Artificial Intelligence-Based Fault Operation and Maintenance Data Transmission Method and System

Abstract

The present application provides an artificial intelligence-based fault operation and maintenance data transmission method and system, which obtains an operation and maintenance information flow to be processed; if the operation and maintenance information flow includes a first fault mode, a first knowledge topology branch is determined in a pre-deployed operation and maintenance knowledge topology structure, the first knowledge topology branch including a first topology unit, a topology unit within a preset distance obtained based on the first topology unit, and a topology chain between topology units; based on the first knowledge topology branch, a first knowledge topology feature is obtained through a first embedding layer; based on the operation and maintenance information flow, an operation and maintenance information feature is obtained through a second embedding layer in an operation and maintenance information processing algorithm; an aggregate feature is established based on the first knowledge topology feature and the operation and maintenance information feature; based on the aggregate feature, a fault analysis result is obtained through a fault identification layer in the operation and maintenance information processing algorithm. The present application can improve the technical problem of inaccurate fault detection results caused by insufficient instantaneous information in the operation and maintenance information flow.

Description

Technical Field

[0001] The present application relates to the field of data processing, and specifically to an artificial intelligence-based fault operation and maintenance data transmission method and system. Background Art

[0002] As networks continue to expand and become increasingly complex, the probability of network equipment failure also increases accordingly. How to efficiently and accurately detect and handle network failures has become a key issue that needs to be urgently addressed in the field of network operation and maintenance.

[0003] Traditional network operation and maintenance fault detection methods primarily rely on simple analysis of operation and maintenance information flows, often performing isolated assessments based on device operating parameters and log information at a single point in time. This approach is often limited by the limited amount of instantaneous information in the operation and maintenance information flows, making it difficult to fully and accurately grasp the nature and full picture of the fault. For example, when a network device fails, due to data limitations, the detection results may only reflect the surface symptoms of the fault, failing to deeply analyze the root cause and potential related factors. This leads to inaccurate fault detection results, which in turn affects the efficiency and effectiveness of fault resolution. Furthermore, traditional methods fail to effectively leverage the correlations between fault modes. In real-world network environments, different fault modes often have complex connections, and a single fault can trigger a series of related faults. However, traditional detection methods fail to fully consider these correlations, treating each fault mode solely as an independent entity. This results in a lack of systematic and comprehensive fault detection and resolution, making it difficult to accurately diagnose and effectively resolve network faults. Furthermore, because traditional methods fail to fully utilize the contextual characteristics of the operation and maintenance information flows, they lack adaptability and flexibility in the face of complex and ever-changing network fault scenarios. Summary of the Invention

[0004] The present application provides a method and system for transmitting fault operation and maintenance data based on artificial intelligence.

[0005] According to one aspect of the present application, a method for transmitting fault operation and maintenance data based on artificial intelligence is provided, which is applied to a server, and the server is in communication with an operation and maintenance terminal. The method comprises: obtaining an operation and maintenance information stream to be processed uploaded by the operation and maintenance terminal; if the operation and maintenance information stream includes a first fault mode, determining a first knowledge topology branch in a pre-deployed operation and maintenance knowledge topology structure, wherein each topology unit in the operation and maintenance knowledge topology structure represents a fault mode, each topology chain in the operation and maintenance knowledge topology structure represents a fault mode correlation, the first fault mode belongs to the fault mode represented by the first topology unit in the operation and maintenance knowledge topology structure, and the first knowledge topology branch is a fault mode represented by the first topology unit in the operation and maintenance knowledge topology structure. The branch includes the first topological unit, the topological unit within a preset distance obtained based on the first topological unit, and the topological chain between the topological units; based on the first knowledge topological branch, the first knowledge topological feature is obtained through the first embedding layer contained in the operation and maintenance information processing algorithm; based on the operation and maintenance information flow, the second embedding layer contained in the operation and maintenance information processing algorithm is used to obtain the operation and maintenance information feature; based on the first knowledge topological feature and the operation and maintenance information feature, an aggregation feature is established; based on the aggregation feature, the fault identification layer contained in the operation and maintenance information processing algorithm is used to obtain the fault analysis result of the operation and maintenance information flow, and the fault analysis result is transmitted to the operation and maintenance terminal.

[0006] According to another aspect of the present application, a fault operation and maintenance data transmission system is provided, comprising a server and an operation and maintenance terminal communicating with each other, wherein the server comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described above.

[0007] The present application obtains an operation and maintenance information flow to be processed. If it is detected that the operation and maintenance information flow includes a first fault mode, a first knowledge topology branch is determined in a pre-deployed operation and maintenance knowledge topology structure. Each topology unit in the operation and maintenance knowledge topology structure represents a fault mode, and each topology chain in the operation and maintenance knowledge topology structure represents the correlation of the fault modes. Among them, the first fault mode belongs to the fault mode represented by the first topology unit in the operation and maintenance knowledge topology structure, and the first knowledge topology branch includes the first topology unit, the topology units within a preset distance obtained based on the first topology unit, and the topology chain between the topology units. Based on this, based on the first knowledge topology branch, the first knowledge topology feature is obtained through the first embedding layer contained in the operation and maintenance information processing algorithm. And, based on the operation and maintenance information flow, the operation and maintenance information feature is obtained through the second embedding layer contained in the operation and maintenance information processing algorithm. Afterwards, based on the first knowledge topology feature and the operation and maintenance information feature, an aggregate feature is established, and based on the aggregate feature, the fault analysis result of the operation and maintenance information flow is obtained through the fault identification layer contained in the operation and maintenance information processing algorithm. This application combines the fault modes and fault mode correlations in the operation and maintenance knowledge topology structure to establish a knowledge topology branch. By improving the contextual characteristics of the operation and maintenance information flow through the knowledge topology branch, it can overcome the current situation where the fault detection results of the operation and maintenance information flow are inaccurate due to insufficient instantaneous information. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A schematic diagram of a fault operation and maintenance data transmission system according to an embodiment of the present application is shown.

[0009] Figure 2 A flowchart of an artificial intelligence-based fault operation and maintenance data transmission method according to an embodiment of the present application is shown.

[0010] Figure 3 A schematic diagram of the composition of a server according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0011] Figure 1 FIG2 shows a schematic diagram of a fault operation and maintenance data transmission system 100 provided according to an embodiment of the present application. The fault operation and maintenance data transmission system 100 includes one or more operation and maintenance terminals 101, a server 120, and one or more communication networks 110 coupling the one or more operation and maintenance terminals 101 to the server 120. The operation and maintenance terminals 101 can be configured to execute one or more applications.

[0012] exist Figure 1In the configuration shown, the server 120 may include one or more components that implement the functions performed by the server 120. These components may include software components, hardware components, or a combination thereof that can be executed by one or more processors. The user operating the operation and maintenance terminal 101 may in turn utilize one or more applications to interact with the server 120 to utilize the services provided by these components. It should be understood that various different system configurations are possible, which may be different from the fault operation and maintenance data transmission system 100. Therefore, Figure 1 is one example of a system for implementing the various methods described herein and is not intended to be limiting.

[0013] The user can use the operation and maintenance terminal 101 to receive the operation and maintenance information stream sent by the operation and maintenance terminal 101. The operation and maintenance terminal 101 can be a general-purpose computer (such as a personal computer and a laptop computer), a workstation computer, a thin client, etc. It can also be an operation and maintenance toolbox designed according to actual needs. These computer devices can run various types and versions of software applications and operating systems, such as MICROSOFT Windows, APPLE iOS, UNIX-like operating systems, Linux or Linux-like operating systems (such as GOOGLE Chrome OS); or include various mobile operating systems, such as MICROSOFT WindowsMobile OS, iOS, Windows Phone, and Android.

[0014] The fault operation and maintenance data transmission system 100 may also include one or more databases 130. In certain embodiments, these databases may be used to store data and other information. The databases 130 may reside in various locations.

[0015] Please refer to Figure 2 , is a flow chart of the artificial intelligence-based fault operation and maintenance data transmission method provided by this application, the method comprising:

[0016] Step S100: Acquire the operation and maintenance information flow to be processed uploaded by the operation and maintenance terminal.

[0017] The operation and maintenance terminal is a toolbox for network operations. In practice, when operators perform maintenance operations on network devices, the terminal records relevant operational information, device status information, and other information. This information is aggregated into an operation and maintenance information stream and uploaded to the server. The pending operation and maintenance information stream refers to a collection of data from the operation and maintenance process that has not yet been processed and analyzed by the server. This data may include device operating parameters, fault information, operation logs, and more. For example, in an enterprise network environment, operators use the operation and maintenance terminal to perform routine inspections and configuration adjustments on routers. The terminal records operating parameters such as CPU usage, memory usage, and port connection status, as well as configuration modifications made by operators, such as access control list modifications and routing policy adjustments. This recorded data is uploaded to the server as an operation and maintenance information stream for further processing.

[0018] The server can use network communication protocols such as HTTP and HTTPS to obtain the operation and maintenance information stream. The operation and maintenance terminal encapsulates the operation and maintenance information stream according to the corresponding protocol format and sends it to the server over the network. The server listens on a specific port, receives the data packets from the operation and maintenance terminal, parses the contents, and extracts the operation and maintenance information stream. For example, the operation and maintenance terminal can encode the operation and maintenance information stream in JSON format and send it to the server via an HTTP POST request. After receiving the request, the server decodes the JSON data and obtains the operation and maintenance information contained therein.

[0019] Alternatively, the operation and maintenance terminal sends the operation and maintenance information stream to a message queue, from which the server subscribes. Message queues can provide buffering and asynchronous processing, ensuring the reliable transmission of the operation and maintenance information stream. For example, using a message queue system such as RabbitMQ or Kafka, the operation and maintenance terminal sends the operation and maintenance information stream to a designated queue, from which the server retrieves the messages for processing.

[0020] Step S200: If the operation and maintenance information flow includes a first fault mode, a first knowledge topology branch is determined in a pre-deployed operation and maintenance knowledge topology structure, wherein each topology unit in the operation and maintenance knowledge topology structure represents a fault mode, each topology chain in the operation and maintenance knowledge topology structure represents a fault mode correlation, the first fault mode belongs to the fault mode represented by the first topology unit in the operation and maintenance knowledge topology structure, and the first knowledge topology branch includes the first topology unit, topology units within a preset distance obtained based on the first topology unit, and topology chains between topology units.

[0021] The operation and maintenance knowledge topology structure is a topological structure that describes failure modes and their correlations, such as a graph structure, in which each topological unit represents a failure mode, and each topological chain represents the correlations between failure modes. The first failure mode is a failure mode contained in the operation and maintenance information flow and existing in the operation and maintenance knowledge topology structure. The first knowledge topology branch is a substructure consisting of the topological unit corresponding to the first failure mode, the topological units within a preset distance, and the topological chains between them. When determining the first knowledge topology branch, the server finds the topological unit corresponding to the first failure mode in the operation and maintenance knowledge topology structure, namely the first topological unit. Then, based on the operation and maintenance knowledge topology structure, a group of topological units that are correlated with the first topological unit and within a preset distance are obtained. The preset distance is a pre-set parameter, which can be the number of hops between two topological units, and is used to control the scope of the knowledge topology branch. For example, failure modes that may be related to "excessive router CPU usage" include "excessive router memory usage" and "abnormal router port traffic." The topological units corresponding to these failure modes are within a preset distance from the topological unit corresponding to "excessive router CPU usage" and constitute the topological unit group. The server can use a graph search algorithm, such as breadth-first search (BFS) or depth-first search (DFS), to determine the first knowledge topology branch. For example, using breadth-first search, the server begins with the first topological unit and expands the search layer by layer, adding topological units within a preset distance to the topological unit group. During the search, the server traverses the topological chain to determine the connections between topological units.

