Artificial Intelligence-Based Operation and Maintenance Log Event Correlation Analysis Method and System

Abstract

The present invention provides an operation and maintenance log event association analysis method and system based on artificial intelligence. First, an original operation and maintenance log set of a target system is obtained, and the original operation and maintenance log set contains multiple operation and maintenance log fragments. Feature extraction processing is then performed on the original operation and maintenance log set to obtain contextual semantic features and temporal behavior features of each operation and maintenance log fragment. Subsequently, a pre-trained association analysis model is called to perform association rule matching processing on the above features to generate an association rule set between the operation and maintenance log fragments. The association rule set contains a causal relationship definition and an event propagation path description. An operation and maintenance event optimization strategy is generated based on the association rule set. Finally, the operation and maintenance event optimization strategy is fed back to the operation and maintenance management interface of the target system to trigger system optimization operations. The method can efficiently analyze the association of operation and maintenance log events and improve the system operation and maintenance efficiency and stability.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an artificial intelligence-based operation and maintenance log event correlation analysis method and system. Background Art

[0002] In modern, complex information technology systems, operations and maintenance logs record various status and event information during system operation, serving as a crucial basis for system maintenance and troubleshooting. However, as systems continue to expand in size and complexity, the volume of operations and maintenance log data is exploding, and traditional operations and maintenance log analysis methods are gradually exposing numerous drawbacks.

[0003] Existing methods often analyze only individual operation and maintenance log fragments in isolation, ignoring the potential correlations between different log fragments. This results in an inability to fully and accurately understand the causes and propagation of system failures. When faced with complex system failures, operation and maintenance personnel struggle to quickly locate key information from massive amounts of log data and formulate effective operation and maintenance strategies. In addition, traditional methods lack a comprehensive consideration of the contextual semantics and temporal behavior of operation and maintenance logs, making it impossible to accurately mine the causal relationships and event propagation paths between logs. This results in a lack of scientific basis for operation and maintenance decisions, making it difficult to achieve timely system optimization and rapid failure recovery, which seriously affects the stability and reliability of the system. Summary of the Invention

[0004] In view of the above-mentioned problems, in combination with the first aspect of the present invention, an embodiment of the present invention provides an operation and maintenance log event correlation analysis method based on artificial intelligence, the method comprising:

[0005] Obtaining an original operation and maintenance log set of a target system, wherein the original operation and maintenance log set includes multiple operation and maintenance log fragments;

[0006] Performing feature extraction processing on the original operation and maintenance log set to obtain contextual semantic features and temporal behavior features of each operation and maintenance log segment;

[0007] Calling a pre-trained association analysis model to perform association rule matching processing on the contextual semantic features and temporal behavior features to generate an association rule set between the operation and maintenance log segments, wherein the association rule set includes a causal relationship definition and an event propagation path description of the operation and maintenance log segments in the system fault link;

[0008] generating an operation and maintenance event optimization strategy based on the association rule set, wherein the operation and maintenance event optimization strategy includes an event response priority and a system resource adjustment plan for each association rule in the association rule set;

[0009] The operation and maintenance event optimization strategy is fed back to the operation and maintenance management interface of the target system to trigger system optimization operations.

[0010] On the other hand, an embodiment of the present invention also provides an operation and maintenance log event correlation analysis system based on artificial intelligence, including a processor and a machine-readable storage medium, the machine-readable storage medium is connected to the processor, the machine-readable storage medium is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the machine-readable storage medium to implement the above method.

[0011] Based on the above aspects, the embodiment of the present invention realizes efficient analysis of the association of operation and maintenance log events. First, the original operation and maintenance log set is obtained and feature extraction is performed to obtain the contextual semantic features and temporal behavior features of each operation and maintenance log fragment. Then, the pre-trained association analysis model is called to perform association rule matching processing on these features, and a set of association rules is generated including the causal relationship definition and event propagation path description of the operation and maintenance log fragment in the system fault link. The intrinsic connection between the log fragments is deeply revealed. Based on the set of association rules, an operation and maintenance event optimization strategy is generated, including the event response priority and system resource adjustment plan for each association rule. Finally, the operation and maintenance event optimization strategy is fed back to the operation and maintenance management interface of the target system to trigger system optimization operations. It can make full use of the information in the operation and maintenance log, accurately locate the root cause of the system failure, and quickly formulate effective operation and maintenance strategies, which significantly improves the operation and maintenance efficiency and stability of the system and reduces the losses caused by system failures. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a schematic diagram of the execution flow of the operation and maintenance log event correlation analysis method based on artificial intelligence provided by an embodiment of the present invention.

[0013] Figure 2 This is a schematic diagram of exemplary hardware and software components of an artificial intelligence-based operation and maintenance log event correlation analysis system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0014] The present invention will be described in detail below with reference to the accompanying drawings. Figure 1 This is a flow chart of an artificial intelligence-based operation and maintenance log event correlation analysis method provided by an embodiment of the present invention. The artificial intelligence-based operation and maintenance log event correlation analysis method is introduced in detail below.

[0015] Step S110: obtaining an original operation and maintenance log set of the target system, wherein the original operation and maintenance log set includes a plurality of operation and maintenance log segments.

[0016] In this embodiment, the target system can be a financial trading system, which includes multiple key components, such as a trading front-end, a market information server, an order processing engine, a clearing system, and a database cluster. These components generate a rich variety of operation and maintenance logs during operation. The trading front-end records user trading requests, such as buy and sell orders, as well as information such as the time, quantity, and price of the order. The market information server records real-time market data, including stock prices, trading volume, and price fluctuations. The order processing engine records the order processing flow, such as order matching and execution status. The clearing system records transaction settlement information, such as fund transfers and securities delivery. The database cluster records data read and write operations, backup status, and more.

[0017] To collect these logs, the target system adopts a log collection architecture that combines centralized and distributed approaches. Lightweight log collection agents are deployed on each component, sending generated logs to a local log buffer. Log forwarders then centrally transmit the log data from the local buffer to a log storage center. The log storage center uses a distributed file system and database to store massive amounts of log data, ensuring log security and scalability. Finally, a collection of raw operation and maintenance logs is retrieved from the log storage center, containing a large number of operation and maintenance log fragments in various formats and contents.

[0018] Step S120: performing feature extraction processing on the original operation and maintenance log set to obtain contextual semantic features and temporal behavior features of each operation and maintenance log segment.

[0019] To extract valuable information from the raw operation and maintenance logs, feature extraction is required. This step consists of multiple sub-steps, which are explained in detail below.

[0020] Step S121: performing grammatical structure parsing processing on the log statements in the operation and maintenance log fragment, and splitting the log statements into multiple log word units, wherein the log word units include system component identifiers, operation instruction keywords and status descriptors.

[0021] Take a log statement in a financial transaction system as an example: "[2024-11-25 10:30:15] -[OrderProcessingEngine - Instance2] - [EXECUTE ORDER - BUY 100 SHARES OF ABCSTOCK AT $50] - [Status: PENDING] - [Error: Insufficient funds in account]".

[0022] When parsing this log statement's grammatical structure, it is divided into different sections based on delimiters (such as brackets and hyphens) within the log. "OrderProcessingEngine - Instance2" in "[OrderProcessingEngine - Instance2]" is the system component identifier, clearly indicating that this log entry was generated by the second instance of the order processing engine. In "[EXECUTE ORDER - BUY 100 SHARES OF ABC STOCK AT $50]," "EXECUTEORDER" and "BUY" are instruction keywords, describing the specific transaction. In "[Status: PENDING]," "PENDING" and "[Error: Insufficient funds in account]" are status descriptors; the former indicates the current order processing status, while the latter describes any problems encountered during order processing.

[0023] During the parsing process, considering the diversity of log formats, regular expression matching and pattern recognition are employed. For example, the regular expression "\[(.*?)\]" matches all information enclosed by square brackets. Based on the characteristics of each piece of information, system component identifiers, operation command keywords, and status descriptors are further distinguished. For ambiguous information, context and predefined rules are combined for judgment.

[0024] Step S122: calling a pre-trained feature encoder to perform context encoding processing on the multiple log word units to generate a semantic vector of the operation and maintenance log segment. The context encoding processing constructs a global semantic expression by capturing the dependency relationship between adjacent log word units.

[0025] After obtaining multiple log word units, we need to convert them into semantic vectors that computers can understand and process. This is done with the help of a pre-trained feature encoder. This feature encoder is trained on a large amount of log data and has good semantic representation capabilities. This step includes the following sub-steps:

[0026] Step S1221: input the log word unit into the word embedding layer of the pre-trained feature encoder, and convert the discrete log word unit into an initial word vector in a continuous space through distributed vector mapping.

