Operation and maintenance root cause location method and system combined with knowledge graph

Abstract

The present invention provides an operation and maintenance root cause location method and system combined with a knowledge graph. First, a historical operation and maintenance log data set containing multiple log sequences of a target system is obtained, where each log sequence consists of a system operation status record and an abnormal event mark. Entity relationship recognition processing is performed on the historical operation and maintenance log data set to generate an operation and maintenance knowledge graph. Then, a pre-trained node feature extraction model is called to perform attribute feature extraction operations on the nodes corresponding to the system component entities in the knowledge graph to generate a node operation status feature set and a node environment association feature set. Multi-level feature fusion processing is then performed based on the node operation status feature set and the node environment association feature set to generate a root cause location feature set. Finally, abnormal event backtracking analysis processing is performed based on the root cause location feature set to generate a root cause location result of the target system and a corresponding operation and maintenance optimization strategy set, thereby being able to efficiently and accurately locate the operation and maintenance root cause and ensure stable operation of the system.

Description

Technical Field

[0001] The present invention relates to the field of digital operation and maintenance technology, and in particular to a method and system for locating the root cause of operation and maintenance in combination with a knowledge graph. Background Art

[0002] During the operation and maintenance of a target system, accurately and quickly locating the root cause is crucial to ensuring stable system operation. As system complexity continues to increase, traditional root cause location methods face numerous challenges.

[0003] Currently, common root cause location methods for O&M operations primarily rely on manual empirical analysis or simple rule matching. While manual empirical analysis can solve problems to a certain extent, this approach is highly dependent on the expertise and experience of O&M personnel, making it inefficient and prone to omissions and misjudgments when dealing with large-scale, complex systems. Simple rule matching methods are too rigid to adapt to the complex and ever-changing anomalies that occur during system operation, and they struggle to accurately capture the inherent connections between system components and between the operating environment and abnormal events. Furthermore, most existing methods fail to fully utilize the rich information contained in historical O&M log data, failing to comprehensively analyze system operating status and abnormal events from a global perspective. This results in root cause location accuracy and timeliness failing to meet actual needs. Summary of the Invention

[0004] In view of the above-mentioned problems, in combination with the first aspect of the present invention, an embodiment of the present invention provides a method for locating operation and maintenance root causes in combination with a knowledge graph, the method comprising:

[0005] Obtain a historical operation and maintenance log data set of the target system, wherein the historical operation and maintenance log data set includes multiple log sequences, each log sequence consisting of at least one system operation status record and a corresponding abnormal event marker;

[0006] Performing entity relationship recognition processing on the historical operation and maintenance log data set to generate an operation and maintenance knowledge graph containing system component entities, operating environment entities, and event association relationships;

[0007] Calling a pre-trained node feature extraction model to perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph to generate a node operation status feature set and a node environment association feature set;

[0008] Performing multi-level feature fusion processing based on the node operation status feature set and the node environment association feature set to generate a root cause location feature set for each system component entity;

[0009] An abnormal event backtracking analysis process is performed based on the root cause location feature set to generate a root cause location result of the target system and a corresponding operation and maintenance optimization strategy set.

[0010] On the other hand, an embodiment of the present invention also provides an operation and maintenance root cause positioning system combined with a knowledge graph, including a processor and a machine-readable storage medium, the machine-readable storage medium is connected to the processor, the machine-readable storage medium is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the machine-readable storage medium to implement the above method.

[0011] Based on the above aspects, by obtaining the historical operation and maintenance log data set of the target system, performing entity relationship recognition processing on the historical operation and maintenance log data set, an operation and maintenance knowledge graph containing system component entities, operating environment entities and event association relationships is constructed, and then the pre-trained node feature extraction model is called to perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph, generating a node operation status feature set and a node environment association feature set, and deeply mining the feature information of the nodes in different aspects. Based on these feature sets, multi-level feature fusion processing is performed to generate a root cause location feature set for each system component entity, and the feature information related to root cause location is fully integrated. Finally, according to the root cause location feature set, abnormal event retrospective analysis processing is performed to generate the root cause location results of the target system and the corresponding operation and maintenance optimization strategy set, realizing the complete process from feature extraction to root cause location to operation and maintenance optimization, greatly improving the accuracy and efficiency of operation and maintenance root cause location, and helping to ensure the stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a schematic diagram of the execution flow of the operation and maintenance root cause location method combined with the knowledge graph provided in an embodiment of the present invention.