[0022] In some cases, the operation and maintenance information flow may also contain first fault mode correlation information. For example, in addition to indicating that the router CPU usage is too high, the operation and maintenance information flow also indicates that there is a specific correlation between the fault and the abnormal router port traffic, that is, the first fault mode correlation. At this time, based on the operation and maintenance knowledge topology structure, the topology unit group is further screened out with the first fault mode correlation with the first topology unit to form a first sub-topology unit group. The server then establishes a first knowledge topology branch based on the first topology unit, the first sub-topology unit group, and the topological chain between them. By combining the fault mode and fault mode correlation in the operation and maintenance knowledge topology structure, the server can have a more comprehensive understanding of the contextual information of the fault in the operation and maintenance information flow. This helps to overcome the problem of inaccurate fault detection results due to insufficient instantaneous information in the operation and maintenance information flow, and improve the accuracy of operation and maintenance detection.

[0023] Step S300: Based on the first knowledge topology branch, a first knowledge topology feature is obtained through a first embedding layer included in the operation and maintenance information processing algorithm.

[0024] The first knowledge topology branch is a substructure within the operation and maintenance knowledge topology structure, consisting of topological units corresponding to the first fault mode, topological units within a preset distance, and the topological chains between them. It contains contextual information related to the first fault mode. The operation and maintenance information processing algorithm is a machine learning algorithm used by the server to process operation and maintenance information flows and analyze faults. The first embedding layer is a component of this algorithm, used to convert the information in the first knowledge topology branch into a feature vector that can be processed by a computer, namely the first knowledge topology feature.

[0025] The server uses the first embedding layer to obtain the first knowledge topology feature, numerically representing the discrete information in the first knowledge topology branch. This process can be achieved using graph embedding technology, which maps nodes (topological units) and edges (topological links) in a graph structure (such as the first knowledge topology branch) into a low-dimensional vector space. For example, the server can use the DeepWalk algorithm to generate node sequences on the first knowledge topology branch through random walks. These sequences are then input into a model similar to word embedding to learn the vector representation of each topological unit. Specifically, the server starts from a topological unit in the first knowledge topology branch and performs a random walk, selecting an adjacent topological unit each walk to form a node sequence. This process is repeated multiple times to obtain multiple node sequences. The server then trains these node sequences using the Skip-Gram model, ensuring that adjacent topological units are close in vector space. Ultimately, each topological unit is represented as a vector, which constitutes the first knowledge topology feature. Alternatively, the Node2Vec algorithm can be used, combining depth-first and breadth-first search strategies to walk the first knowledge topology branch and capture different types of relationships between topological units. When the server uses the Node2Vec algorithm, it performs a random walk on the first knowledge topology branch based on pre-set parameters to generate a node sequence. Unlike DeepWalk, Node2Vec adjusts the walk probability based on the local and global information of the node during the walk, thereby learning a richer representation of the topological units.

[0026] By converting the first knowledge topology branches into feature vectors, the server can further process and analyze these features using machine learning or deep learning models, thereby more accurately identifying fault modes and predicting fault development trends. For example, the server can input the first knowledge topology features into a neural network model and combine them with other features of the operation and maintenance information flow to classify and diagnose faults, improving the accuracy and efficiency of fault analysis.

[0027] Step S400: Based on the operation and maintenance information flow, the second embedding layer included in the operation and maintenance information processing algorithm is used to obtain operation and maintenance information features.

[0028] In step S400, the server uses the second embedded layer of the operation and maintenance information processing algorithm to obtain operation and maintenance information features based on the operation and maintenance information stream. The operation and maintenance information stream is a collection of information uploaded by the operation and maintenance terminal containing various data related to the network operation and maintenance process, including equipment operating parameters, fault prompt information, operation logs, and so on. The operation and maintenance information processing algorithm is used by the server to process and analyze the operation and maintenance information stream to perform fault detection and diagnosis. The second embedded layer is a key component of this algorithm, converting the raw data in the operation and maintenance information stream into feature vectors, or operation and maintenance information features, that are easy for computers to process and analyze.

[0029] One method for capturing operational information features is to use word embedding technology. When the data in the operational information stream contains text, such as text descriptions in operation logs, the text can be segmented and then mapped to a low-dimensional vector space using the Word2Vec algorithm. The Word2Vec algorithm trains a neural network model so that words with similar contexts in the text are closely spaced in the vector space. For example, in a router's operation log, expressions such as "configure port" and "set port parameters" may frequently appear together. After training with the Word2Vec algorithm, their corresponding vectors will be relatively close in the vector space. After segmenting the text in the operational information stream, the server converts each word into a corresponding vector. These vectors are then combined into a feature vector representing the entire text using some aggregation method (such as averaging).

[0030] For numerical data in the operation and maintenance information flow, such as the CPU usage and memory usage of the router, the server can use normalization and feature scaling methods to process them. These numerical data are scaled to a specific range, such as the [0, 1] interval, to prevent certain values from being too large and affecting subsequent analysis. The server can use the minimum-maximum normalization formula: , where x is the original value, and are the minimum and maximum values of the value in the data set, It is a normalized value. The server arranges the normalized numerical data in a certain order to form a feature vector as part of the operation and maintenance information feature.

[0031] The server can also use convolutional neural networks (CNNs) or recurrent neural networks (RNNs) in deep learning to process the operation and maintenance information stream. Taking CNN as an example, the server can organize the data in the operation and maintenance information stream into a two-dimensional or three-dimensional matrix, extract local features from the data through the convolution layer, then reduce the dimensionality of the features through the pooling layer. Finally, the fully connected layer combines the extracted features into a feature vector, namely the operation and maintenance information feature.

[0032] By acquiring operation and maintenance information features, the server can convert complex operation and maintenance information flows into feature representations that are easy to process and analyze, providing a more effective data foundation for subsequent fault analysis and diagnosis, and helping to improve the accuracy and efficiency of fault detection.

[0033] Step S500: establishing an aggregated feature based on the first knowledge topology feature and the operation and maintenance information feature.

[0034] As previously mentioned, the first knowledge topology feature is obtained by the server based on the first knowledge topology branch through the first embedding layer of the operation and maintenance information processing algorithm. It reflects the contextual information related to the first fault mode. The operation and maintenance information feature is obtained by the server based on the operation and maintenance information flow through the second embedding layer of the operation and maintenance information processing algorithm. It reflects the specific data information during the operation and maintenance process. The aggregated feature is a new feature obtained by fusing these two features. It combines the contextual information of the fault mode and the operation and maintenance data information, facilitating more comprehensive and accurate fault analysis.

[0035] One way for the server to establish aggregate features is to achieve feature fusion through matrix operations. Multiply the operation and maintenance information feature by the first mapping parameter to obtain the first feature, multiply the first knowledge topology feature by the second mapping parameter and transpose the product to obtain the second feature, then multiply the first feature by the second feature to obtain the third feature, and finally add the adjustment feature to the third feature to obtain the aggregate feature. The first mapping parameter and the second mapping parameter here are the result of decomposing a multidimensional data structure. The multidimensional data structure is, for example, a tensor with a structure of e*g*f, the structure of the first mapping parameter is e*1*f, the structure of the second mapping parameter is 1*g*f, and the dimension of the aggregate feature is f. For example, if the dimension e of the operation and maintenance information feature is 10, the dimension g of the first knowledge topology feature is 20, and f is set to 5, the server performs matrix operations according to the above rules to obtain the aggregate feature.

[0036] Another approach is to perform eigenvalue alignment. Each eigenvalue in the first knowledge topology feature is aligned with the eigenvalue in the operation and maintenance information feature, such as by performing inner product operations or summing them, to obtain an aggregated feature. The dimensions of the first knowledge topology feature, the operation and maintenance information feature, and the aggregated feature are equal. Assuming that the dimensions of the first knowledge topology feature and the operation and maintenance information feature are both 15, the server will perform inner product or sum operations on the eigenvalues at the corresponding positions to obtain an aggregated feature with the same dimension of 15.

[0037] If the operation and maintenance information flow also includes a second fault mode, the second knowledge topology branch is determined and the second knowledge topology feature is obtained. At this time, the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature are comprehensively considered when establishing the aggregate feature. The server can first perform a bitwise multiplication of the first knowledge topology feature and the second knowledge topology feature with the weight feature respectively, and then perform operations such as addition, averaging, or dot multiplication on the results to obtain the target feature, and then combine the operation and maintenance information feature to obtain the aggregate feature through matrix operations or feature splicing. For example, after performing bitwise addition to obtain the target feature, the operation and maintenance information feature is multiplied by the first mapping parameter, the target feature is multiplied by the second mapping parameter and transposed, and the two are multiplied and then the adjustment feature is added to obtain the aggregate feature.

[0038] Step S600: Based on the aggregated features, the fault identification layer included in the operation and maintenance information processing algorithm is used to obtain the fault analysis result of the operation and maintenance information flow, and the fault analysis result is transmitted to the operation and maintenance terminal.

[0039] Aggregated features are derived from the server's fusion of the first knowledge topology features and the operation and maintenance information features, or, in the case of a second fault mode, the first knowledge topology features, the second knowledge topology features, and the operation and maintenance information features. They integrate the context of the fault mode and the operation and maintenance data, providing a more comprehensive and accurate basis for fault analysis. The fault identification layer in the operation and maintenance information processing algorithm is a module specifically designed to analyze and process aggregated features to identify faults and provide fault analysis results.

[0040] In step 200, the identified fault mode is merely a manifestation of the fault. It is an abstraction and generalization of the fault manifestation, referring to the specific manifestation of a specific problem in a device or system. For example, hardware failure, software crash, and network interruption are all different types of fault modes. Identifying the fault mode is the first step in problem resolution, helping technicians quickly locate the possible scope of the problem. After analysis in step 600, the resulting fault analysis result is a comprehensive and accurate fault type. In other words, the fault mode is a discrete fault type identified through pattern matching and is an atomic problem label (e.g., "hard disk IO limit exceeded" or "memory leak"). The fault analysis result is a composite diagnostic conclusion generated based on topological relevance and contextual features.

[0041] In an enterprise network environment, operations personnel use an operation and maintenance terminal to perform routine inspections and configuration adjustments on routers. The terminal records the router's operating parameters and operational information and uploads it to the server. The server determines the first fault mode as "excessive CPU usage in the router" and, through a series of steps, obtains the first knowledge topology feature and the operation and maintenance information feature. If a second fault mode exists, it also obtains the second knowledge topology feature to create an aggregated feature. The server then uses the fault identification layer to analyze the aggregated feature to obtain the fault analysis results.

[0042] The fault identification layer can employ a variety of technical approaches to perform fault analysis. One approach is to use machine learning classification algorithms, such as support vector machines (SVMs), decision trees, and random forests. Deep learning models, such as multilayer perceptrons (MLPs), can also be used in the fault identification layer. An MLP consists of an input layer, hidden layers, and an output layer. The server inputs aggregated features into the MLP input layer. After nonlinear transformations and calculations in the hidden layers, the output layer generates the predicted probability of each fault mode. The server can then select the fault mode with the highest probability as the fault analysis result.

[0043] After obtaining the fault analysis results, the server transmits them to the operation and maintenance terminal.

[0044] Through step 600, the server can use the aggregation features and fault identification layer to accurately analyze the fault mode in the operation and maintenance information flow, and promptly feed back the results to the operation and maintenance terminal, helping the operation and maintenance personnel to quickly understand the fault status of the equipment, take corresponding maintenance measures, improve the efficiency and accuracy of network operation and maintenance, and complete remote maintenance.

[0045] In one implementation, after obtaining the operation and maintenance information stream to be processed uploaded by the operation and maintenance terminal, the method provided in the embodiment of the present application may further include:

[0046] Step 101: Perform fault mode detection on the operation and maintenance information flow to obtain a fault mode detection result;

[0047] Step 102: If the failure mode detection result indicates that the operation and maintenance information flow includes a failure mode, the failure mode included in the operation and maintenance information flow is compared with the failure mode in the operation and maintenance knowledge topology structure to obtain a failure mode comparison result;

[0048] Step 103: If the fault mode comparison result indicates that the fault mode included in the operation and maintenance information flow exists in the fault mode in the operation and maintenance knowledge topology structure, the existing fault mode is used as the first fault mode.