[0027] The resulting log word units, such as "OrderProcessingEngine - Instance2," "EXECUTEORDER," and "BUY," are fed into the word embedding layer of the pre-trained feature encoder. The word embedding layer uses a distributed vector mapping method to map each discrete log word unit into a continuous vector space, forming an initial word vector. For example, "OrderProcessingEngine - Instance2" is mapped to a vector of a set dimension that contains the semantic information of the log word unit. By learning the co-occurrence relationships between words in a large amount of log data, the word embedding layer brings semantically similar log word units closer together in the vector space.

[0028] Step S1222: Input the initial word vector into the bidirectional attention layer of the feature encoder for contextual association analysis processing. The bidirectional attention layer calculates the semantic interaction weights between different log word units through the self-attention mechanism.

[0029] The resulting initial word vector is input into the bidirectional attention layer of the feature encoder. The bidirectional attention layer uses a self-attention mechanism to analyze the semantic interactions between different log word units. The self-attention mechanism determines the semantic interaction weights between each log word unit by calculating the similarity between each log word unit and other log word units. For example, there may be a strong semantic connection between "EXECUTE ORDER" and "BUY" because "BUY" is a specific form of the "EXECUTE ORDER" operation. The bidirectional attention layer calculates a high semantic interaction weight between these two log word units, indicating their close semantic connection. During the calculation process, the order and context of the log word units are taken into account to capture more accurate semantic interaction relationships.

[0030] Step S1223: performing weighted fusion on the initial word vectors according to the semantic interaction weights to generate a context-aware vector for each log word unit, wherein the context-aware vector includes context dependency information of the log word unit in the entire log sentence.

[0031] Based on the semantic interaction weights calculated by the bidirectional attention layer, the initial word vectors are weighted and fused. Specifically, the initial word vector of each log word unit is weighted and summed according to its semantic interaction weights with other log word units. For example, the initial word vector of the log word unit "EXECUTE ORDER" is weighted and fused with the semantic interaction weights of other log word units such as "BUY" and "100 SHARES OF ABC STOCK" to obtain the context-aware vector of "EXECUTE ORDER." This context-aware vector incorporates the contextual dependency information of "EXECUTE ORDER" within the entire log statement, taking into account its semantic relationship with other log word units.

[0032] Step S1224: Pooling is performed on the context-aware vector, and a semantic vector of uniform dimension is generated through a combination of maximum pooling and average pooling operations, wherein the window size and sliding step size of the pooling operation are kept consistent for all operation and maintenance log fragments, ensuring that the semantic vectors of different log fragments have the same feature dimension.

[0033] The obtained context-aware vector is pooled. A combination of maximum pooling and average pooling is used to generate a semantic vector of uniform dimension. Maximum pooling selects the maximum value in each pooling window as the output of the window, which can highlight the important features in the vector. Average pooling calculates the average value of the vector elements in each pooling window, which can smooth the features of the vector. For example, the context-aware vector is divided according to the set window size and sliding step size, and the vectors in each window are subjected to maximum pooling and average pooling operations respectively. The two results are then spliced or otherwise combined to obtain a semantic vector of uniform dimension. In order to ensure that the semantic vectors of different operation and maintenance log fragments have the same feature dimension, the window size and sliding step size of the pooling operation remain consistent for all operation and maintenance log fragments.

[0034] Step S1225: inputting the semantic vector into the output layer of the feature encoder for nonlinear transformation to obtain a standardized semantic vector expression. The standardization process eliminates the feature scale differences between different log segments.

[0035] The semantic vectors obtained through pooling are input to the output layer of the feature encoder. The output layer performs a nonlinear transformation on the semantic vectors, processing the vector elements using activation functions such as ReLU, to enhance the model's nonlinear expressiveness. The output layer also performs normalization to eliminate differences in feature scales between different log segments. For example, semantic vectors from different log segments may have significantly different numerical ranges. Normalization can unify the feature scales of these vectors into an appropriate range, making subsequent analysis and processing more stable and accurate.

[0036] Step S123: Determine the contextual relevance between the operation and maintenance log segments based on the semantic vector, and construct a contextual semantic feature according to the contextual relevance. The contextual relevance is used to quantify the logical relevance of different operation and maintenance log segments in the fault propagation path.

[0037] After obtaining the semantic vectors of the operation and maintenance log segments, in order to quantify the logical relevance of different operation and maintenance log segments in the fault propagation path, it is necessary to determine the contextual correlation between them and construct contextual semantic features based on this. This step includes the following sub-steps:

[0038] Step S1231: Calculate the similarity scores between the semantic vectors, where the similarity scores are obtained by vector inner product operation combined with normalization processing.

[0039] For each operation and maintenance log segment, the corresponding semantic vector has been obtained through the previous steps. Let the semantic vector of operation and maintenance log segment A be Va, and the semantic vector of operation and maintenance log segment B be Vb. To calculate the similarity score between these two semantic vectors, the vectors are first normalized. The purpose of normalization is to eliminate the influence of vector length on the similarity calculation, making the similarity calculation more focused on the vector's direction.

[0040] For vector Va, its normalized vector Va' is calculated as follows: each element in Va' is equal to the corresponding element in Va divided by the modulus of Va. Similarly, the normalized vector Vb' of Vb can be obtained.

[0041] Next, calculate the inner product of the normalized vectors Va' and Vb'. The inner product of two vectors is the sum of the multiplication of corresponding elements of the two vectors. A larger inner product indicates closer orientations between the two vectors, meaning more semantically similar. The resulting similarity score ranges from -1 to 1, with values closer to 1 indicating greater semantic similarity between the two operation and maintenance log segments.

[0042] Step S1232: performing temporal sliding window smoothing processing on the similarity scores to generate smoothed context relevance.

[0043] Since the similarity score may be affected by noise or instantaneous fluctuations, in order to obtain a more stable and reliable context relevance, the similarity score needs to be smoothed using a temporal sliding window.

[0044] Set a fixed-size time series sliding window, assuming the window size is W. Starting from the first score in the similarity score sequence, select W consecutive similarity scores. For each score within the window, calculate their average or weighted average. For example, for the similarity score of the i-th position, select the W scores before and after it as the center, and calculate the average of these scores as the smoothed context relevance of the i-th position.

[0045] By continuously moving the sliding window across the similarity score sequence and smoothing each position, we ultimately obtain a smoothed context relevance sequence. This smoothing process reduces noise interference and enables the context relevance to better reflect the long-term and stable logical correlation between operation and maintenance log segments.

[0046] Step S1233: concatenate the context relevance and the semantic vector, and map features of different dimensions to a unified semantic space through a fully connected network.

[0047] Concatenate the smoothed contextual relevance with the semantic vector. Assume the semantic vector has dimension D and the contextual relevance is a one-dimensional value. During concatenation, add the contextual relevance as a new dimension to the end of the semantic vector, forming a new feature vector with dimension D+1.

[0048] The concatenated feature vector is fed into a fully connected network. A fully connected network consists of multiple layers of neurons, each connected to all neurons in the previous layer. In a fully connected network, features of different dimensions are combined and transformed through a series of linear transformations and nonlinear activation functions, ultimately mapping them into a unified semantic space.

[0049] In this unified semantic space, the semantic relationships between different features are clearer and more comparable. For example, the original semantic vector and context relevance may represent different aspects of information. Through the mapping of the fully connected network, they can be better integrated in the new space, providing more effective feature representation for subsequent clustering and pattern recognition.

[0050] Step S1234: In the unified semantic space, a semi-supervised clustering algorithm is used to perform pattern division on the spliced features, wherein the cluster center is initialized to the feature vector corresponding to the predefined system component role identifier, and the semantic grouping of the operation and maintenance log fragments in the system failure scenario is identified and associated with the specific role identifier to obtain the semantic grouping result.

[0051] In the unified semantic space, a semi-supervised clustering algorithm is used to classify the patterns of the concatenated features. The semi-supervised clustering algorithm combines the advantages of supervised learning and unsupervised learning, using predefined information to guide the clustering process.

[0052] First, based on the system architecture and component functions, a series of system component role identifiers are predefined, such as "database server," "application server," and "network equipment." A corresponding feature vector is defined for each role identifier. These feature vectors can be obtained through analysis and statistics of historical operation and maintenance log data, or can be set by domain experts based on experience.

[0053] These predefined feature vectors are used as the initial values for cluster centers. The semi-supervised clustering algorithm then assigns the O&M log segments to different clusters based on the distance between the concatenated feature vectors and these initial cluster centers. During this assignment process, the algorithm continuously adjusts the positions of the cluster centers, increasing the similarity of feature vectors within each cluster and decreasing the similarity between clusters.

[0054] This method identifies semantic groupings of operation and maintenance log fragments in system failure scenarios. Each semantic grouping corresponds to a specific system component role identifier. Operation and maintenance log fragments are then associated with these role identifiers to generate semantic grouping results. For example, if all operation and maintenance log fragments in a cluster are related to "database server," then these log fragments are associated with the role identifier "database server."

[0055] Step S1235: constructing the contextual semantic feature based on the semantic grouping result, wherein the contextual semantic feature includes the role identification of the operation and maintenance log segment in the system operation context and the semantic weight distribution result.