[0013] Figure 2 This is a schematic diagram of exemplary hardware and software components of an operation and maintenance root cause location system combined with a knowledge graph provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0014] The present invention will be described in detail below with reference to the accompanying drawings. Figure 1 This is a flow chart of an operation and maintenance root cause location method combined with a knowledge graph provided by an embodiment of the present invention. The operation and maintenance root cause location method combined with a knowledge graph is introduced in detail below.

[0015] Step S110: Acquire a historical operation and maintenance log data set of the target system, wherein the historical operation and maintenance log data set includes multiple log sequences, and each log sequence consists of at least one system operation status record and a corresponding abnormal event mark.

[0016] In this embodiment, taking the service system of a financial institution as an example, the service system of the financial institution may cover a variety of financial services, such as loan approval, customer account management, transaction processing, etc., and a large number of operation and maintenance logs will be generated during its daily operation.

[0017] To obtain a historical operation and maintenance log dataset, data must be collected from the log storage module of the financial institution's service system. Assume that the log storage module stores logs in chronological order, and each log has a unique identifier. For example, data is collected from the log storage for a period of time in the past, spanning T. Each log sequence in the collected logs contains system operation status records and abnormal event markers. For example, in log sequence A, the system operation status records may include resource usage of the module that processes loan applications, including but not limited to processor resource usage (records related to this resource usage are represented by P), memory resource usage (records related to this resource usage are represented by M), and corresponding abnormal event markers, such as abnormal markers indicating loan application processing delays. In this way, the historical operation and maintenance log dataset of the target system is obtained.

[0018] Step S120: Execute entity relationship recognition processing on the historical operation and maintenance log data set to generate an operation and maintenance knowledge graph including system component entities, operating environment entities and event association relationships.

[0019] In this embodiment, entity relationship recognition processing is carried out based on the acquired historical operation and maintenance log data set of the financial institution service system to generate an operation and maintenance knowledge graph.

[0020] Step S121: performing entity recognition processing on the system operation status record in the log sequence to identify the system component entity identifier and the operation environment entity identifier involved in the system operation status record.

[0021] For system operation status records in the log sequence of a financial institution's service system, a structured parsing process is first performed. For example, in a system operation status record for a customer account login verification module, the specified structured parsing rules are used to segment it into a component identification field, an environmental parameter field, and a status description field. Assuming the record is "The customer account login verification module processes Z number of login requests per second under the conditions of network delay X and server load Y," after parsing, the component identification field is "Customer Account Login Verification Module," the environmental parameter field is "Network Delay X, Server Load Y," and the status description field is "Z number of login requests processed per second."

[0022] Step S1211: calling a predefined component entity dictionary to perform matching processing on the component identification field, and identifying the system component entity identifier corresponding to the component identification field.

[0023] In this embodiment, the predefined component entity dictionary contains standard identifiers for various components within a financial institution's service system. After obtaining the component identification field "Customer Account Login Verification Module," it is compared with each entry in the component entity dictionary. Assume that the entries in the dictionary are stored in a predetermined format, such as each entry containing a component name and a corresponding standard identifier. After traversing and comparing, a matching entry for "Customer Account Login Verification Module" is found, thereby identifying the system component entity identifier corresponding to this component identification field and setting it as C1.

[0024] Step S1212: calling a predefined environment entity dictionary to perform matching processing on the environment parameter field, and identifying the operating environment entity identifier corresponding to the environment parameter field.

