal patterns and signs of failure. Specifically, the model can identify typical patterns during normal operation and trigger anomaly detection when system behavior deviates from these typical patterns.

[0062] In addition, the machine learning models contained in the machine learning module can be continuously optimized through training to improve their accuracy and robustness. On the other hand, they can receive verification and feedback from operation and maintenance personnel on the root cause analysis results. The feedback from operation and maintenance personnel can be used to adjust and optimize the machine learning models and improve the accuracy of the machine learning models in pattern recognition and anomaly detection.

[0063] Module 240: Root cause analysis module: The root cause analysis module takes the multi-dimensional feature data obtained by the data preprocessing module as input and outputs a root cause analysis report.

[0064] (1) The root cause analysis module analyzes the multi-dimensional feature data obtained by the data preprocessing module:

[0065] A multi-dimensional data model is built in the root cause analysis module, which can examine the problem from different angles and conduct a comprehensive analysis of the multi-dimensional feature data obtained by the data preprocessing module. The sources of the multi-dimensional feature data include but are not limited to: log data, performance indicators, and configuration information. Accordingly, the comprehensive analysis includes but is not limited to: log file analysis, performance indicator analysis, configuration information change, and dependent service analysis.

[0066] (2) Use the machine learning module to implement pattern recognition and anomaly detection using a variety of pre-trained machine learning models.

[0067] This step uses a pre-trained typical pattern recognition model to identify typical patterns during normal operation and monitor the behavior of the IT system, triggering anomaly detection when the behavior of the IT system deviates from these typical patterns. The typical pattern recognition model is trained using a supervised learning algorithm with the IT system behavior in typical patterns as labels.

[0068] In the abnormality detection step, a pre-trained abnormal pattern recognition model is used to identify abnormal patterns, and a pre-trained fault type recognition model is used to predict and identify known fault type indicators. The abnormal pattern recognition model is pre-trained using an unsupervised learning method, and the fault type recognition model is trained using known fault type indicators as labels and corresponding multi-dimensional feature data as input data.

[0069] Among them, unsupervised learning algorithms refer to the process of discovering hidden structures, patterns or relationships from input data sets without explicit labels or results. Supervised learning algorithms rely on data sets with clear labels or results for model training, enabling them to accurately predict or classify unseen data.

[0070] (3) After the abnormal patterns are identified, causal inference methods (Bayesian networks, causal graphs and / or decision trees) are used to determine the causal relationship between the generation of different abnormal patterns and the fault type indicators.

[0071] It is important to note that causal inference goes beyond simple correlation analysis and can provide deeper insights into which factors are the root cause of a problem.

[0072] (4) Dynamically obtain system components, service dependencies between components, and service interaction records related to the IT system, build and dynamically update a knowledge graph based on the system components, service dependencies between components, and service interaction records, use the knowledge graph to identify the association between different abnormal patterns and system components, identify the critical paths of fault propagation related to different abnormal patterns, help understand how faults propagate in the system, and thus determine the root cause of the abnormal pattern or fault.

[0073] In layman's terms, the first thing observed is the generation of abnormal patterns and fault type indicators. The fault type indicators are associated with one or more system components contained in the knowledge graph. Using the service dependencies and service interaction records between components contained in the knowledge graph, a critical path can be identified. This critical path is composed of system components, service dependencies between components, and service interaction records. It can assist the module in understanding how the fault occurs and the scope of the fault's impact in the IT system, and then analyze and obtain recommended repair measures.

[0074] Among them, system components refer to the components contained in the target object (IT system) of operation and maintenance. In IT systems, service dependency services refer to the interdependencies between components in terms of function implementation, data processing or communication. Service interaction records refer to the interaction operations such as function implementation, data processing or communication between components with service dependencies.

[0075] In the specific implementation process, the knowledge graph can be constructed through a graph relationship network, with each component in the IT system as a node, the relationship between nodes as the service dependency relationship between components, and a database to record all service interaction records. In the process of identifying the key fault propagation path, the fault type indicators identified in the causal inference step are first used to determine the system components involved, and the service dependency and service interaction records between the system components involved in the period when the IT system is in abnormal mode are counted, and recorded in the form of a linked list, array or graph to generate the key path generated by the abnormal mode.

[0076] (5) Use the built-in feedback system to receive verification and feedback from operation and maintenance personnel on the analysis results. The feedback from these operation and maintenance personnel can be used to continuously adjust and optimize the embedded algorithm model of the root cause analysis module, thereby improving the accuracy and efficiency of the root cause analysis.

[0077] (6) Integrate the root cause analysis results, including abnormal patterns, fault type indicators, and / or critical fault propagation paths related to abnormal patterns, into an easy-to-understand intelligent operation and maintenance analysis report, including the root cause of the fault, the scope of the fault, and recommended repair measures. The generated intelligent operation and maintenance analysis report can be directly used for decision support, helping the operation and maintenance team to quickly respond to and solve problems.

[0078] Module 250: Result display module.

[0079] The analysis results need to be presented to the operation and maintenance personnel in an intuitive and easy-to-understand way. The result display module will use visualization technologies such as charts and dashboards to transform complex data analysis results into intuitive views. Virtual reality (VR) or augmented reality (AR) can also be used for more intuitive presentation. In addition, the module will also provide interactive functions, allowing users to deeply query and analyze specific fault events.

