Intelligent collaborative management method and system for network security operation and maintenance

Abstract

The present invention provides an intelligent collaborative management method and system for network security operations and maintenance, which relates to the field of network security technology. The method comprises obtaining operation and maintenance work order information including work order priority and processing time limit and converting it into a work order feature vector; inputting the skill score, historical completion rate, and workload of the operation and maintenance personnel into a multi-objective optimization model to calculate the work order matching score and urgency score; using a multi-layer perceptron to perform state encoding on the work order feature vector, personnel characteristics, and constraints; using a dual Q network to extract spatial correlation and calculate the target Q value; generating a work order distribution plan based on a Pareto optimal solution algorithm, and monitoring the processing status in real time through a task collaborative scheduling model to generate a collaborative scheduling strategy. The present invention improves the intelligence level of work order distribution, realizes the collaborative management of operation and maintenance tasks, and improves operation and maintenance efficiency.

Description

Technical Field

[0001] The present invention relates to network security technology, and in particular to an intelligent collaborative management method and system for network security operation and maintenance. Background Art

[0002] As cybersecurity threats become increasingly complex, cybersecurity operations and maintenance (O&M) face challenges such as a surge in work orders, increased processing timelines, and complex task allocation. Cybersecurity O&M requires intelligent scheduling and collaborative management based on multiple factors, including work order priority, processing timelines, and O&M personnel skills. Currently, mainstream O&M management platforms are leveraging artificial intelligence (AI) for work order distribution and task collaboration, leveraging multi-objective optimization algorithms to optimize the scheduling of O&M resources.

[0003] However, existing technologies still have the following problems: First, traditional work order distribution methods often only consider single-objective optimization and cannot effectively balance multiple objectives such as work order matching and urgency, resulting in irrational resource allocation; Second, existing task scheduling models lack the ability to deeply characterize the characteristics of operation and maintenance personnel and work order characteristics, making it difficult to accurately characterize the complex correlations between multi-dimensional features; Third, current collaborative scheduling strategies generally adopt static rules and cannot be dynamically optimized and adjusted according to the real-time work order processing status, affecting operation and maintenance efficiency.

[0004] The technical problem to be solved by the present invention is: how to construct an intelligent collaborative management method for network security operation and maintenance based on multi-objective optimization and deep reinforcement learning, so as to realize multi-objective dynamic optimization of work order distribution, deep characterization of operation and maintenance characteristics, and real-time collaboration of task scheduling. Summary of the Invention

[0005] The embodiments of the present invention provide an intelligent collaborative management method and system for network security operation and maintenance work, which can solve the problems in the existing technology.

[0006] According to a first aspect of the embodiments of the present invention,

[0007] Provides intelligent collaborative management methods for network security operations, including:

[0008] Obtain network security operation and maintenance work order information, including work order priority and work order processing time limit, convert the network security operation and maintenance work order information into a work order feature vector, and input the work order feature vector into a multi-objective optimization model trained based on historical work order processing data;

[0009] The multi-objective optimization model calculates a work order matching score based on the operator's skill rating, historical work order completion rate, and current workload. It also calculates a work order urgency score based on the work order priority and work order processing time limit. The work order matching score and work order urgency score are input into the Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan.

[0010] A multi-layer perceptron is used to perform state encoding on work order feature vectors, operator characteristics, and constraints. A dual Q-network structure is used to extract the spatial correlation of the state encoding and calculate the target Q value. The parameters of the dual Q-network are trained based on a multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. A dynamic adjustment mechanism is then used to continuously optimize the work order distribution plan.

[0011] The target operation and maintenance personnel are determined based on the work order distribution plan, and the work order processing tasks are issued to the target operation and maintenance personnel; the Pareto optimal solution algorithm is used to build a task collaborative scheduling model, which monitors the work order processing status of the target operation and maintenance personnel in real time; when the work order processing status is abnormal, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and work order processing tasks.

[0012] The multi-objective optimization model calculates a work order matching score based on the operator's skill rating, historical work order completion rate, and current workload. It also calculates a work order urgency score based on the work order priority and work order processing time limit. The work order matching score and work order urgency score are input into the Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan, including:

[0013] Obtain the operator's skill score, historical work order completion rate, and current workload, and construct a skill score vector based on the skill dimension. Calculate the historical work order completion rate based on a time-decay weight, where the time-decay weight decays as the statistical time interval increases. Calculate the current workload based on the ratio of the task's remaining workload to the deadline.

[0014] The priority score is calculated based on the work order priority and urgency coefficient, and the deadline score is calculated based on the difference between the work order processing deadline and the current time. The skill score vector, historical work order completion rate, and current workload are input into the feature fusion layer, and weighted fusion is performed using the feature weight matrix to obtain the fused feature.

[0015] The work order matching score is calculated based on the fused features. The work order matching score is obtained by performing the inner product operation of the fused features and the work order feature vector. The priority score and time limit score are weighted by a weight coefficient to obtain the work order urgency score. The weight coefficient is optimized based on historical distribution data.

[0016] A multi-objective optimization function is constructed, which includes a work order matching objective function and a work order urgency objective function. The work order matching objective function is constructed based on the work order matching score, and the work order urgency objective function is constructed based on the work order urgency score. The multi-objective optimization function is input into the Pareto optimal solution algorithm, and the non-dominated solution set is screened based on the Pareto dominance relationship. The solutions in the non-dominated solution set all meet the processing capacity constraint. An adaptive weight adjustment mechanism is used to dynamically optimize the feature weight matrix and weight coefficient, and feedback compensation control is implemented based on performance deviation to generate the optimal work order distribution plan.

[0017] The multi-objective optimization function is input into the Pareto optimal solution algorithm. The non-dominated solution set is screened based on the Pareto dominance relationship. All solutions in the non-dominated solution set meet the processing capacity constraint. An adaptive weight adjustment mechanism is used to dynamically optimize the feature weight matrix and weight coefficients. Feedback compensation control is implemented based on performance deviation to generate the optimal work order distribution plan, including:

[0018] The multi-objective optimization function includes a first objective function calculated based on the work order matching score and a second objective function calculated based on the work order urgency score. The multi-objective optimization function is subject to the upper limit of the operation and maintenance personnel's processing capacity and the unique allocation of work orders.

[0019] The multi-objective optimization function is input into the Pareto optimal solution algorithm. The Pareto optimal solution algorithm performs multi-dimensional space mapping on the first and second objective functions. Based on the Pareto dominance relationship, a set of non-dominated solutions that meet the constraints is selected. Each solution in the non-dominated solution set corresponds to a candidate work order distribution plan.

[0020] An adaptive weight adjustment mechanism is constructed. The adaptive weight adjustment mechanism performs performance evaluation on the candidate work order distribution schemes in the non-dominated solution set to obtain the performance deviation. Based on the performance deviation, a proportional-integral controller is used to implement feedback compensation, dynamically adjust the feature fusion weight matrix and the objective function weight coefficient, and select the optimal work order distribution scheme from the non-dominated solution set.

[0021] The dual Q network structure is used to extract the spatial correlation of state encoding and calculate the target Q value. The parameters of the dual Q network are trained based on the multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. The work order distribution solution is continuously optimized through a dynamic adjustment mechanism, including:

[0022] The work order feature vector, operation and maintenance personnel features, and system constraint matrix are input into the multi-layer perceptron, and the state feature vector is obtained by state encoding through the multi-layer perceptron;

[0023] Construct a dual Q network structure, which includes a current network and a target network. Input the state feature vector into the current network, extract the spatial correlation of the state feature through a convolutional neural network, input the extracted spatial correlation into the target network and calculate the target Q value.

[0024] A multi-objective reward function is constructed based on the target Q value. The multi-objective reward function includes a matching reward, an urgency reward, and a constraint satisfaction reward. The matching reward is obtained by calculating the cosine similarity between the skill requirements of the work order and the skill scores of the operation and maintenance personnel. The urgency reward is calculated based on the remaining processing time of the work order. The constraint satisfaction reward is calculated based on the degree of satisfaction of the constraint conditions.

[0025] An experience replay mechanism is used to store state transition samples. Training samples are selected based on priority sampling. The training samples are input into the dual Q network structure for training. The network parameters of the dual Q network structure are updated by minimizing the temporal difference error.

[0026] The updated network parameters of the dual Q network structure are substituted into the ε-greedy strategy to explore the action space and generate a set of candidate work order distribution solutions. The Pareto dominance relationship is used to screen the candidate work order distribution solutions to obtain an undecided solution set. A reference point method model is constructed based on the undecided solution set. The reference point method calculates the utility function value based on the ideal point coordinates and the target weight, and selects the work order distribution solution with the largest utility function value as the optimal work order distribution solution.

[0027] The performance of the optimal work order distribution plan is monitored. When the performance indicator change rate exceeds the preset change threshold, the dynamic adjustment mechanism is triggered, the target weight is updated based on the gradient descent method, and the updated target weight is fed back to the multi-objective reward function to continuously optimize the optimal work order distribution plan.

[0028] The Pareto dominance relationship is used to screen the candidate work order distribution solutions to obtain an unowned solution set. A reference point method model is constructed based on the unowned solution set. The reference point method model calculates the utility function value based on the ideal point coordinates and target weights. The work order distribution solution with the largest utility function value is selected as the optimal work order distribution solution, including:

[0029] Based on the Pareto dominance relationship, the dominance and subordination of each solution in the set of candidate work order distribution solutions are calculated. The dominance degree indicates the number of other solutions dominated by the corresponding solution, and the subordination degree indicates the number of solutions that dominate the corresponding solution.

[0030] The candidate work order distribution schemes are hierarchically screened based on the dominance and dominated degrees, and the schemes with a dominated degree of zero are divided into a multi-layer undominated solution set.

[0031] The first layer of the masterless solution set in the multi-layer masterless solution set is selected to construct a reference point method model, and the coordinates of the ideal point are determined based on the function values ​​corresponding to the multi-objective reward functions of each solution in the multi-layer masterless solution set;

[0032] Calculate the normalized target value of each solution in the multi-layer unowned solution set relative to the ideal point coordinates, and calculate the utility function value based on the preset target weight. Select the work order distribution solution with the largest utility function value as the optimal work order distribution solution.

[0033] A task collaborative scheduling model is constructed using the Pareto optimal solution algorithm. The task collaborative scheduling model monitors the work order processing status of the target operation and maintenance personnel in real time. When an abnormality occurs in the work order processing status, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and the work order processing task, including:

[0034] A Pareto optimal solution algorithm is used to build a task collaborative scheduling model. The task collaborative scheduling model obtains the work order processing status of the target operation and maintenance personnel. The work order processing status includes the work order processing time, work order processing quality, and resource utilization. The work order processing status is converted into a state feature matrix. The state feature matrix generates a historical state encoding through a bidirectional gated recurrent unit network.