[0025] The predefined environment entity dictionary stores standard identifiers related to the operating environment of financial institutions' service systems. For the environmental parameter fields "Network Delay X, Server Load Y," "Network Delay X" and "Server Load Y" are matched against entries in the environment entity dictionary. Assume that entries related to network delay in the dictionary are stored with different delay ranges and corresponding identifiers, and entries related to server load are stored with different load levels and corresponding identifiers. Through matching, it is identified that the operating environment entity identifier corresponding to "Network Delay X" is E1, and the operating environment entity identifier corresponding to "Server Load Y" is E2.

[0026] Step S1213: Associating the operating status parameter in the status description field with the system component entity identifier to generate operating status attribute data of the system component entity identifier.

[0027] The operating status parameter Z in the status description field "Number of login requests processed per second is Z" is associated with the identified system component entity identifier C1. This creates a corresponding relationship between C1 and the operating status attribute data Z. This means that the operating status attribute data for system component entity identifier C1 is Z. This data will be used to further analyze the component's operation.

[0028] Step S122: performing relationship extraction processing on the abnormal event markers in the log sequence, and extracting the association relationship descriptor between the system component entity identifier and the operating environment entity identifier in the abnormal event marker.

[0029] For abnormal event markers in the log sequence of the financial institution service system, relationship extraction processing is carried out to extract the association relationship descriptors between the system component entity identifiers and the operating environment entity identifiers.

[0030] Step S1221: performing semantic parsing processing on the abnormal event marker to identify the abnormal state description segment corresponding to the system component entity identifier and the environment change description segment corresponding to the operating environment entity identifier in the abnormal event marker.

[0031] For example, consider an abnormal event labeled "The login failure rate of the customer account login verification module increases significantly when network latency suddenly increases and server load is too high." The semantic structure of this tag is analyzed using semantic parsing technology. The abnormal state description fragment corresponding to the system component entity identifier C1 (customer account login verification module) is identified as "The login failure rate increases significantly." The environmental change description fragments corresponding to the operating environment entity identifiers E1 (network latency-related environmental factors) and E2 (server load-related environmental factors) are "A sudden increase in network latency" and "Excessive server load," respectively.

[0032] Step S12211: perform word segmentation processing on the abnormal state description segment and the environmental change description segment to generate multiple word nodes, and perform dependency syntax analysis processing on the multiple word nodes to construct a dependency tree structure of the abnormal state description segment and the environmental change description segment.

[0033] "Login failure rate increased significantly" and "network delay increased suddenly" and "server load is too high" are segmented separately. Assume that after word segmentation, "login failure rate increased significantly" obtains word nodes such as "login", "failure rate", "significantly", and "increased"; "network delay increased suddenly" obtains word nodes such as "network", "delay", "suddenly", and "increased"; "server load is too high" obtains word nodes such as "server", "load", and "too high". Then, dependency syntactic analysis is performed on these word nodes. For example, the dependency relationship between the words in "login failure rate increased significantly" is analyzed, and there is a certain dependency relationship between "login" and "failure rate", and "significantly" modifies "increased", etc., so as to construct the dependency tree structure of the segment. Similarly, the dependency tree structure is constructed for the other two environmental change description segments, and finally the dependency tree structure of the abnormal state description segment and the environmental change description segment is obtained.

[0034] Step S12212: Extract the root node and leaf nodes containing the system component entity identifier and the operating environment entity identifier from the dependency tree structure, generate a key node sequence, and perform path traversal processing on the key node sequence to identify all directed edge paths between the node corresponding to the system component entity identifier and the node corresponding to the operating environment entity identifier.

[0035] In the dependency tree structure, search for root nodes and leaf nodes related to the system component entity identifier C1 and the operating environment entity identifiers E1 and E2. For example, in the dependency tree structure, find the key nodes related to C1 in the "significant increase in login failure rate" segment, and the key nodes related to E1 and E2 in the "sudden increase in network delay" and "excessive server load" segments. Extract these key nodes to generate a key node sequence. Then perform path traversal processing on the key node sequence, starting from the node corresponding to the system component entity identifier C1, find all directed edge paths leading to the nodes corresponding to the operating environment entity identifiers E1 and E2. For example, through traversal, it is found that there is a path from the node related to C1 in "significant increase in login failure rate" to the node related to E1 in "sudden increase in network delay", and there is another path to the node related to E2 in "excessive server load".