[0056] Contextual semantic features are constructed based on the semantic grouping results. Contextual semantic features need to include the role identification of the operation and maintenance log fragment in the system operation context and the semantic weight distribution results.

[0057] For each operation and maintenance log fragment, its corresponding system component role identifier is determined based on the semantic grouping it belongs to. For example, if a log fragment is assigned to the semantic grouping "database server", its role identifier is "database server".

[0058] The semantic weight assigned reflects the importance of a log segment within its semantic grouping. The semantic weight is determined based on the distance between the log segment and the cluster center. The closer the distance to the cluster center, the more similar the log segment's characteristics are to the semantic grouping, resulting in a higher semantic weight. Conversely, the farther the distance from the cluster center, the lower the semantic weight.

[0059] When calculating semantic weights, a normalized approach can be used. Let's assume the distance between a log segment and the cluster center is d. Within this semantic group, the maximum distance between all log segments and the cluster center is Dmax, and the minimum distance is Dmin. The semantic weight w for this log segment can then be calculated using the formula w = (Dmax - d) / (Dmax - Dmin). This gives a semantic weight between 0 and 1.

[0060] The role identification and semantic weight information are combined to construct a contextual semantic feature. This contextual semantic feature can accurately reflect the role and semantic importance of the operation and maintenance log fragment in the system operation context.

[0061] Step S124: Perform time series distribution analysis on the generation timestamp of the operation and maintenance log fragment, extract the time series interval characteristics and event triggering frequency characteristics of the operation and maintenance log fragment, and fuse the time series interval characteristics and event triggering frequency characteristics to generate the time series behavior characteristics of the operation and maintenance log fragment. The time series interval characteristics reflect the continuity and burst pattern of event triggering, and the event triggering frequency characteristics reflect the event density within the preset time window. The fusion process eliminates redundant information through the feature dimensionality reduction algorithm and retains the key representation of the time series pattern.

[0062] After obtaining the operation and maintenance log fragments, their generated timestamps contain important timing information. In-depth time series distribution analysis of these timestamps can extract features that reflect the patterns of event triggering. This step includes the following sub-steps:

[0063] Step S1241: extracting a generation timestamp set of the operation and maintenance log fragments, and sorting the generation timestamp set in chronological order.

[0064] From the raw operation and maintenance log fragments, extract the generation timestamp corresponding to each log fragment to form a generation timestamp set. These timestamps record the specific moment when the log event occurred. Since subsequent analysis must be performed in chronological order, this generation timestamp set must be sorted.

[0065] The sorting process can use common sorting algorithms, such as quick sort and merge sort. Taking quick sort as an example, the basic idea is to select a base timestamp and divide the timestamps in the set into two parts: one smaller than the base timestamp and the other larger than the base timestamp. These two parts are then recursively sorted, ultimately resulting in a chronologically ordered set of generated timestamps. This sorted set clearly demonstrates the order in which log events occurred, laying the foundation for subsequent time series analysis.

[0066] Step S1242: Calculate the interval duration between adjacent generation timestamps in the sorted generation timestamp set, where the interval duration reflects the continuity and suddenness of event triggering.

[0067] After obtaining the chronologically ordered set of generation timestamps, calculate the intervals between two adjacent generation timestamps. Let the sorted generation timestamp set be T = {t1, t2, t3, …, tn}. Then the set of intervals between adjacent timestamps is ΔT = {Δt1, Δt2, …, Δtn-1}, where Δti = ti+1-ti (i = 1, 2, …, n-1).

[0068] These interval durations contain information about the continuity and suddenness of event triggering. If the interval duration is relatively stable and short, it indicates that the event triggering is highly continuous, possibly indicating that the system is in a stable operating mode, with events occurring sequentially and in a certain rhythm. If the interval duration fluctuates significantly, with alternating short and long intervals, it indicates that the event triggering is sudden, possibly indicating that the system is experiencing external interference or internal anomalies, resulting in irregular event occurrences.

[0069] Step S1243: performing distribution statistics processing on the interval duration to extract time series interval features that characterize the event triggering mode. The time series interval features include a central tendency index and a dispersion index of the interval duration.

[0070] In order to describe the event triggering pattern more comprehensively, it is necessary to perform distribution statistics on the interval duration set and extract the central tendency index and dispersion index.

[0071] Indices of central tendency are used to describe typical values of interval durations. Common indices of central tendency include the mean and median. The mean is the sum of all interval durations divided by the number of intervals, reflecting the overall average level of interval durations. The median is the middle value after arranging the interval durations from smallest to largest (if the number is even, the average of the two middle values is taken). It is less affected by extreme values and better represents the median level of the data.

[0072] Dispersion metrics describe the fluctuation in interval duration. Common dispersion metrics include standard deviation and variance. Standard deviation is the square root of variance, while variance is the average of the squares of the differences between each interval duration and the mean. Larger standard deviations and variances indicate greater fluctuations in interval duration and less regular event triggering. Conversely, smaller standard deviations and variances indicate more stable interval duration and more regular event triggering.

[0073] Through these central tendency indicators and dispersion indicators, the temporal interval characteristics of event triggering can be comprehensively characterized.

[0074] Step S1244: Count the number of event triggering of the operation and maintenance log segment within a preset time window to generate an event triggering frequency feature reflecting the density of events.

[0075] Set a preset time window, such as in hours or days. Within this time window, count the number of event triggers in the operation and maintenance log segments. Let the start time of the time window be t_start and the end time be t_end. Traverse the sorted set of generated timestamps T and count the number of timestamps that satisfy t_start ≤ ti ≤ t_end. This number is the number of event triggers within the time window.

[0076] By varying the size and position of the time window, the number of event triggers within different time periods is counted, yielding a series of event trigger count values. These event trigger count values constitute the event trigger frequency signature, reflecting the frequency of event occurrence within different time periods. A high number of event triggers within a given time window indicates frequent system activity during that time period, possibly indicating anomalies or peak traffic. Conversely, a low number of event triggers indicates a relatively stable or idle system.

[0077] Step S1245: Normalize the time series interval features and the event trigger frequency features, and perform dimensionality reduction processing on the normalized time series interval features and the event trigger frequency features through the principal component analysis method to generate the time series behavior features of the operation and maintenance log fragment. The dimensionality reduction processing retains the feature component with the largest variance in the original time series data.

[0078] Because time interval features and event trigger frequency features may have different dimensions and numerical ranges, they need to be normalized to ensure comparability in subsequent analysis. Normalization maps feature values to a set range. Common normalization methods include min-max normalization and z-score normalization.

[0079] Taking min-max normalization as an example, for a feature vector X = {x1, x2, ..., xn}, its normalized vector X' = {x1', x2', ..., xn'}, where xi' = (xi-min(X)) / (max(X)-min(X)), min(X) and max(X) are the minimum and maximum values in the feature vector X. In this way, both the time series interval features and the event trigger frequency features are normalized to the range of [0, 1].

[0080] After normalization, principal component analysis (PCA) is used to reduce the dimensionality of these two features. The basic idea of PCA is to find the directions with the largest variance in the original data and project the data onto these directions to achieve data dimensionality reduction. The specific steps are as follows:

[0081] First, the covariance matrix of the normalized time interval features and event trigger frequency features is calculated. The covariance matrix reflects the correlation between the various features.

[0082] Then, the covariance matrix is decomposed into eigenvalues and eigenvectors. The eigenvalues represent the variance corresponding to each eigenvector, and the eigenvectors represent the projection of the data in that direction.

[0083] Next, sort the eigenvectors by eigenvalue from largest to smallest and select the first k eigenvectors, where k is the feature dimension you want to retain after dimensionality reduction. The directions corresponding to these k eigenvectors are the directions with the largest variance.

[0084] Finally, the normalized feature data is projected onto these k feature vectors to obtain the reduced-dimensional feature data, which is the temporal behavior characteristics of the operation and maintenance log fragment. This dimensionality reduction eliminates redundant information in the original features, retains the key representations of the temporal pattern, and makes subsequent analysis more efficient and accurate.

[0085] Step S130: Call the pre-trained association analysis model to perform association rule matching processing on the context semantic features and temporal behavior features to generate an association rule set between the operation and maintenance log fragments, wherein the association rule set includes the causal relationship definition and event propagation path description of the operation and maintenance log fragments in the system fault link.

[0086] After obtaining the contextual semantic features and temporal behavior features, it is necessary to call the pre-trained association analysis model to perform association rule matching processing to generate a set of association rules between operation and maintenance log segments. This step includes the following sub-steps:

[0087] Step S131: Input the contextual semantic features and temporal behavior features into the feature fusion layer of the pre-trained association analysis model to obtain a fused feature vector. The feature fusion layer uses a gated recurrent unit to dynamically adjust the contribution ratio of different feature types.

