Knowledge graph-combined operation and maintenance root cause positioning method and system

Abstract

The invention provides an operation and maintenance root cause positioning method and system combined with a knowledge graph, and the method comprises the steps: firstly obtaining a historical operation and maintenance log data set of a target system containing a plurality of log sequences, each log sequence is composed of a system operation state record and an abnormal event mark, and carrying out the entity relation recognition processing of the historical operation and maintenance log data set; the method comprises the following steps: generating an operation and maintenance knowledge graph, calling a pre-trained node feature extraction model, executing attribute feature extraction operation on nodes corresponding to system component entities in the knowledge graph, and generating a node operation state feature set and a node environment association feature set; and performing multi-level feature fusion processing based on the node operation state feature set and the node environment association feature set to generate a root cause positioning feature set, and finally performing abnormal event backtracking analysis processing according to the root cause positioning feature set to generate a root cause positioning result of the target system and a corresponding operation and maintenance optimization strategy set. Therefore, the operation and maintenance root cause can be efficiently and accurately positioned, and stable operation of the system is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of digital operation and maintenance, and in particular, to an operation and maintenance root cause location method and system combined with a knowledge graph. Background Art

[0002] During the operation and maintenance of a target system, accurately and quickly locating the root cause is crucial for ensuring the stable operation of the system. With the continuous improvement of system complexity, traditional operation and maintenance root cause location methods face many challenges.

[0003] Currently, common operation and maintenance root cause location methods mainly rely on manual experience analysis or simple rule matching. Although manual experience analysis can solve problems to a certain extent, this method highly depends on the professional knowledge and experience of operation and maintenance personnel. It is not only inefficient but also prone to omissions or misjudgments when facing large-scale and complex systems. Simple rule matching methods are too rigid to adapt to various complex and changeable abnormal situations during system operation and are difficult to accurately capture the internal relationships between system components, between the operating environment and abnormal events. In addition, most of the existing methods do not fully utilize the rich information contained in historical operation and maintenance log data and cannot comprehensively analyze the system operation status and abnormal events from a global perspective, resulting in the accuracy and timeliness of root cause location being difficult to meet actual requirements. Summary of the Invention

[0004] In view of the above-mentioned problems, in combination with the first aspect of the present invention, embodiments of the present invention provide an operation and maintenance root cause location method combined with a knowledge graph, and the method includes: Obtain a historical operation and maintenance log data set of a target system, where the historical operation and maintenance log data set includes multiple log sequences, and each log sequence is composed of at least one system operation status record and a corresponding abnormal event marker; Perform entity relationship recognition processing on the historical operation and maintenance log data set to generate an operation and maintenance knowledge graph including system component entities, operating environment entities, and event association relationships; Call a pre-trained node feature extraction model to perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph to generate a node operation status feature set and a node environment association feature set; Perform multi-level feature fusion processing based on the node operation status feature set and the node environment association feature set to generate a root cause location feature set for each system component entity; Perform abnormal event backtracking analysis processing according to the root cause location feature set to generate a root cause location result of the target system and a corresponding operation and maintenance optimization strategy set.

[0005] On the other hand, an embodiment of the present invention further provides an operation and maintenance root cause location system combined with a knowledge graph, including a processor and a machine-readable storage medium. The machine-readable storage medium is connected to the processor. The machine-readable storage medium is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the machine-readable storage medium to implement the above method.

[0006] Based on the above aspects, by obtaining the historical operation and maintenance log data set of the target system, performing entity relationship recognition processing on the historical operation and maintenance log data set, constructing an operation and maintenance knowledge graph including system component entities, operating environment entities and event association relationships, and then calling the pre-trained node feature extraction model, performing attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph, generating a node operation status feature set and a node environment association feature set, deeply mining the feature information of the nodes in different aspects, performing multi-level feature fusion processing based on these feature sets, generating a root cause location feature set for each system component entity, comprehensively integrating the feature information related to root cause location, and finally performing abnormal event backtracking analysis processing according to the root cause location feature set, generating the root cause location result of the target system and the corresponding operation and maintenance optimization strategy set, realizing a complete process from feature extraction to root cause location to operation and maintenance optimization, greatly improving the accuracy and efficiency of operation and maintenance root cause location, and contributing to ensuring the stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 is a schematic execution flow diagram of an operation and maintenance root cause location method combined with a knowledge graph provided by an embodiment of the present invention.

[0008] Figure 2 is a schematic diagram of exemplary hardware and software components of an operation and maintenance root cause location system combined with a knowledge graph provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0009] The present invention will be specifically described below in conjunction with the accompanying drawings of the specification. Figure 1 is a schematic flow diagram of an operation and maintenance root cause location method combined with a knowledge graph provided by an embodiment of the present invention. The operation and maintenance root cause location method combined with the knowledge graph will be introduced in detail below.

[0010] Step S110: Obtain the historical operation and maintenance log data set of the target system. The historical operation and maintenance log data set includes multiple log sequences, and each log sequence is composed of at least one system operation status record and a corresponding abnormal event mark.

[0011] In this embodiment, taking the service system of a financial institution as an example, the financial institution service system can cover a variety of financial services, such as loan approval, customer account management, transaction processing, etc., and a large number of operation and maintenance logs will be generated during its daily operation.

[0012] To obtain the historical operation and maintenance log dataset, data needs to be collected from the log storage module of the financial institution service system. Assume that the log storage module stores logs in chronological order, and each log has a unique identifier. For example, collect data from the log storage with a time span of T in the past. In the collected logs, each log sequence contains system operation status records and anomaly event markers. For example, in log sequence A, the system operation status records may include the resource occupancy of the module for processing loan applications, including but not limited to the processor resource occupancy (denoted by P for the relevant records of this resource occupancy), the memory resource occupancy (denoted by M for the relevant records of this resource occupancy), etc., and the corresponding anomaly event marker, such as the anomaly marker for the delay in loan application processing. In this way, the historical operation and maintenance log dataset of the target system is obtained.

[0013] Step S120: Perform entity relationship recognition processing on the historical operation and maintenance log dataset to generate an operation and maintenance knowledge graph containing system component entities, operation environment entities, and event association relationships.

[0014] In this embodiment, based on the obtained historical operation and maintenance log dataset of the financial institution service system, entity relationship recognition processing is carried out to generate an operation and maintenance knowledge graph.

[0015] Step S121: Perform entity recognition processing on the system operation status records in the log sequence to identify the system component entity identifiers and operation environment entity identifiers involved in the system operation status records.

[0016] For the system operation status records in the log sequence of the financial institution service system, first perform structured parsing processing. For example, in a system operation status record about the customer account login verification module, through the set structured parsing rules, it is split into a component identification field, an environment parameter field, and a status description field. Assume that this record is "The customer account login verification module processes Z login requests per second under the network latency X and server load Y". After parsing, the component identification field is "customer account login verification module", the environment parameter field is "network latency X, server load Y", and the status description field is "processes Z login requests per second".

[0017] Step S1211: Call the predefined component entity dictionary to perform matching processing on the component identification field to identify the system component entity identifier corresponding to the component identification field.

[0018] In this embodiment, the predefined component entity dictionary contains the standard identifiers of various components within the financial institution service system. When the component identifier field "Customer Account Login Verification Module" is obtained, it is compared with each entry in the component entity dictionary. Assume that the entries in the dictionary are stored in a set format, for example, each entry contains the component name and the corresponding standard identifier. After traversing and comparing, an entry that matches "Customer Account Login Verification Module" is found, thereby identifying the system component entity identifier corresponding to this component identifier field, denoted as C1.

[0019] Step S1212: Invoke the predefined environment entity dictionary to perform a matching process on the environment parameter field, and identify the operating environment entity identifier corresponding to the environment parameter field.