[0049] In step 101, the server performs fault mode detection on the operation and maintenance information stream and obtains the fault mode detection results. The operation and maintenance information stream is a collection of various data uploaded by the operation and maintenance terminal, including various types of data related to the network operation and maintenance process. This data includes equipment operating parameters, operation logs, fault prompts, and other content. Fault mode detection involves the server using specific methods and techniques to identify possible fault modes from the operation and maintenance information stream.

[0050] In an enterprise network environment, operations and maintenance personnel use operations and maintenance terminals to perform daily inspections and configuration adjustments on routers. The operations and maintenance terminals record the router's operating parameters, such as CPU usage, memory usage, and port connection status, as well as configuration modification operations performed by operations and maintenance personnel, such as modifying access control lists and adjusting routing policies. This recorded data is uploaded to the server in the form of an operations and maintenance information stream. When the server detects fault modes in the operations and maintenance information stream, it can use a rule-based detection method. The server pre-sets a series of rules. For example, when the CPU usage of the router exceeds 80% for more than 10 minutes continuously, it is judged as a "CPU usage is too high" fault mode; when the packet loss rate of a certain port of the router exceeds 5%, it is judged as a "port packet loss abnormality" fault mode. The server compares the data in the operations and maintenance information stream with these rules to determine whether a fault mode exists and the specific type of fault mode.

[0051] The server can also use machine learning algorithms for failure mode detection. During the training phase, the machine learning model is trained using a large amount of historical operation and maintenance information flow data labeled with failure modes, allowing the model to learn the operation and maintenance data characteristics corresponding to different failure modes. In actual use, the server inputs the current operation and maintenance information flow into the trained model, which then determines the presence and type of failure mode based on the characteristics.

[0052] In step 102, if the failure mode detection result indicates that the operation and maintenance information flow includes a failure mode, the server compares the failure mode contained in the operation and maintenance information flow with the failure modes in the operation and maintenance knowledge topology structure to obtain a failure mode comparison result. The operation and maintenance knowledge topology structure is a topological structure pre-deployed by the server to describe failure modes and their correlations. Each topological unit represents a failure mode, and each topological chain represents the correlation between failure modes.

[0053] In the example of the enterprise network environment described above, the server detects failure modes such as "excessive CPU usage" and "abnormal port packet loss" in the operation and maintenance information flow. The server compares these failure modes with the failure modes in the operation and maintenance knowledge topology structure. The operation and maintenance knowledge topology structure is constructed by the server based on a large amount of historical operation and maintenance data and failure cases. It contains the possible failure modes of various network devices and the relationships between them. The server searches the operation and maintenance knowledge topology structure to see if there are failure modes identical to "excessive CPU usage" and "abnormal port packet loss." If so, the failure mode in the operation and maintenance information flow matches the failure mode in the operation and maintenance knowledge topology structure; if not, there is a mismatch.

[0054] To compare fault modes, a string matching method can be used to compare the fault mode names in the operation and maintenance information flow with the fault mode names represented by each topological unit in the operation and maintenance knowledge topology structure. If the names are exactly the same, it is determined to be a match. The server can also use a semantic matching method. When the fault mode names are not exactly the same, the server determines whether they match by analyzing their semantic similarity. For example, if the operation and maintenance information flow records "Router CPU load is too high" and the corresponding fault mode in the operation and maintenance knowledge topology structure is "Router CPU utilization is too high", semantic analysis can determine that these two fault modes match.

[0055] In step 103, if the fault mode comparison result indicates that the fault mode included in the operation and maintenance information flow exists in the operation and maintenance knowledge topology structure, the existing fault mode is used as the first fault mode. The first fault mode is the key basis for subsequent analysis and processing. Based on the first fault mode, the server will determine the first knowledge topology branch in the operation and maintenance knowledge topology structure to conduct more in-depth fault analysis.

[0056] In the above example, after comparing the failure modes, the server discovered that both "CPU usage is too high" and "port packet loss is abnormal" exist in the operation and maintenance knowledge topology. The server can select one of these failure modes as the first failure mode. This selection can be made based on preset rules, such as selecting the failure mode with the highest support coefficient as the first failure mode. The support coefficient can indicate the frequency of occurrence of the failure mode in historical data or the degree of impact on the system. If the support coefficient for "CPU usage is too high" is greater than the support coefficient for "port packet loss is abnormal", the server selects "CPU usage is too high" as the first failure mode.

[0057] Through steps 101 to 103, the server accurately identifies the fault mode from the operation and maintenance information flow, and compares it with the operation and maintenance knowledge topology structure to determine the first fault mode, providing a basis for subsequent fault analysis and processing.

[0058] When performing fault mode detection, the server can also combine multiple detection methods to improve the accuracy and reliability of detection. For example, a rule-based detection method is first used for preliminary screening, and then a machine learning algorithm is used for further verification and refinement. The server can also adjust the rules and model parameters of fault mode detection according to different equipment types and operation and maintenance scenarios to adapt to different needs. During the fault mode comparison process, a synonym library and a near-synonymous thesaurus for the fault mode can be established to improve the accuracy of semantic matching. When the fault mode name in the operation and maintenance information flow is not exactly the same as the fault mode name in the operation and maintenance knowledge topology structure, the server can determine whether there is a match by querying the synonym library and the near-synonymous thesaurus. The server can also introduce natural language processing technology to conduct a more in-depth analysis and understanding of the description of the fault mode to improve the accuracy of the comparison.

[0059] After determining the first failure mode, the server will determine a first knowledge topology branch in the operation and maintenance knowledge topology structure based on the first failure mode. The first knowledge topology branch contains contextual information related to the first failure mode, which helps the server more comprehensively understand the cause and possible impact of the failure.

[0060] In one implementation, if the failure mode detection result indicates that the operation and maintenance information flow includes a failure mode, the failure mode included in the operation and maintenance information flow is compared with the failure mode in the operation and maintenance knowledge topology structure to obtain a failure mode comparison result, including:

[0061] Step 1021: If the failure mode detection result indicates that the operation and maintenance information flow includes multiple failure modes, then obtain the support coefficient corresponding to each of the multiple failure modes;

[0062] Step 1022: The failure mode corresponding to the maximum support coefficient among the multiple failure modes is used as the failure mode included in the operation and maintenance information flow;

[0063] Step 1023: Compare the failure mode included in the operation and maintenance information flow with the failure mode in the operation and maintenance knowledge topology structure to obtain a failure mode comparison result.

[0064] Specifically, if the failure mode detection result indicates that the operation and maintenance information stream includes several failure modes, the server obtains the support coefficient corresponding to each of the several failure modes. The support coefficient is an indicator that measures the likelihood or credibility of the failure mode in the operation and maintenance information stream, reflecting the probability of the failure mode's existence based on the existing data and model.

[0065] To obtain the support coefficient for each failure mode, one approach is to use a machine learning-based classification algorithm, such as the Naive Bayes classifier. Based on Bayes' theorem and the conditional independence assumption of features, the Naive Bayes classifier builds a probabilistic model between failure modes and features by studying a large amount of historical operation and maintenance data. For a new operation and maintenance information stream, the server can calculate the posterior probability of each failure mode based on this model and use the posterior probability as the support coefficient. The specific formula is as follows:

[0066] Let C be the failure mode category, is a feature in the operation and maintenance information flow, then according to Bayes' theorem, the posterior probability of failure mode C is:

[0067] ;

[0068] Since the naive Bayes classifier assumes conditional independence between features, that is, , then the above formula can be simplified to:

[0069] ;

[0070] Among them, P(C) is the prior probability of failure mode C, which can be obtained through historical data statistics; Is the characteristic F under failure mode C i The probability of occurrence can also be learned from historical data; It is the same for all failure modes and can be ignored when comparing the posterior probabilities of different failure modes. Therefore, the server can calculate the posterior probability of each failure mode as the support coefficient according to the above formula.

[0071] Another approach is to use deep learning-based neural network models, such as convolutional neural networks (CNNs) or recurrent neural networks (RNNs). For example, in a CNN model, the server takes the operation and maintenance information flow as input, processes it through convolutional layers, pooling layers, and fully connected layers, and finally uses the softmax function to output the probability distribution of each failure mode. These probabilities are the support coefficients.

[0072] After obtaining the support coefficient for each fault mode, the server executes step 1022 and selects the fault mode corresponding to the maximum support coefficient among the multiple fault modes as the fault mode included in the operation and maintenance information flow. This is because the maximum support coefficient indicates that the fault mode has the highest probability of appearing in the current operation and maintenance information flow and is most likely to be the actual fault mode.

[0073] Finally, the server executes step 1023, comparing the fault modes contained in the operation and maintenance information flow with the fault modes in the operation and maintenance knowledge topology structure to obtain a fault mode comparison result. Through steps 1021-1023, the server accurately determines the most likely fault mode from the operation and maintenance information flow containing multiple fault modes and compares it with the operation and maintenance knowledge topology structure, providing a foundation for subsequent fault analysis and processing. This method can improve the accuracy of fault detection, overcome the problem of inaccurate fault detection results caused by insufficient instantaneous information in the operation and maintenance information flow, and combine the fault modes and fault mode correlations in the operation and maintenance knowledge topology structure to provide more comprehensive information for fault analysis.

[0074] As an implementation of step 200, that is, if the operation and maintenance information flow includes the first fault mode, determining a first knowledge topology branch in the pre-deployed operation and maintenance knowledge topology structure includes:

[0075] Step 201: If the operation and maintenance information flow includes a first fault mode, a topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure is used as a first topology unit;

[0076] Step 202: obtaining a topological unit group that is correlated with the first topological unit according to the operation and maintenance knowledge topological structure, wherein the distance between each topological unit in the topological unit group and the first topological unit is within a preset distance;

[0077] Step 203: Establish a first knowledge topology branch according to the first topology unit, the topology unit group, and the topology chain between the topology units.

[0078] In step 201, when the operation and maintenance information flow includes the first fault mode, the server uses the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure as the first topology unit. For example, if the server determines that the first fault mode is "router CPU usage is too high" through analysis of the operation and maintenance information flow, then the server searches for the topology unit corresponding to "router CPU usage is too high" in the operation and maintenance knowledge topology structure and designates it as the first topology unit. As previously mentioned, the server can search for the corresponding topology unit by name matching, comparing the name of the first fault mode with the name of the fault mode represented by each topology unit in the operation and maintenance knowledge topology structure one by one. If the names are exactly the same, the topology unit is determined to be the first topology unit. For some situations where the expressions are similar but not exactly the same, the server can use semantic analysis technology to determine whether they represent the same type of fault mode, such as "router CPU load is too high" and "router CPU usage is too high". Through semantic analysis, it can be determined that they correspond to the same topology unit.

[0079] In step 202, the server retrieves a group of topological units related to the first topological unit based on the operation and maintenance knowledge topology structure, where each topological unit in the group is within a preset distance from the first topological unit. The preset distance is a pre-set parameter that controls the scope of the knowledge topology branch and determines the breadth of the server's search for related topological units within the operation and maintenance knowledge topology structure. For example, for the first topological unit "high router CPU usage," associated failure modes might include "excessive router memory usage" and "abnormal router port traffic." Starting with the first topological unit, the server searches the operation and maintenance knowledge topology structure for topological units that are connected to the first topological unit via a topological chain and within a preset distance. The server can implement this process using a graph search algorithm. For example, starting from the first topological unit, the server gradually expands the search scope layer by layer, sequentially adding topological units within the preset distance from the first topological unit to the group of topological units. During the search, the server traverses the topological chain and determines which topological units are related to the first topological unit based on the correlation of the failure modes indicated by the topological chain.