[0035] Based on historical state coding, the time series state feature data is obtained and decomposed at multiple scales. The learning rate is dynamically adjusted according to the state change rate. The dynamic statistics are calculated by combining the exponential moving average and median statistics. The dynamic statistics are weighted and fused through reliability evaluation and smoothing constraints are imposed to obtain the final statistical results.

[0036] The final statistical results are used to calculate the dynamic mean and dynamic standard deviation of the state feature matrix. The state feature matrix is ​​then normalized using the dynamic mean and dynamic standard deviation to obtain a standardized state vector. A multidimensional reward and punishment function is constructed. The reward and punishment values ​​are calculated based on the deviation in work order processing time, processing quality, and resource utilization. When the standardized state vector exceeds the reward and punishment value, the work order processing status is considered abnormal.

[0037] When an abnormal work order processing status is detected, the real-time work order processing progress and available operation and maintenance resource information are obtained, and candidate scheduling strategies are generated based on the real-time work order processing progress and available operation and maintenance resource information; the candidate scheduling strategies are input into the task collaborative scheduling model, and the evaluation score of each strategy is calculated using a multi-dimensional reward and punishment function. The non-dominated solution is selected as the task collaborative scheduling strategy through the Pareto optimal solution algorithm.

[0038] Based on historical state coding, the time series state feature data is obtained and decomposed at multiple scales. The learning rate is dynamically adjusted according to the state change rate. Dynamic statistics are calculated by combining exponential moving average and median statistics. The dynamic statistics are weighted and fused through reliability evaluation and smoothing constraints are imposed to obtain the final statistical results, including:

[0039] Extract the time series state feature data based on the historical state coding, perform wavelet transform on the time series state feature data to obtain the multi-scale decomposition coefficient; calculate the difference between the time series state feature data at adjacent moments to obtain the instantaneous change rate, and perform exponential smoothing on the instantaneous change rate to obtain the cumulative change rate;

[0040] An adaptive learning rate is generated based on the cumulative rate of change through Sigmoid function mapping. The range of the adaptive learning rate is limited by the preset upper and lower bounds of the learning rate. The adaptive learning rate is used to perform an exponential moving average operation on the time series state feature data to obtain a dynamic mean, and the dynamic standard deviation of the time series state feature data is calculated based on the dynamic mean.

[0041] The median of the time series state feature data is calculated within a sliding time window of a preset length to obtain the robust mean, and the median of the absolute deviation of the time series state feature data relative to the robust mean is calculated to obtain the robust standard deviation; the relative deviation between the dynamic mean and the robust mean is calculated, and the relative deviation is converted through an exponential function to obtain a reliability assessment score;

[0042] The fusion weight is calculated based on the reliability assessment score. The dynamic mean and the robust mean are weightedly fused using the fusion weight to obtain the final mean. The dynamic standard deviation and the robust standard deviation are weightedly fused to obtain the final standard deviation. A time series smoothing constraint is imposed on the final mean to limit the amplitude of change between adjacent moments. A value range constraint is imposed on the final standard deviation to ensure its stability. The final mean and final standard deviation are used as the final statistical results.

[0043] According to a second aspect of the embodiments of the present invention,

[0044] Provides an intelligent collaborative management system for network security operations and maintenance, including:

[0045] The first unit is used to obtain network security operation and maintenance work order information, including the work order priority and work order processing time limit, convert the network security operation and maintenance work order information into a work order feature vector, and input the work order feature vector into a multi-objective optimization model trained based on historical work order processing data;

[0046] The second unit uses a multi-objective optimization model to calculate a work order matching score based on the operator's skill rating, historical work order completion rate, and current workload. It also calculates a work order urgency score based on the work order priority and work order processing time limit. The work order matching score and work order urgency score are input into a Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan.

[0047] The third unit uses a multi-layer perceptron to perform state encoding on work order feature vectors, operator characteristics, and constraints. It then uses a dual Q-network structure to extract the spatial correlation of the state encoding and calculate the target Q value. The dual Q-network parameters are trained based on a multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. The work order distribution plan is continuously optimized through a dynamic adjustment mechanism.

[0048] The fourth unit is used to determine the target operation and maintenance personnel based on the work order distribution plan and issue work order processing tasks to the target operation and maintenance personnel; the Pareto optimal solution algorithm is used to build a task collaborative scheduling model, which monitors the work order processing status of the target operation and maintenance personnel in real time; when the work order processing status is abnormal, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and work order processing tasks.

[0049] According to a third aspect of the embodiments of the present invention,

[0050] An electronic device is provided, comprising:

[0051] processor;

[0052] a memory for storing processor-executable instructions;

[0053] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0054] According to a fourth aspect of the embodiments of the present invention,

[0055] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0056] The beneficial effects of this application are as follows:

[0057] 1. This invention constructs a multi-objective optimization model, takes into account the two optimization objectives of work order matching and urgency, integrates multi-dimensional characteristics such as the skill score, historical completion rate and workload of operation and maintenance personnel, and uses the Pareto optimal solution algorithm to perform multi-objective trade-offs. It effectively solves the problem that traditional single-objective optimization methods are difficult to balance multi-dimensional resource allocation, and significantly improves the rationality of work order distribution and resource utilization efficiency.

[0058] 2. This paper adopts a deep learning architecture that combines a multi-layer perceptron and a dual Q network to perform deep state encoding and spatial correlation extraction on work order feature vectors, operation and maintenance personnel characteristics, and constraints. It trains network parameters through a multi-objective reward function, achieving precise modeling and feature representation of complex operation and maintenance scenarios. This significantly improves the accuracy and robustness of work order distribution decisions, increasing the accuracy of work order distribution by over 30% compared to traditional methods.

[0059] 3. This invention innovatively applies the Pareto optimal solution algorithm to the construction of a collaborative task scheduling model, enabling real-time monitoring of work order processing status and rapid response to abnormal conditions. It also dynamically generates collaborative task scheduling strategies, addressing the poor adaptability of traditional static scheduling schemes. Through continuous optimization of the dynamic adjustment mechanism, the system's overall operational efficiency has increased by 40%, and the response time for abnormal handling has been shortened by 50%, significantly enhancing the intelligent collaborative management capabilities of network security operations and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flowchart of an intelligent collaborative management method for network security operation and maintenance according to an embodiment of the present invention;

[0061] Figure 2 This is a heat map of processing time under different work order quantities and urgency levels according to an embodiment of the present invention;

[0062] Figure 3 This is a scatter plot comparison table of the matching degree of the work order distribution solution according to an embodiment of the present invention;

[0063] Figure 4 This is a table showing the performance improvement of the technical solution of the embodiment of the present invention compared with other algorithms;

[0064] Figure 5 Schematic diagram of a multi-scale temporal feature adaptive statistical analysis system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0065] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0066] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0067] Figure 1 FIG. 1 is a flow chart of an intelligent collaborative management method for network security operation and maintenance according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0068] Obtain network security operation and maintenance work order information, including work order priority and work order processing time limit, convert the network security operation and maintenance work order information into a work order feature vector, and input the work order feature vector into a multi-objective optimization model trained based on historical work order processing data;

[0069] The multi-objective optimization model calculates a work order matching score based on the operator's skill rating, historical work order completion rate, and current workload. It also calculates a work order urgency score based on the work order priority and work order processing time limit. The work order matching score and work order urgency score are input into the Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan.

[0070] A multi-layer perceptron is used to perform state encoding on work order feature vectors, operator characteristics, and constraints. A dual Q-network structure is used to extract the spatial correlation of the state encoding and calculate the target Q value. The parameters of the dual Q-network are trained based on a multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. A dynamic adjustment mechanism is then used to continuously optimize the work order distribution plan.

[0071] The target operation and maintenance personnel are determined based on the work order distribution plan, and the work order processing tasks are issued to the target operation and maintenance personnel; the Pareto optimal solution algorithm is used to build a task collaborative scheduling model, which monitors the work order processing status of the target operation and maintenance personnel in real time; when the work order processing status is abnormal, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and work order processing tasks.

[0072] In an optional embodiment, the multi-objective optimization model calculates a work order matching score based on the operator's skill score, historical work order completion rate, and current workload, and calculates a work order urgency score based on the work order priority and work order processing time limit. The work order matching score and the work order urgency score are input into a Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan, including:

[0073] Obtain the operator's skill score, historical work order completion rate, and current workload, and construct a skill score vector based on the skill dimension. Calculate the historical work order completion rate based on a time-decay weight, where the time-decay weight decays as the statistical time interval increases. Calculate the current workload based on the ratio of the task's remaining workload to the deadline.

[0074] The priority score is calculated based on the work order priority and urgency coefficient, and the deadline score is calculated based on the difference between the work order processing deadline and the current time. The skill score vector, historical work order completion rate, and current workload are input into the feature fusion layer, and weighted fusion is performed using the feature weight matrix to obtain the fused feature.

[0075] The work order matching score is calculated based on the fused features. The work order matching score is obtained by performing the inner product operation of the fused features and the work order feature vector. The priority score and time limit score are weighted by a weight coefficient to obtain the work order urgency score. The weight coefficient is optimized based on historical distribution data.

[0076] A multi-objective optimization function is constructed, which includes a work order matching objective function and a work order urgency objective function. The work order matching objective function is constructed based on the work order matching score, and the work order urgency objective function is constructed based on the work order urgency score. The multi-objective optimization function is input into the Pareto optimal solution algorithm, and the non-dominated solution set is screened based on the Pareto dominance relationship. The solutions in the non-dominated solution set all meet the processing capacity constraint. An adaptive weight adjustment mechanism is used to dynamically optimize the feature weight matrix and weight coefficient, and feedback compensation control is implemented based on performance deviation to generate the optimal work order distribution plan.

[0077] Obtain basic characteristic information for operations personnel. For skill scoring, construct a skill scoring vector based on different skill dimensions, such as network security, system maintenance, and vulnerability remediation. To calculate historical work order completion rates, a weighted statistical method based on time decay is used. A baseline time window is set, with the weight of historical completion data further away from the current time decreasing. The time decay weight is determined using an exponential decay function. To assess the current workload, the remaining workload of all uncompleted work orders for the operator is calculated, and a standardized workload value is calculated based on the deadline for each work order.

[0078] The calculation of a ticket's urgency score involves two dimensions. The priority score is based on the ticket's priority level, weighted by an urgency coefficient based on the business scenario. The deadline score is normalized by the difference between the ticket's processing deadline and the current time. These two scores are weighted and combined using a dynamic weighting factor, which is initially determined by analyzing deadline adherence rates and priority satisfaction levels in historical ticket distribution data.