[0020] The predefined environment entity dictionary stores the standard identifiers related to the operating environment of the financial institution service system. For the environment parameter field "Network Latency X, Server Load Y", "Network Latency X" and "Server Load Y" are respectively matched with the entries in the environment entity dictionary. Assume that the entries regarding network latency are stored with different latency ranges and the corresponding identifiers, and the entries regarding server load are stored with different load levels and the corresponding identifiers. Through matching, the operating environment entity identifier corresponding to "Network Latency X" is identified as E1, and the operating environment entity identifier corresponding to "Server Load Y" is identified as E2.

[0021] Step S1213: Associate the operating status parameter in the status description field with the system component entity identifier to generate the operating status attribute data of the system component entity identifier.

[0022] Associate the operating status parameter Z in the status description field "The number of login requests processed per second is Z" with the identified system component entity identifier C1. A corresponding relationship with C1 as the identifier and the operating status attribute data as Z is formed, that is, the operating status attribute data of the system component entity identifier C1 is Z, and this data will be used for further analysis of the component's operating condition later.

[0023] Step S122: Perform a relationship extraction process on the abnormal event markers in the log sequence, and extract the association relationship descriptor between the system component entity identifier and the operating environment entity identifier in the abnormal event markers.

[0024] For the abnormal event markers in the log sequence of the financial institution service system, a relationship extraction process is carried out to extract the association relationship descriptor between the system component entity identifier and the operating environment entity identifier.

[0025] Step S1221: Perform semantic parsing on the abnormal event label to identify the abnormal state description fragment corresponding to the system component entity identifier and the environmental change description fragment corresponding to the operating environment entity identifier in the abnormal event label.

[0026] For example, the abnormal event label is "When the network latency suddenly increases and the server load is too high, the login failure rate of the customer account login verification module increases significantly". Through semantic parsing technology, analyze the semantic structure of this label. Identify that the abnormal state description fragment corresponding to the system component entity identifier C1 (customer account login verification module) is "the login failure rate increases significantly", and the environmental change description fragments corresponding to the operating environment entity identifiers E1 (network latency-related environmental factors) and E2 (server load-related environmental factors) are "the network latency suddenly increases" and "the server load is too high", respectively.

[0027] Step S12211: Perform word segmentation on the abnormal state description fragment and the environmental change description fragment to generate multiple word nodes, and perform dependency syntactic analysis on the multiple word nodes to construct the dependency tree structure of the abnormal state description fragment and the environmental change description fragment.

[0028] Perform word segmentation on "the login failure rate increases significantly", "the network latency suddenly increases", and "the server load is too high" respectively. Suppose after word segmentation, the word nodes obtained from "the login failure rate increases significantly" are such as "login", "failure rate", "significantly", "increases"; the word nodes obtained from "the network latency suddenly increases" are such as "network", "latency", "suddenly", "increases"; the word nodes obtained from "the server load is too high" are such as "server", "load", "too high". Then, perform dependency syntactic analysis on these word nodes. For example, analyze the dependency relationship between the words in "the login failure rate increases significantly", there is a certain dependency relationship between "login" and "failure rate", and "significantly" modifies "increases", etc., to construct the dependency tree structure of this fragment. Similarly, construct the dependency tree structure for the other two environmental change description fragments, and finally obtain the dependency tree structure of the abnormal state description fragment and the environmental change description fragment.

[0029] Step S12212: Extract the root nodes and leaf nodes containing the system component entity identifier and the operating environment entity identifier from the dependency tree structure to generate a key node sequence, and perform path traversal on the key node sequence to identify all directed edge paths between the node corresponding to the system component entity identifier and the node corresponding to the operating environment entity identifier.

[0030] In the dependency tree structure, find the root nodes and leaf nodes related to the system component entity identifier C1 and the operating environment entity identifiers E1 and E2. For example, in the dependency tree structure, the key nodes related to C1 in the segment "The login failure rate has increased significantly", and the key nodes related to E1 and E2 in the segments "The network latency has suddenly increased" and "The server load is too high". Extract these key nodes to generate a key node sequence. Then perform a path traversal process on the key node sequence. Starting from the node corresponding to the system component entity identifier C1, find all the directed edge paths leading to the nodes corresponding to the operating environment entity identifiers E1 and E2. For example, through traversal, it is found that there is a path from the node related to C1 in "The login failure rate has increased significantly" to the node related to E1 in "The network latency has suddenly increased", and another path to the node related to E2 in "The server load is too high".

[0031] Step S12213: Perform a causal strength calculation process on each of the directed edge paths to generate a causal strength value for the directed edge path. Specifically, it includes: extracting the verb trigger word nodes in the directed edge path, and calculating the causal semantic similarity of the verb trigger word nodes in the historical event library; obtaining the time difference parameter between the node corresponding to the system component entity identifier and the node corresponding to the operating environment entity identifier, and performing a normalization process on the time difference parameter to generate a time proximity feature; performing a weighted summation process on the causal semantic similarity and the time proximity feature to generate the causal strength value of the directed edge path.

[0032] For each directed edge path, such as the path from C1 to E1 and the path from C1 to E2. First, extract the verb trigger word nodes in the path. Assume that in the path from C1 to E1, the verb trigger word node is "increase". Then, in the historical event library, calculate the causal semantic similarity between the verb trigger word node "increase" and the related semantics in the historical events through the conventional semantic analysis method in the related technology, denoted as S1. At the same time, obtain the time difference parameter between the node corresponding to the system component entity identifier C1 and the node corresponding to the operating environment entity identifier E1, denoted as T1. Perform a normalization process on T1, map it to the set range, and generate a time proximity feature, denoted as N1. Perform a weighted summation process on the causal semantic similarity S1 and the time proximity feature N1. Assume that the weighting coefficients are W1 and W2 respectively. Through the formula causal strength value = W1 × S1 + W2 × N1, calculate the causal strength value of the directed edge path from C1 to E1. Use the same method to calculate the causal strength value of the directed edge path from C1 to E2.

[0033] Step S12214: Perform a descending order arrangement process on the directed edge paths according to the causal strength values, and select the directed edge path corresponding to the highest causal strength value as the causal association path between the system component entity identifier and the operating environment entity identifier.

[0034] Compare the calculated causal strength values of the directed edge paths from C1 to E1 and from C1 to E2. Assume that the causal strength value from C1 to E1 is V1, and the causal strength value from C1 to E2 is V2. If V1 > V2, then arrange the directed edge path from C1 to E1 in descending order in the front. Select the directed edge path with the highest causal strength value, that is, the path from C1 to E1, as the causal association path between the system component entity identifier C1 and the operating environment entity identifier E1.

[0035] Step S12215: Generate the association relationship descriptor according to the causal association path, and mark the type of the association relationship descriptor as an abnormal event trigger relationship.

[0036] Based on the determined causal association path, that is, the path from C1 to E1, generate an association relationship descriptor. The content of the descriptor may be "There is a close association between the significant increase in the login failure rate of the customer account login verification module and the sudden increase in network latency", and mark the type of this association relationship descriptor as an abnormal event trigger relationship, indicating that this is a trigger association between the system component and the operating environment when an abnormal event occurs.

[0037] Step S123: Construct an initial entity relationship network according to the system component entity identifier, the operating environment entity identifier, and the association relationship descriptor.

[0038] Taking the financial institution service system as an example, integrate the identified system component entity identifier C1, the operating environment entity identifiers E1 and E2, and the generated association relationship descriptor. In the initial entity relationship network, use C1, E1, and E2 as nodes, and use the relationship described by the association relationship descriptor as the edge to construct the connection between nodes. For example, take C1 as one node, and E1 and E2 as the other two nodes respectively. According to the association relationship descriptor "There is a close association between the significant increase in the login failure rate of the customer account login verification module and the sudden increase in network latency", establish a directed edge between C1 and E1 to represent this association relationship, thereby constructing the initial entity relationship network.

[0039] Step S124: Perform attribute association processing on the initial entity relationship network, associate the operation status parameters corresponding to the system component entity identifier and the environment parameters corresponding to the operation environment entity identifier in the log sequence to the corresponding entity nodes in the initial entity relationship network, and generate an initial operation and maintenance knowledge graph. Among them, set a trigger rule based on the time period and system change events. When a preset trigger condition is detected, perform incremental entity relationship update processing on the initial operation and maintenance knowledge graph.