[0080] In step 203, the server establishes a first knowledge topology branch based on the first topology unit, the topology unit group, and the topology chain between the topology units. The first knowledge topology branch is a substructure that contains contextual information related to the first fault mode, which helps the server to more comprehensively understand the cause and possible impact of the fault. The server combines the first topology unit, each topology unit in the topology unit group, and the topology chain between them to form a complete knowledge topology branch. In the above example, the first topology unit is the topology unit corresponding to "excessive router CPU usage", and the topology unit group contains topology units corresponding to "excessive router memory usage" and "abnormal router port traffic". These topology units and the topology chains between them are integrated to construct the first knowledge topology branch. This branch not only shows the first fault mode itself, but also shows other related fault modes and the relationship between them.

[0081] As another implementation of step 200, that is, if the operation and maintenance information flow includes the first fault mode, determining a first knowledge topology branch in the pre-deployed operation and maintenance knowledge topology structure includes:

[0082] Step 210: If the operation and maintenance information flow includes the first fault mode, the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure is used as the first topology unit;

[0083] Step 220: obtaining a topological unit group that is correlated with the first topological unit according to the operation and maintenance knowledge topological structure, wherein a distance between each topological unit in the topological unit group and the first topological unit is within a preset distance;

[0084] Step 230: If the operation and maintenance information flow includes the first fault mode correlation, then according to the operation and maintenance knowledge topological structure, obtain a first sub-topological unit group having the first fault mode correlation with the first topological unit in the topological unit group;

[0085] Step 240: Establish a first knowledge topology branch according to the first topology unit, the first sub-topology unit group, and the topology chain between the topology units.

[0086] In step 210, when the operation and maintenance information flow includes the first fault mode, the server uses the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure as the first topology unit.

[0087] In step 220, the server retrieves a group of topological units that are relevant to the first topological unit based on the operation and maintenance knowledge topology structure, where each topological unit in the group is within a preset distance from the first topological unit. The preset distance is a predefined parameter that controls the scope of the knowledge topology branch and determines the breadth of the server's search for relevant topological units in the operation and maintenance knowledge topology structure.

[0088] In step 230, if the operation and maintenance information flow includes a first fault mode correlation, the server, based on the operation and maintenance knowledge topology structure, retrieves a first sub-topology unit group from the topology unit group that has a first fault mode correlation with the first topology unit. A first fault mode correlation refers to the relationship between the first fault mode and other fault modes. This relationship is represented in the operation and maintenance knowledge topology structure through a topology chain. Assume that, in addition to indicating the first fault mode of "excessive router CPU usage," the operation and maintenance information flow also indicates a specific correlation with "abnormal router port traffic," i.e., a first fault mode correlation. Based on the operation and maintenance knowledge topology structure, the server selects, from the previously obtained topology unit group, topology units that have a first fault mode correlation with the first topology unit "excessive router CPU usage" (i.e., "correlated with abnormal router port traffic"), forming a first sub-topology unit group. The server can determine this correlation by examining the attributes of the topology chains. For example, each topology chain has a corresponding label or attribute to indicate the type of correlation it represents. The server uses these labels or attributes to determine whether the topology units have a first fault mode correlation. To more accurately identify the first sub-topological unit group, the server can employ a machine learning algorithm. During the training phase, the server can use a large amount of historical data with associated labels to train the machine learning model, allowing the model to learn the correlation characteristics between different failure modes. In practice, the server inputs the topological units in the topological unit group and the first failure mode correlation information into the trained model. The model then determines which topological units are associated with the first failure mode based on the characteristics.

[0089] When establishing the first knowledge topology branch, the server can also assign weights to topology units and chains. Topology units and chains that are more strongly associated with the first fault mode can be given higher weights, allowing this important information to receive more attention in subsequent fault analysis. The server can determine weights based on factors such as the frequency of associations between fault modes in historical data and the degree of impact.

[0090] In step 240, the server establishes a first knowledge topology branch based on the first topology unit, the first sub-topology unit group, and the topology links between the topology units. The first knowledge topology branch is a substructure that contains contextual information related to the first fault mode, helping the server to more comprehensively understand the fault's cause and potential impact. The server combines the first topology unit, the individual topology units in the first sub-topology unit group, and the topology links between them to construct a complete knowledge topology branch. In the above example, the first topology unit corresponds to "high router CPU usage." The first sub-topology unit group includes topology units that are associated with "high router CPU usage" and are related to abnormal router port traffic, such as the topology unit corresponding to "abnormal router port traffic." These topology units and the topology links between them are integrated to form the first knowledge topology branch. This branch not only displays the first fault mode itself, but also displays other fault modes with specific associations and their relationships. For example, the topology link indicates that "high router CPU usage" may be caused by "abnormal router port traffic," providing more targeted information for the server's subsequent fault analysis.

[0091] As another implementation of step 200, that is, if the operation and maintenance information flow includes the first fault mode, determining a first knowledge topology branch in a pre-deployed operation and maintenance knowledge topology structure includes:

[0092] Step 2100: If the operation and maintenance information flow includes the first fault mode, the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure is used as the first topology unit;

[0093] Step 2200: Obtain a topological unit group that is correlated with the first topological unit according to the operation and maintenance knowledge topological structure, wherein the distance between each topological unit in the topological unit group and the first topological unit is within a preset distance;

[0094] Step 2300: If the operation and maintenance information flow includes the first fault mode correlation and the second fault mode correlation, then according to the operation and maintenance knowledge topological structure, obtain, from the topological unit group, a second sub-topological unit group that has at least one of the first fault mode correlation and the second fault mode correlation with the first topological unit;

[0095] Step 2400: Establish a first knowledge topology branch based on the first topology unit, the second sub-topology unit group, and the topology chain between the topology units.

[0096] In step 2100, when the operation and maintenance information flow includes the first fault mode, the server uses the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure as the first topology unit.

[0097] In step 2200, the server retrieves a group of topological units that are relevant to the first topological unit based on the operation and maintenance knowledge topology structure, where each topological unit in the group is within a preset distance from the first topological unit. The preset distance is a pre-set parameter that controls the scope of the knowledge topology branch and determines the breadth of the server's search for relevant topological units in the operation and maintenance knowledge topology structure.

[0098] In step 2300, if the operation and maintenance information flow includes a first fault mode correlation and a second fault mode correlation, the server, based on the operation and maintenance knowledge topology structure, retrieves from the topology unit group a second sub-group of topology units that have at least one of the first fault mode correlation or the second fault mode correlation with the first topology unit. The first fault mode correlation and the second fault mode correlation refer to specific associations between the first fault mode and other fault modes. These associations are represented by topology chains in the operation and maintenance knowledge topology structure. Assume that, in addition to indicating the first fault mode of "excessive router CPU usage," the operation and maintenance information flow also indicates that this fault has a first fault mode correlation with "abnormal router port traffic" and a second fault mode correlation with "excessive router memory usage." From the previously obtained topology unit group, based on the operation and maintenance knowledge topology structure, select topology units that have at least one of the first fault mode correlations of "abnormal router port traffic" or "excessive router memory usage" with the first topology unit "excessive router CPU usage," forming a second sub-group of topology units. The server can determine this association by checking the properties of the topology chain. Each topology chain may have a corresponding label or attribute to indicate the type of association it represents. The server determines whether there is a corresponding failure mode association between topology units based on these labels or attributes.

[0099] In step 2400, the server establishes a first knowledge topology branch based on the first topology unit, the second sub-topology unit group, and the topology links between the topology units. The first knowledge topology branch is a substructure that contains contextual information related to the first fault mode, helping the server to more comprehensively understand the fault's cause and potential impact. The server combines the first topology unit, each topology unit in the second sub-topology unit group, and the topology links between them to construct a complete knowledge topology branch. In the above example, the first topology unit corresponds to "high router CPU usage." The second sub-topology unit group includes topology units associated with "high router CPU usage" that are "related to abnormal router port traffic" or "related to excessive router memory usage," such as topology units corresponding to "abnormal router port traffic" and "excessive router memory usage." These topology units and the topology links between them are integrated to form the first knowledge topology branch. This branch not only displays the first fault mode itself, but also displays other fault modes that have specific associations with it and their relationships.

[0100] Through steps 2100-2400, the server can accurately determine the first knowledge topology branch in the operation and maintenance knowledge topology structure, combining the first fault mode and other fault modes with two different association relationships therewith, providing more comprehensive and detailed context information for subsequent fault analysis.

[0101] In step 2300, to more accurately determine the second sub-topological unit group, the server can employ a machine learning algorithm. During the training phase, the server can use a large amount of historical data with associated labels to train the machine learning model, allowing the model to learn the associated features between different failure modes. In practice, the server inputs the topological units in the topological unit group and the first and second failure mode association information into the trained model. The model then determines, based on the features, which topological units have corresponding failure mode associations with the first topological unit.

[0102] When establishing the first knowledge topology branch, the server can also assign weights to the topology units and topology chains. Topology units and topology chains that are more closely associated with the first fault mode can be assigned higher weights, so that these important information will receive more attention in subsequent fault analysis. The server can determine the weight value based on factors such as the association frequency and impact degree between fault modes in historical data. For example, if the association frequency of "excessive router CPU usage" and "abnormal router port traffic" is high in historical data, and this association has a greater impact on system performance, then the topology unit corresponding to "abnormal router port traffic" and the topology chain connected to it can be assigned a higher weight.

[0103] Steps 2100-2400 provide a more detailed and comprehensive method for the server to determine the first knowledge topology branch within the O&M knowledge topology structure. By combining the first fault mode and the correlation between the two different fault modes, the server can construct a knowledge topology branch that better reflects the actual fault situation. This provides stronger support for fault analysis and resolution, improves the efficiency and quality of network O&M, and ensures the stable operation of the enterprise network.

[0104] In the AI-based fault maintenance data transmission method, step 200 requires determining a first knowledge topology branch within a pre-deployed maintenance knowledge topology structure when the maintenance information flow includes a first failure mode. This step can be implemented in three different ways. The following compares and introduces these three solutions, analyzing their respective advantages, similarities, and differences.

[0105] The core objectives of the three aforementioned solutions are the same: to determine the first knowledge topology branch from the operation and maintenance knowledge topology structure when the operation and maintenance information flow contains the first failure mode. Furthermore, based on the operation and maintenance knowledge topology structure, all three solutions first determine the first topology unit, then search for related topology units around the first topology unit, and ultimately construct the first knowledge topology branch. When acquiring the topology unit group, all solutions consider the distance between the topology unit and the first topology unit, requiring the distance to be within a preset distance to ensure that the acquired topology unit has a certain degree of correlation with the first topology unit.

[0106] The differences lie in the degree to which they utilize fault mode correlations. Solution 1 doesn't consider fault mode correlations, but instead identifies related topological unit groups based solely on the distances between topological units to construct the first knowledge topology branch. Solution 2 considers one type of fault mode correlation, the first fault mode correlation, and further selects a first sub-topological unit group that shares this correlation with the first topological unit. Solution 3 considers two types of fault mode correlations, the first fault mode correlation and the second fault mode correlation, and selects a second sub-topological unit group from the topological unit group that shares at least one correlation with the first topological unit.

[0107] Solution 1 eliminates the need to consider fault mode correlations, reducing computational complexity and data processing. When fault mode correlations are unclear or difficult to accurately capture within the O&M knowledge topology, this solution can quickly identify the first knowledge topology branch, improving processing efficiency. For example, in newly established O&M systems, where data on fault mode correlations is incomplete, using Solution 1 allows for timely processing of the O&M information flow.