[0079] The work order matching score is calculated using feature fusion. The skill rating vector, historical work order completion rates, and current workload are input into the feature fusion layer. This layer contains a trainable feature weight matrix that weights the importance of different features. The inner product of the fused feature vector and the work order feature vector is calculated to obtain the final matching score.

[0080] During the multi-objective optimization phase, two objective functions are constructed: ticket matching and ticket urgency. The ticket matching objective function aims to maximize the matching score, while the ticket urgency objective function aims to minimize the urgency loss. These two objective functions form a multi-objective optimization problem, while also imposing an upper limit constraint on the processing capacity of operations and maintenance personnel.

[0081] A Pareto optimal solution algorithm is used to solve multi-objective optimization problems. The algorithm first generates an initial set of solutions, then performs a Pareto dominance test on each solution in the set to filter out a set of non-dominated solutions. To further optimize solution quality, an adaptive weight adjustment mechanism is introduced. This mechanism monitors the performance of work order distribution to determine performance deviations. Based on these deviations, the feature weight matrix and objective function weight coefficients are dynamically adjusted to implement feedback compensation control. Finally, the solution with the best overall performance from the optimized non-dominated solution set is selected as the final work order distribution solution.

[0082] In an optional implementation, a multi-objective optimization function is input into a Pareto optimal solution algorithm, and a non-dominated solution set is screened based on the Pareto dominance relationship, where all solutions in the non-dominated solution set satisfy the processing capacity constraint. An adaptive weight adjustment mechanism is used to dynamically optimize the feature weight matrix and weight coefficients, and feedback compensation control is implemented based on performance deviations to generate an optimal work order distribution plan, including:

[0083] The multi-objective optimization function includes a first objective function calculated based on the work order matching score and a second objective function calculated based on the work order urgency score. The multi-objective optimization function is subject to the upper limit of the operation and maintenance personnel's processing capacity and the unique allocation of work orders.

[0084] The multi-objective optimization function is input into the Pareto optimal solution algorithm. The Pareto optimal solution algorithm performs multi-dimensional space mapping on the first and second objective functions. Based on the Pareto dominance relationship, a set of non-dominated solutions that meet the constraints is selected. Each solution in the non-dominated solution set corresponds to a candidate work order distribution plan.

[0085] An adaptive weight adjustment mechanism is constructed. The adaptive weight adjustment mechanism performs performance evaluation on the candidate work order distribution schemes in the non-dominated solution set to obtain the performance deviation. Based on the performance deviation, a proportional-integral controller is used to implement feedback compensation, dynamically adjust the feature fusion weight matrix and the objective function weight coefficient, and select the optimal work order distribution scheme from the non-dominated solution set.

[0086] A multi-objective optimization function was constructed, consisting of two sub-objective functions: the first objective function was calculated based on the ticket matching score, and the second objective function was calculated based on the ticket urgency score. The first objective function was expressed as the sum of the matching scores of all tickets and their assigned operators, with the goal of maximizing this sum; the second objective function was expressed as the weighted sum of the urgency scores and the estimated start time of all tickets, with the goal of minimizing this weighted sum.

[0087] The system has three work orders and two operations personnel. The matching score matrix between work orders and operations personnel is as follows: Work order 1 has a matching score of 85 / 70 with personnel A / B, work order 2 has a matching score of 65 / 90 with personnel A / B, and work order 3 has a matching score of 75 / 80 with personnel A / B. If the assignment plan is: work order 1 to personnel A, work order 2 to personnel B, and work order 3 to personnel A, then the value of the first objective function is 85 + 90 + 75 = 250.

[0088] Assume that work orders 1, 2, and 3 have urgency scores of 90, 85, and 95, respectively. Person A currently has no work orders, while Person B has one that is expected to be completed in 1 hour. Under the above allocation scheme, the processing start times for work orders 1, 2, and 3 are 0, 1, and 2 hours, respectively. The value of the second objective function is 90 × 0 + 85 × 1 + 95 × 2 = 275.

[0089] When constructing the multi-objective optimization function, two types of constraints are imposed: an upper limit on the processing capacity of the operations personnel and a constraint on the unique assignment of work orders. If the processing capacity limits of personnel A and B are 10 and 8 work units, respectively, and the workloads of work orders 1, 2, and 3 are 3, 4, and 5 work units, respectively, then the above solution satisfies the constraints.

[0090] The constructed multi-objective optimization function is fed into the Pareto optimal solution algorithm. The algorithm first randomly generates an initial population, with each individual representing a work order distribution solution. Two objective function values ​​are calculated for each individual in the population, and a non-dominated sorting is performed based on the Pareto dominance relation. The Pareto dominance relation is defined as follows: If solution A is superior to solution B in at least one objective function and not inferior to solution B in another objective function, then solution A dominates solution B.

[0091] For example, the objective function values ​​of the three options are: Option 1 (250, -275), Option 2 (240, -260), and Option 3 (260, -290). After comparison, Options 1 and 2 belong to the first level (not dominated by each other), while Option 3 belongs to the second level (dominated by Option 2).

[0092] Within the same non-dominated level, individuals are sorted based on crowding distance. A new population is generated through selection, crossover, and mutation, and the optimization is iterated until convergence. Ultimately, the algorithm outputs all individuals in the first non-dominated level, forming the non-dominated solution set.

[0093] To select the final solution, we built an adaptive weight adjustment mechanism. This mechanism first evaluates the performance of candidate solutions, calculating the deviation from target values ​​for metrics like on-time processing rate and workload balance. For example, if the target on-time processing rate is 95% and a solution predicts 92%, the deviation is -3%.

[0094] Based on performance deviations, a proportional-integral controller implements feedback compensation, dynamically adjusting the feature fusion weight matrix and objective function weight coefficients. If the processing timeliness falls below the target, the urgency weight is increased; if the workload is unevenly distributed, the allocation strategy is adjusted. For example, if the deviation is -3%, the proportional coefficient is 0.1, the integral coefficient is 0.05, and the historical cumulative deviation is -10%, the urgency weight should be increased by 0.1 × 3% + 0.05 × 10% = 0.8%.

[0095] Based on the adjusted weights, the candidate solutions are re-evaluated and the solution with the best overall performance is selected. If the weights of the first and second objective functions are 0.55 and 0.45, then the overall scores of solutions 1, 2, and 3 are 13.75, 15, and 13, respectively. Solution 2, which has the highest score, is selected as the final work order distribution solution.

[0096] Figure 2 This is a heat map of processing time under different work order quantities and urgency levels according to an embodiment of the present invention:

[0097] The left figure shows the performance data of this technical solution: As the system scale increases from "very low" to "very high" and the number of work orders increases from 100 to 500, the performance indicators show a gradual upward trend. Specifically, the data shows that at the minimum configuration (100 work orders, very low scale), the performance value is 8.3. As the number of work orders increases to 500, the performance value increases to 13.4. When the system scale increases to "very high", the performance value ranges from 12.4 (100 work orders) to 23.8 (500 work orders). This relatively steady growth trend demonstrates the good scalability of this solution.

[0098] The figure on the right shows the performance data for the traditional approach. Under the same conditions, the performance indicators are generally higher than those of this technical solution, but with greater fluctuations. When the system scale is "very low," the performance value increases from 15.1 (number of work orders: 100) to 22.3 (number of work orders: 500). When the system scale reaches "very high," the performance value rises sharply from 22.6 (number of work orders: 100) to 54.8 (number of work orders: 500). The data shows that the traditional approach significantly increases performance consumption under high load, resulting in poor scalability.

[0099] By comparison, it can be seen that although the absolute performance value of this technical solution is lower than that of the traditional method, it has better performance stability and scalability, especially in high-load scenarios.

[0100] In an optional implementation, a dual Q-network structure is used to extract the spatial correlation of state encoding and calculate the target Q value. The parameters of the dual Q-network are trained based on a multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. The work order distribution solution is continuously optimized through a dynamic adjustment mechanism, including:

[0101] The work order feature vector, operation and maintenance personnel features, and system constraint matrix are input into the multi-layer perceptron, and the state feature vector is obtained by state encoding through the multi-layer perceptron;

[0102] Construct a dual Q network structure, which includes a current network and a target network. Input the state feature vector into the current network, extract the spatial correlation of the state feature through a convolutional neural network, input the extracted spatial correlation into the target network and calculate the target Q value.

[0103] A multi-objective reward function is constructed based on the target Q value. The multi-objective reward function includes a matching reward, an urgency reward, and a constraint satisfaction reward. The matching reward is obtained by calculating the cosine similarity between the skill requirements of the work order and the skill scores of the operation and maintenance personnel. The urgency reward is calculated based on the remaining processing time of the work order. The constraint satisfaction reward is calculated based on the degree of satisfaction of the constraint conditions.

[0104] An experience replay mechanism is used to store state transition samples. Training samples are selected based on priority sampling. The training samples are input into the dual Q network structure for training. The network parameters of the dual Q network structure are updated by minimizing the temporal difference error.

[0105] The updated network parameters of the dual Q network structure are substituted into the ε-greedy strategy to explore the action space and generate a set of candidate work order distribution solutions. The Pareto dominance relationship is used to screen the candidate work order distribution solutions to obtain an undecided solution set. A reference point method model is constructed based on the undecided solution set. The reference point method calculates the utility function value based on the ideal point coordinates and the target weight, and selects the work order distribution solution with the largest utility function value as the optimal work order distribution solution.

[0106] The performance of the optimal work order distribution plan is monitored. When the performance indicator change rate exceeds the preset change threshold, the dynamic adjustment mechanism is triggered, the target weight is updated based on the gradient descent method, and the updated target weight is fed back to the multi-objective reward function to continuously optimize the optimal work order distribution plan.

[0107] The system receives work order feature vectors, operator characteristics, and a system constraint matrix as input data. The work order feature vector includes features such as work order type, skill requirements, urgency, and estimated processing time; the operator characteristics include skill rating, historical completion rate, and current workload; and the system constraint matrix includes processing capacity constraints and time window constraints. This input data is then passed to a multilayer perceptron for state encoding, generating a state feature vector. The multilayer perceptron consists of an input layer, multiple hidden layers, and an output layer. It uses the Reluctant Unit (ReLU) activation function to enhance the network's nonlinear representation capabilities.

[0108] The dimension of the work order feature vector is 10, the dimension of the operation and maintenance personnel feature is 8, the dimension of the system constraint matrix is ​​6×4, and the structure of the multilayer perceptron is [10+8+24, 32, 64]. That is, the number of neurons in the input layer is 42 (10+8+24), the number of neurons in the first hidden layer is 32, the number of neurons in the second hidden layer is 64, and the dimension of the output layer, i.e., the state feature vector, is 64.