[0040] In the financial institution service system, for the constructed initial entity relationship network, perform attribute association processing. Associate the operation status attribute data Z of the system component entity identifier C1 generated previously, as well as the network latency X corresponding to the operation environment entity identifier E1 and the server load Y corresponding to E2, to the corresponding entity nodes of C1, E1, and E2 in the initial entity relationship network respectively. In this way, each node not only has its identification information but also is associated with corresponding attribute data, thus generating an initial operation and maintenance knowledge graph.

[0041] At the same time, set a trigger rule based on the time period and system change events. For example, the time period is set to be checked every M time units, and the system change events include software updates and hardware replacements of the service system. When it is detected that the time reaches every M time units, or a preset trigger condition such as a specific system change event occurs, perform incremental entity relationship update processing on the initial operation and maintenance knowledge graph. For example, after the system software is updated, new log records may bring new system component entity identifiers, operation environment entity identifiers, and the association relationships between them. At this time, it is necessary to update the initial operation and maintenance knowledge graph according to the new log data, adding new nodes, edges, and associated attributes, etc.

[0042] Step S130: Invoke a pre-trained node feature extraction model to perform attribute feature extraction operations on each node corresponding to the system component entity in the operation and maintenance knowledge graph, and generate a node operation status feature set and a node environment association feature set.

[0043] After the financial institution service system generates the initial operation and maintenance knowledge graph, invoke a pre-trained node feature extraction model to perform attribute feature extraction operations on each node corresponding to the system component entity in the operation and maintenance knowledge graph to obtain a node operation status feature set and a node environment association feature set.

[0044] Step S131: Traverse the system component entity nodes in the operation and maintenance knowledge graph, and obtain the operation status attribute data and environment parameter attribute data associated with the system component entity nodes.

[0045] In the operation and maintenance knowledge graph of the financial institution service system, start traversing each system component entity node. For example, for the system component entity node C1 corresponding to the customer account login verification module, obtain its associated operation status attribute data Z, that is, the number of login requests processed per second, and the associated environmental parameter attribute data, such as network latency X and server load Y. In this way, obtain the corresponding operation status attribute data and environmental parameter attribute data for each system component entity node, preparing for subsequent feature extraction.

[0046] Step S132: Invoke the state feature encoding unit in the node feature extraction model to perform time series feature extraction processing on the operation status attribute data, and generate a node operation status feature set of the system component entity node.

[0047] For the operation status attribute data Z of the obtained system component entity node C1, invoke the state feature encoding unit in the node feature extraction model.

[0048] Step S1321: Perform time window partitioning processing on the operation status attribute data to generate state parameter subsequences for multiple consecutive time intervals.

[0049] Assume that the time range is divided into multiple consecutive time windows, each with a length of t. Taking the operation status attribute data Z of the system component entity node C1 as an example, in chronological order, it is divided into multiple time windows of length t, and the data within each time window forms a state parameter subsequence. For example, the Z data in the time interval [0, t] forms a state parameter subsequence Z1, and the Z data in the time interval [t, 2t] forms another state parameter subsequence Z2, and so on.

[0050] Step S1322: Perform fluctuation feature extraction processing on each state parameter subsequence to generate a state fluctuation amplitude feature and a state change trend feature corresponding to each time interval.

[0051] For each state parameter subsequence, such as Z1, analyze the fluctuation of its data. Calculate the difference between the maximum value and the minimum value of the data in Z1 to obtain the state fluctuation amplitude feature, denoted as F1. At the same time, by analyzing the change trend of the data in Z1, for example, using methods such as linear regression to fit the data, obtain the state change trend feature, denoted as T1. Similarly, perform the same fluctuation feature extraction processing on other state parameter subsequences such as Z2, and obtain the corresponding state fluctuation amplitude features and state change trend features respectively.

[0052] Step S1323: Perform multi-scale fusion processing on the state fluctuation amplitude feature and the state change trend feature to generate a time series fusion feature of the state parameter subsequence.

[0053] In this step, considering that the state fluctuation amplitude feature and the state change trend feature have different emphases on reflecting the operating state of the system component entity at different time scales, in order to capture the operating state information more comprehensively, multi-scale fusion processing is performed.

[0054] First, set the state fluctuation amplitude feature set as F, which contains the fluctuation amplitude feature values corresponding to different time intervals, such as F1, F2, etc. Each feature value represents the fluctuation degree of the operating state parameters within the corresponding time interval. The state change trend feature set is set as T, which also contains the trend feature values corresponding to the time intervals, such as T1, T2, etc. These feature values reflect the change trend of the operating state parameters within the corresponding time intervals.

[0055] To perform multi-scale fusion, weight sets of different scales are defined. Suppose there are three different scales, and different weight sets W1, W2, and W3 are assigned respectively. Each weight set contains weight values corresponding to the elements in F and T. For example, in the W1 set, there is a weight w11 corresponding to F1, a weight w12 corresponding to T1, etc.; in the W2 set, there is a weight w21 corresponding to F1, a weight w22 corresponding to T1, etc.; in the W3 set, there is a weight w31 corresponding to F1, a weight w32 corresponding to T1, etc.

[0056] For each time interval, fusion is performed according to the weights of different scales. Taking the first time interval as an example, based on the weight set W1, calculate the fusion feature value M11 = w11×F1 + w12×T1; based on the weight set W2, calculate the fusion feature value M21 = w21×F1 + w22×T1; based on the weight set W3, calculate the fusion feature value M31 = w31×F1 + w32×T1.

[0057] Combine the fusion feature values of the same time interval under different scales into a vector. For the first time interval, obtain the fusion vector V1 = [M11, M21, M31]. Process other time intervals in the same way to obtain a series of fusion vectors V2, V3, etc.

[0058] These fusion vectors comprehensively consider the information of the state fluctuation amplitude feature and the state change trend feature under different scales. Arrange the fusion vectors of all time intervals in order to form the time-series fusion feature set of this state parameter subsequence, and use this as the time-series fusion feature information of the state parameter subsequence.

[0059] Step S1324: Aggregate the time-series fusion features of all time intervals to generate the node operating state feature set of the system component entity node.

[0060] In a financial institution service system, for the environmental parameter attribute data associated with the system component entity node C1, such as network latency X and server load Y, the environmental feature encoding unit in the node feature extraction model is called to generate a node environment association feature set. The specific steps are as follows: Step S133: Call the environmental feature encoding unit in the node feature extraction model to perform spatial feature extraction processing on the environmental parameter attribute data, and generate a node environment association feature set for the system component entity node.

[0061] Step S1331: Obtain the environmental parameter attribute data of the running environment entity nodes adjacent to the system component entity node in the operation and maintenance knowledge graph.

[0062] In the operation and maintenance knowledge graph, carefully search for the adjacent running environment entity nodes directly connected to the system component entity node C1. Suppose the function of C1 is to process customer transaction requests. Then the adjacent running environment entity nodes closely related to it may include the node E1 responsible for network transmission (corresponding to the environmental factors related to network latency X) and the server node E2 hosting transaction processing (corresponding to the environmental factors related to server load Y). Obtain the detailed environmental parameter attribute data related to network latency associated with E1. In addition to network latency X, it may also include related parameters such as network bandwidth and network packet loss rate, which are respectively set as B (network bandwidth) and L (network packet loss rate); obtain the detailed environmental parameter attribute data related to server load associated with E2. In addition to server load Y, it may also include related parameters such as CPU usage rate and memory usage rate, which are respectively set as U (CPU usage rate) and M (memory usage rate).

[0063] Step S1332: Perform a difference degree calculation process on the environmental parameter attribute data of the system component entity node itself and the environmental parameter attribute data of the adjacent running environment entity nodes, and generate an environmental parameter difference feature set.