[0088] Contextual semantic features and temporal behavioral features are input into the feature fusion layer of the pre-trained association analysis model. This feature fusion layer uses a gated recurrent unit (GRU) to dynamically adjust the contribution ratio of different feature types. A GRU is a recurrent neural network that contains update and reset gates. It dynamically determines which information to retain and which to update based on the input features. For example, the GRU dynamically adjusts the weights of contextual semantic features and temporal behavioral features during the fusion process based on their importance in the current task. Through GRU processing, the contextual semantic features and temporal behavioral features are fused to produce a fused feature vector.

[0089] Step S132: performing weight distribution processing on the fused feature vector through the attention mechanism layer of the association analysis model to obtain a weight distribution result, wherein the weight distribution processing captures the dependency relationship across log segments and the causal strength of event triggering.

[0090] The fused feature vector is input into the attention mechanism layer of the association analysis model. The attention mechanism layer assigns weights to the fused feature vector to capture the dependencies across log segments and the causal strength of event triggering. This step includes the following sub-steps:

[0091] Step S1321: performing linear projection processing on the fused feature vector to generate a query vector and a key vector, wherein the linear projection processing realizes feature space transformation through a trainable parameter matrix.

[0092] In the attention mechanism layer of the association analysis model, the input fused feature vector first undergoes a linear projection. This linear projection is accomplished using a trainable parameter matrix. Assume that the fused feature vector is represented by the letter F, and there are two trainable parameter matrices, denoted as Wq and Wk. Through matrix multiplication, the fused feature vector F is multiplied by the parameter matrix Wq to obtain the query vector Q, i.e., Q = F × Wq. Similarly, the key vector K is multiplied by the fused feature vector F with the parameter matrix Wk, i.e., K = F × Wk. The purpose of this linear projection is to map the fused feature vector into different feature spaces for subsequent similarity score calculation.

[0093] Step S1322: Calculate a similarity score between the query vector and the key vector, wherein the similarity score is obtained by a scaled dot product operation.

[0094] After obtaining the query vector Q and the key vector K, it is necessary to calculate the similarity score between them. The scaled dot product operation is used to implement this calculation. Specifically, the dot product of the query vector Q and the key vector K is first calculated, that is, each element in the query vector Q is multiplied by the element at the corresponding position in the key vector K, and then these products are added together to obtain an unscaled dot product result. In order to avoid the dot product result being too large, it also needs to be scaled. Assume that the scaling factor is dk, dk is usually the dimension of the key vector K. Divide the unscaled dot product result by the square root of dk to obtain the final similarity score. This similarity score reflects the degree of similarity between the query vector and the key vector. The higher the score, the more similar the two are.

[0095] Step S1323: normalize the similarity scores and convert the original scores into attention weights in the form of probability distribution.

[0096] After obtaining the similarity scores, they need to be normalized to convert the raw similarity scores into attention weights in the form of a probability distribution. Normalization is achieved using the softmax function. The softmax function takes each similarity score as input and, through exponential and normalization operations, converts it to a value between 0 and 1, with the sum of all attention weights being 1. This converts the similarity scores into a probability distribution, with each attention weight representing the importance of the corresponding key vector in the subsequent weighted summation process.

[0097] Step S1324: performing weighted summation on the key vectors according to the attention weights to generate a context-enhanced feature expression.

[0098] Based on the normalized attention weights, a weighted summation operation is performed on the key vectors. Specifically, each key vector is multiplied by its corresponding attention weight, and then these weighted key vectors are summed to obtain a new vector, which is the context-enhanced feature representation. This weighted summation method can highlight the information of key vectors with high similarity to the query vector, thereby enhancing the contextual relevance of the feature representation.

[0099] Step S1325: Perform a residual connection between the context-enhanced feature expression and the original fused feature vector, and capture dependency patterns at different abstraction levels through a multi-layer attention stacking structure to generate a weight distribution result that reflects the potential relationship of the event chain.

[0100] A residual connection is performed on the context-enhanced feature representation and the original fused feature vector. This residual connection adds the context-enhanced feature representation to the original fused feature vector to produce a new vector. This connection helps alleviate the vanishing gradient problem, allowing the model to better learn the differences between features. Then, a multi-layer attention stacking structure—that is, stacking multiple attention mechanism layers in sequence—further captures dependency patterns at different levels of abstraction. Each attention mechanism layer learns feature information at a different level, and this multi-layer stacking allows for a more comprehensive capture of the underlying relationships between event chains. Finally, after processing through the multi-layer attention stacking structure, a weight distribution result is generated that reflects the underlying relationships in the event chain.

[0101] Step S133: The fused feature vector is aggregated according to the weight distribution result to generate event association features. The aggregation process uses a graph neural network to mine the topological association structure between log events, where graph nodes are defined as semantic vectors of operation and maintenance log fragments, and graph edge weights are jointly determined by the temporal interval characteristics and context association between log fragments, and the edge connection range is limited to a preset time proximity threshold.

[0102] Based on the weight distribution results obtained previously, the fused feature vectors are aggregated. Here, a graph neural network is used to mine the topological correlation structure between log events. First, the semantic vectors of the operation and maintenance log segments are defined as graph nodes. Each semantic vector represents a log event, and these nodes constitute the basic elements of the graph. The weights of the graph edges are determined by the temporal interval characteristics and contextual relevance between log segments. The temporal interval characteristics reflect the temporal order of events, while the contextual relevance reflects the semantic relevance between events. By combining these two features, the strength of the correlation between events can be more accurately described. Furthermore, to avoid excessive graph complexity, the range of edge connections is limited to a preset temporal proximity threshold. In other words, edges are only established between log events that are close in time. In the graph neural network, through information transfer and aggregation between nodes, the feature representations of the nodes are continuously updated, ultimately generating event correlation features. This event correlation feature can reflect the topological correlation structure between log events.

[0103] Step S134: calling the rule generation layer of the association analysis model to perform rule matching processing on the event association features to obtain an initial association rule set. The rule generation layer identifies association rules that meet the support threshold through a frequent pattern mining algorithm.

[0104] The generated event correlation features are input into the rule generation layer of the association analysis model for rule matching to obtain the initial association rule set. This step involves the application of frequent pattern mining algorithms, and the mining process requires careful identification and screening of rules. Specifically, it includes the following sub-steps:

[0105] Step S1341: input the event association features into the fully connected network of the rule generation layer, and extract potential rule features through nonlinear transformation.

[0106] The fully connected network of the rule generation layer consists of multiple layers of neurons, each connected to all neurons in the previous layer. When event correlation features are input into the fully connected network, they undergo a series of linear transformations and nonlinear activation operations. Linear transformations are achieved by multiplying the input feature vector by a weight matrix and adding a bias term. Nonlinear activation functions (such as the ReLU function) introduce nonlinearity into the network, enabling it to learn more complex feature patterns. Through this process, the fully connected network can extract potential rule features from event correlation features. These potential rule features contain information about possible correlation patterns and causal relationships between log events, but further processing is required to clarify the specific rules.

[0107] Step S1342: Perform multi-label classification processing on the potential rule features to identify the concurrent association categories and sequential association categories between the operation and maintenance log fragments. When the same group of log fragments meet both concurrent and sequential association conditions, select the association category with a higher priority based on the confidence score of the causal relationship in the historical trigger record of the association rule.

[0108] After obtaining the potential rule features, multi-label classification is performed to identify concurrent and sequential associations between operation and maintenance log segments. Multi-label classification means that a single sample can belong to multiple categories simultaneously. In this scenario, operation and maintenance log segments may exhibit both concurrent associations (multiple events occurring simultaneously) and sequential associations (events occurring in a predefined order).

[0109] During the classification process, a classifier (such as a support vector machine or neural network classifier) is used to assess potential rule features. Based on trained model parameters, the classifier maps potential rule features to different association categories. When the same set of log fragments meets both concurrent and sequential association conditions, the higher-priority association category is selected based on the confidence score of the causal relationship in the association rule's historical trigger records. The confidence score reflects the reliability of the rule's causal relationship in historical events; a higher score indicates a more reliable causal relationship. By comparing the confidence scores of concurrent and sequential association rules, the association category with the higher score is selected as the final association category for the set of log fragments.

[0110] Step S1343: Determine the parallel constraint parameters in the event triggering condition according to the concurrent association category, where the parallel constraint parameters define resource competition rules when multiple events are triggered simultaneously.

[0111] For the identified concurrency association categories, it's necessary to determine the parallelism constraint parameters within the event triggering conditions. Parallelism constraint parameters define resource contention rules when multiple events are triggered simultaneously. During system operation, when multiple events occur simultaneously, competition for system resources (such as CPU, memory, and network bandwidth) may arise. Parallelism constraint parameters specify the resource allocation method and restrictions in this situation.

[0112] For example, if multiple events require access to database resources simultaneously, concurrency constraints can set an upper limit on the number of database connections each event can occupy, or allocate connections based on event priority. By defining concurrency constraints, you can avoid system performance degradation or errors caused by resource contention when multiple events are triggered simultaneously.