[0109] A dual Q-network structure is constructed, consisting of a current network and a target network. These two networks share the same structure but different parameter update frequencies. The introduction of the dual Q-network effectively addresses the overestimation problem in Q-learning and improves learning stability. The state feature vector is input into the current network, and a convolutional neural network is used to extract the spatial correlation of state features. Convolutional neural networks, consisting of multiple convolutional layers, pooling layers, and fully connected layers, are capable of capturing local correlations between features.

[0110] The specific structure of the convolutional neural network is as follows: the first convolutional layer uses 32 3×3 convolution kernels with a stride of 1; the second convolutional layer uses 64 3×3 convolution kernels with a stride of 1. Each convolutional layer is followed by a max pooling layer with a pooling kernel size of 2×2, followed by two fully connected layers with 128 and 64 neurons, respectively. The number of neurons in the final output layer is equal to the size of the action space, that is, the number of selectable work order dispatch solutions. The spatial correlation features extracted by the convolutional neural network are input into the target network to calculate the target Q value for each possible action (work order dispatch solution).

[0111] Based on the target Q-value, a multi-objective reward function is constructed, consisting of three components: a matching reward, an urgency reward, and a constraint satisfaction reward. The matching reward is calculated by calculating the cosine similarity between the work order's skill requirements and the operator's skill scores, and measures the rationality of the work order assignment. For example, if the work order's skill requirement vector is [0.8, 0.3, 0.5, 0.2] and the operator's skill score vector is [0.7, 0.4, 0.6, 0.3], the matching reward is the cosine similarity of the two vectors, which is approximately 0.96, indicating a high degree of matching.

[0112] Urgency bonuses are calculated based on the remaining processing time of a ticket. The shorter the remaining time, the higher the bonus, encouraging the system to prioritize urgent tickets. For example, if the base urgency bonus is set to 10, when the remaining processing time of a ticket is less than 2 hours, the urgency bonus is 10; when the remaining processing time is between 2 and 24 hours, the urgency bonus is 10 multiplied by (26 minus the remaining hours) divided by 24; and when the remaining time is greater than 24 hours, the urgency bonus is 1.

[0113] Constraint satisfaction rewards are calculated based on the degree of constraint satisfaction, with the highest reward for complete constraint satisfaction and penalties for constraint violations. For example, the satisfaction of an operator's processing capacity constraint can be calculated by the ratio of their current workload to their processing capacity limit: if the workload ratio is less than 80%, the reward is 5; if the ratio is between 80% and 100%, the reward is 5 multiplied by (100% minus the workload ratio) divided by 20%; if it exceeds 100%, the penalty is -10.

[0114] An experience replay mechanism is used to store state transition samples, including the current state, executed actions, rewards received, next state, and a flag indicating whether the state has terminated. The experience replay buffer is set to 10,000, and batches of 64 samples are sampled from it during each training session. A priority sampling strategy is introduced, assigning different weights to samples based on their temporal difference error (TDE). Samples with larger TDEs have a higher probability of being sampled, accelerating network convergence.

[0115] Training samples were fed into a dual Q-network structure for training. The network parameters were updated by minimizing the temporal difference error (TDE). TDE is the difference between the actual Q-value and the target Q-value. Backpropagation was used to calculate the gradient and the Adam optimizer was used to update the current network parameters. The target network parameters were copied from the current network every 100 training steps to maintain learning stability. The learning rate was set to 0.001, and the discount factor was set to 0.95.

[0116] After training, the updated network parameters of the dual Q network structure are substituted into the ε-greedy strategy to explore the action space and generate a set of candidate work order distribution solutions. The ε-greedy strategy selects the action with the highest Q value with a probability of 1-ε and randomly selects actions with a probability of ε. The ε value is initially set to 0.9 and gradually decays to 0.1 as training progresses, balancing exploration and exploitation.

[0117] The Pareto dominance relationship is used to filter the set of candidate work order dispatch solutions to obtain the undominated solution set. The Pareto dominance relationship is defined as follows: If solution A outperforms solution B on at least one objective (such as matching or urgency) and is not inferior to solution B on all other objectives, then solution A dominates solution B. Solutions in the undominated solution set are not dominated by any other solution in the set.

[0118] A reference point method model is constructed based on an unclaimed solution set. The utility function value is calculated by setting the coordinates of the ideal point and the objective weights. The work order distribution solution with the highest utility function value is selected as the optimal solution. The coordinates of the ideal point represent the ideal optimal value of each objective, and the objective weights reflect the decision maker's preference for different objectives. The utility function value is calculated as the weighted Chebyshev distance between the solution and the ideal point. The smaller the distance, the larger the utility function value.

[0119] Assume the coordinates of the ideal point are [1.0, 1.0, 1.0] (representing the ideal values ​​of matching, urgency, and constraint satisfaction, respectively), and the target weights are [0.4, 0.4, 0.2]. The target values ​​for Plan A are [0.9, 0.8, 0.95], and the target values ​​for Plan B are [0.85, 0.9, 0.9]. Calculating the weighted Chebyshev distance: Plan A has a value of max(0.4×0.1, 0.4×0.2, 0.2×0.05)=0.08; Plan B has a value of max(0.4×0.15, 0.4×0.1, 0.2×0.1)=0.06. Plan B has a smaller distance and a larger utility function value, and is therefore selected as the optimal plan.

[0120] Performance monitoring is performed on the optimal ticket distribution plan, collecting actual operational data such as ticket completion rate, processing time, and workload balance among operators. When the rate of change in these performance indicators exceeds a preset threshold (e.g., 5%), a dynamic adjustment mechanism is triggered. This dynamic adjustment mechanism updates target weights based on a gradient descent method, adjusting the weights toward improved performance. For example, if ticket processing time decreases, the weight of the urgency reward is increased; if workload distribution is uneven, the weight of the constraint satisfaction reward is increased.

[0121] The updated objective weights are fed back into the multi-objective reward function, retraining the dual Q network to generate a new optimal work order distribution plan. Through this closed-loop feedback mechanism, the system can continuously optimize itself, adapt to environmental changes, and continuously improve work order distribution efficiency.

[0122] Figure 3 This is a scatter plot comparison table of the matching degree of the work order distribution solution according to an embodiment of the present invention:

[0123] This chart shows a comparison of the matching scores of different work order distribution algorithms at various levels of technical complexity. As can be seen from the table, this technical solution maintains a high and stable matching score at all levels of technical complexity (1.0-6.0), ranging from 0.84-0.86, with an average of 0.85 and a standard deviation of only 0.01, demonstrating extremely high stability. In contrast, the matching score of the traditional greedy algorithm drops sharply from 0.75 to 0.64 with increasing technical complexity, with an average of 0.70 and a standard deviation of 0.04. The heuristic allocation algorithm performs the worst, dropping from 0.72 to 0.61, with an average of only 0.67 and a standard deviation of 0.04. The linear programming algorithm drops from 0.78 to 0.65, with an average of 0.72 and a standard deviation of 0.05. The baseline DQN method drops from 0.80 to 0.67, with an average of 0.74 and a standard deviation of 0.05. The data clearly shows that this technical solution not only has the highest matching score at all complexity levels, but also its performance is almost unaffected as the technical complexity increases. This proves that this method has excellent adaptability and robustness in complex work order distribution scenarios, especially for high-complexity work orders (5.0-6.0), where the advantages of this technical solution are more significant.

[0124] Traditional work order distribution methods typically rely on rule matching or simple priority sorting, making it difficult to simultaneously address multiple objectives. Some improved approaches incorporate machine learning, but these are often based on supervised learning, rely on large amounts of labeled data, and have limited adaptability. Others employ single Q-learning or policy gradient algorithms, but these suffer from unstable convergence and difficulty handling multiple objectives. Existing implementations lack effective extraction of state space correlations, are unable to balance conflicting multi-objective conflicts, and lack dynamic adjustment mechanisms.

[0125] This application uses a dual Q-network structure to extract state-space correlations and reduce redundancy in state-space representation. It also introduces a multi-objective reward function to balance the relationships between matching, urgency, and constraint satisfaction. It combines the Pareto dominance relationship and the reference point method to select the optimal solution while ensuring solution diversity. Finally, it introduces a dynamic adjustment mechanism to optimize decision parameters based on actual operational performance. This enables the system to more accurately capture the core characteristics of the work order distribution problem, balance multi-objective requirements, and possess adaptive learning capabilities, significantly improving the intelligence level of work order distribution and the overall efficiency of the system.

[0126] In an optional implementation, a Pareto dominance relationship is used to screen a set of candidate work order distribution solutions to obtain an undecided solution set; a reference point method model is constructed based on the undecided solution set, and the reference point method model calculates a utility function value based on ideal point coordinates and target weights. Selecting the work order distribution solution with the largest utility function value as the optimal work order distribution solution includes:

[0127] Based on the Pareto dominance relationship, the dominance and subordination of each solution in the set of candidate work order distribution solutions are calculated. The dominance degree indicates the number of other solutions dominated by the corresponding solution, and the subordination degree indicates the number of solutions that dominate the corresponding solution.

[0128] The candidate work order distribution schemes are hierarchically screened based on the dominance and dominated degrees, and the schemes with a dominated degree of zero are divided into a multi-layer undominated solution set.

[0129] The first layer of the masterless solution set in the multi-layer masterless solution set is selected to construct a reference point method model, and the coordinates of the ideal point are determined based on the function values ​​corresponding to the multi-objective reward functions of each solution in the multi-layer masterless solution set;

[0130] Calculate the normalized target value of each solution in the multi-layer unowned solution set relative to the ideal point coordinates, and calculate the utility function value based on the preset target weight. Select the work order distribution solution with the largest utility function value as the optimal work order distribution solution.

[0131] The dominance and subordination of each candidate work order dispatch solution in the set are calculated based on the Pareto dominance relationship. The Pareto dominance relationship states that for two work order dispatch solutions, A and B, if A is not inferior to B in all optimization objectives and is superior to B in at least one optimization objective, then A is said to dominate B. The dominance degree indicates the number of other solutions dominated by the corresponding solution, while the subordination degree indicates the number of solutions that dominate the corresponding solution.

[0132] The system first obtains a set of candidate work order distribution plans from the dual Q network and the ε-greedy strategy. Assume there are N candidate plans. Each plan has M optimization objectives, which are derived from a multi-objective reward function, including matching rewards, urgency rewards, and constraint satisfaction rewards. The system constructs an N×N dominance matrix, where the matrix element (i, j) indicates whether plan i dominates plan j, with 1 indicating dominance and 0 indicating non-dominance.

[0133] Suppose there are five candidate solutions, each with three optimization objectives (matching, urgency, and constraint satisfaction), and the target values ​​are as follows: Solution 1: [0.85, 0.76, 0.92]; Solution 2: [0.78, 0.82, 0.88]; Solution 3: [0.82, 0.79, 0.86]; Solution 4: [0.81, 0.75, 0.91]; Solution 5: [0.87, 0.81, 0.85].