[0108] Solution 2 considers the correlation of the first fault mode, enabling more precise selection of topological units related to the first topological unit, and constructing a more targeted first knowledge topology branch. In scenarios where fault mode correlations are clear and high-precision fault analysis is required, Solution 2 can provide more accurate contextual information, helping to improve the accuracy of fault detection and analysis. For example, in a specific network operation and maintenance scenario, where a certain fault mode is known to have specific correlations with other fault modes, Solution 2 can better leverage these correlations for fault analysis.

[0109] Solution 3 considers two types of fault mode correlations, further refining the topology unit screening criteria and constructing a more accurate and comprehensive first knowledge topology branch. In scenarios where fault mode correlations are complex and diverse, and fault analysis requirements are extremely demanding, Solution 3 can fully leverage multiple correlation information to provide richer contextual features, enabling more accurate fault analysis. For example, in the operation and maintenance of large-scale industrial production systems, where the correlations between fault modes are complex and varied, Solution 3 can more effectively mine fault information and improve the accuracy of fault diagnosis.

[0110] In one implementation of step 500, that is, establishing an aggregate feature based on the first knowledge topology feature and the operation and maintenance information feature includes:

[0111] Step 510: Multiply the operation and maintenance information feature by the first mapping parameter to obtain a first feature, where the dimension of the operation and maintenance information feature is e;

[0112] Step 520: multiplying the first knowledge topology feature by the second mapping parameter and transposing the product to obtain a second feature, wherein the feature of the first knowledge topology feature is g;

[0113] Step 530: Multiply the first feature by the second feature to obtain a third feature;

[0114] Step 540: Add the third feature to the adjustment feature to obtain the aggregated feature.

[0115] Among them, the first mapping parameter and the second mapping parameter are the results of decomposing the multidimensional data structure. The structure of the multidimensional data structure is e*g*f, the structure of the first mapping parameter is e*1*f, the structure of the second mapping parameter is 1*g*f, and the dimension of the aggregated feature is f.

[0116] In step 510, the server multiplies the operation and maintenance information feature by the first mapping parameter to obtain the first feature, where the dimension of the operation and maintenance information feature is e. The operation and maintenance information feature is obtained by the server based on the operation and maintenance information flow using the second embedding layer included in the operation and maintenance information processing algorithm, and it reflects the specific data information in the operation and maintenance process. The first mapping parameter is a hyperparameter group with a structure of e*1*f, where e represents the dimension of the operation and maintenance information feature, and f is a pre-set dimension value used to control the dimension of the final aggregated feature. Assuming that the operation and maintenance information feature is represented as an e-dimensional vector, the server multiplies this vector with the first mapping parameter to obtain a new vector, namely the first feature. For example, if the dimension e of the operation and maintenance information feature is 10, and the structure of the first mapping parameter is 10*1*5, the server multiplies the operation and maintenance information feature vector with the first mapping parameter to obtain a first feature vector with a dimension of 5. The server can use the basic rules of matrix multiplication to implement this operation, and the calculation of each element is performed according to the formula of matrix multiplication. Suppose the operation and maintenance information feature vector is , the first mapping parameter is M1, the first eigenvector is Y1, then each element y of Y1 1i The calculation method is .

[0117] In step 520, the server multiplies the first knowledge topology feature by the second mapping parameter and transposes the product to obtain the second feature, where the dimension of the first knowledge topology feature is g. The first knowledge topology feature is obtained by the server based on the first knowledge topology branch through the first embedding layer contained in the operation and maintenance information processing algorithm, which reflects the context information related to the first fault mode. The second mapping parameter is a hyperparameter matrix with a structure of 1*g*f, and g represents the dimension of the first knowledge topology feature. The server multiplies the first knowledge topology feature vector by the second mapping parameter to obtain an intermediate result, and then transposes the intermediate result to obtain the second feature. For example, if the dimension g of the first knowledge topology feature is 20, and the structure of the second mapping parameter is 1*20*5, the server multiplies the first knowledge topology feature vector by the second mapping parameter to obtain an intermediate vector, and then transposes it to finally obtain a second feature vector with a dimension of 5. Suppose the first knowledge topology feature vector is , the second mapping parameter is M2, the intermediate result vector is Y mid , then Y mid Each element y midi The calculation method is , the second eigenvector Y2 is Y mid The transpose of .

[0118] In step 530, the server multiplies the first feature by the second feature to obtain a third feature. The server multiplies the first feature vector obtained in step 510 by the second feature vector obtained in step 520. The multiplication here can be a dot product operation of the vectors.

[0119] In step 540, the server adds the adjusted feature to the third feature to obtain an aggregated feature, where the dimension of the aggregated feature is f. The adjusted feature, also known as the bias term, fine-tunes the third feature to improve the expressiveness of the aggregated feature. The server then adds the third feature vector obtained in step 530 to the adjusted feature vector element-by-element to obtain the final aggregated feature vector.

[0120] The first and second mapping parameters here are the result of decomposing a multidimensional data structure with the structure e*g*f. By decomposing this multidimensional data structure into the first and second mapping parameters, the server can flexibly transform and fuse between different dimensions, effectively combining the operation and maintenance information features with the first knowledge topology features. In actual applications, the values of the first and second mapping parameters are learned through an optimization algorithm during the training of the operation and maintenance information processing algorithm. These parameter values are continuously adjusted based on a large amount of training data to ensure that the final aggregated features are more effectively used for fault analysis.

[0121] The aggregated features constructed through steps 510-540 integrate the information of the operation and maintenance information features and the first knowledge topology features, and include both specific data information in the operation and maintenance process and contextual information related to the first fault mode. This helps the server to more comprehensively and accurately identify fault modes and predict fault development trends in subsequent fault analysis. For example, when analyzing router faults, the operation and maintenance information features may reflect the current operating parameters of the router, such as CPU usage, memory usage, etc., while the first knowledge topology features reflect other possible fault modes related to the fault mode and the correlation between them. By constructing aggregated features, the server can fuse this information to more accurately determine the cause of the router fault and the possible scope of impact.

[0122] In another implementation of step 500, that is, based on the first knowledge topology feature and the operation and maintenance information feature, an aggregate feature is established, including:

[0123] Step 501: align each eigenvalue in the first knowledge topology feature with the eigenvalue in the operation and maintenance information feature to obtain an aggregate feature; the alignment process is inner product solution or addition, and the dimensions of the first knowledge topology feature, the operation and maintenance information feature, and the aggregate feature are equal.

[0124] Step 501 is another implementation of step 500. The server aligns each feature value in the first knowledge topology feature with the feature value in the operation and maintenance information feature to obtain an aggregate feature. The alignment is performed by inner product solution or summation. At the same time, the dimensions of the first knowledge topology feature, the operation and maintenance information feature, and the aggregate feature are equal. In an enterprise network environment, operation and maintenance personnel use an operation and maintenance terminal to perform daily inspections and configuration adjustments on routers. The operation and maintenance terminal records the relevant information and uploads it to the server. After a series of operations, the server obtains the first knowledge topology feature and the operation and maintenance information feature, and then constructs the aggregate feature according to step 501.

[0125] The first knowledge topology feature is obtained by the server based on the first knowledge topology branch using the first embedding layer of the operation and maintenance information processing algorithm. It reflects contextual information related to the first fault mode and provides a numerical representation of the fault mode and its associated relationships. The operation and maintenance information feature is obtained by the server based on the operation and maintenance information flow using the second embedding layer of the operation and maintenance information processing algorithm. It reflects specific data information during the operation and maintenance process, such as the router's CPU usage and memory usage.

[0126] If the inner product solution is used, assuming that the first knowledge topological feature is represented by a vector , the operation and maintenance information feature is represented as a vector , where n is the dimension of the feature. Then each element a of the aggregated feature vector A i The calculation method is If the addition and counterposition processing method is adopted, each element a of the aggregated feature vector A i The calculation method is .

[0127] The server can implement this alignment through a loop traversal operation. The server sequentially extracts the feature values of corresponding positions in the first knowledge topology feature and the operation and maintenance information feature, and calculates the feature values of corresponding positions in the aggregated feature using the inner product or summation rule. This simple and efficient processing method can quickly fuse the first knowledge topology feature and the operation and maintenance information feature to obtain the aggregated feature.

[0128] The aggregated features constructed in step 501 integrate the first knowledge topology features and the operation and maintenance information features, including both the contextual information of the failure mode and the specific data information during the operation and maintenance process. This helps the server more comprehensively and accurately identify failure modes and predict failure development trends in subsequent failure analysis.

[0129] In one implementation, the method provided by the embodiment of the present invention may further include:

[0130] Step 200A: If the operation and maintenance information flow further includes a second fault mode, a second knowledge topology branch is determined in the operation and maintenance knowledge topology structure, wherein the second fault mode belongs to a fault mode represented by a second topology unit in the operation and maintenance knowledge topology structure, and the second knowledge topology branch includes the second topology unit, topology units within a preset distance obtained based on the second topology unit, and a topology chain between the topology units;

[0131] Step 200B: Based on the second knowledge topology branch, the first embedding layer included in the operation and maintenance information processing algorithm is used to obtain the second knowledge topology feature;

[0132] At this time, step 500, establishing an aggregate feature based on the first knowledge topology feature and the operation and maintenance information feature, may include:

[0133] Step 500A: Obtain an aggregated feature based on the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature.

[0134] In step 200A, when the operation and maintenance information flow also includes the second fault mode, the server determines the second knowledge topology branch in the operation and maintenance knowledge topology structure. The operation and maintenance knowledge topology structure is constructed by the server based on a large amount of historical operation and maintenance data and fault cases, in which each topology unit represents a fault mode, and the topology chain represents the correlation between fault modes. For example, after analyzing the operation and maintenance information flow, the server determines that the first fault mode is "the router CPU usage is too high" and the second fault mode is "the router memory usage is too large." The topology unit corresponding to "the router memory usage is too large" is found in the operation and maintenance knowledge topology structure, that is, the second topology unit. Then, based on the preset distance, the server obtains the topology units that are related to the second topology unit and are within the preset distance. These topology units and the topology chains between them together constitute the second knowledge topology branch.

[0135] In step 200B, the server uses the first embedding layer included in the operation and maintenance information processing algorithm based on the second knowledge topology branch to obtain the second knowledge topology feature. The function of the first embedding layer is to convert the topological structure information into a feature vector that can be processed by a computer. The server inputs the topological units and topological chain information in the second knowledge topology branch into the first embedding layer. Through the mapping and transformation of the embedding layer, the second knowledge topology feature is obtained. For example, the first embedding layer may use a deep learning model, such as a graphical neural network (GNN), to encode the node and edge information in the second knowledge topology branch, obtaining a vector representation of each topological unit. These vectors are combined to form the second knowledge topology feature. Assuming that there are m topological units in the second knowledge topology branch, and each topological unit is a d-dimensional vector after passing through the first embedding layer, the second knowledge topology feature can be represented as an m×d matrix.

[0136] Based on this, in step 500A, the server generates aggregated features based on the first knowledge topology features, the second knowledge topology features, and the operation and maintenance information features. The first knowledge topology features are obtained by the server through the first embedding layer based on the first knowledge topology branch and reflect contextual information related to the first failure mode. The operation and maintenance information features are obtained by the server through the second embedding layer based on the operation and maintenance information flow and reflect specific data information during the operation and maintenance process. The server needs to fuse these three features to obtain a more comprehensive and accurate aggregated feature.

[0137] One way to implement step 500A is to perform a weighted combination of the first knowledge topology feature and the second knowledge topology feature, and then fuse them with the operation and maintenance information feature. The server can assign weights to the first knowledge topology feature and the second knowledge topology feature, multiply them by the weights, and then add them to obtain a target feature. Let the first knowledge topology feature be K1, the second knowledge topology feature be K2, the weight feature be W, and the target feature be T, then (in Then, the server multiplies the operation and maintenance information feature O by the first mapping parameter M1, multiplies the target feature T by the second mapping parameter M2, and transposes them. After multiplying the two, the adjustment feature B is added to obtain the aggregated feature A.