[0113] Step S1344: determining the timing constraint parameters in the event triggering condition according to the sequence association category, wherein the timing constraint parameters define the sequence of event triggering and the time window limitation.

[0114] For sequential associations, you need to determine the timing constraints for the event triggering conditions. These constraints define the order in which events are triggered and the time window within which they are triggered. In sequential associations, events must have a clear order, and this order must typically be satisfied within a specified timeframe.

[0115] For example, event A must occur before event B, and after event A occurs, event B must be triggered within a specific time window. Timing constraints can precisely describe these sequence and time window requirements. By defining timing constraints, you can ensure that events are triggered in the expected order and timeframe, thereby ensuring the normal operation of the system and the smooth execution of business processes.

[0116] Step S1345: Constructing a trigger condition expression of the association rule based on the parallel constraint parameter and the timing constraint parameter.

[0117] After determining the parallel and timing constraint parameters, you need to construct the trigger condition expression for the association rule based on these parameters. The trigger condition expression is a logical expression that describes the conditions that must be met for an event to be triggered.

[0118] For concurrent associations, the trigger condition expression includes the logical judgment of the parallel constraint parameters. For example, if the parallel constraint parameters specify the usage limit of a certain resource when multiple events are triggered simultaneously, the trigger condition expression will include the judgment of the resource usage. The association rule will only be triggered when the resource usage meets the conditions.

[0119] For sequential associations, the trigger condition expression includes logical judgments based on timing constraints. For example, if a timing constraint specifies that event B must be triggered within a certain time window after event A occurs, the trigger condition expression will include judgments about the occurrence times of events A and B. The association rule will only be triggered if both the time sequence and the time window requirements are met.

[0120] Step S1346: performing logical simplification processing on the trigger condition expression, binding the simplified trigger condition expression with the event response action, and generating an initial association rule set containing a complete causal relationship definition.

[0121] After obtaining the trigger condition expression for an association rule, it needs to be logically simplified. The purpose of logical simplification is to remove redundant parts from the expression, making it more concise and easier to understand. Boolean algebraic rules and methods can be used to simplify the trigger condition expression, such as combining similar terms and eliminating conflicting terms.

[0122] The simplified trigger condition expression is then bound to the corresponding event response action. An event response action is the action the system needs to perform when the association rule is triggered, such as adjusting system configuration or sending an alert. By binding the trigger condition expression to the event response action, an initial set of association rules containing a complete definition of causal relationships is generated. Each rule in this initial set of association rules specifies the event triggering condition and the response action the system should take.

[0123] Step S135: Pruning the initial association rule set to remove redundant rules and conflicting rules, and generating a simplified association rule set.

[0124] After obtaining the initial association rule set, it needs to be pruned to remove redundant and conflicting rules. Redundant rules are those that can be derived from other rules. Retaining these rules increases the complexity of the rule set and may lead to repeated processing. Conflicting rules are those that reach different conclusions under the same conditions, which leads to uncertainty when applying the rules. The pruning process is to analyze and compare each rule in the initial association rule set. For redundant rules, judgment is made based on the logical deduction and inclusion relationship between the rules. If a rule can be derived from other rules, it is deleted from the set. For conflicting rules, they are evaluated based on indicators such as the confidence and support of the rules. More reliable rules are retained and unreliable rules are deleted. After pruning, a streamlined association rule set is obtained. The rules in this streamlined association rule set are more concise and effective.

[0125] Step S136: Compare and verify the simplified association rule set with the historical event knowledge base. If any association rule conflicts with more than a preset proportion of historical rules in the knowledge base in terms of trigger conditions and causal relationship definitions, the abnormal trigger conditions and incorrect causal relationship definitions of the association rule are corrected according to the rule with the highest confidence in the knowledge base to generate the final association rule set.

[0126] The simplified association rule set is compared and verified against the historical event knowledge base. The historical event knowledge base stores past events and their associated rules. These rules have been verified in practice and have high reliability. During the comparison process, each rule in the simplified association rule set is checked for conflicts between its trigger conditions and causal relationship definitions and those in the historical event knowledge base. If a rule conflicts with more than a preset percentage of historical rules in the knowledge base in terms of trigger conditions and causal relationship definitions, it indicates that the rule may be an anomaly. In this case, the abnormal trigger conditions and incorrect causal relationship definitions of the association rule are corrected based on the rule with the highest confidence in the knowledge base. Confidence is a measure of rule reliability; higher confidence indicates more reliable rules. After comparison, verification, and correction, a final association rule set is generated. The association rules in this final association rule set consider both the association patterns in the current log data and historical experience, resulting in higher accuracy and reliability.

[0127] Step S140: generating an operation and maintenance event optimization strategy based on the association rule set, wherein the operation and maintenance event optimization strategy includes an event response priority and a system resource adjustment plan for each association rule in the association rule set.

[0128] After obtaining the final set of association rules, it is necessary to generate an operation and maintenance event optimization strategy based on these rules. This strategy aims to improve the operating efficiency and stability of the system and reduce the probability of failure. This step includes the following sub-steps:

[0129] Step S141: performing an influence evaluation process on each association rule in the association rule set to obtain a comprehensive scoring index.

[0130] Perform an impact assessment on each association rule in the association rule set to determine its importance to the system. For example, this step includes the following sub-steps:

[0131] Step S1411: extracting a historical trigger record set of the association rule, wherein the historical trigger record set includes event chain data and system response logs each time the rule is triggered.

[0132] The system extracts a set of historical trigger records for each associated rule from the system's log database. This set includes detailed information about each rule trigger, such as event chain data, which records the sequence and relationship of related events before and after the rule trigger; and system response logs, which record the system's processing when the rule triggers, including resource usage and error messages. By analyzing these historical trigger records, we can understand information such as the rule trigger frequency and trigger consequences.

[0133] Step S1412: Counting the number of triggers in the historical trigger record set, where the number of triggers reflects the activity level of the rule in the historical period.

[0134] Statistics are collected from the extracted historical trigger records to calculate the number of times each association rule was triggered. The number of triggers reflects the activity of the rule within the historical period. If a rule is triggered frequently, it indicates that it is frequently triggered during system operation, potentially having a significant impact on system stability and performance. Conversely, if it is triggered less frequently, the rule's impact is relatively small.

[0135] Step S1413: Analyze the system processing results after each association rule is triggered, and calibrate the trigger consequence level according to the service recovery time and resource consumption in the system processing results.

[0136] Analyze the system processing results after each association rule is triggered, focusing on service recovery time and resource consumption. Service recovery time refers to the time required for the system to recover from a fault or abnormal state caused by rule triggering to a normal operating state, which reflects the impact of rule triggering on system service availability. Resource consumption refers to the resources consumed by the system when processing rule triggering events, such as CPU usage, memory usage, network bandwidth, etc., which reflects the occupation of system resources by rule triggering. Based on the service recovery time and resource consumption, the trigger consequence level can be calibrated. For example, if the service recovery time is long and the resource consumption is large, it means that the consequences of rule triggering are more serious and the trigger consequence level is high; conversely, if the service recovery time is short and the resource consumption is small, it means that the consequences of rule triggering are relatively minor and the trigger consequence level is low.

[0137] Step S1414: Calculate an initial impact score based on the number of triggers and the level of trigger consequences, wherein the calculation process introduces a weight coefficient to balance the contribution ratio of frequency and severity.

[0138] The initial impact score for each association rule is calculated based on the statistically determined number of triggers and the calibrated trigger consequence level. During the calculation process, a weighting factor is introduced to balance the contribution of the number of triggers (frequency) and the trigger consequence level (severity). Assume that the number of triggers is represented by the letter N and the trigger consequence level is represented by the letter S, and the weighting factors are w1 and w2, respectively, with w1 + w2 = 1. The initial impact score I can then be calculated using the formula I = w1 × N + w2 × S. By adjusting the weighting factors, the influence of frequency or severity on the impact score can be emphasized based on actual circumstances.

[0139] Step S1415: performing time-attenuation processing on the initial influence score to obtain a time-attenuated influence score.

[0140] Taking into account the timeliness of historical data, the initial impact score is subjected to time-attenuation processing. As time passes, the reference value of historical data for the current system state gradually decreases. Time-attenuation processing can be implemented using a decay function, such as an exponential decay function. Assuming the initial impact score is I, the time is t, and the decay coefficient is λ, the impact score I' after time-attenuation can be expressed as I'=I×exp(-λt). In this way, newer rule trigger records contribute more to the impact score and better reflect the actual situation of the current system.

[0141] Step S1416: extracting matching parameters of the association rule in the current system environment, wherein the matching parameters are obtained by comparing the triggering conditions of the association rule with the real-time system status.