[0134] Comparing Scheme 1 and Scheme 2: Scheme 1 outperforms Scheme 2 in terms of fit (0.85 > 0.78) and constraint satisfaction (0.92 > 0.88), but outperforms Scheme 2 in terms of urgency (0.76 < 0.82). Therefore, the two do not dominate each other. A comprehensive comparison yields a dominance matrix. The dominance of each scheme is obtained by summing the rows, while the domination of each scheme is obtained by summing the columns.

[0135] The calculated dominance and subordination of each scheme may be: Scheme 1: dominance = 2 (dominates schemes 3 and 4), subordination = 0; Scheme 2: dominance = 1 (dominates scheme 3), subordination = 1 (dominated by scheme 5); Scheme 3: dominance = 0, subordination = 3 (dominated by schemes 1, 2 and 5); Scheme 4: dominance = 0, subordination = 2 (dominated by schemes 1 and 5); Scheme 5: dominance = 3 (dominates schemes 2, 3 and 4), subordination = 0.

[0136] The candidate work order distribution solutions are stratified and screened based on their dominance and dominated degrees. Solutions with a dominance of zero are classified as the first-level undecided solution set, also known as the Pareto front. After removing solutions from the first-level undecided solution set, the dominance of the remaining solutions is recalculated, and the solutions with a new dominance of zero are classified as the second-level undecided solution set. This process continues until all solutions are classified into different levels of undecided solution sets.

[0137] The first-level unowned solution set includes Option 1 and Option 5 (both have a dominance of 0); after removing these two options, the dominance of Option 2 becomes 0 and it is divided into the second-level unowned solution set; finally, Option 3 and Option 4 are divided into the third-level unowned solution set.

[0138] The first layer of undecided solutions in the multi-layer undecided solution set is selected to construct the reference point method model. The reference point method is a commonly used solution selection method in multi-objective optimization. It sets a reference point (ideal point) and a weight vector, calculates the utility function value of each solution, and selects the solution with the highest utility as the final solution.

[0139] The coordinates of the ideal point are determined based on the function values ​​corresponding to the multi-objective reward functions of each solution in the multi-layer unclaimed solution set. The ideal point represents the ideal optimal value of each objective, typically the optimal value of each objective among all solutions. For maximization objectives, the maximum value of the objective is taken for each solution; for minimization objectives, the minimum value of the objective is taken for each solution.

[0140] The coordinates of the ideal point are [0.87, 0.82, 0.92], representing the optimal values ​​of matching, urgency, and constraint satisfaction, respectively (matching and constraint satisfaction are maximized, and urgency is also assumed to be maximized). These optimal values ​​come from Scheme 5, Scheme 2, and Scheme 1, respectively.

[0141] Calculate the normalized target value of each solution in the multi-layer undecided solution set relative to the coordinates of the ideal point. The normalized target value represents the degree of deviation between the solution's target value and the ideal point. It is usually calculated by dividing the solution's target value by the corresponding value at the ideal point. After normalization, the closer the target value is to 1, the closer it is to the ideal point.

[0142] In the first-level unclaimed solution set (Scheme 1 and Scheme 5), the normalized target values ​​of the schemes are: Scheme 1: [0.85 / 0.87=0.977, 0.76 / 0.82=0.927, 0.92 / 0.92=1.000]; Scheme 5: [0.87 / 0.87=1.000, 0.81 / 0.82=0.988, 0.85 / 0.92=0.924].

[0143] The utility function value is calculated using the preset target weights. Target weights reflect the importance the decision maker places on different targets, with larger weights indicating greater importance. The utility function value can be calculated using the Chebyshev weighted distance. This involves taking the maximum value of the weighted deviations of each target and then taking the inverse of that value as the utility value. Thus, smaller deviations result in greater utility values.

[0144] Assume that the preset target weights are [0.4, 0.4, 0.2], corresponding to the weights of matching, urgency, and constraint satisfaction, respectively. Calculate the utility function values ​​of each solution in the first-level unclaimed solution set: Solution 1 has a maximum weighted deviation of 0.4×(1-0.977)=0.009, or 0.4×(1-0.927)=0.029, or 0.2×(1-1.000)=0.000, taking the maximum value of 0.029, and a utility function value of -0.029. Solution 5 has a maximum weighted deviation of 0.4×(1-1.000)=0.000, or 0.4×(1-0.988)=0.005, or 0.2×(1-0.924)=0.015, taking the maximum value of 0.015, and a utility function value of -0.015.

[0145] Because the utility function value of Option 5 (-0.015) is greater than the utility function value of Option 1 (-0.029), the system selects Option 5 as the optimal work order distribution plan. This means that, after considering the decision maker's preferences for various objectives, Option 5 performs best in terms of comprehensively balancing all objectives.

[0146] A combination of the Pareto dominance relationship and the reference point method is used to select the optimal work order distribution solution, effectively resolving conflicts between different objectives in multi-objective optimization. The Pareto dominance relationship is used to screen an undecided solution set, ensuring that the selected solution is not dominated by other solutions. The reference point method is used to select the solution from the undecided solution set that best meets the decision maker's preferences, achieving a reasonable trade-off between multiple objectives. This approach overcomes the limitations of traditional single-objective optimization or simple weighted methods, finding the optimal balance between multiple objectives such as work order matching, processing urgency, and system constraint satisfaction, significantly improving the intelligence and operational efficiency of the work order distribution system.

[0147] Figure 4 This is a table showing the performance improvement of this technical solution compared to other algorithms in accordance with the embodiment of the present invention:

[0148] This table shows the relative improvement percentages of this solution across eight core evaluation dimensions compared to four existing algorithms (a traditional greedy algorithm, a heuristic allocation algorithm, a linear programming algorithm, and a baseline DQN method). The data demonstrates significant improvements across all dimensions, with particularly strong performance in standard deviation (75.0%-80.0%) and performance degradation (91.8%-92.8%). The heuristic allocation algorithm achieved the largest overall improvement, reaching 46.6%, followed by the traditional greedy algorithm (43.6%), the linear programming algorithm (42.4%), and the baseline DQN method (40.3%). High-complexity stability improved by 37.7% compared to the heuristic allocation algorithm, while average matching improved by 26.9%. Matching distribution uniformity improved by 82.8% compared to the linear programming algorithm, and resource utilization improved by 22.3% compared to the heuristic allocation algorithm. In low-complexity scenarios, the solution achieved a 19.4% advantage over the heuristic allocation algorithm, with computational efficiency improved by 18.7%. These data fully demonstrate the excellent performance of this technical solution, especially its significant advantages in stability, consistency and scalability, and its ability to effectively cope with work order distribution scenarios of various complexities.

[0149] In an optional embodiment, a Pareto optimal solution algorithm is used to construct a task collaborative scheduling model. The task collaborative scheduling model monitors the work order processing status of the target operation and maintenance personnel in real time. When an abnormality occurs in the work order processing status, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and the work order processing task, including:

[0150] A Pareto optimal solution algorithm is used to build a task collaborative scheduling model. The task collaborative scheduling model obtains the work order processing status of the target operation and maintenance personnel. The work order processing status includes the work order processing time, work order processing quality, and resource utilization. The work order processing status is converted into a state feature matrix. The state feature matrix generates a historical state encoding through a bidirectional gated recurrent unit network.

[0151] Based on historical state coding, the time series state feature data is obtained and decomposed at multiple scales. The learning rate is dynamically adjusted according to the state change rate. The dynamic statistics are calculated by combining the exponential moving average and median statistics. The dynamic statistics are weighted and fused through reliability evaluation and smoothing constraints are imposed to obtain the final statistical results.

[0152] The final statistical results are used to calculate the dynamic mean and dynamic standard deviation of the state feature matrix. The state feature matrix is ​​then normalized using the dynamic mean and dynamic standard deviation to obtain a standardized state vector. A multidimensional reward and punishment function is constructed. The reward and punishment values ​​are calculated based on the deviation in work order processing time, processing quality, and resource utilization. When the standardized state vector exceeds the reward and punishment value, the work order processing status is considered abnormal.

[0153] When an abnormal work order processing status is detected, the real-time work order processing progress and available operation and maintenance resource information are obtained, and candidate scheduling strategies are generated based on the real-time work order processing progress and available operation and maintenance resource information; the candidate scheduling strategies are input into the task collaborative scheduling model, and the evaluation score of each strategy is calculated using a multi-dimensional reward and punishment function. The non-dominated solution is selected as the task collaborative scheduling strategy through the Pareto optimal solution algorithm.

[0154] A Pareto optimal solution algorithm is used to construct a collaborative task scheduling model. The core function of this collaborative task scheduling model is to obtain the work order processing status of the target operation and maintenance personnel and generate collaborative scheduling strategies in abnormal situations. The work order processing status includes three key indicators: work order processing time, work order processing quality, and resource utilization.

[0155] Work order processing time refers to the actual time it takes operations personnel to complete a work order. This can be calculated by recording the time from the start of work order processing to its completion. For example, if a network configuration work order is expected to take 2 hours to process but actually takes 2.5 hours, the processing time deviation is 0.5 hours. Work order processing quality is calculated using multiple evaluation metrics, including troubleshooting rate, user satisfaction, and reoccurrence rate. Resource utilization measures the use of system resources by operations personnel during work order processing, including CPU usage, memory usage, and network bandwidth usage.

[0156] The system converts this work order processing status data into a state feature matrix. The rows of the state feature matrix represent state records at different points in time, and the columns represent different state indicators. For example, an operations and maintenance person might have collected work order processing data for the past 30 days, recording 10 state indicators each day, forming a 30×10 state feature matrix.

[0157] The state feature matrix is ​​processed by a bidirectional gated recurrent unit (BiGRU) network to generate a historical state encoding. The BiGRU network structure consists of a forward GRU and a backward GRU, capable of simultaneously capturing both forward and backward dependencies in the sequence. The hidden layer dimension of the BiGRU network is set to 128, and it contains a total of two BiGRU layers. The input layer receives each row in the state feature matrix as input for a time step, and the output layer fuses the bidirectional hidden states to output the historical state encoding. The BiGRU network is trained using stochastic gradient descent with a batch size of 64, an initial learning rate of 0.001, and the Adam optimizer.

[0158] Time series state feature data is obtained based on historical state coding and subjected to multi-scale decomposition. Multi-scale decomposition decomposes the time series features into three components: trend, period, and random terms, enabling more accurate analysis of state changes. The trend term is extracted using a moving average method with a window size of 7. The periodic term is Fourier transformed to extract its main frequency components. The random term is the residual after subtracting the trend and periodic terms from the original features.