[0080] Corresponding to the above method, the present invention also provides an electronic device, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the electronic device implements the steps of the method described above.

[0081] Corresponding to the above method, the present invention also provides a computer-readable storage medium, on which a computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the steps of the method described in any one of the above embodiments are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0082] Corresponding to the above method, the present invention also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any one of the above embodiments when executed by a processor.

[0083] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0084] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0085] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0086] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for implementing root cause analysis in an intelligent operation and maintenance system, characterized in that: include: Collect raw data of different dimensions of IT systems that need to be operated and maintained in real time; wherein the raw data includes: system component information, service dependencies and service interaction records; Perform data preprocessing including data cleaning, feature extraction and normalization on each raw data to obtain corresponding multi-dimensional feature data; Using the multi-dimensional feature data as input data, using a pre-trained typical pattern recognition model to identify whether the IT system is in a typical mode during normal operation, and when the degree to which the multi-dimensional feature data deviates from the typical mode exceeds a preset threshold, the IT system is judged to be in an abnormal mode; wherein the typical pattern recognition model is trained using different typical modes as labels and the corresponding multi-dimensional feature data as input data; When the IT system is in an abnormal mode, a pre-trained fault type recognition model is used to predict and identify the fault type indicators that cause the abnormal mode; wherein the fault type recognition model is trained using known fault type indicators as labels and corresponding multi-dimensional feature data as input data; The multi-dimensional feature data is used to build and dynamically update a knowledge graph, and the knowledge graph is used to analyze abnormal patterns and fault type indicators to generate root cause analysis results.

2. The method according to claim 1, characterized in that The raw data also includes multiple types of log data, performance indicators, configuration information and dependent service status; The typical pattern recognition model and the fault type recognition model belong to machine learning models, and the types of machine learning models include classification algorithm models, clustering algorithm models and anomaly detection algorithm models.

3. The method according to claim 1, characterized in that For multi-dimensional feature data, the method further includes: The multi-dimensional feature data is used as input data, and a pre-trained abnormal pattern recognition model is used to identify that the IT system is in an abnormal mode; wherein the abnormal pattern recognition model is pre-trained using an unsupervised learning method.

4. The method according to claim 1, characterized in that: The knowledge graph is used to analyze abnormal patterns and fault type indicators to generate root cause analysis results, including: Based on the multi-dimensional feature data collected in real time and the identified fault type indicators, analyze and count the system components that have abnormalities during the period when the IT system is in abnormal mode; Search the knowledge graph for abnormal service dependencies and service interaction records between components, and determine the key abnormal system components that cause the IT system to be in abnormal mode through the service dependencies between components; A root cause analysis result of the system component containing the critical anomaly is generated.

5. The method according to claim 4, characterized in that Analyzing abnormal patterns and fault type indicators using the knowledge graph to generate root cause analysis results also includes: The causal relationship between the generation of the abnormal pattern and the fault type indicator is determined by causal inference, and the generated root cause analysis result also includes the causal relationship between the generation of the abnormal pattern and the fault type indicator.

6. The method according to claim 4, characterized in that Analyzing abnormal patterns and fault type indicators using the knowledge graph to generate root cause analysis results also includes: Generate a critical path of all system components with associated anomalies by using the service dependency relationships and service interaction records between components contained in the knowledge graph; The generated root cause analysis result also includes the critical path and the abnormal mode impact range, and the abnormal mode impact range includes all system components that are abnormal when the IT system is in the abnormal mode.

7. The method according to any one of claims 1 to 6, characterized in that For the generated root cause analysis results, the method further includes: integrating the root cause analysis results to generate an intelligent operation and maintenance analysis report, so as to intuitively display the intelligent operation and maintenance analysis report to the user through a result display module.

8. An intelligent operation and maintenance system, characterized in that: include: A data collection module is used to collect raw data of different dimensions of IT systems that need to be operated and maintained in real time; wherein the raw data includes: system component information, service dependency relationships, and service interaction records; The data preprocessing module is used to perform data preprocessing including data cleaning, feature extraction and normalization on various raw data to obtain corresponding multi-dimensional feature data; A machine learning module, used to use the multi-dimensional feature data as input data, and use a pre-trained typical pattern recognition model to identify whether the IT system is in a typical mode during normal operation, and when the degree to which the multi-dimensional feature data deviates from the typical mode exceeds a preset threshold, it is judged that the IT system is in an abnormal mode; wherein the typical pattern recognition model is trained with different typical modes as labels and with the corresponding multi-dimensional feature data as input data; when the IT system is in an abnormal mode, a pre-trained fault type recognition model is used to predict and identify a fault type indicator that causes the abnormal mode; wherein the fault type recognition model is trained with known fault type indicators as labels and with the corresponding multi-dimensional feature data as input data; The root cause analysis module is used to build and dynamically update the knowledge graph using the multi-dimensional feature data, analyze abnormal patterns and fault type indicators using the knowledge graph, and generate root cause analysis results.

9. An electronic device comprising a processor, a memory and a computer program / instruction stored in the memory, characterized in that: The processor is used to execute the computer program / instructions. When the computer program / instructions are executed, the electronic device implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method as claimed in any one of claims 1 to 7 are implemented.

Images