[0142] Extract the matching parameters for each association rule in the current system environment. The matching parameters reflect the degree of consistency between the association rule's triggering conditions and the real-time system status. The matching parameters are calculated by comparing the association rule's triggering conditions with real-time system status data, such as system resource usage and service operation status. For example, if the association rule's triggering condition is that CPU usage exceeds a certain threshold, and the current system's CPU usage is close to or exceeds this threshold, the matching parameter is high. Conversely, if the current system's CPU usage is far below the threshold, the matching parameter is low.

[0143] Step S1417: weighted fusion of the influence score after time-attenuation and the matching parameter to generate a final comprehensive score index.

[0144] The impact score after time-attenuation is weighted and combined with the matching parameter to obtain the final comprehensive score. Assume that the impact score after time-attenuation is I', the matching parameter is M, the weight coefficients are w3 and w4, and w3 + w4 = 1. The final comprehensive score C can be calculated using the formula C = w3 × I' + w4 × M. This final comprehensive score comprehensively considers the rule's historical impact, timeliness, and matching degree in the current system environment, and can more accurately reflect the impact of each association rule on the system.

[0145] Step S142: Prioritize the association rule set according to the comprehensive scoring index to generate a rule queue arranged in descending order of processing urgency.

[0146] The association rule set is prioritized based on the final comprehensive score of each association rule. A higher score indicates a greater impact on the system and a higher urgency for handling. Association rules are sorted from highest to lowest urgency to create a rule queue. Rules at the top of the queue are prioritized to ensure the system can respond promptly to potential issues and improve system stability and reliability.

[0147] Step S143: determining an event response priority of the target optimization operation based on the rule queue, wherein the event response priority is used to enable an event response action corresponding to an association rule that is ranked higher in the rule queue to obtain system resources first.

[0148] Based on the generated rule queue, the event response priority for the target optimization operation is determined. Event response actions corresponding to the highest-ranked association rules should be prioritized for system resource allocation to ensure that these important rules are processed promptly. For example, if the event response action corresponding to the first rule in the rule queue is to increase the number of instances of a certain service to improve system performance, then when executing the optimization operation, the required computing resources, memory resources, etc. should be prioritized for this event response action. By properly arranging event response priorities, the efficiency of system resource utilization can be improved, ensuring that the system can quickly and effectively respond to various operation and maintenance events.

[0149] Step S144: configuring a system resource adjustment plan according to the event response priority, wherein the system resource adjustment plan includes at least one of dynamically allocating computing resources, adjusting the number of service instances, and modifying the load balancing strategy.

[0150] Based on the determined objectives, optimize the operational event response priority and configure a system resource adjustment plan. System resource adjustment plans can include various methods, such as dynamically allocating computing resources, flexibly adjusting the allocation of CPU, memory, and other computing resources based on the requirements of different rules; adjusting the number of service instances. When the load on a service is too high, increase the number of service instances to improve processing power, and when the load is low, reduce the number of service instances to conserve resources; and modifying the load balancing strategy. By adjusting the load balancing algorithm, requests can be more reasonably distributed to different service instances, improving overall system performance. Based on the event response priority and the specific requirements of the rules, select the appropriate resource adjustment method and develop a detailed system resource adjustment plan.

[0151] Step S145: Encapsulate the event response priority and system resource adjustment plan into an executable operation and maintenance event optimization strategy. The encapsulation process includes adding a strategy version identifier, an effective time range, and a rollback mechanism description.

[0152] Encapsulate the determined event response priority and configured system resource adjustment plan into an executable operation and maintenance event optimization policy. During the encapsulation process, it is necessary to add a policy version identifier to distinguish different policy versions for easier management and tracking. At the same time, the policy's effective time range must be clearly defined, specifying the time period during which the policy is valid. Furthermore, a rollback mechanism must be described. If problems arise during policy execution or the expected results are not achieved, the system can be restored to its pre-policy state using the rollback mechanism. Through encapsulation, the event response priority and system resource adjustment plan are integrated into a complete, manageable operation and maintenance event optimization policy.

[0153] Step S146: Perform a grayscale execution test on the operation and maintenance event optimization strategy, split the operation and maintenance event optimization strategy into multiple sub-strategies and execute them in stages in the isolated sandbox environment of the target system in order of priority, detect the execution risk of each sub-strategy under limited resource constraints, and dynamically adjust the parameters of subsequent sub-strategies according to the feedback results of the sandbox environment to obtain the test results.

[0154] Perform grayscale execution testing on the encapsulated operation and maintenance event optimization strategy. First, split the operation and maintenance event optimization strategy into multiple sub-strategies. Each sub-strategy corresponds to a part of the rules in the rule queue and the corresponding resource adjustment operations. Then, execute these sub-strategies in stages in the isolated sandbox environment of the target system according to the order of priority. The isolated sandbox environment is a test environment isolated from the actual production environment. It can simulate the operation of the actual system but will not affect the production environment. When executing each sub-strategy, detect its execution risks under limited resource constraints, such as insufficient resources, service interruption, etc. According to the feedback results of the sandbox environment, dynamically adjust the parameters of subsequent sub-strategies, such as adjusting the resource allocation ratio, modifying the number of service instances, etc. Through grayscale execution testing, problems that may arise during the policy execution process can be discovered in advance to ensure the security and effectiveness of the policy in the actual production environment.

[0155] Step S147: Modify the parameter configuration in the operation and maintenance event optimization strategy according to the test result to generate a final version of the operation and maintenance event optimization strategy.

[0156] Based on the results of the grayscale execution test, the parameter configurations in the operation and maintenance event optimization strategy are revised. If insufficient resources are found in a sub-strategy during testing, the corresponding resource allocation can be increased. If adjustments to a service instance are found to cause system performance degradation, the number of service instances or the load balancing strategy can be adjusted. By revising the parameter configurations, the operation and maintenance event optimization strategy is optimized to improve its adaptability and effectiveness in actual production environments. The final version of the operation and maintenance event optimization strategy is fully tested and optimized, and can better ensure the stable operation of the system.

[0157] Step S150: Feedback the operation and maintenance event optimization strategy to the operation and maintenance management interface of the target system to trigger system optimization operations.

[0158] The final version of the operation and maintenance event optimization policy is fed back to the target system's operation and maintenance management interface. The operation and maintenance management interface receives the operation and maintenance event optimization policy and converts it into specific system operation instructions. Once the operation and maintenance event optimization policy is received, the operation and maintenance management interface parses and verifies the policy. The parsing process converts various components of the policy, such as event response priorities and system resource adjustment plans, into instructions that the system can understand and execute. The verification process verifies the legality and rationality of the policy to ensure that it does not harm the system.

[0159] After verification, the operation and maintenance management interface will trigger the corresponding system optimization operations in sequence according to the event response priority in the policy. For the dynamic allocation of computing resources in the system resource adjustment plan, the operation and maintenance management interface will interact with the system's resource management module. The resource management module is responsible for monitoring the resource usage of each component in the system, such as CPU, memory, storage, etc. When computing resources need to be allocated for an event response action corresponding to a rule, the operation and maintenance management interface will send instructions to the resource management module, and the resource management module will allocate the corresponding resources from the free resource pool to the specified component or service according to the instructions. For example, if the policy requires increasing CPU resources for a critical service, the resource management module will adjust the CPU scheduling policy of the server where the service is located and allocate more CPU time slices to the service.

[0160] To adjust the number of service instances, the operations management interface communicates with the system's container orchestration tool or service management platform. Container orchestration tools, such as Kubernetes, can automatically manage and schedule containerized service instances. When policies require increasing or decreasing the number of service instances, the operations management interface sends the corresponding instructions to the container orchestration tool. To increase the number of service instances, the container orchestration tool launches the new service instance on the appropriate node based on the preset image and configuration information. To decrease the number of service instances, the container orchestration tool selects the appropriate instance to shut down and releases the associated resources.

[0161] To modify the load balancing policy, the Operations and Maintenance Management API interacts with the system's load balancer. The load balancer is responsible for distributing client requests to multiple backend service instances to achieve balanced request processing and high availability. The Operations and Maintenance Management API sends new configuration information to the load balancer to modify the load balancing algorithm or adjust the weights of backend service instances. For example, if the policy requires distributing more requests to service instances with better performance, the Operations and Maintenance Management API adjusts the load balancer's weight distribution so that these high-performing instances receive more requests.

[0162] During system optimization operations, the O&M management interface monitors the execution status and system feedback in real time. If the operation is successful, system performance indicators and operational status will gradually improve, such as shortened service response times and increased resource utilization. The O&M management interface records this feedback for subsequent evaluation and analysis.

[0163] However, if an exception occurs during the operation, such as a resource allocation failure or a service instance startup failure, the operation and maintenance management interface will handle it according to the preset error handling mechanism. This error handling mechanism may include retrying the operation, rolling back the operation, or issuing an alert to notify the operation and maintenance personnel. For example, if a service instance fails to start, the operation and maintenance management interface will attempt to restart the instance a set number of times. If multiple attempts still fail, a rollback operation will be triggered, restoring the system to the state before the operation was performed, and an alert will be issued to notify the operation and maintenance personnel for further investigation and handling.