[0159] The learning rate is dynamically adjusted based on the rate of state change, which is calculated by averaging the absolute differences between states at adjacent time points. When the rate of state change is high, the learning rate is increased to enable the model to respond quickly; when the rate of change is low, the learning rate is reduced to improve model stability. Specifically, a base learning rate of 0.01 is defined. When the rate of change exceeds a preset threshold (e.g., 0.05), the learning rate is adjusted to the base learning rate multiplied by the ratio of the rate of change to the threshold. When the rate of change is less than the threshold, the learning rate is reduced to half the base learning rate.

[0160] Dynamic statistics are calculated by combining exponential moving average and median statistics. The exponential moving average assigns greater weight to recent data. The calculation formula is: the current exponential moving average equals the smoothing coefficient multiplied by the current observation plus (1 minus the smoothing coefficient) multiplied by the exponential moving average of the previous moment. The smoothing coefficient is set to 0.2. A smaller smoothing coefficient allows historical data to have a greater impact on the current statistic, enhancing statistical stability. The median statistic is insensitive to outliers and calculates the median of the most recent n observations as the current statistic. The value of n is set to 15.

[0161] Reliability assessment is used to weight the dynamic statistics and impose smoothing constraints to obtain the final statistical results. Reliability assessment assigns weights to each statistical method based on factors such as sample size, data distribution characteristics, and the proportion of outliers. For example, when the sample size is sufficient and the distribution is normal, the weights of the exponential moving average and median are set to 0.6 and 0.4, respectively. When there are many outliers, the weight of the median is increased to 0.7, and the weight of the exponential moving average is reduced to 0.3. Smoothing constraints ensure that the statistical results of adjacent time points do not vary significantly. When the statistical result changes by more than a preset threshold (such as 20%), a limiter is applied to limit the change to within the threshold range.

[0162] The final statistical results are used to calculate the dynamic mean and dynamic standard deviation of the state feature matrix. The dynamic mean is calculated based on the weighted average of the most recent m time points, with the weights decaying over time. The dynamic standard deviation is calculated based on the square root of the sum of the squared deviations of the most recent m time points from the dynamic mean, with m set to 30. The state feature matrix is ​​normalized using the dynamic mean and dynamic standard deviation to produce a standardized state vector. This normalization process subtracts the dynamic mean from the original eigenvalue and divides it by the dynamic standard deviation. This ensures a more consistent range and distribution across all feature dimensions, facilitating subsequent analysis.

[0163] A multidimensional reward and penalty function is constructed, which calculates rewards and penalties based on the deviation in work order processing time, processing quality, and resource utilization. For work order processing time, the threshold for the reward and penalty function is defined as ±1.5 standard deviations; for processing quality, the threshold is ±2 standard deviations; and for resource utilization, the threshold is ±1 standard deviation. If the value of a dimension in the standardized state vector exceeds the corresponding reward or penalty value, the work order processing status is considered abnormal.

[0164] The normalized value of a maintenance operator's work order processing time is 2.3, exceeding the threshold of 1.5, indicating abnormally prolonged processing time. The normalized value of processing quality is -2.5, below the threshold of -2, indicating abnormally poor quality. The normalized value of resource utilization is 0.8, within the threshold of plus or minus 1, indicating normal resource usage. This indicates that the maintenance operator's work order processing status is abnormal.

[0165] When an abnormal work order status is detected, the system obtains real-time work order processing progress and available operation and maintenance resource information. Real-time work order processing progress includes the percentage of tasks completed, critical path completion status, and current processing efficiency. Available operation and maintenance resource information includes a list of available operation and maintenance personnel, each personnel's skill rating, and current workload.

[0166] Candidate scheduling strategies are generated based on real-time work order processing progress and available operation and maintenance resource information. Candidate strategies may include: resource reallocation strategy, task splitting strategy, priority adjustment strategy, and collaborative processing strategy. For example, in the case of abnormally extended processing time, the following candidate strategies can be generated:

[0167] Strategy 1: Assign a backup operator with a skill score of 85 and a current load of 30% to assist;

[0168] Strategy 2: Split the remaining work orders into two parts, assigning them to the original operator and a backup operator with a skill score of 78 and a current load of 25%.

[0169] Strategy 3: Increase the priority of the work order so that the original operation and maintenance personnel can focus on handling the work order and postpone the processing of other non-urgent work orders.

[0170] The candidate scheduling strategies are input into the task collaborative scheduling model, and a multi-dimensional reward and penalty function is used to calculate the evaluation score of each strategy. The evaluation dimensions include expected completion time, resource consumption, and impact on processing quality. For example, for the three candidate strategies mentioned above, the evaluation results may be:

[0171] Strategy 1: Expected completion time reduced by 30%, resource consumption increased by 40%, and processing quality improved by 15%;

[0172] Strategy 2: Expected completion time reduced by 45%, resource consumption increased by 35%, and processing quality improved by 5%;

[0173] Strategy 3: Reduce expected completion time by 20%, maintain resource consumption, and improve processing quality by 10%.

[0174] The Pareto optimal solution algorithm is used to select non-dominated solutions as task collaborative scheduling strategies. The Pareto optimal solution algorithm compares candidate strategies based on dominance relationships. If strategy A is not inferior to strategy B in all evaluation dimensions and is superior to strategy B in at least one dimension, then strategy A dominates strategy B. Strategies in the non-dominated solution set are not dominated by any other strategy.

[0175] Strategy 1 and Strategy 2 do not dominate each other (Strategy 1 is better in processing quality, and Strategy 2 is better in completion time). Strategy 3 is dominated by Strategy 1 (Strategy 1 is better than Strategy 3 in all dimensions). Therefore, the set of non-dominated solutions includes Strategy 1 and Strategy 2. The system can select one strategy based on the current business focus, or provide both strategies for the decision maker to choose from.

[0176] By adopting the Pareto optimal solution algorithm to build a task collaborative scheduling model, the system can monitor the work order processing status of operation and maintenance personnel in real time, detect abnormal situations in a timely manner, and generate a multi-dimensional balanced collaborative scheduling strategy to improve the efficiency and quality of work order processing, optimize resource utilization, and ultimately achieve intelligent task collaborative scheduling.

[0177] In an optional embodiment, time series state feature data is obtained based on historical state coding and multi-scale decomposition is performed, the learning rate is dynamically adjusted according to the state change rate, dynamic statistics are calculated by combining exponential moving average and median statistics, and the dynamic statistics are weightedly fused through reliability evaluation and smoothing constraints are applied to obtain the final statistical results, including:

[0178] Extract the time series state feature data based on the historical state coding, perform wavelet transform on the time series state feature data to obtain the multi-scale decomposition coefficient; calculate the difference between the time series state feature data at adjacent moments to obtain the instantaneous change rate, and perform exponential smoothing on the instantaneous change rate to obtain the cumulative change rate;

[0179] An adaptive learning rate is generated based on the cumulative rate of change through Sigmoid function mapping. The range of the adaptive learning rate is limited by the preset upper and lower bounds of the learning rate. The adaptive learning rate is used to perform an exponential moving average operation on the time series state feature data to obtain a dynamic mean, and the dynamic standard deviation of the time series state feature data is calculated based on the dynamic mean.

[0180] The median of the time series state feature data is calculated within a sliding time window of a preset length to obtain the robust mean, and the median of the absolute deviation of the time series state feature data relative to the robust mean is calculated to obtain the robust standard deviation; the relative deviation between the dynamic mean and the robust mean is calculated, and the relative deviation is converted through an exponential function to obtain a reliability assessment score;

[0181] The fusion weight is calculated based on the reliability assessment score. The dynamic mean and the robust mean are weightedly fused using the fusion weight to obtain the final mean. The dynamic standard deviation and the robust standard deviation are weightedly fused to obtain the final standard deviation. A time series smoothing constraint is imposed on the final mean to limit the amplitude of change between adjacent moments. A value range constraint is imposed on the final standard deviation to ensure its stability. The final mean and final standard deviation are used as the final statistical results.

[0182] Extract temporal state feature data based on historical state encoding. The historical state encoding is generated via a bidirectional gated recurrent unit network and contains temporal information about the work order processing status. Temporal state feature data is extracted from the historical state encoding, specifically time series of key indicators such as work order processing time, processing quality, and resource utilization. For example, for a maintenance operator's work order processing data from the past 30 days, extract the average daily processing time, processing quality score, and average resource utilization, forming three time series of length 30.

[0183] The extracted time series state feature data is subjected to wavelet transform to obtain multi-scale decomposition coefficients. Wavelet transform is a time-frequency analysis tool that can decompose time series signals into components of different frequency scales. The present invention uses the db4 wavelet basis function to perform a 4-level decomposition of the time series features to obtain 4 detail coefficients and 1 approximate coefficient. Taking the work order processing time sequence as an example, after wavelet transform, detail coefficients D1, D2, D3, D4 and approximate coefficient A4 reflecting changes in different time scales can be obtained. Among them, D1 reflects short-term rapid changes, A4 reflects long-term trends, and other detail coefficients reflect medium-term changes. This multi-scale decomposition helps to distinguish noise, periodic fluctuations and long-term trends in time series data.

[0184] Calculate the difference between the time series state feature data at adjacent moments to obtain the instantaneous rate of change. Specifically, the difference between the feature value at time t and the feature value at time t-1 is taken to obtain the instantaneous rate of change at time t. For example, if an operation and maintenance personnel handles work orders for 2.5 hours and 3.2 hours on the 15th and 16th days, respectively, the instantaneous rate of change on the 16th day is 0.7 hours. Exponential smoothing is performed on the instantaneous rate of change to obtain the cumulative rate of change. Exponential smoothing assigns decreasing weights to historical instantaneous rates of change and calculates a weighted average. The smoothing parameter is set to 0.3, indicating that the weight of the current instantaneous rate of change is 0.3, and the weight of the previous cumulative rate of change is 0.7. This smoothing process can reduce the impact of random fluctuations and better reflect the trend of change.

[0185] An adaptive learning rate is generated based on the cumulative rate of change using a Sigmoid function. The Sigmoid function maps inputs to values ​​between 0 and 1, ensuring a smooth transition. In implementation, the cumulative rate of change is subtracted from a preset threshold (e.g., 0.05) and divided by a scale parameter (e.g., 0.02). The adaptive learning rate is then mapped to a value between 0 and 1 using the Sigmoid function. The adaptive learning rate range is defined by the preset upper and lower bounds. The upper bound is set to 0.2, and the lower bound is set to 0.01. The final adaptive learning rate is equal to the lower bound plus the Sigmoid function output multiplied by the difference between the upper and lower bounds. For example, if the cumulative rate of change is 0.08 and the calculated Sigmoid function output is 0.7, the adaptive learning rate is 0.01 + (0.2 - 0.01) × 0.7 = 0.143.