[0064] For the basic network latency X0 and basic server load Y0 assumed to exist for the system component entity node C1 itself, calculate the difference degrees with the network latency X, network bandwidth B, network packet loss rate L of the adjacent running environment entity node E1 and the server load Y, CPU usage rate U, and memory usage rate M of E2 respectively.

[0065] Calculate the network latency difference degree \(D_X = |X - X_0|\), which represents the absolute value of the difference between the actual network latency and the baseline network latency, reflecting the deviation degree of the network latency; calculate the network bandwidth difference degree \(D_B = |B - B_0|\) (assuming that \(C1\) itself corresponds to the baseline network bandwidth \(B_0\)), reflecting the difference between the network bandwidth and the baseline value; calculate the network packet loss rate difference degree \(D_L = |L - L_0|\) (assuming that \(C1\) itself corresponds to the baseline network packet loss rate \(L_0\)), showing the change difference of the network packet loss rate.

[0066] Regarding the server load, calculate the server load difference degree \(D_Y = |Y - Y_0|\), reflecting the deviation of the server load from the baseline value; calculate the CPU usage difference degree \(D_U = |U - U_0|\) (assuming that \(C1\) itself corresponds to the baseline CPU usage \(U_0\)), reflecting the change in the CPU usage; calculate the memory usage difference degree \(D_M = |M - M_0|\) (assuming that \(C1\) itself corresponds to the baseline memory usage \(M_0\)), showing the difference in the memory usage.

[0067] Combine these difference degree values \(D_X\), \(D_B\), \(D_L\), \(D_Y\), \(D_U\), \(D_M\) together to form an environmental parameter difference feature set \(D\). This environmental parameter difference feature set \(D\) comprehensively reflects the differences in various environmental parameters between \(C1\) itself and the adjacent running environment entity nodes.

[0068] Step S1333: Perform a spatial correlation analysis process based on physical topology constraints on the environmental parameter difference feature set, and combine the component environmental dependency relationships defined in the system architecture document to determine the weighted environmental dependency strength features between the system component entity nodes and the adjacent running environment entity nodes.

[0069] According to the system architecture document, clarify the dependency relationships between the system component entity node \(C1\) and the adjacent running environment entity nodes \(E1\), \(E2\). For example, the document shows that \(C1\) has a relatively high dependency on the network latency in the network environment (\(E1\)), and also has a certain dependency on the network bandwidth and network packet loss rate; \(C1\) has a relatively high dependency on the server load in the server environment (\(E2\)), and also has a certain dependency on the CPU usage and memory usage.

[0070] Based on this dependency relationship, assign initial dependency weights to each difference feature in the environmental parameter difference feature set \(D\). Let the initial weight of the network latency difference degree \(D_X\) be \(Wd_X\), the initial weight of the network bandwidth difference degree \(D_B\) be \(Wd_B\), the initial weight of the network packet loss rate difference degree \(D_L\) be \(Wd_L\), the initial weight of the server load difference degree \(D_Y\) be \(Wd_Y\), the initial weight of the CPU usage difference degree \(D_U\) be \(Wd_U\), and the initial weight of the memory usage difference degree \(D_M\) be \(Wd_M\).

[0071] Meanwhile, physical topology constraints are considered. From the perspective of physical topology, if the network device (corresponding to E1) is physically close to the server (corresponding to C1) that processes customer transaction requests, and the network connection between them uses a high-speed dedicated line, then the impact of network latency, network bandwidth, and network packet loss rate on C1 may be more direct and significant. At this time, appropriately increase the weight values of Wd_X, Wd_B, and Wd_L; if the server (corresponding to E2) that bears transaction processing is in the same server cluster as C1, and C1 has a high degree of resource dependence on this server, then the impact of server load, CPU usage rate, and memory usage rate on C1 is more critical. Appropriately increase the weight values of Wd_Y, Wd_U, and Wd_M. After adjusting according to physical topology constraints, the final dependence weights Wd_X', Wd_B', Wd_L', Wd_Y', Wd_U', and Wd_M' are obtained.

[0072] Next, combined with the adjusted weights and the environmental parameter difference features, the weighted environmental dependence strength features are calculated. For the network latency difference degree D_X, its weighted environmental dependence strength feature is D_X × Wd_X'; for the network bandwidth difference degree D_B, its weighted environmental dependence strength feature is D_B × Wd_B'; for the network packet loss rate difference degree D_L, its weighted environmental dependence strength feature is D_L × Wd_L'; for the server load difference degree D_Y, its weighted environmental dependence strength feature is D_Y × Wd_Y'; for the CPU usage rate difference degree D_U, its weighted environmental dependence strength feature is D_U × Wd_U'; for the memory usage rate difference degree D_M, its weighted environmental dependence strength feature is D_M × Wd_M'.

[0073] These weighted environmental dependence strength features are combined together to form a weighted environmental dependence strength feature set W. This weighted environmental dependence strength feature set W comprehensively considers physical topology constraints and component environmental dependence relationships, and more accurately reflects the environmental dependence strength between C1 and adjacent running environment entity nodes.

[0074] Step S1334: Generate a node environment association feature set for the system component entity nodes according to the weighted environmental dependence strength features and the environmental parameter difference feature set.

[0075] Integrate the weighted environment dependence intensity feature set W and the environmental parameter difference feature set D. First, arrange the elements in the weighted environment dependence intensity feature set W in a set logical order. For example, sort them according to network-related and server-related respectively. The network-related weighted environment dependence intensity features D_X × Wd_X', D_B × Wd_B', D_L × Wd_L' are arranged in the front, and the server-related weighted environment dependence intensity features D_Y × Wd_Y', D_U × Wd_U', D_M × Wd_M' are arranged in the back.

[0076] Then, arrange the elements in the environmental parameter difference feature set D in the same order and concatenate them after W to obtain the node environment association feature set E. This node environment association feature set E comprehensively includes various information such as the spatial correlation and dependence relationship between the system component entity node C1 and the adjacent running environment entity node.

[0077] Step S140: Perform multi-level feature fusion processing based on the node running state feature set and the node environment association feature set to generate a root cause location feature set for each system component entity.

[0078] After obtaining the node running state feature set S and the node environment association feature set E of the system component entity node C1, start performing multi-level feature fusion processing to generate a root cause location feature set.

[0079] Step S141: Determine the feature dimension corresponding to each running state feature in the node running state feature set and the feature dimension corresponding to each environment association feature in the node environment association feature set.

[0080] For the node running state feature set S, it contains multiple running state features, such as the time series fusion features M1, M2, etc. Each time series fusion feature has its corresponding feature dimension. For example, M1 may be obtained by weighted fusion of the state fluctuation amplitude feature F1 and the state change trend feature T1, and its feature dimension is related to the combination of F1 and T1. Assume that F1 has dimension d1 and T1 has dimension d2, and the feature dimension of M1 after weighted fusion is d1 + d2. Similarly, determine the feature dimension of each environment association feature in the node environment association feature set E. For example, the environmental parameter difference feature D1 and the weighted environment dependence intensity feature D1×Wd1' both have their respective corresponding feature dimensions. Let the dimension of D1 be d3 and the dimension of D1×Wd1' be d4. Clarifying these feature dimensions is the basis for subsequent feature alignment and fusion.

[0081] Step S142: Perform feature alignment processing based on the self-attention mechanism on the node operating state feature set and the node environment association feature set to generate a standardized feature set with matching dimensions, and perform element-wise product processing on each standardized operating state feature and the corresponding environment association feature to generate a feature interaction vector.

[0082] Perform feature alignment processing on the node operating state feature set S and the node environment association feature set E using the self-attention mechanism. The self-attention mechanism can automatically learn the correlation between different features to adjust the dimensions of the features to match. Specifically, for each operating state feature in the node operating state feature set S, such as M1, the self-attention mechanism will calculate a weight matrix based on all the environment association features in the node environment association feature set E, and perform a weighted transformation on M1 through this weight matrix to make its dimension match that of an environment association feature in E. Similarly, perform similar processing on other operating state features in S, and perform corresponding dimension adjustment on the environment association features in E, so as to generate a standardized feature set with matching dimensions, denoted as S' and E' respectively.