[0164] After the system optimization operation is completed, the operation and maintenance management interface will summarize and evaluate the entire process. The evaluation content includes the effectiveness of the policy execution, the improvement of system performance, and the efficiency of resource utilization. By analyzing these evaluation results, we can understand the effectiveness and shortcomings of the operation and maintenance event optimization strategy.

[0165] Furthermore, to ensure system security and data privacy, strict privacy protection and anti-leakage technologies are employed throughout the entire data collection and processing process. For example, when acquiring the original operation and maintenance log collection, the log data is encrypted, and only authorized modules and personnel can access and process this data. During the training and use of the association analysis model, technologies such as differential privacy are also employed to process the model's input and output data to prevent the leakage of sensitive information. At the same time, the system also implements a strict access control mechanism, assigning different permissions to users and modules with different roles, ensuring that only personnel and modules with appropriate permissions can collect, process, and use data.

[0166] During long-term system operation, as the system continues to evolve and develop, such as due to increased business demands and adjustments to the system architecture, the content and characteristics of the original operation and maintenance log collection will also change. Therefore, the correlation analysis model needs to be regularly updated and optimized. This update process involves collecting new operation and maintenance log data, re-extracting features, and retraining the model. When retraining the model, the model parameters and structure need to be adjusted to accommodate the new data characteristics and system changes. Simultaneously, the operation and maintenance event optimization strategy also needs to be adjusted accordingly to ensure that the strategy can continuously and effectively improve system performance and stability.

[0167] Training the association analysis model is a complex and critical process. First, a large amount of labeled training data is required. This data is extracted from historical operation and maintenance logs and manually annotated, including correlations and causal relationships between log segments. This training data is divided into a training set and a validation set. The training set is used for model training, while the validation set is used to evaluate the performance and generalization ability of the association analysis model.

[0168] The association analysis model's architecture comprises several key modules, including a feature fusion layer, an attention mechanism layer, and a rule generation layer. During training, optimization algorithms such as stochastic gradient descent are used to adjust the model's parameters. First, the feature data from the training set is input into the association analysis model. The feature fusion layer then fuses the contextual semantic features with the temporal behavioral features. In this layer, the gated recurrent unit dynamically adjusts the contribution ratio of different feature types based on the input features, enabling the association analysis model to better capture the correlations between different features.

[0169] The fused feature vector then enters the attention layer. Using a self-attention mechanism, the attention layer calculates the semantic interaction weights between different log segments, capturing cross-segment dependencies and the causal strength of event triggering. During this process, a query vector and a key vector are generated through linear projection, their similarity scores are calculated, and normalization is performed to obtain attention weights. The key vectors are weighted and summed according to the attention weights to generate a context-enhanced feature representation. This multi-layer attention stacking structure continuously captures dependency patterns at different levels of abstraction, enabling the association analysis model to more comprehensively understand the associations in the log data.

[0170] Next, the feature vector processed by the attention mechanism layer enters the rule generation layer. This layer uses a frequent pattern mining algorithm to identify association rules that meet a support threshold. During training, the association analysis model continuously adjusts parameters to make the generated association rules more accurate and reliable. Furthermore, the generated rules are pruned to remove redundant and conflicting rules, improving their quality and effectiveness.

[0171] During the training process, the validation set is used to evaluate the association analysis model's performance. Evaluation metrics include rule accuracy, recall, and F1 score. By continuously adjusting the parameters and structure of the association analysis model, the model's performance on the validation set is optimized. Model training is considered complete when the performance of the association analysis model on the validation set is stable and meets the preset performance requirements.

[0172] To further improve the performance and adaptability of association analysis models, techniques such as transfer learning can be employed. Transfer learning utilizes model parameters trained in other related fields or systems as the initial parameters for the current model, and then fine-tunes them based on current operation and maintenance log data. This reduces model training time and data requirements, while also improving the generalization and performance of the association analysis model.

[0173] In practical applications, association analysis models and operation and maintenance event optimization strategies are closely integrated with large-scale financial trading systems. The input data for the association analysis model is a collection of raw operation and maintenance logs collected from the system. After feature extraction, contextual semantic features and temporal behavioral features are obtained. The output data is a set of association rules between operation and maintenance log segments and the corresponding operation and maintenance event optimization strategies. In this way, the association analysis model and algorithm are integrated with the specific financial trading system scenario, enabling effective analysis and optimization of system operation and maintenance events, improving system stability and reliability, and ensuring the smooth progress of financial transactions.

[0174] Figure 2 A schematic diagram illustrates exemplary hardware and software components of an AI-based maintenance log event correlation analysis system 100, provided in some embodiments of the present application, that can implement the concepts of the present application. For example, the processor 120 can be used in the AI-based maintenance log event correlation analysis system 100 to perform the functions described in the present application.

[0175] The artificial intelligence-based operation and maintenance log event correlation analysis system 100 can be a general-purpose server or a special-purpose server, both of which can be used to implement the artificial intelligence-based operation and maintenance log event correlation analysis method of the present application. Although only one server is shown in this application, for convenience, the functions described in this application can be implemented in a distributed manner on multiple similar platforms to balance the processing load.

[0176] For example, the artificial intelligence-based operation and maintenance log event correlation analysis system 100 may include a network port 110 connected to the network, one or more processors 120 for executing program instructions, a communication bus 130, and storage media 140 in different forms, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the artificial intelligence-based operation and maintenance log event correlation analysis system 100 may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The method of the present application can be implemented according to these program instructions. The artificial intelligence-based operation and maintenance log event correlation analysis system 100 also includes an I / O interface 150 between the computer and other input and output devices.

[0177] For ease of explanation, only one processor is described in the artificial intelligence-based operation and maintenance log event correlation analysis system 100. However, it should be noted that the artificial intelligence-based operation and maintenance log event correlation analysis system 100 in the present application may also include multiple processors, so the steps performed by one processor described in the present application may also be performed jointly or individually by multiple processors. For example, if the processor of the artificial intelligence-based operation and maintenance log event correlation analysis system 100 executes step A and step B, it should be understood that step A and step B may also be performed jointly by two different processors or individually in one processor. For example, the first processor executes step A, the second processor executes step B, or the first processor and the second processor execute steps A and B together.

[0178] In addition, an embodiment of the present invention further provides a readable storage medium, in which computer-executable instructions are preset. When a processor executes the computer-executable instructions, the above-mentioned artificial intelligence-based operation and maintenance log event correlation analysis method is implemented.

[0179] It should be noted that in order to simplify the description of the present invention and thus help understand one or more embodiments of the invention, in the foregoing description of the embodiments of the present invention, multiple features are sometimes combined into one embodiment, figure or description thereof.

Claims

1. An artificial intelligence-based operation and maintenance log event correlation analysis method, characterized in that: The method comprises: Obtaining an original operation and maintenance log set of a target system, wherein the original operation and maintenance log set includes multiple operation and maintenance log fragments; Performing feature extraction processing on the original operation and maintenance log set to obtain contextual semantic features and temporal behavior features of each operation and maintenance log segment; Calling a pre-trained association analysis model to perform association rule matching processing on the contextual semantic features and temporal behavior features to generate an association rule set between the operation and maintenance log segments, wherein the association rule set includes a causal relationship definition and an event propagation path description of the operation and maintenance log segments in the system fault link; generating an operation and maintenance event optimization strategy based on the association rule set, wherein the operation and maintenance event optimization strategy includes an event response priority and a system resource adjustment plan for each association rule in the association rule set; Feedback the operation and maintenance event optimization strategy to the operation and maintenance management interface of the target system to trigger system optimization operations; The calling of the pre-trained association analysis model performs association rule matching processing on the contextual semantic features and the temporal behavior features to generate an association rule set between the operation and maintenance log segments, including: Inputting the contextual semantic features and the temporal behavior features into the feature fusion layer of the pre-trained association analysis model to obtain a fused feature vector, wherein the feature fusion layer uses a gated recurrent unit to dynamically adjust the contribution ratio of different feature types; Performing weight distribution processing on the fused feature vectors through the attention mechanism layer of the association analysis model to obtain a weight distribution result, wherein the weight distribution processing captures the dependency relationship across log segments and the causal strength of event triggering; Aggregation processing is performed on the fused feature vectors based on the weight distribution results to generate event correlation features. The aggregation processing uses a graph neural network to mine the topological correlation structure between log events, where graph nodes are defined as semantic vectors of operation and maintenance log fragments, graph edge weights are determined by the temporal interval characteristics and contextual correlation between log fragments, and the edge connection range is limited to a preset time proximity threshold; Calling the rule generation layer of the association analysis model to perform rule matching processing on the event association features to obtain an initial association rule set, wherein the rule generation layer identifies association rules that meet a support threshold through a frequent pattern mining algorithm; Pruning the initial association rule set to remove redundant rules and conflicting rules to generate a simplified association rule set; The simplified association rule set is compared and verified with the historical event knowledge base. If any association rule conflicts with more than a preset proportion of historical rules in the knowledge base in terms of trigger conditions and causal relationship definitions, the abnormal trigger conditions and incorrect causal relationship definitions of the association rule are corrected according to the rule with the highest confidence in the knowledge base to generate the final association rule set.