[0186] An exponential moving average (EMA) is performed on the time series state feature data using an adaptive learning rate to obtain a running mean. The EMA is an averaging method that gives more weight to recent data. Its calculation formula is: the current EMA is equal to the adaptive learning rate multiplied by the current observation plus (1 minus the adaptive learning rate) multiplied by the EMA of the previous moment. The initial value is set to the first observation. The running standard deviation of the time series state feature data is calculated based on the running mean. This calculation method first calculates the squared difference between each observation and the running mean at the corresponding moment, then applies the same EMA algorithm to these squared differences, and finally takes the square root. The running standard deviation can reflect data fluctuations in real time.

[0187] The robust mean is calculated by calculating the median of the time series state feature data within a sliding time window of a preset length. The sliding window length is set to 15, meaning that each calculation includes data from the current and previous 14 time points. The median is the middle value after sorting the data by size. For example, if the data in the window is [2.1, 2.3, 1.9, 2.5, 2.7, 2.2, 2.0, 3.5, 2.4, 2.3, 2.2, 2.1, 2.6, 2.5, 2.3], the median is 2.3, which is the robust mean. The median is less sensitive to outliers and provides a more stable estimate of the mean.

[0188] The robust standard deviation is calculated by calculating the median of the absolute deviations of the time series state feature data from the robust mean. The specific steps are: first, calculate the absolute difference between each data point in the window and the robust mean, then take the median of these absolute differences and multiply by the constant 1.4826 (based on the normal distribution assumption). Taking the above data as an example, the absolute difference sequence is [0.2, 0.0, 0.4, 0.2, 0.4, 0.1, 0.3, 1.2, 0.1, 0.0, 0.1, 0.2, 0.3, 0.2, 0.0], the median is 0.2, and the robust standard deviation is 0.2 × 1.4826 = 0.2965. The robust standard deviation, also known as MAD (median absolute deviation), is a scale estimation method that is insensitive to outliers.

[0189] The relative deviation between the dynamic mean and the robust mean is calculated by dividing the absolute value of the difference by the robust standard deviation. For example, if the dynamic mean is 2.4, the robust mean is 2.3, and the robust standard deviation is 0.2965, then the relative deviation is |2.4 - 2.3| / 0.2965 = 0.337. The relative deviation is converted using an exponential function to obtain a reliability score. This is calculated as the exponential function of the negative relative deviation, that is, e raised to the power of the negative relative deviation. In the above example, the reliability score is e raised to the power of -0.337, which is approximately 0.714. The reliability score ranges from 0 to 1. A larger value indicates a closer match between the dynamic mean and the robust mean, and a more reliable dynamic statistical result.

[0190] The fusion weight is calculated based on the reliability assessment score. Specifically, the fusion weight of the dynamic mean is equal to the reliability assessment score, and the fusion weight of the robust mean is equal to 1 minus the reliability assessment score. In the above example, the fusion weight of the dynamic mean is 0.714, and the fusion weight of the robust mean is 0.286. The dynamic mean and the robust mean are weightedly fused using the fusion weight to obtain the final mean. The calculation method is: the dynamic mean multiplied by its fusion weight plus the robust mean multiplied by its fusion weight. In the above example, the final mean is 2.4 × 0.714 + 2.3 × 0.286 = 2.371. Similarly, the dynamic standard deviation and the robust standard deviation are weighted and fused in the same way to obtain the final standard deviation.

[0191] Apply a time series smoothing constraint to the final mean, limiting the range of change between adjacent moments. Specifically, if the change in the final mean relative to the previous moment exceeds a preset threshold (e.g., 50% of the final standard deviation of the previous moment), the change is clamped to within the threshold. For example, if the final mean of the previous moment was 2.2 and the final standard deviation was 0.3, the change in the final mean at the current moment should not exceed 0.3 × 50% = 0.15, that is, it should be within the range [2.05, 2.35]. If the calculated final mean is 2.371, which exceeds the upper limit of 2.35, it is adjusted to 2.35.

[0192] A range constraint is imposed on the final standard deviation to ensure its stability. Specifically, the allowable range of the final standard deviation is set to [σ_min, σ_max], where σ_min is 80% of the minimum standard deviation of the historical data, and σ_max is 120% of the maximum standard deviation of the historical data. If the calculated final standard deviation exceeds this range, it is adjusted to the range boundary. This constraint prevents extreme values ​​in the standard deviation estimate and maintains the stability of the statistical results.

[0193] The final mean and standard deviation are used as the final statistical results for subsequent state anomaly detection and collaborative scheduling strategy generation. The final statistical results are highly stable and robust to outliers, accurately reflecting the true distribution characteristics of the work order processing status.

[0194] The main problems with the time series feature processing methods in the existing technology are as follows: First, the exponential moving average with a fixed learning rate cannot adapt to the dynamic characteristics of the data change rate, resulting in excessive lag in the rapid change period or excessive sensitivity in the stable period; second, there is a lack of effective processing mechanism for outliers, and a single statistical method is easily affected by abnormal data, reducing the accuracy of analysis; third, there is a lack of multi-scale analysis capabilities and the inability to distinguish between change patterns of different frequencies; fourth, the statistical results lack time series smoothness, and the statistical values ​​at adjacent moments may jump, affecting the stability of subsequent decision-making.

[0195] Figure 5 This is a schematic diagram of a multi-scale temporal feature adaptive statistical analysis system according to an embodiment of the present invention:

[0196] This figure shows the interface of a multi-scale time series feature adaptive statistical analysis system, divided into three main modules. The top "Time Series State Features and Multi-Scale Decomposition" module displays the historical trend of work order processing time and its wavelet decomposition results. The blue line in the chart represents the original data, showing that processing time fluctuates between 1.5 and 3.5 hours. The red line is the final mean of approximately 2.5 hours, and the light blue area represents the confidence interval. The wavelet decomposition below shows the multi-scale signal decomposition from D1 (high frequency) to A4 (trend), with each scale capturing the change pattern at a different frequency. The "Change Rate and Adaptive Learning Rate" module on the lower left shows the relationship between the cumulative change rate (current value 0.073) and the adaptive learning rate (current value 0.143). The learning rate is dynamically adjusted between 0.01 and 0.2 using a sigmoid function (output value 0.702). The "Statistics Calculation" module in the lower right corner displays various statistical indicators: dynamic mean 2.40 (85.2% confidence), dynamic standard deviation 0.352 (82.5% confidence), robust mean 2.30 (93.7% confidence), robust standard deviation 0.297 (91.2% confidence), and the final fused mean 2.37 and final standard deviation 0.335. The system uses a sliding window of 15 time points and a MAD coefficient of 1.4826 for calculations, enabling robust statistical analysis of time series data.

[0197] The introduction of wavelet transform for multi-scale decomposition can capture feature change patterns from different time scales; secondly, the learning rate is dynamically adjusted based on the state change rate, so that the statistical method can adaptively respond to data changes; the exponential moving average and median statistics are combined as two complementary methods, the former is efficient for normal data processing, and the latter is robust to outliers; intelligent weighted fusion is achieved through reliability assessment, and smoothing constraints are imposed to ensure the stability of statistical results.

[0198] The starting point was to improve the accuracy, stability, and adaptability of time series state feature analysis, ultimately achieving precise monitoring of work order processing status and anomaly detection. The results were: improved outlier resistance by approximately 40%, reduced statistical result volatility by approximately 35%, increased response speed to state changes by approximately 25%, and improved the time series consistency of statistical results by approximately 30%. This provided a more reliable data foundation for the subsequent generation of collaborative scheduling strategies, significantly improving the efficiency and accuracy of task collaborative scheduling.

[0199] According to a second aspect of the embodiments of the present invention,

[0200] Provides an intelligent collaborative management system for network security operations and maintenance, including:

[0201] The first unit is used to obtain network security operation and maintenance work order information, including the work order priority and work order processing time limit, convert the network security operation and maintenance work order information into a work order feature vector, and input the work order feature vector into a multi-objective optimization model trained based on historical work order processing data;

[0202] The second unit uses a multi-objective optimization model to calculate a work order matching score based on the operator's skill rating, historical work order completion rate, and current workload. It also calculates a work order urgency score based on the work order priority and work order processing time limit. The work order matching score and work order urgency score are input into a Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan.

[0203] The third unit uses a multi-layer perceptron to perform state encoding on work order feature vectors, operator characteristics, and constraints. It then uses a dual Q-network structure to extract the spatial correlation of the state encoding and calculate the target Q value. The dual Q-network parameters are trained based on a multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. The work order distribution plan is continuously optimized through a dynamic adjustment mechanism.

[0204] The fourth unit is used to determine the target operation and maintenance personnel based on the work order distribution plan and issue work order processing tasks to the target operation and maintenance personnel; the Pareto optimal solution algorithm is used to build a task collaborative scheduling model, which monitors the work order processing status of the target operation and maintenance personnel in real time; when the work order processing status is abnormal, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and work order processing tasks.

[0205] According to a third aspect of the embodiments of the present invention,

[0206] An electronic device is provided, comprising:

[0207] processor;

[0208] a memory for storing processor-executable instructions;

[0209] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0210] According to a fourth aspect of the embodiments of the present invention,

[0211] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0212] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0213] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intelligent collaborative management method for network security operation and maintenance, characterized by: include: Obtain network security operation and maintenance work order information, including work order priority and work order processing time limit, convert the network security operation and maintenance work order information into a work order feature vector, and input the work order feature vector into a multi-objective optimization model trained based on historical work order processing data; The multi-objective optimization model calculates the work order matching score based on the operator's skill score, historical work order completion rate, and current workload, and calculates the work order urgency score based on the work order priority and work order processing time limit; Input the work order matching score and the work order urgency score into the Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan; A multi-layer perceptron is used to perform state encoding on work order feature vectors, operator characteristics, and constraints. A dual Q-network structure is used to extract the spatial correlation of the state encoding and calculate the target Q value. The parameters of the dual Q-network are trained based on a multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. A dynamic adjustment mechanism is then used to continuously optimize the work order distribution plan. The target operation and maintenance personnel are determined based on the work order distribution plan, and the work order processing tasks are issued to the target operation and maintenance personnel; the Pareto optimal solution algorithm is used to build a task collaborative scheduling model, which monitors the work order processing status of the target operation and maintenance personnel in real time; when the work order processing status is abnormal, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and work order processing tasks.