[0083] After that, perform element-wise product processing on each standardized operating state feature and the corresponding environment association feature. For example, take an operating state feature M1' from the standardized feature set S', and take the corresponding environment association feature (assumed to be D1') in E'. Multiply each element in M1' by the corresponding element in D1' to obtain a new vector, which is the feature interaction vector, denoted as I1. In the same way, process all the corresponding features in S' and E' to generate multiple feature interaction vectors.

[0084] Step S143: Concatenate all the feature interaction vectors in the order of feature dimensions to generate a state-environment cross feature matrix.

[0085] Concatenate the generated multiple feature interaction vectors, such as I1, I2, etc., in the order of feature dimensions. Assume that the feature interaction vector I1 has dimension d5 and I2 has dimension d6. First, take I1 as the first row of the matrix, and then take I2 arranged in the order of feature dimensions as the second row of the matrix, and so on. In this way, generate a matrix, which is the state-environment cross feature matrix, denoted as M. This state-environment cross feature matrix integrates the interaction information between the node operating state features and the node environment association features.

[0086] Step S144: Perform feature dimensionality reduction processing on the state-environment cross feature matrix to generate a reduced-dimensional state-environment fusion feature set.

[0087] Process the state-environment cross-feature matrix M using a suitable feature dimensionality reduction method. For example, the principal component analysis (PCA) method can be used. The basic principle of PCA is to project high-dimensional data into a low-dimensional space through a linear transformation while retaining the main features of the data. For the state-environment cross-feature matrix M, PCA will calculate the covariance matrix of the data, and then find the eigenvalues and eigenvectors of the covariance matrix. According to the magnitudes of the eigenvalues, select the eigenvectors corresponding to the first few larger eigenvalues, and project the matrix M into the low-dimensional space spanned by these eigenvectors. Suppose after PCA processing, the matrix M is reduced from a high-dimensional space to a space of dimension n, obtaining the reduced matrix M'. Take each row in M' as an element to form the reduced state-environment fusion feature set, denoted as F.

[0088] Step S145: Perform a residual connection process on the reduced state-environment fusion feature set and the node running state feature set to generate a primary root cause localization feature set.

[0089] Perform a residual connection process on the reduced state-environment fusion feature set F and the original node running state feature set S. The purpose of the residual connection is to make the model easier to learn and train, and avoid problems such as gradient disappearance. For each feature in the node running state feature set S, such as M1, add it to the corresponding feature in the reduced state-environment fusion feature set F (assuming it is F1) (here under the premise of ensuring the same dimension), obtaining a new feature, denoted as R1 = M1 + F1. Process all corresponding features in S and F in the same way to generate the primary root cause localization feature set, denoted as P. This primary root cause localization feature set P contains both the information of the original node running state features and the information of the state-environment cross-features, preparing for the further generation of the final root cause localization feature set.

[0090] Step S146: Perform a non-linear transformation process on the primary root cause localization feature set to generate the root cause localization feature set of the system component entity.

[0091] Perform a non-linear transformation process on the primary root cause localization feature set P. Common non-linear transformations can use activation functions, such as the ReLU function. For each feature in the primary root cause localization feature set P, such as R1, perform a transformation through the ReLU function. The definition of the ReLU function is: if R1 is greater than 0, the output is R1 itself; if R1 is less than or equal to 0, the output is 0. Denote the feature after the ReLU function transformation as R1'. Perform the same non-linear transformation process on all features in P to generate the root cause localization feature set of the system component entity C1, denoted as G. This root cause localization feature set G contains the feature information after multi-level feature fusion and non-linear transformation, and will be used for subsequent abnormal event backtracking analysis processing.

[0092] Step S150: Perform an abnormal event backtracking analysis process according to the root cause localization feature set, and generate the root cause localization result of the target system and the corresponding set of operation and maintenance optimization strategies.

[0093] Based on the root cause localization feature set G of the system component entity C1, start to perform an abnormal event backtracking analysis process to generate the root cause localization result of the target system (financial institution service system) and the corresponding set of operation and maintenance optimization strategies.

[0094] Step S151: Perform an abnormal degree scoring process on the root cause localization feature set, and generate the abnormal degree scoring value of each system component entity.

[0095] To perform an abnormal degree scoring process on the root cause localization feature set G, first, an abnormal degree scoring function needs to be defined. Assume that this function compares the features in the feature set G with the feature reference values in the normal state. For each feature in the root cause localization feature set G, such as G1, there is a corresponding normal state reference value, denoted as G1_ref. Through a distance metric method, such as the Euclidean distance, calculate the distance between G1 and G1_ref, denoted as d_G1. Calculate the comprehensive distance (for example, through weighted summation, assuming the weights of each feature are W_G1, W_G2, etc.) of all features in G and their corresponding reference values, and obtain a comprehensive distance value, denoted as D. This comprehensive distance value D is the abnormal degree scoring value of the system component entity C1, denoted as A. In this way, the abnormal degree scoring value is generated for each system component entity.

[0096] Step S152: Perform a sorting process on the system component entities according to the abnormal degree scoring values, and generate a candidate root cause entity sequence.

[0097] Collect the abnormal degree scoring values of all system component entities, and then sort the system component entities in descending order. For example, in addition to the system component entity C1, there are other component entities C2, C3, etc., and they each have corresponding abnormal degree scoring values A1, A2, A3, etc. Compare these abnormal degree scoring values. Assume A1 > A2 > A3, then the system component entities are arranged in descending order of the abnormal degree scoring value as C1, C2, C3, generating a candidate root cause entity sequence, denoted as Seq. This candidate root cause entity sequence will be used as the basis for further analysis in the follow-up. Component entities with higher abnormal degree scoring values are more likely to be the root cause of the abnormal event.

[0098] Step S153: Perform an event association path verification process on each system component entity in the candidate root cause entity sequence to determine the association path matching degree between the system component entity and the historical abnormal event marker.

[0099] For each system component entity in the candidate root cause entity sequence Seq, such as C1, start to execute the event association path verification process. Review the previously generated operation and maintenance knowledge graph, which records system component entities, operating environment entities, and event association relationships. Search for all event association paths related to C1 in the knowledge graph. These paths connect C1 with historical anomaly event markers. For example, in the operation and maintenance knowledge graph, there may be a path from C1 to a historical anomaly event marker, and the path contains some intermediate nodes, such as the operating environment entity node E1 and some association relationship descriptions.

[0100] To determine the association path matching degree, first define a matching degree calculation method. This method can be based on factors such as the length of the path, the importance of the nodes on the path, and the strength of the association relationships on the path. For the path from C1 to the historical anomaly event marker, calculate the length of the path, denoted as L. Each node on the path has its importance weight, such as the weight of C1 is W_C1, the weight of E1 is W_E1, etc. The association relationships on the path also have their strength values, such as the strength of the association relationship between C1 and E1 is S1. By comprehensively calculating these factors (for example, through weighted summation, assuming the weight of the length is W_L, and the weights of the node importance and association relationship strength are W_W and W_S respectively), an association path matching degree value is obtained, denoted as M1. In the same way, calculate the matching degrees of the association paths between other system component entities in the candidate root cause entity sequence Seq and the historical anomaly event markers, and obtain their respective association path matching degree values.

[0101] Step S154: According to the preset path matching weight coefficient and anomaly weight coefficient, perform weighted fusion processing on the association path matching degree and the anomaly score value to generate a comprehensive root cause score for each system component entity.

[0102] Set the preset path matching weight coefficient as W_p and the anomaly weight coefficient as W_a. For the system component entity C1, its association path matching degree is M1 and the anomaly score value is A1. Through the weighted fusion formula: comprehensive root cause score = W_p × M1 + W_a × A1, calculate the comprehensive root cause score of C1, denoted as Score1. Similarly, for other system component entities in the candidate root cause entity sequence Seq, according to their respective association path matching degrees and anomaly score values, use the same weighted fusion formula to calculate their comprehensive root cause scores. In this way, a comprehensive root cause score that comprehensively considers the association path matching degree and anomaly is generated for each system component entity.