[0138] Another implementation method is to perform a weighted combination of the first knowledge topology feature and the second knowledge topology feature, calculate the average, and then connect them end to end with the operation and maintenance information feature. The server first multiplies the first knowledge topology feature and the second knowledge topology feature with the weight feature respectively to obtain the first temporary feature and the second temporary feature, and then averages them to obtain the target feature. Let the first temporary feature be , the second temporary feature is , the target feature is T'=(T1+T2) / 2. Then the target feature and the operation and maintenance information feature are connected end to end to obtain the aggregate feature. In addition, another feasible implementation method is to perform a weighted combination of the first knowledge topology feature and the second knowledge topology feature, perform a dot product, and then perform a positional addition with the operation and maintenance information feature. The server first obtains the first temporary feature and the second temporary feature, and then performs a dot product on them to obtain the target feature Finally, the target feature and the operation and maintenance information feature are added in place to obtain the aggregate feature A'=T''+O.

[0139] Through steps 200A-200B and step 500A, the server can fully utilize the multiple fault mode information contained in the operation and maintenance information flow to construct a more comprehensive knowledge topology branch, obtain corresponding knowledge topology features, and effectively integrate these features with the operation and maintenance information features to obtain aggregated features. This aggregated feature integrates the contextual information of multiple fault modes and operation and maintenance data information, helping the server to more accurately identify fault modes and predict fault development trends in subsequent fault analysis, providing operation and maintenance personnel with more targeted fault handling suggestions, thereby improving the efficiency and quality of network operation and maintenance and ensuring the stable operation of the enterprise network.

[0140] In one implementation, after step 100, obtaining the operation and maintenance information flow to be processed uploaded by the operation and maintenance terminal, the method further includes:

[0141] Step 1001: Perform fault mode detection on the operation and maintenance information flow to obtain a fault mode detection result;

[0142] Step 1002: If the failure mode detection result indicates that the operation and maintenance information flow includes two failure modes, then the two failure modes included in the operation and maintenance information flow are respectively compared with the failure modes in the operation and maintenance knowledge topology structure to obtain a failure mode comparison result for each failure mode;

[0143] Step 1003: If a fault mode comparison result indicates that a fault mode included in the operation and maintenance information flow matches a fault mode in the operation and maintenance knowledge topology structure, the matched fault mode is used as the first fault mode;

[0144] Step 1004: If the comparison result of another fault pattern indicates that another fault pattern included in the operation and maintenance information flow matches the fault pattern in the operation and maintenance knowledge topology structure, the matched another fault pattern is used as the second fault pattern.

[0145] In step 1001, the server performs a fault mode detection on the operation and maintenance information flow and obtains a fault mode detection result. The detection method can be referred to in the above content and will not be described here in detail.

[0146] In step 1002, when the failure mode detection result indicates that the operation and maintenance information flow includes two failure modes, the server compares the two failure modes included in the operation and maintenance information flow with the failure modes in the operation and maintenance knowledge topology structure respectively to obtain a failure mode comparison result for each failure mode.

[0147] In step 1003, when a fault pattern comparison result indicates that a fault pattern included in the operation and maintenance information flow matches a fault pattern in the operation and maintenance knowledge topology structure, the server uses the matched fault pattern as the first fault pattern.

[0148] In step 1004, if the server finds that another fault mode included in the operation and maintenance information stream matches a fault mode in the operation and maintenance knowledge topology structure, the server uses the matched fault mode as the second fault mode. If two fault modes in the operation and maintenance information stream match the operation and maintenance knowledge topology structure, the server identifies them as the first fault mode and the second fault mode, respectively, so that these two fault modes and their relationship can be comprehensively considered in subsequent fault analysis.

[0149] Through steps 1001-1004, the server can accurately identify possible failure modes from the operation and maintenance information stream and compare them with the operation and maintenance knowledge topology structure to determine the first failure mode and the second failure mode. This provides an important foundation for subsequent failure analysis and resolution. Based on the first and second failure modes, the server can respectively determine the first and second knowledge topology branches in the operation and maintenance knowledge topology structure. Combining the information in these two branches, the server can gain a more comprehensive understanding of the cause and potential impact of the failure.

[0150] After determining the first and second failure modes, a first knowledge topology branch and a second knowledge topology branch are respectively determined in the operation and maintenance knowledge topology structure based on the two failure modes. The first and second knowledge topology branches contain contextual information related to the first and second failure modes, helping the server to more comprehensively understand the cause and potential impact of the failure.

[0151] As an implementation of step 500A, that is, obtaining an aggregated feature based on the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature, includes:

[0152] Step 500A1: perform positional multiplication on each eigenvalue in the first knowledge topology feature and the eigenvalue of the weight feature to obtain a first temporary feature;

[0153] Step 500A2: performing positional multiplication on each eigenvalue in the second knowledge topology feature and the eigenvalue of the weight feature to obtain a second temporary feature;

[0154] Step 500A3: performing positional addition on each feature value in the first temporary feature and the feature value of the second temporary feature to obtain the target feature;

[0155] Step 500A4: Multiply the operation and maintenance information feature by the first mapping parameter to obtain a first feature, where the dimension of the operation and maintenance information feature is e;

[0156] Step 500A5: multiply the target feature by the second mapping parameter, and transpose the multiplication result to obtain the second feature, where the dimension of the target feature is g;

[0157] Step 500A6: Multiply the first feature by the second feature to obtain a third feature;

[0158] Step 500A7: Sum the third feature and the adjusted feature to obtain an aggregated feature.

[0159] Among them, the above-mentioned first mapping parameter and second mapping parameter are the results of decomposing the multidimensional data structure. The structure of the multidimensional data structure is e*g*f, the structure of the first mapping parameter is e*1*f, the structure of the second mapping parameter is 1*g*f, and the dimension of the aggregated feature is f.

[0160] In step 500A1, each eigenvalue in the first knowledge topology feature is multiplied by the eigenvalue of the weight feature to obtain a first temporary feature. The first knowledge topology feature is obtained by the server based on the first knowledge topology branch through the first embedding layer contained in the operation and maintenance information processing algorithm, which reflects the context information related to the first fault mode. The weight feature is a pre-set vector used to weight the first knowledge topology feature and the second knowledge topology feature to highlight the importance of different features. The server can obtain the first temporary feature by looping through the corresponding elements of the first knowledge topology feature and the weight feature and performing multiplication operations in sequence.

[0161] In step 500A2, each feature value in the second knowledge topology feature is bitwise multiplied by the feature value of the weight feature to obtain a second temporary feature. The second knowledge topology feature is obtained by the server based on the second knowledge topology branch, also through the first embedding layer, and reflects contextual information related to the second failure mode.

[0162] In step 500A3, each feature value in the first temporary feature is added to the feature value of the second temporary feature to obtain a target feature. The target feature is a weighted combination of the first knowledge topology feature and the second knowledge topology feature. The server loops through the corresponding elements of the first temporary feature and the second temporary feature, performing addition operations in sequence to obtain the target feature.

[0163] In step 500A4, the operation and maintenance information feature is multiplied by the first mapping parameter to obtain the first feature, where the dimension of the operation and maintenance information feature is e. The operation and maintenance information feature is obtained by the server based on the operation and maintenance information stream using the second embedding layer included in the operation and maintenance information processing algorithm, and reflects the specific data information during the operation and maintenance process. The first mapping parameter is a hyperparameter matrix with a structure of e×1×f, where e represents the dimension of the operation and maintenance information feature, and f is a pre-set dimensionality value used to control the dimensionality of the final aggregated feature.

[0164] In step 500A5, the target feature is multiplied by the second mapping parameter, and the multiplication result is transposed to obtain the second feature, where the dimension of the target feature is g. The second mapping parameter is a hyperparameter matrix with a structure of 1×g×f, where g represents the dimension of the target feature.

[0165] In step 500A6, the first feature is multiplied by the second feature to obtain the third feature. The server multiplies the first feature vector obtained in step 500A4 with the second feature vector obtained in step 500A5. The multiplication here can be a dot product of vectors. Through this multiplication, the server performs a preliminary fusion of the operation and maintenance information features and the integrated knowledge topology features, obtaining a new feature vector, namely the third feature.

[0166] In step 500A7, the third feature is summed with the adjustment feature to obtain an aggregate feature, where the dimension of the aggregate feature is f. The adjustment feature, also known as the bias term, fine-tunes the third feature to improve the expressiveness of the aggregate feature. In this way, the server completes the process of constructing the aggregate feature from the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature.

[0167] The first and second mapping parameters here are the result of decomposing a multidimensional data structure, which has a structure of e×g×f. By decomposing this multidimensional data structure into the first and second mapping parameters, the server can flexibly transform and fuse between different dimensions, thereby effectively combining the operation and maintenance information features, the first knowledge topology features, and the second knowledge topology features. In practical applications, the values of the first and second mapping parameters, weight features, and adjustment features are typically learned through an optimization algorithm during the training of the operation and maintenance information processing algorithm. The values of these parameters are continuously adjusted based on a large amount of training data to ensure that the final aggregated features can be better used for fault analysis.

[0168] The aggregated features constructed through steps 500A1-500A7 integrate the information of the operation and maintenance information features, the first knowledge topology features and the second knowledge topology features, and include both specific data information in the operation and maintenance process and context information related to the first fault mode and the second fault mode.

[0169] As another implementation of step 500A, that is, obtaining an aggregated feature based on the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature, includes:

[0170] Step 500A10: perform positional multiplication on each eigenvalue in the first knowledge topology feature and the eigenvalue of the weight feature to obtain a first temporary feature;

[0171] Step 500A20: performing positional multiplication on each eigenvalue in the second knowledge topology feature and the eigenvalue in the weight feature to obtain a second temporary feature;

[0172] Step 500A30: performing an alignment and averaging of each feature value in the first temporary feature and the feature value in the second temporary feature to obtain a target feature;

[0173] Step 500A40: Connect the target feature and the operation and maintenance information feature end to end to obtain the aggregated feature.

[0174] In step 500A10, the server multiplies each feature value in the first knowledge topology feature with the feature value of the weight feature to obtain a first temporary feature. The first knowledge topology feature is obtained by the server based on the first knowledge topology branch through the first embedding layer in the operation and maintenance information processing algorithm. It reflects the contextual information related to the first fault mode, such as the degree of association of other fault modes related to the fault mode. The weight feature is a pre-set vector used to weight the first knowledge topology feature and the second knowledge topology feature to highlight the importance of different features. The server can obtain the first temporary feature by looping through the corresponding elements of the first knowledge topology feature and the weight feature and performing multiplication operations in sequence.

[0175] In step 500A20, the server performs a positional multiplication on each feature value in the second knowledge topology feature by the feature value in the weight feature to obtain a second temporary feature. The second knowledge topology feature is obtained by the server based on the second knowledge topology branch, also through the first embedding layer, and reflects contextual information related to the second failure mode.

[0176] In step 500A30, the server performs a positional average of each feature value in the first temporary feature with the feature value in the second temporary feature to obtain a target feature. The target feature is the result of weighted averaging of the first knowledge topology feature and the second knowledge topology feature, and it integrates contextual information related to the two failure modes.

[0177] In step 500A40, the server concatenates the target feature and the operation and maintenance information feature to obtain an aggregated feature. The operation and maintenance information feature is obtained by the server based on the operation and maintenance information stream using the second embedding layer of the operation and maintenance information processing algorithm. It reflects specific data information during the operation and maintenance process, such as the router's CPU usage and memory usage.

[0178] Through steps 500A10-500A40, the server effectively integrates the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature to generate an aggregated feature. This aggregated feature contains both contextual information related to the first and second fault modes, as well as specific data from the operation and maintenance process. In subsequent fault analysis, the server can use this aggregated feature to more comprehensively and accurately identify fault modes and predict fault development trends, providing operation and maintenance personnel with more targeted troubleshooting recommendations. This improves the efficiency and quality of network operation and maintenance, ensuring the stable operation of the enterprise network.