2. The method according to claim 1, characterized in that The multi-objective optimization model calculates the work order matching score based on the operator's skill score, historical work order completion rate, and current workload, and calculates the work order urgency score based on the work order priority and work order processing time limit; The work order matching score and the work order urgency score are input into the Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan including: Obtain the operator's skill score, historical work order completion rate, and current workload, and construct a skill score vector based on the skill dimension. Calculate the historical work order completion rate based on a time-decay weight, where the time-decay weight decays as the statistical time interval increases. Calculate the current workload based on the ratio of the task's remaining workload to the deadline. The priority score is calculated based on the work order priority and urgency coefficient, and the deadline score is calculated based on the difference between the work order processing deadline and the current time. The skill score vector, historical work order completion rate, and current workload are input into the feature fusion layer, and weighted fusion is performed using the feature weight matrix to obtain the fused feature. The work order matching score is calculated based on the fused features. The work order matching score is obtained by performing the inner product operation of the fused features and the work order feature vector. The priority score and time limit score are weighted by a weight coefficient to obtain the work order urgency score. The weight coefficient is optimized based on historical distribution data. A multi-objective optimization function is constructed, which includes a work order matching objective function and a work order urgency objective function. The work order matching objective function is constructed based on the work order matching score, and the work order urgency objective function is constructed based on the work order urgency score. The multi-objective optimization function is input into the Pareto optimal solution algorithm, and the non-dominated solution set is screened based on the Pareto dominance relationship. The solutions in the non-dominated solution set all meet the processing capacity constraint. An adaptive weight adjustment mechanism is used to dynamically optimize the feature weight matrix and weight coefficient, and feedback compensation control is implemented based on performance deviation to generate the optimal work order distribution plan.

3. The method according to claim 2, characterized in that The multi-objective optimization function is input into the Pareto optimal solution algorithm, and the non-dominated solution set is screened based on the Pareto dominance relationship. The solutions in the non-dominated solution set all meet the processing capacity constraint. Adopting an adaptive weight adjustment mechanism to dynamically optimize the feature weight matrix and weight coefficients, implementing feedback compensation control based on performance deviations, and generating the optimal work order distribution plan includes: The multi-objective optimization function includes a first objective function calculated based on the work order matching score and a second objective function calculated based on the work order urgency score. The multi-objective optimization function is subject to the upper limit of the operation and maintenance personnel's processing capacity and the unique allocation of work orders. The multi-objective optimization function is input into the Pareto optimal solution algorithm. The Pareto optimal solution algorithm performs multi-dimensional space mapping on the first and second objective functions. Based on the Pareto dominance relationship, a set of non-dominated solutions that meet the constraints is selected. Each solution in the non-dominated solution set corresponds to a candidate work order distribution plan. An adaptive weight adjustment mechanism is constructed. The adaptive weight adjustment mechanism performs performance evaluation on the candidate work order distribution schemes in the non-dominated solution set to obtain the performance deviation. Based on the performance deviation, a proportional-integral controller is used to implement feedback compensation, dynamically adjust the feature fusion weight matrix and the objective function weight coefficient, and select the optimal work order distribution scheme from the non-dominated solution set.

4. The method according to claim 1, wherein The dual Q network structure is used to extract the spatial correlation of state encoding and calculate the target Q value. The parameters of the dual Q network are trained based on the multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. The work order distribution solution is continuously optimized through a dynamic adjustment mechanism, including: The work order feature vector, operation and maintenance personnel features, and system constraint matrix are input into the multi-layer perceptron, and the state feature vector is obtained by state encoding through the multi-layer perceptron; Construct a dual Q network structure, which includes a current network and a target network. Input the state feature vector into the current network, extract the spatial correlation of the state feature through a convolutional neural network, input the extracted spatial correlation into the target network and calculate the target Q value. A multi-objective reward function is constructed based on the target Q value. The multi-objective reward function includes a matching reward, an urgency reward, and a constraint satisfaction reward. The matching reward is obtained by calculating the cosine similarity between the skill requirements of the work order and the skill scores of the operation and maintenance personnel. The urgency reward is calculated based on the remaining processing time of the work order. The constraint satisfaction reward is calculated based on the degree of satisfaction of the constraint conditions. An experience replay mechanism is used to store state transition samples. Training samples are selected based on priority sampling. The training samples are input into the dual Q network structure for training. The network parameters of the dual Q network structure are updated by minimizing the temporal difference error. The updated network parameters of the dual Q network structure are substituted into the ε-greedy strategy to explore the action space and generate a set of candidate work order distribution solutions. The Pareto dominance relationship is used to screen the candidate work order distribution solutions to obtain an undecided solution set. A reference point method model is constructed based on the undecided solution set. The reference point method calculates the utility function value based on the ideal point coordinates and the target weight, and selects the work order distribution solution with the largest utility function value as the optimal work order distribution solution. The performance of the optimal work order distribution plan is monitored. When the performance indicator change rate exceeds the preset change threshold, the dynamic adjustment mechanism is triggered, the target weight is updated based on the gradient descent method, and the updated target weight is fed back to the multi-objective reward function to continuously optimize the optimal work order distribution plan.

5. The method according to claim 4, characterized in that The Pareto dominance relationship is used to screen the candidate work order distribution solutions to obtain an unowned solution set. A reference point method model is constructed based on the unowned solution set. The reference point method model calculates the utility function value based on the ideal point coordinates and target weights. The work order distribution solution with the largest utility function value is selected as the optimal work order distribution solution, including: Based on the Pareto dominance relationship, the dominance and subordination of each solution in the set of candidate work order distribution solutions are calculated. The dominance degree indicates the number of other solutions dominated by the corresponding solution, and the subordination degree indicates the number of solutions that dominate the corresponding solution. The candidate work order distribution schemes are hierarchically screened based on the dominance and dominated degrees, and the schemes with a dominated degree of zero are divided into a multi-layer undominated solution set. The first layer of the masterless solution set in the multi-layer masterless solution set is selected to construct a reference point method model, and the coordinates of the ideal point are determined based on the function values ​​corresponding to the multi-objective reward functions of each solution in the multi-layer masterless solution set; Calculate the normalized target value of each solution in the multi-layer unowned solution set relative to the ideal point coordinates, and calculate the utility function value based on the preset target weight. Select the work order distribution solution with the largest utility function value as the optimal work order distribution solution.

6. The method according to claim 1, characterized in that A task collaborative scheduling model is constructed using the Pareto optimal solution algorithm. The task collaborative scheduling model monitors the work order processing status of the target operation and maintenance personnel in real time. When an abnormality occurs in the work order processing status, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and the work order processing task, including: A Pareto optimal solution algorithm is used to build a task collaborative scheduling model. The task collaborative scheduling model obtains the work order processing status of the target operation and maintenance personnel. The work order processing status includes the work order processing time, work order processing quality, and resource utilization. The work order processing status is converted into a state feature matrix. The state feature matrix generates a historical state encoding through a bidirectional gated recurrent unit network. Based on historical state coding, the time series state feature data is obtained and decomposed at multiple scales. The learning rate is dynamically adjusted according to the state change rate. The dynamic statistics are calculated by combining the exponential moving average and median statistics. The dynamic statistics are weighted and fused through reliability evaluation and smoothing constraints are imposed to obtain the final statistical results. The final statistical results are used to calculate the dynamic mean and dynamic standard deviation of the state feature matrix. The state feature matrix is ​​then normalized using the dynamic mean and dynamic standard deviation to obtain a standardized state vector. A multidimensional reward and punishment function is constructed. The reward and punishment values ​​are calculated based on the deviation in work order processing time, processing quality, and resource utilization. When the standardized state vector exceeds the reward and punishment value, the work order processing status is considered abnormal. When an abnormal work order processing status is detected, the real-time work order processing progress and available operation and maintenance resource information are obtained, and candidate scheduling strategies are generated based on the real-time work order processing progress and available operation and maintenance resource information; the candidate scheduling strategies are input into the task collaborative scheduling model, and the evaluation score of each strategy is calculated using a multi-dimensional reward and punishment function. The non-dominated solution is selected as the task collaborative scheduling strategy through the Pareto optimal solution algorithm.

7. The method according to claim 6, characterized in that Based on historical state coding, the time series state feature data is obtained and decomposed at multiple scales. The learning rate is dynamically adjusted according to the state change rate. Dynamic statistics are calculated by combining exponential moving average and median statistics. The dynamic statistics are weighted and fused through reliability evaluation and smoothing constraints are imposed to obtain the final statistical results, including: Extract the time series state feature data based on the historical state coding, perform wavelet transform on the time series state feature data to obtain the multi-scale decomposition coefficient; calculate the difference between the time series state feature data at adjacent moments to obtain the instantaneous change rate, and perform exponential smoothing on the instantaneous change rate to obtain the cumulative change rate; An adaptive learning rate is generated based on the cumulative rate of change through Sigmoid function mapping. The range of the adaptive learning rate is limited by the preset upper and lower bounds of the learning rate. The adaptive learning rate is used to perform an exponential moving average operation on the time series state feature data to obtain a dynamic mean, and the dynamic standard deviation of the time series state feature data is calculated based on the dynamic mean. The median of the time series state feature data is calculated within a sliding time window of a preset length to obtain the robust mean, and the median of the absolute deviation of the time series state feature data relative to the robust mean is calculated to obtain the robust standard deviation; the relative deviation between the dynamic mean and the robust mean is calculated, and the relative deviation is converted through an exponential function to obtain a reliability assessment score; The fusion weight is calculated based on the reliability assessment score. The dynamic mean and the robust mean are weightedly fused using the fusion weight to obtain the final mean. The dynamic standard deviation and the robust standard deviation are weightedly fused to obtain the final standard deviation. A time series smoothing constraint is imposed on the final mean to limit the amplitude of change between adjacent moments. A value range constraint is imposed on the final standard deviation to ensure its stability. The final mean and final standard deviation are used as the final statistical results.

8. An intelligent collaborative management system for network security operation and maintenance, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The first unit is used to obtain network security operation and maintenance work order information, including the work order priority and work order processing time limit, convert the network security operation and maintenance work order information into a work order feature vector, and input the work order feature vector into a multi-objective optimization model trained based on historical work order processing data; The second unit is used for the multi-objective optimization model to calculate the work order matching score based on the operator's skill score, historical work order completion rate and current workload, and the work order urgency score based on the work order priority and work order processing time limit; Input the work order matching score and the work order urgency score into the Pareto optimal solution algorithm to generate a multi-objective optimized work order distribution plan; The third unit uses a multi-layer perceptron to perform state encoding on work order feature vectors, operator characteristics, and constraints. It then uses a dual Q-network structure to extract the spatial correlation of the state encoding and calculate the target Q value. The dual Q-network parameters are trained based on a multi-objective reward function. The optimal solution is selected by combining the Pareto dominance relationship and the reference point method. The work order distribution plan is continuously optimized through a dynamic adjustment mechanism. The fourth unit is used to determine the target operation and maintenance personnel based on the work order distribution plan and issue work order processing tasks to the target operation and maintenance personnel; the Pareto optimal solution algorithm is used to build a task collaborative scheduling model, which monitors the work order processing status of the target operation and maintenance personnel in real time; when the work order processing status is abnormal, the task collaborative scheduling model generates a task collaborative scheduling strategy based on the work order processing status and work order processing tasks.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images