2. The method for analyzing operation and maintenance log events based on artificial intelligence according to claim 1, characterized in that: The feature extraction process is performed on the original operation and maintenance log set to obtain the contextual semantic features and temporal behavior features of each operation and maintenance log segment, including: Performing grammatical structure parsing on the log statements in the operation and maintenance log fragment, and splitting the log statements into a plurality of log word units, wherein the log word units include a system component identifier, an operation instruction keyword, and a status descriptor; Calling a pre-trained feature encoder to perform context encoding processing on the multiple log word units to generate a semantic vector of the operation and maintenance log segment, wherein the context encoding processing constructs a global semantic expression by capturing the dependency relationship between adjacent log word units; Determining the context relevance between the operation and maintenance log segments based on the semantic vectors, and constructing context semantic features based on the context relevance, wherein the context relevance is used to quantify the logical relevance of different operation and maintenance log segments in the fault propagation path; A time series distribution analysis is performed on the generation timestamp of the operation and maintenance log fragment, and the time series interval characteristics and event triggering frequency characteristics of the operation and maintenance log fragment are extracted. The time series interval characteristics and event triggering frequency characteristics are fused to generate the time series behavior characteristics of the operation and maintenance log fragment. The time series interval characteristics reflect the continuity and burst pattern of event triggering, and the event triggering frequency characteristics reflect the event density within a preset time window. The fusion process eliminates redundant information and retains the key representation of the time series pattern through a feature dimensionality reduction algorithm.

3. The method for analyzing operation and maintenance log events based on artificial intelligence according to claim 2 is characterized in that: The calling of a pre-trained feature encoder to perform context encoding processing on the multiple log word units to generate a semantic vector of the operation and maintenance log segment includes: Inputting the log word unit into the word embedding layer of the pre-trained feature encoder, and converting the discrete log word unit into an initial word vector in a continuous space through distributed vector mapping; Inputting the initial word vector into the bidirectional attention layer of the feature encoder for contextual association analysis, the bidirectional attention layer calculates the semantic interaction weights between different log word units through a self-attention mechanism; Performing weighted fusion on the initial word vectors according to the semantic interaction weights to generate a context-aware vector for each log word unit, wherein the context-aware vector includes context dependency information of the log word unit in the entire log sentence; Pooling the context-aware vectors to generate semantic vectors of uniform dimension through a combination of maximum pooling and average pooling. The window size and sliding step size of the pooling operation are kept consistent for all operation and maintenance log segments to ensure that the semantic vectors of different log segments have the same feature dimension. The semantic vector is input into the output layer of the feature encoder for nonlinear transformation to obtain a standardized semantic vector expression. The standardization process eliminates the feature scale differences between different log segments.

4. The method for analyzing operation and maintenance log events based on artificial intelligence according to claim 2 is characterized in that: Determining the context relevance between the operation and maintenance log segments based on the semantic vectors, and constructing context semantic features according to the context relevance, includes: Calculating a similarity score between the semantic vectors, wherein the similarity score is obtained by a vector inner product operation combined with a normalization process; Performing a time series sliding window smoothing process on the similarity scores to generate a smoothed context relevance; Concatenating the context relevance with the semantic vector, and mapping features of different dimensions into a unified semantic space through a fully connected network; In the unified semantic space, a semi-supervised clustering algorithm is used to perform pattern division on the spliced features, wherein the cluster center is initialized to the feature vector corresponding to the predefined system component role identifier. The semantic grouping of the operation and maintenance log fragments in the system failure scenario is identified and associated with the specific role identifier to obtain the semantic grouping result; The contextual semantic feature is constructed based on the semantic grouping result, and the contextual semantic feature includes a role identification of the operation and maintenance log segment in the system operation context and a semantic weight distribution result.

5. The method for analyzing operation and maintenance log events based on artificial intelligence according to claim 2 is characterized in that: The time series distribution analysis processing is performed on the generation timestamp of the operation and maintenance log fragment, the time series interval characteristics and event triggering frequency characteristics of the operation and maintenance log fragment are extracted, and the time series interval characteristics and event triggering frequency characteristics are integrated to generate the time series behavior characteristics of the operation and maintenance log fragment, including: Extracting a generation timestamp set of the operation and maintenance log fragments, and sorting the generation timestamp set in chronological order; Calculate the interval duration between adjacent generation timestamps in the sorted generation timestamp set, where the interval duration reflects the continuity and suddenness of event triggering; Performing distribution statistics processing on the interval duration to extract time series interval features that characterize the event triggering pattern, wherein the time series interval features include a central tendency index and a dispersion index of the interval duration; Counting the number of event triggering of the operation and maintenance log fragment within a preset time window to generate an event triggering frequency feature reflecting the intensity of the event; The time series interval features and the event triggering frequency features are normalized, and the normalized time series interval features and the event triggering frequency features are subjected to dimensionality reduction processing by the principal component analysis method to generate the time series behavior features of the operation and maintenance log fragments. The dimensionality reduction processing retains the feature component with the largest variance in the original time series data.

6. The method for analyzing operation and maintenance log events based on artificial intelligence according to claim 1 is characterized in that: The weight distribution process is performed on the fused feature vector by the attention mechanism layer of the association analysis model to obtain a weight distribution result, including: Performing linear projection processing on the fused feature vector to generate a query vector and a key vector, wherein the linear projection processing realizes feature space transformation through a trainable parameter matrix; Calculating a similarity score between the query vector and the key vector, the similarity score being obtained by a scaled dot product operation; Normalizing the similarity scores to convert the original scores into attention weights in the form of probability distribution; performing weighted summation of the key vectors according to the attention weights to generate a context-enhanced feature expression; The context-enhanced feature expression is residually connected with the original fused feature vector, and the dependency patterns of different abstraction levels are captured through a multi-layer attention stacking structure to generate a weight distribution result that reflects the potential relationship of the event chain.

7. The method for analyzing operation and maintenance log events based on artificial intelligence according to claim 1 is characterized in that: The calling of the rule generation layer of the association analysis model performs rule matching processing on the event association features to obtain an initial association rule set, including: Inputting the event association features into the fully connected network of the rule generation layer, and extracting potential rule features through nonlinear transformation; Performing multi-label classification on the potential rule features to identify concurrent association categories and sequential association categories between the operation and maintenance log segments. When the same group of log segments meets both concurrent and sequential association conditions, selecting the association category with a higher priority based on the confidence score of the causal relationship in the historical trigger records of the association rule; Determining a parallel constraint parameter in an event triggering condition according to the concurrent association category, wherein the parallel constraint parameter defines a resource competition rule when multiple events are triggered simultaneously; Determine the timing constraint parameters in the event triggering condition according to the sequence association category, wherein the timing constraint parameters define the sequence of event triggering and the time window limit; Constructing a trigger condition expression of the association rule based on the parallel constraint parameter and the timing constraint parameter; The trigger condition expression is logically simplified, and the simplified trigger condition expression is bound to the event response action to generate an initial association rule set containing a complete causal relationship definition.

8. The method for analyzing operation and maintenance log events based on artificial intelligence according to claim 1 is characterized in that: Generating an operation and maintenance event optimization strategy based on the association rule set includes: Performing an impact evaluation on each association rule in the association rule set to obtain a comprehensive scoring index; Prioritize the association rule set according to the comprehensive scoring index to generate a rule queue sorted in descending order of processing urgency; Determining an event response priority of a target optimization operation based on the rule queue, wherein the event response priority is used to enable an event response action corresponding to an association rule ranked higher in the rule queue to obtain system resources first; Configuring a system resource adjustment plan based on the event response priority, wherein the system resource adjustment plan includes at least one of dynamically allocating computing resources, adjusting the number of service instances, and modifying the load balancing strategy; Encapsulating the event response priority and system resource adjustment plan into an executable operation and maintenance event optimization strategy, wherein the encapsulation process includes adding a strategy version identifier, an effective time range, and a rollback mechanism description; Conduct a grayscale execution test on the operation and maintenance event optimization strategy, splitting it into multiple sub-strategies and executing them in stages in order of priority in an isolated sandbox environment of the target system. Detect the execution risk of each sub-strategy under limited resource constraints, and dynamically adjust the parameters of subsequent sub-strategies based on the feedback from the sandbox environment to obtain test results. The parameter configuration in the operation and maintenance event optimization strategy is modified according to the test results to generate a final version of the operation and maintenance event optimization strategy.

9. An artificial intelligence-based operation and maintenance log event correlation analysis system, characterized in that: It includes a processor and a memory, the memory is connected to the processor, the memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to implement the artificial intelligence-based operation and maintenance log event correlation analysis method described in any one of claims 1 to 8.

Images