[0179] As another implementation of step 500A, that is, obtaining an aggregated feature based on the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature, includes:

[0180] Step 500A100: performing positional multiplication on each eigenvalue in the first knowledge topology feature and the eigenvalue in the weight feature to obtain a first temporary feature;

[0181] Step 500A200: performing positional multiplication on each eigenvalue in the second knowledge topology feature and the eigenvalue in the weight feature to obtain a second temporary feature;

[0182] Step 500A300: Perform a point-wise multiplication on each eigenvalue in the first temporary feature and the eigenvalue in the second temporary feature to obtain a target feature;

[0183] Step 500A400: perform positional addition on each feature value in the target feature and the feature value in the operation and maintenance information feature to obtain an aggregate feature; the dimensions of the target feature, the operation and maintenance information feature, and the aggregate feature are equal.

[0184] In step 500A100, the server multiplies each eigenvalue in the first knowledge topology feature with the eigenvalue in the weight feature to obtain a first temporary feature. The first knowledge topology feature is obtained by the server through the first embedding layer of the operation and maintenance information processing algorithm based on the first knowledge topology branch. It reflects the contextual information related to the first fault mode. For example, in a network environment, if the first fault mode is "excessive CPU usage of the router", the first knowledge topology feature may contain associated information of related fault modes such as "abnormal port traffic". The weight feature is a pre-set vector, and its function is to weight different knowledge topology features to highlight the importance of certain features. The server can multiply the elements of the corresponding positions of the first knowledge topology feature and the weight feature in turn through a simple loop traversal operation to obtain the first temporary feature.

[0185] In step 500A200, the server performs a positional multiplication on each feature value in the second knowledge topology feature by the feature value in the weight feature to obtain a second temporary feature. The second knowledge topology feature is obtained by the server based on the second knowledge topology branch, also through the first embedding layer, and reflects contextual information related to the second failure mode.

[0186] In step 500A300, the server performs a point-wise multiplication on each feature value in the first temporary feature and the feature value in the second temporary feature to obtain a target feature. The target feature is a result of combining weighted information of the first knowledge topology feature and the second knowledge topology feature.

[0187] In step 500A400, the server performs a positional addition of each feature value in the target feature with the feature value in the operation and maintenance information feature to obtain an aggregated feature. The target feature, the operation and maintenance information feature, and the aggregated feature have equal dimensions. The operation and maintenance information feature is obtained by the server based on the operation and maintenance information stream using the second embedded layer of the operation and maintenance information processing algorithm. It reflects specific data information during the operation and maintenance process, such as the router's real-time CPU usage and memory usage percentage.

[0188] Through steps 500A100-500A400, the server effectively integrates the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature to generate an aggregated feature. This aggregated feature combines the contextual information of the two failure modes and the specific data information during the operation and maintenance process, helping the server to more comprehensively and accurately identify failure modes and predict failure development trends in subsequent fault analysis.

[0189] In the artificial intelligence-based fault operation and maintenance data transmission method, when the operation and maintenance information flow includes the first fault mode and the second fault mode, step 500A involves obtaining an aggregate feature based on the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature. It has three different implementation schemes. These three schemes will be compared below to analyze their advantages, similarities, and differences.

[0190] The common goal of the three aforementioned solutions in step 500A is to construct an aggregated feature based on the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature for subsequent fault analysis. Furthermore, in each case, the first and second knowledge topology features are first aligned with the weighted features to obtain corresponding temporary features. These temporary features are then further processed to obtain the target feature, which is then combined with the operation and maintenance information feature to obtain the aggregated feature.

[0191] Each of the three solutions above has its own unique advantages and applicable scenarios. In actual fault operation and maintenance data processing, we can determine the appropriate solution to construct aggregate features based on factors such as specific data characteristics, computing resources, and fault analysis requirements, thereby achieving more efficient and accurate fault analysis.

[0192] The present embodiment also provides a training process for the above-mentioned operation and maintenance information processing algorithm, which specifically includes the following steps:

[0193] Step T1: Obtain a set of training operation and maintenance information flows, wherein each training operation and maintenance information flow in the set includes a fault mode label, and the fault mode label included in each training operation and maintenance information flow belongs to the fault mode represented by the target topology unit in the operation and maintenance knowledge topology structure;

[0194] Step T2: For each training operation and maintenance information flow, determine the training knowledge topology branch corresponding to the training operation and maintenance information flow in the operation and maintenance knowledge topology structure, where the training knowledge topology branch includes the target topology unit, the topology units within a preset distance obtained based on the target topology unit, and the topology chain between the topology units;

[0195] Step T3: For each training operation and maintenance information flow, based on the training knowledge topology branch, the first embedding layer included in the operation and maintenance information processing algorithm is used to obtain the training knowledge topology features;

[0196] Step T4: for each training operation and maintenance information flow, based on the training operation and maintenance information flow, the second embedding layer included in the operation and maintenance information processing algorithm is used to obtain the training operation and maintenance information features;

[0197] Step T5: For each training operation and maintenance information flow, generate training aggregation features based on the training knowledge topology features and training operation and maintenance information features;

[0198] Step T6: For each training operation and maintenance information flow, based on the training aggregation features, the fault identification layer included in the operation and maintenance information processing algorithm is used to obtain the support distribution of the fault type corresponding to the training operation and maintenance information flow;

[0199] Step T7: Based on the fault type support distribution and fault mode label corresponding to each training operation and maintenance information flow, the operation and maintenance information processing algorithm is trained based on the loss function.

[0200] In step T1, the server obtains a set of training operation and maintenance information flows, wherein each training operation and maintenance information flow in the set includes a fault mode label, and the fault mode label contained in each training operation and maintenance information flow belongs to the fault mode represented by the target topology unit in the operation and maintenance knowledge topology structure. The set of training operation and maintenance information flows is a data set used by the server to train the operation and maintenance information processing algorithm. These information flows are collected from historical operation and maintenance data, and each information flow records relevant information in an operation and maintenance process, such as the operating parameters and operation records of the equipment. The fault mode label is an identifier of the fault mode corresponding to the operation and maintenance information flow, and clarifies the type of fault that occurred during this operation and maintenance process. The operation and maintenance knowledge topology structure is a topology structure constructed in advance by the server to describe the fault mode and its correlation. The target topology unit is the topology unit corresponding to the fault mode label.

[0201] In step T2, the server determines the training knowledge topology branch corresponding to the training operation and maintenance information flow in the operation and maintenance knowledge topology structure for each training operation and maintenance information flow, wherein the training knowledge topology branch includes the target topology unit, the topology units within the preset distance obtained based on the target topology unit, and the topology chain between the topology units. The preset distance is a pre-set parameter, which is the number of topology chains in the graph structure and is used to control the range of the training knowledge topology branch. Taking the target topology unit "router CPU usage is too high" as an example, the related failure modes may include "router memory usage is too large" and "router port traffic is abnormal". With the target topology unit as the center, the operation and maintenance knowledge topology structure is searched for topology units within the preset distance from it, and these topology units and the topology chains between them are combined to form a training knowledge topology branch.

[0202] In step T3, the server uses the first embedding layer included in the operation and maintenance information processing algorithm to obtain the training knowledge topology features for each training operation and maintenance information flow based on the training knowledge topology branch. The function of the first embedding layer is to convert the topological structure information in the training knowledge topology branch into a feature vector that can be processed by the computer. The server inputs the topological units and topological chain information in the training knowledge topology branch into the first embedding layer. Through the mapping and transformation of the embedding layer, the training knowledge topology features are obtained. For example, the first embedding layer may use a deep learning model, such as a graphical neural network (GNN), to encode the node and edge information in the training knowledge topology branch, obtaining a vector representation of each topological unit. These vectors are combined to form the training knowledge topology features.

[0203] In step T4, the server obtains the training operation and maintenance information features for each training operation and maintenance information stream based on the training operation and maintenance information stream using the second embedding layer included in the operation and maintenance information processing algorithm. The second embedding layer is used to convert the raw data in the training operation and maintenance information stream into a feature vector. The training operation and maintenance information stream contains various types of data, such as numerical equipment operating parameters, text-based operation records, etc. The second embedding layer processes and converts these data to extract valuable feature information. For numerical data, the server can use normalization and feature scaling methods to scale the data to a specific range. For text data, the server can use word embedding technology, such as Word2Vec, to map words in the text to a low-dimensional vector space. Through the processing of the second embedding layer, the server converts the training operation and maintenance information stream into a feature vector, namely the training operation and maintenance information features.

[0204] In step T5, the server generates a training aggregate feature for each training operation and maintenance information stream based on the training knowledge topology features and the training operation and maintenance information features. The server can generate training aggregate features in a variety of ways, such as concatenating the training knowledge topology features and the training operation and maintenance information features, performing weighted summation, and so on. One method is to multiply the training knowledge topology features by a weight matrix, and the training operation and maintenance information features by a weight matrix, and then add the two results to obtain the training aggregate feature. By generating training aggregate features, the server integrates the contextual information of the fault mode with the operation and maintenance data information, providing more comprehensive information for subsequent fault identification.

[0205] In step T6, for each training operation and maintenance information flow, based on the training aggregated features, the fault identification layer included in the operation and maintenance information processing algorithm is used to obtain the support distribution of the fault type corresponding to the training operation and maintenance information flow. The fault identification layer is the core component of the operation and maintenance information processing algorithm. Its function is to determine the fault type corresponding to the training operation and maintenance information flow based on the training aggregated features. The fault type support distribution represents the probability that the training operation and maintenance information flow belongs to each fault type. The server can use machine learning classification algorithms such as support vector machines (SVMs) and neural networks to implement the fault identification layer. Taking neural networks as an example, the server inputs the training aggregated features into the neural network. After the neural network undergoes multiple layers of calculation and transformation, it ultimately outputs the probability value for each fault type. These probability values constitute the fault type support distribution. For example, for the three fault types of "router CPU usage is too high", "router memory usage is too large", and "router port traffic is abnormal", the fault type support distribution may be [0.7, 0.2, 0.1], indicating that the probability that the training operation and maintenance information flow belongs to "router CPU usage is too high" is 0.7, the probability that it belongs to "router memory usage is too large" is 0.2, and the probability that it belongs to "router port traffic is abnormal" is 0.1.

[0206] In step T7, the operation and maintenance information processing algorithm is trained based on a loss function, based on the fault type support distribution and fault mode label corresponding to each training operation and maintenance information flow. The loss function is used to measure the difference between the fault type support distribution and the fault mode label. The server's goal is to minimize the loss function by adjusting the parameters in the operation and maintenance information processing algorithm. Examples of loss functions include cross-entropy loss and mean squared error loss. The server uses optimization algorithms such as stochastic gradient descent (SGD) and Adam to update the parameters in the operation and maintenance information processing algorithm based on the gradient of the loss function. Training is iterated continuously until the loss function converges to a smaller value, completing the training of the operation and maintenance information processing algorithm.

[0207] Please refer to Figure 3 , is a structural block diagram of the server 120 of the present application. The server 120 includes a computing unit 1001, which can perform various appropriate actions and processes according to a computer program stored in a ROM 1002 (i.e., read-only memory) or a computer program loaded from a storage unit 1008 into a RAM 1003 (i.e., random access memory). Various programs and data required for the operation of the server 120 can also be stored in the RAM 1003. The computing unit 1001, ROM 1002, and RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004. The input unit 1006 can be any type of device that can input information to the server 120, such as receiving input digital or character information and generating key signal input related to user settings and / or function control of the server. The output unit 1007 can be any type of device that can present information, such as a display or a speaker.