[0103] Step S155: generating a root cause location result of the target system according to descending order of the comprehensive root cause scores, and generating the operation and maintenance optimization strategy set based on the attribute characteristics of the system component entities in the root cause location result.

[0104] The comprehensive root cause scores of all system component entities are collected and sorted in descending order. For example, if the comprehensive root cause scores of system component entities C1, C2, and C3 are Score 1, Score 2, and Score 3, respectively, and Score 1 > Score 2 > Score 3, then the root cause location results, arranged in descending order, are C1, C2, and C3. This root cause location result indicates that, based on the current analysis, system component entity C1 is most likely the root cause of the anomaly, followed by C2 and C3.

[0105] Generate an operation and maintenance optimization strategy set based on the attribute characteristics of the system component entities in the root cause location results. For the system component entities that rank high in the root cause location results, such as C1, analyze their attribute characteristics. For example, the operating status attribute data of C1 may show that its efficiency in processing login requests is low, and the environmental parameter attribute data may show that high network latency has an impact on it. Based on these attribute characteristics, corresponding operation and maintenance optimization strategies can be generated. For example, for network latency issues, a strategy for optimizing network configuration can be generated; for issues with low efficiency in processing login requests, a strategy for optimizing module algorithms or increasing resource allocation can be generated. These strategies generated for the attribute characteristics of different system component entities are combined together to form an operation and maintenance optimization strategy set to help financial institutions solve abnormal problems in service systems and improve system stability and performance.

[0106] Next, consider the steps involved in model training. The node feature extraction model is responsible for extracting useful features from nodes in the operation and maintenance knowledge graph during the entire root cause location process. This node feature extraction model primarily consists of a state feature encoding unit and an environment feature encoding unit.

[0107] First, we collect a large amount of operational knowledge graph data from financial institutions' service systems. This operational knowledge graph data contains the operational status attribute data and environmental parameter attribute data of numerous system component entity nodes, along with the corresponding correct node operational status feature sets and node environment-related feature sets as labels. For example, for multiple different system component entity nodes C_i (i=1, 2, 3,...), we collect their operational status attribute data, such as various operational indicator data within different time windows, as well as environmental parameter attribute data, such as related network latency, server load, and so on. At the same time, through manual labeling or other reliable methods, we determine the correct node operational status feature set S_i and node environment-related feature set E_i corresponding to each C_i. This data is organized into a training dataset, designated Train_data.

[0108] The state feature encoding unit of the node feature extraction model can adopt a recurrent neural network (RNN) or its variant, such as a long short-term memory network (LSTM) structure. Taking LSTM as an example, it has an input gate, a forget gate, and an output gate, which can effectively process time series data and is suitable for extracting temporal features from the operation state attribute data. The environmental feature encoding unit can adopt a convolutional neural network (CNN) structure. CNN can effectively extract spatial features and is suitable for extracting spatial features from environmental parameter attribute data. The input of the model is the operation state attribute data and environmental parameter attribute data of the system component entity nodes, and the output is the set of node operation state features and the set of node environment association features.

[0109] Set the parameters during the training process, such as the learning rate, denoted as lr. The learning rate determines the step size of the model when updating parameters each time. It is also necessary to set the number of training epochs, denoted as epoch, which represents the number of times the model makes a complete traversal of the training dataset. In addition, set the batch size, denoted as batch_size, that is, the number of samples selected from the training dataset each time during training. For example, set the learning rate lr to a small value to ensure the stability of model training; set the number of training epochs epoch to a suitable value so that the model can fully learn the data features; set the batch size batch_size to a moderate value to balance training efficiency and memory usage.

[0110] During the training process, divide the training dataset Train_data according to the batch size batch_size to form multiple small batches of data. For each small batch of data, input the operation state attribute data therein into the state feature encoding unit (LSTM structure), and input the environmental parameter attribute data into the environmental feature encoding unit (CNN structure). The state feature encoding unit extracts temporal features from the operation state attribute data through the gating mechanism of LSTM and outputs the predicted set of node operation state features, denoted as S_pred. The environmental feature encoding unit extracts spatial features from the environmental parameter attribute data through operations such as the convolutional layer and pooling layer of CNN and outputs the predicted set of node environment association features, denoted as E_pred.

[0111] Then, calculate the loss function between the prediction result and the label. The mean squared error loss function can be adopted. Taking the node running state feature set as an example, for each feature value S_pred_i in the predicted node running state feature set S_pred and the corresponding feature value S_i_i in the label S_i, calculate the square of their difference, i.e., (S_pred_i - S_i_i)². Accumulate the squares of such differences for all feature values, and then divide by the total number of feature values to obtain the mean squared error loss of the node running state feature set, denoted as Loss_S. Similarly, for the node environment association feature set, calculate the mean squared error loss between the prediction E_pred and the label E, denoted as Loss_E. The total loss function Loss is the sum of Loss_S and Loss_E, i.e., Loss = Loss_S + Loss_E.

[0112] According to the calculated loss function Loss, use an optimization algorithm to update the parameters of the node feature extraction model. Common optimization algorithms such as Stochastic Gradient Descent (SGD) and its variants, such as Adagrad, Adadelta, Adam, etc. Taking the Adam optimization algorithm as an example, it combines the advantages of Adagrad and Adadelta and can adaptively adjust the learning rate. In each training iteration, the Adam optimization algorithm updates the parameters according to the gradient of the loss function with respect to the model parameters. The gradient represents the rate of change of the loss function at the current parameter position. By moving the parameters in the opposite direction of the gradient, the loss function can be gradually reduced.

[0113] Specifically, for each parameter θ in the model, the Adam optimization algorithm first calculates the gradient g, which reflects the change of the loss function with respect to the parameter θ. Then, the Adam optimization algorithm maintains two variables, one is the first moment estimate m of the gradient, and the other is the second moment estimate v of the gradient. In each iteration, update the first moment estimate m and the second moment estimate v according to the current gradient g. For example, for the first moment estimate m, it is updated by the formula m = β1 * m + (1 - β1) * g, where β1 is a hyperparameter close to 1, usually set to 0.9. For the second moment estimate v, it is updated by the formula v = β2 * v + (1 - β2) * g², where β2 is also a hyperparameter close to 1, usually set to 0.999.

[0114] Next, bias correction is performed on the first - moment estimate m and the second - moment estimate v to obtain the corrected first - moment estimate m_hat and second - moment estimate v_hat. For example, m_hat = m / (1 - β1^t), v_hat = v / (1 - β2^t), where t represents the current iteration number. Finally, based on the corrected first - moment estimate m_hat and second - moment estimate v_hat, and the learning rate lr, the parameter θ is updated. The update formula is θ = θ - lr * m_hat / (sqrt(v_hat)+ε), where ε is a very small constant, usually set to 1e - 8, to prevent the denominator from being zero. In this way, the model parameters are continuously updated in each training iteration, making the model's prediction results gradually approach the labels.

[0115] During the training process, it is necessary to regularly evaluate the performance of the node feature extraction model to determine whether the model converges and whether it achieves the expected effect. The training dataset Train_data is divided into a training set and a validation set according to a set ratio. For example, most of the data is used as the training set for model training, and the remaining small part of the data is used as the validation set.

[0116] After each epoch in the training process, the model is evaluated using the validation set data. The running - state attribute data in the validation set is input into the state - feature encoding unit, and the environmental - parameter attribute data is input into the environmental - feature encoding unit. The model outputs the predicted node running - state feature set and node environmental - association feature set. The mean - squared error loss function is also used to calculate the loss between the prediction result and the label in the validation set, denoted as Val_Loss. At the same time, other evaluation metrics such as accuracy and recall can be calculated to more comprehensively evaluate the model performance.