[0208] The computing unit 1001 performs the various methods and processes described above. For example, in some embodiments, the method 200 may be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 1008. In some embodiments, part or all of the computer program may be loaded and / or installed on the server 120 via the ROM 1002 and / or the communication unit 1009. When the computer program is loaded into the RAM 1003 and executed by the computing unit 1001, one or more steps of the method described above may be performed.

Claims

1. A fault operation and maintenance data transmission method based on artificial intelligence, characterized in that: Applied to a server, the server being communicatively connected to an operation and maintenance terminal, the method comprises: Obtaining the operation and maintenance information flow to be processed uploaded by the operation and maintenance terminal; If the operation and maintenance information flow includes a first fault mode, a first knowledge topology branch is determined in a pre-deployed operation and maintenance knowledge topology structure, wherein each topology unit in the operation and maintenance knowledge topology structure represents a fault mode, each topology chain in the operation and maintenance knowledge topology structure represents a fault mode association, the first fault mode belongs to the fault mode represented by the first topology unit in the operation and maintenance knowledge topology structure, and the first knowledge topology branch includes the first topology unit, topology units within a preset distance obtained based on the first topology unit, and topology chains between topology units; Based on the first knowledge topology branch, obtaining a first knowledge topology feature through a first embedding layer included in the operation and maintenance information processing algorithm; Based on the operation and maintenance information flow, the second embedding layer included in the operation and maintenance information processing algorithm is used to obtain operation and maintenance information features; Establishing an aggregated feature based on the first knowledge topology feature and the operation and maintenance information feature; Based on the aggregation features, a fault identification layer included in the operation and maintenance information processing algorithm is used to obtain a fault analysis result of the operation and maintenance information flow, and the fault analysis result is transmitted to the operation and maintenance terminal.

2. The method according to claim 1, characterized in that After obtaining the operation and maintenance information flow to be processed uploaded by the operation and maintenance terminal, the method further includes: Performing fault mode detection on the operation and maintenance information flow to obtain a fault mode detection result; If the failure mode detection result indicates that the operation and maintenance information flow includes a failure mode, then comparing the failure mode included in the operation and maintenance information flow with the failure mode in the operation and maintenance knowledge topology structure to obtain a failure mode comparison result; If the fault mode comparison result indicates that the fault mode included in the operation and maintenance information flow exists in the operation and maintenance knowledge topology structure, the existing fault mode is used as the first fault mode.

3. The method according to claim 2, characterized in that If the fault mode detection result indicates that the operation and maintenance information flow includes a fault mode, comparing the fault mode included in the operation and maintenance information flow with the fault mode in the operation and maintenance knowledge topology structure to obtain a fault mode comparison result, including: If the failure mode detection result indicates that the operation and maintenance information flow includes multiple failure modes, obtaining a support coefficient corresponding to each of the multiple failure modes; The failure mode corresponding to the maximum support coefficient among the plurality of failure modes is used as the failure mode included in the operation and maintenance information flow; The failure mode included in the operation and maintenance information flow is compared with the failure mode in the operation and maintenance knowledge topology structure to obtain the failure mode comparison result.

4. The method according to claim 1, wherein If the operation and maintenance information flow includes the first fault mode, determining a first knowledge topology branch in a pre-deployed operation and maintenance knowledge topology structure includes: If the operation and maintenance information flow includes the first fault mode, taking the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure as the first topology unit; Acquire, according to the operation and maintenance knowledge topological structure, a topological unit group that is correlated with the first topological unit, wherein a distance between each topological unit in the topological unit group and the first topological unit is within the preset distance; Establishing the first knowledge topology branch according to the first topology unit, the topology unit group, and the topology chain between the topology units; Alternatively, if the operation and maintenance information flow includes the first fault mode, determining a first knowledge topology branch in a pre-deployed operation and maintenance knowledge topology structure includes: If the operation and maintenance information flow includes the first fault mode, taking the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure as the first topology unit; Acquire, according to the operation and maintenance knowledge topological structure, a topological unit group that is correlated with the first topological unit, wherein a distance between each topological unit in the topological unit group and the first topological unit is within the preset distance; If the operation and maintenance information flow includes a first fault mode correlation, obtaining, from the topology unit group, a first sub-topology unit group having the first fault mode correlation with the first topology unit according to the operation and maintenance knowledge topology structure; Establishing the first knowledge topology branch according to the first topology unit, the first sub-topology unit group, and the topology chain between the topology units; Alternatively, if the operation and maintenance information flow includes the first fault mode, determining a first knowledge topology branch in a pre-deployed operation and maintenance knowledge topology structure includes: If the operation and maintenance information flow includes the first fault mode, taking the topology unit corresponding to the first fault mode in the operation and maintenance knowledge topology structure as the first topology unit; Acquire, according to the operation and maintenance knowledge topological structure, a topological unit group that is correlated with the first topological unit, wherein a distance between each topological unit in the topological unit group and the first topological unit is within the preset distance; If the operation and maintenance information flow includes a first fault mode correlation and a second fault mode correlation, obtaining, in the topology unit group, according to the operation and maintenance knowledge topology structure, a second sub-topology unit group having at least one of the first fault mode correlation or the second fault mode correlation with the first topology unit; The first knowledge topology branch is established according to the first topology unit, the second sub-topology unit group, and the topology chain between the topology units.

5. The method according to claim 1, wherein The establishing of an aggregated feature based on the first knowledge topology feature and the operation and maintenance information feature includes: Multiplying the operation and maintenance information feature by a first mapping parameter to obtain a first feature, wherein the dimension of the operation and maintenance information feature is e; Multiplying the first knowledge topology feature by a second mapping parameter and transposing the product to obtain a second feature, wherein the feature of the first knowledge topology feature is g; multiplying the first feature by the second feature to obtain a third feature; Adding the adjustment feature to the third feature to obtain the aggregate feature; The first mapping parameter and the second mapping parameter are the results of decomposing a multidimensional data structure, the structure of the multidimensional data structure is e*g*f, the structure of the first mapping parameter is e*1*f, the structure of the second mapping parameter is 1*g*f, and the dimension of the aggregated feature is f; Alternatively, establishing an aggregate feature based on the first knowledge topology feature and the operation and maintenance information feature includes: Each eigenvalue in the first knowledge topology feature is aligned with the eigenvalue in the operation and maintenance information feature to obtain the aggregate feature; the alignment processing is inner product solution or addition, and the dimensions of the first knowledge topology feature, the operation and maintenance information feature and the aggregate feature are equal.

6. The method according to claim 1, characterized in that The method further comprises: If the operation and maintenance information flow further includes a second fault mode, determining a second knowledge topology branch in the operation and maintenance knowledge topology structure, wherein the second fault mode belongs to a fault mode represented by a second topology unit in the operation and maintenance knowledge topology structure, and the second knowledge topology branch includes the second topology unit, a topology unit within the preset distance obtained based on the second topology unit, and a topology chain between topology units; Based on the second knowledge topology branch, the first embedding layer included in the operation and maintenance information processing algorithm is used to obtain a second knowledge topology feature; An aggregate feature is established based on the first knowledge topology feature and the operation and maintenance information feature, including: The aggregate feature is obtained according to the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature.

7. The method according to claim 6, characterized in that After obtaining the operation and maintenance information flow to be processed uploaded by the operation and maintenance terminal, the method further includes: Performing fault mode detection on the operation and maintenance information flow to obtain a fault mode detection result; If the failure mode detection result indicates that the operation and maintenance information flow includes two failure modes, then the two failure modes included in the operation and maintenance information flow are respectively compared with the failure modes in the operation and maintenance knowledge topology structure to obtain a failure mode comparison result for each failure mode; If a fault mode comparison result indicates that a fault mode included in the operation and maintenance information flow matches a fault mode in the operation and maintenance knowledge topology structure, the matched fault mode is used as the first fault mode; If the comparison result of another fault mode indicates that another fault mode included in the operation and maintenance information flow matches the fault mode in the operation and maintenance knowledge topology structure, the matched another fault mode is used as the second fault mode.

8. The method according to claim 6, characterized in that The obtaining the aggregated feature according to the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature includes: Multiply each eigenvalue in the first knowledge topology feature by the eigenvalue of the weight feature to obtain a first temporary feature; Multiply each eigenvalue in the second knowledge topology feature by the eigenvalue of the weight feature to obtain a second temporary feature; Performing positional addition on each feature value in the first temporary feature and the feature value of the second temporary feature to obtain a target feature; Multiplying the operation and maintenance information feature by a first mapping parameter to obtain a first feature, where the dimension of the operation and maintenance information feature is e; Multiplying the target feature by a second mapping parameter and transposing the multiplication result to obtain a second feature, wherein the dimension of the target feature is g; multiplying the first feature by the second feature to obtain a third feature; Summing the third feature and the adjustment feature to obtain the aggregate feature; The first mapping parameter and the second mapping parameter are results of decomposing a multidimensional data structure, the structure of the multidimensional data structure is e*g*f, the structure of the first mapping parameter is e*1*f, the structure of the second mapping parameter is 1*g*f, and the dimension of the aggregated feature is f; Alternatively, obtaining the aggregate feature according to the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature includes: Multiply each eigenvalue in the first knowledge topology feature by the eigenvalue of the weight feature to obtain a first temporary feature; Multiply each eigenvalue in the second knowledge topology feature by the eigenvalue in the weight feature to obtain a second temporary feature; Performing an alignment average on each feature value in the first temporary feature and the feature value in the second temporary feature to obtain a target feature; Performing end-to-end connection on the target feature and the operation and maintenance information feature to obtain the aggregate feature; Alternatively, obtaining the aggregate feature according to the first knowledge topology feature, the second knowledge topology feature, and the operation and maintenance information feature includes: Multiply each eigenvalue in the first knowledge topology feature by the eigenvalue in the weight feature to obtain a first temporary feature; Multiply each eigenvalue in the second knowledge topology feature by the eigenvalue in the weight feature to obtain a second temporary feature; Performing a point-wise multiplication on each eigenvalue in the first temporary feature and the eigenvalue in the second temporary feature to obtain a target feature; Each feature value in the target feature is added to the feature value in the operation and maintenance information feature to obtain the aggregate feature; the dimensions of the target feature, the operation and maintenance information feature and the aggregate feature are equal.

9. The method according to claim 1, characterized in that The method further comprises: Acquire a set of training operation and maintenance information flows, wherein each training operation and maintenance information flow in the set of training operation and maintenance information flows includes a fault mode label, and the fault mode label included in each training operation and maintenance information flow belongs to a fault mode represented by a target topological unit in the operation and maintenance knowledge topological structure; For each of the training operation and maintenance information flows, determining a training knowledge topology branch corresponding to the training operation and maintenance information flow in the operation and maintenance knowledge topology structure, wherein the training knowledge topology branch includes the target topology unit, a topology unit within the preset distance obtained based on the target topology unit, and a topology chain between topology units; For each of the training operation and maintenance information flows, based on the training knowledge topology branch, the first embedding layer included in the operation and maintenance information processing algorithm is used to obtain training knowledge topology features; For each of the training operation and maintenance information flows, based on the training operation and maintenance information flows, the second embedding layer included in the operation and maintenance information processing algorithm is used to obtain training operation and maintenance information features; For each of the training operation and maintenance information flows, generating a training aggregation feature according to the training knowledge topology feature and the training operation and maintenance information feature; For each of the training operation and maintenance information flows, based on the training aggregation features, the fault identification layer included in the operation and maintenance information processing algorithm is used to obtain a support distribution of the fault type corresponding to the training operation and maintenance information flow; Based on the fault type support distribution and the fault mode label corresponding to each training operation and maintenance information flow, the operation and maintenance information processing algorithm is trained based on the loss function.

10. A fault operation and maintenance data transmission system, characterized in that: The system includes a server and an operation and maintenance terminal that communicate with each other, wherein the server includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so as to enable the at least one processor to perform the method according to any one of claims 1 to 9.

Images