[0117] The calculation of accuracy can be based on the matching degree between the predicted features and the label features. For example, for the node running - state feature set, a matching rule is defined. If the predicted feature value and the label feature value are within a set error range, they are considered to match. The ratio of the number of matching feature values to the total number of feature values is calculated to obtain the accuracy of the node running - state feature set, denoted as Accuracy_S. Similarly, the accuracy of the node environmental - association feature set is calculated, denoted as Accuracy_E. The calculation of recall focuses on measuring the proportion of positive examples (i.e., features that match the label) correctly identified by the model among the actual positive examples. Through these evaluation metrics, the performance of the model on the validation set can be understood, and it can be judged whether the model is overfitting or underfitting.

[0118] If the loss of the model on the validation set continues to decrease and the accuracy continues to increase, it indicates that the model is continuously learning and improving. However, if the loss on the validation set starts to increase while the loss on the training set is still decreasing, overfitting may occur. In this case, it is necessary to adjust the model structure or training parameters, such as reducing the model complexity, increasing the regularization term, etc. The regularization term can be added to the loss function to penalize the complexity of the model and prevent the model from overfitting the training data. For example, the L2 regularization term is achieved by adding the sum of the squares of the parameters multiplied by a regularization coefficient to the loss function. Let the regularization coefficient be λ, then the loss function after adding the L2 regularization term is Loss = Loss_original + λ * sum(θ²), where Loss_original is the original loss function and sum(θ²) represents the sum of the squares of all the parameters of the model.

[0119] When the performance metrics of the model on the validation set (such as loss function, accuracy, recall, etc.) no longer show significant improvement within a set number of epochs, or reach the preset performance target, it can be considered that the model training is complete. For example, the preset accuracy target is Accuracy_target. When the accuracy of the model on the validation set, Accuracy_S and Accuracy_E, is greater than Accuracy_target for consecutive multiple epochs and the loss function Val_Loss stabilizes within a small range and no longer decreases significantly, the training process is stopped. The obtained node feature extraction model at this time is the trained model, which can be used for the operation of extracting the attribute features of the system component entity nodes in the operation and maintenance knowledge graph to generate the node operation status feature set and the node environment association feature set.

[0120] During the entire process of root cause localization for the operation and maintenance of the financial institution service system, various technical means are adopted for privacy protection and anti-disclosure processing of the data involved in obtaining the historical operation and maintenance log dataset of the target system and subsequent processing.

[0121] During the data collection phase, the operation and maintenance log data collected from various modules of the financial institution service system is encrypted. Before performing entity relationship recognition processing on the historical operation and maintenance log data set, the sensitive information in the data is anonymized. For example, for the system component entity identifiers and operation environment entity identifiers involved in the system operation status records in the log sequence, if these identifiers may contain sensitive information, such as component identifiers related to specific customer accounts or environment identifiers related to specific geographical locations, anonymization techniques are used for processing. Also, a strict access control mechanism is established to ensure that only authorized personnel or modules can access and process the operation and maintenance data. For different roles within the financial institution service system, such as operation and maintenance personnel, data analysts, etc., different access permissions are assigned according to their job responsibilities and requirements. For example, operation and maintenance personnel may only have the permission to view and process some log data related to daily operation and maintenance, while data analysts may have the permission to access the complete historical operation and maintenance log data set and related processing results after a specific approval process. At the system level, access control is implemented through an authentication and authorization module. When a user or module requests access to the operation and maintenance data, first, authentication is performed to verify the identity information of the requester, such as the username and password. If the authentication passes, then according to its role information, the permission database is queried to determine whether it has the permission to access the requested data. Only when both the authentication and permission verification pass is the requester allowed to access the corresponding data.

[0122] After analyzing and processing the data to generate relevant results, such as root cause location results and a set of operation and maintenance optimization strategies, if these results may still contain some sensitive information, data desensitization processing is performed on them. For example, if the root cause location results involve the detailed operation status information of some system component entities related to specific customer transactions, it may be necessary to desensitize this information. Data replacement or masking techniques can be used. For sensitive numerical information, such as transaction amounts, the data replacement method is adopted, and the actual transaction amount value is replaced with a processed substitute value. For example, according to the range of transaction amounts, it is assumed that the transaction amount range is divided into multiple intervals, and a fixed substitute value is set for each interval. Let the transaction amount be Amount. When Amount is in the interval [Lower1, Upper1], it is replaced with Substitute1; when Amount is in the interval [Lower2, Upper2], it is replaced with Substitute2, and so on. In this way, when presenting or transmitting the root cause location results and the set of operation and maintenance optimization strategies externally, the sensitive information has been desensitized, reducing the risk of data leakage.

[0123] Figure 2FIG. 0 shows a schematic diagram of exemplary hardware and software components of an operation and maintenance root cause location system 100 combined with a knowledge graph according to some embodiments of the present application, which can implement the idea of the present application. For example, a processor 120 can be used on the operation and maintenance root cause location system 100 combined with a knowledge graph and is used to execute the functions in the present application.

[0124] The operation and maintenance root cause location system 100 combined with a knowledge graph can be a general-purpose server or a special-purpose server, both of which can be used to implement the operation and maintenance root cause location method combined with a knowledge graph of the present application. Although only one server is shown in the present application, for convenience, the functions described in the present application can be implemented in a distributed manner on multiple similar platforms to balance the processing load.

[0125] For example, the operation and maintenance root cause location system 100 combined with a knowledge graph can include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and different forms of storage media 140, such as disks, ROM, or RAM, or any combination thereof. Exemplarily, the operation and maintenance root cause location system 100 combined with a knowledge graph can also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The method of the present application can be implemented according to these program instructions. The operation and maintenance root cause location system 100 combined with a knowledge graph also includes an I / O interface 150 between the computer and other input and output devices.

[0126] For ease of explanation, only one processor is described in the operation and maintenance root cause location system 100 combined with a knowledge graph. However, it should be noted that the operation and maintenance root cause location system 100 combined with a knowledge graph in the present application can also include multiple processors. Therefore, the steps executed by one processor described in the present application can also be jointly executed or separately executed by multiple processors. For example, if the processor of the operation and maintenance root cause location system 100 combined with a knowledge graph executes step A and step B, it should be understood that step A and step B can also be jointly executed by two different processors or separately executed in one processor. For example, the first processor executes step A, the second processor executes step B, or the first processor and the second processor jointly execute steps A and B.

[0127] In addition, an embodiment of the present invention also provides a readable storage medium, in which computer-executable instructions are preset. When the processor executes the computer-executable instructions, the operation and maintenance root cause location method combined with a knowledge graph as described above is implemented.

[0128] It should be noted that, in order to simplify the expression of the disclosure of the present invention and thus help the understanding of one or more embodiments of the present invention, in the foregoing description of the embodiments of the present invention, sometimes multiple features are merged into one embodiment, drawing, or description thereof.

Claims

1. An operation and maintenance root cause location method combining a knowledge graph, characterized in that, The method includes: Obtaining a historical operation and maintenance log dataset of a target system, where the historical operation and maintenance log dataset includes multiple log sequences, and each log sequence is composed of at least one system operation status record and a corresponding exception event label; Performing entity relationship recognition processing on the historical operation and maintenance log dataset to generate an operation and maintenance knowledge graph including system component entities, operating environment entities, and event association relationships; Invoking a pre-trained node feature extraction model to perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph, generating a node operation status feature set and a node environment association feature set; Performing multi-level feature fusion processing based on the node operation status feature set and the node environment association feature set to generate a root cause location feature set for each system component entity; Performing exception event backtracking analysis processing according to the root cause location feature set to generate a root cause location result of the target system and a corresponding operation and maintenance optimization strategy set.

2. The operation and maintenance root cause location method combining a knowledge graph according to claim 1, characterized in that The performing entity relationship recognition processing on the historical operation and maintenance log dataset to generate an operation and maintenance knowledge graph including system component entities, operating environment entities, and event association relationships includes: Performing entity recognition processing on the system operation status records in the log sequence to identify the system component entity identifiers and operating environment entity identifiers involved in the system operation status records; Performing relationship extraction processing on the exception event labels in the log sequence to extract the association relationship descriptors between the system component entity identifiers and the operating environment entity identifiers in the exception event labels; Constructing an initial entity relationship network according to the system component entity identifiers, the operating environment entity identifiers, and the association relationship descriptors; Performing attribute association processing on the initial entity relationship network, associating the operation status parameters corresponding to the system component entity identifiers and the environment parameters corresponding to the operating environment entity identifiers in the log sequence to the corresponding entity nodes in the initial entity relationship network to generate an initial operation and maintenance knowledge graph, where a trigger rule based on a time period and system change events is set, and when a preset trigger condition is detected, incremental entity relationship update processing is performed on the initial operation and maintenance knowledge graph.

3. The operation and maintenance root cause location method combining a knowledge graph according to claim 2, characterized in that The performing entity recognition processing on the system operation status records in the log sequence to identify the system component entity identifiers and operating environment entity identifiers involved in the system operation status records includes: Performing structured parsing processing on the system operation status records to split out the component identification field, environment parameter field, and status description field included in the system operation status records; Invoking a predefined component entity dictionary to perform matching processing on the component identification field to identify the system component entity identifier corresponding to the component identification field; Invoking a predefined environment entity dictionary to perform matching processing on the environment parameter field to identify the operating environment entity identifier corresponding to the environment parameter field; Associate the operating status parameters in the state description field with the system component entity identifier to generate the operating status attribute data of the system component entity identifier.

4. The operation and maintenance root cause location method combining a knowledge graph according to claim 2, wherein The relational extraction process is performed on the exception event markers in the log sequence to extract the association relationship descriptor between the system component entity identifier and the operating environment entity identifier in the exception event markers, including: Perform semantic parsing processing on the exception event marker to identify the exception status description segment corresponding to the system component entity identifier and the environment change description segment corresponding to the operating environment entity identifier in the exception event marker; Perform word segmentation processing on the exception status description segment and the environment change description segment to generate multiple word nodes, and perform dependency syntactic analysis processing on the multiple word nodes to construct the dependency tree structure of the exception status description segment and the environment change description segment; Extract the root nodes and leaf nodes containing the system component entity identifier and the operating environment entity identifier from the dependency tree structure to generate a key node sequence, and perform path traversal processing on the key node sequence to identify all directed edge paths between the node corresponding to the system component entity identifier and the node corresponding to the operating environment entity identifier; Perform causal strength calculation processing on each directed edge path to generate the causal strength value of the directed edge path. Specifically, it includes: extracting the verb trigger word node in the directed edge path, calculating the causal semantic similarity of the verb trigger word node in the historical event library; obtaining the time difference parameter between the node corresponding to the system component entity identifier and the node corresponding to the operating environment entity identifier, and performing normalization processing on the time difference parameter to generate a time proximity feature; performing weighted summation processing on the causal semantic similarity and the time proximity feature to generate the causal strength value of the directed edge path; Perform descending order arrangement processing on the directed edge paths according to the causal strength value, and select the directed edge path corresponding to the highest causal strength value as the causal association path between the system component entity identifier and the operating environment entity identifier; Generate the association relationship descriptor according to the causal association path, and mark the type of the association relationship descriptor as an exception event trigger relationship.

5. The operation and maintenance root cause location method combining a knowledge graph according to claim 2, characterized in that Call the pre-trained node feature extraction model to perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph, generating a node operating status feature set and a node environment association feature set, including: Traverse the system component entity nodes in the operation and maintenance knowledge graph to obtain the operating status attribute data and environment parameter attribute data associated with the system component entity nodes; Call the state feature encoding unit in the node feature extraction model to perform time series feature extraction processing on the operating status attribute data to generate the node operating status feature set of the system component entity nodes; Invoke the environmental feature encoding unit in the node feature extraction model to perform spatial feature extraction processing on the environmental parameter attribute data, and generate a set of node environment association features for the system component entity node; Associate and store the set of node operation status features and the set of node environment association features on the corresponding system component entity node in the operation and maintenance knowledge graph.

6. The operation and maintenance root cause location method combining a knowledge graph according to claim 5, characterized in that The invocation of the status feature encoding unit in the node feature extraction model to perform temporal feature extraction processing on the operation status attribute data, and generate a set of node operation status features for the system component entity node, including: Perform time window partitioning processing on the operation status attribute data to generate subsequences of status parameters for multiple consecutive time intervals; Perform fluctuation feature extraction processing on each of the status parameter subsequences to generate a status fluctuation amplitude feature and a status change trend feature corresponding to each time interval; Perform multi-scale fusion processing on the status fluctuation amplitude feature and the status change trend feature to generate a temporal fusion feature of the status parameter subsequence; Aggregate the temporal fusion features of all time intervals to generate a set of node operation status features for the system component entity node.

7. The operation and maintenance root cause location method combining a knowledge graph according to claim 5, characterized in that, The invocation of the environmental feature encoding unit in the node feature extraction model to perform spatial feature extraction processing on the environmental parameter attribute data, and generate a set of node environment association features for the system component entity node, including: Obtain the environmental parameter attribute data of the adjacent operation environment entity nodes of the system component entity node in the operation and maintenance knowledge graph; Perform difference calculation processing on the environmental parameter attribute data of the system component entity node itself and the environmental parameter attribute data of the adjacent operation environment entity nodes to generate a set of environmental parameter difference features; Perform spatial correlation analysis processing based on physical topology constraints on the set of environmental parameter difference features, and combine the component environment dependency relationships defined in the system architecture document to determine the weighted environment dependency strength features between the system component entity node and the adjacent operation environment entity nodes; Generate a set of node environment association features for the system component entity node according to the weighted environment dependency strength features and the set of environmental parameter difference features.

8. The operation and maintenance root cause location method combining a knowledge graph according to claim 1, characterized in that The execution of multi-level feature fusion processing based on the set of node operation status features and the set of node environment association features to generate a set of root cause location features for each system component entity, including: Determine the feature dimensions corresponding to each operation status feature in the set of node operation status features and the feature dimensions corresponding to each environment association feature in the set of node environment association features; Perform feature alignment processing based on the self-attention mechanism on the set of node operation status features and the set of node environment association features to generate a set of standardized features with matching dimensions, and perform element-wise product processing on each standardized operation status feature and the corresponding environment association feature to generate a feature interaction vector; Concatenate all the feature interaction vectors in the order of feature dimensions to generate a status environment cross-feature matrix; Perform feature dimensionality reduction processing on the state environment cross-feature matrix to generate a reduced-dimensional state environment fusion feature set; Perform residual connection processing on the reduced-dimensional state environment fusion feature set and the node operation state feature set to generate a primary root cause localization feature set; Perform non-linear transformation processing on the primary root cause localization feature set to generate a root cause localization feature set for the system component entity.

9. The operation and maintenance root cause location method combining a knowledge graph according to claim 1, characterized in that Performing abnormal event backtracking analysis processing according to the root cause localization feature set to generate a root cause localization result of the target system and a corresponding operation and maintenance optimization strategy set, including: Perform abnormal degree scoring processing on the root cause localization feature set to generate an abnormal degree scoring value for each system component entity; Perform sorting processing on the system component entities according to the abnormal degree scoring value to generate a candidate root cause entity sequence; Perform event association path verification processing on each system component entity in the candidate root cause entity sequence to determine the association path matching degree between the system component entity and the historical abnormal event mark; According to the preset path matching weight coefficient and abnormal degree weight coefficient, perform weighted fusion processing on the association path matching degree and the abnormal degree scoring value to generate a comprehensive root cause score for each system component entity; Generate a root cause localization result of the target system according to the descending order of the comprehensive root cause scores, and generate an operation and maintenance optimization strategy set based on the attribute characteristics of the system component entities in the root cause localization result.

10. An operation and maintenance root cause location system combining a knowledge graph, characterized in that, It includes a processor and a memory. The memory is connected to the processor. The memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to implement the operation and maintenance root cause localization method combined with a knowledge graph according to any one of claims 1-9 above.

Images