[0036] Step S12213: Perform causal strength calculation processing on each of the directed edge paths to generate a causal strength value of the directed edge path, which specifically includes: extracting the verb trigger word node in the directed edge path, and calculating the causal semantic similarity of the verb trigger word node in the historical event library; obtaining the time difference parameter between the node corresponding to the system component entity identifier and the node corresponding to the operating environment entity identifier, and performing normalization processing on the time difference parameter to generate a time proximity feature; performing weighted summation processing on the causal semantic similarity and the time proximity feature to generate the causal strength value of the directed edge path.

[0037] For each directed edge path, such as the path from C1 to E1 and the path from C1 to E2, first extract the verb trigger node in the path. Assume that the verb trigger node in the path from C1 to E1 is "increase." Then, using conventional semantic analysis methods in related technologies, calculate the causal semantic similarity between the verb trigger node "increase" and the relevant semantics in the historical event, denoted as S1. Simultaneously, obtain the time difference parameter between the node corresponding to the system component entity identifier C1 and the node corresponding to the operating environment entity identifier E1, denoted as T1. Normalize T1 and map it to a set range to generate a temporal proximity feature, denoted as N1. Perform a weighted summation of the causal semantic similarity S1 and the temporal proximity feature N1, assuming the weighting coefficients are W1 and W2, respectively. Calculate the causal strength value of the directed edge path from C1 to E1 using the formula: Causal Strength Value = W1 × S1 + W2 × N1. In the same way, calculate the causal strength value of the directed edge path from C1 to E2.

[0038] Step S12214: performing descending sorting processing on the directed edge paths according to the causal strength values, and selecting the directed edge path corresponding to the highest causal strength value as the causal association path between the system component entity identifier and the operating environment entity identifier.

[0039] Compare the calculated causal strength values ​​for the directed edge paths from C1 to E1 and from C1 to E2. Assume that the causal strength value from C1 to E1 is V1, and the causal strength value from C1 to E2 is V2. If V1 > V2, then sort the directed edge path from C1 to E1 first in descending order. Select the directed edge path with the highest causal strength value, that is, the path from C1 to E1, as the causal association path between the system component entity identifier C1 and the runtime environment entity identifier E1.

[0040] Step S12215: Generate the association relationship descriptor according to the causal association path, and mark the type of the association relationship descriptor as an abnormal event trigger relationship.

[0041] Based on the determined causal association path, namely the path from C1 to E1, a correlation descriptor is generated. The descriptor content may be "The significant increase in the login failure rate of the customer account login verification module is closely related to the sudden increase in network latency." The correlation descriptor type is marked as an abnormal event trigger relationship, indicating that this is a trigger relationship between system components and the operating environment when an abnormal event occurs.

[0042] Step S123: constructing an initial entity relationship network according to the system component entity identifier, the operating environment entity identifier and the association relationship descriptor.

[0043] Taking the financial institution service system as an example, the identified system component entity identifier C1, the operating environment entity identifiers E1 and E2, and the generated association descriptors are integrated. In the initial entity relationship network, C1, E1, and E2 are used as nodes, and the relationships described by the association descriptors are used as edges to build connections between nodes. For example, with C1 as one node and E1 and E2 as two other nodes, based on the association descriptor "The significant increase in the login failure rate of the customer account login verification module is closely related to the sudden increase in network latency," a directed edge is established between C1 and E1 to represent this association, thus constructing the initial entity relationship network.

[0044] Step S124: Perform attribute association processing on the initial entity relationship network, associate the operating status parameters corresponding to the system component entity identifier and the environmental parameters corresponding to the operating environment entity identifier in the log sequence to the corresponding entity nodes in the initial entity relationship network, and generate an initial operation and maintenance knowledge graph, wherein trigger rules based on time periods and system change events are set, and when preset trigger conditions are detected, incremental entity relationship update processing is performed on the initial operation and maintenance knowledge graph.

[0045] In the financial institution service system, attribute association processing is performed on the constructed initial entity relationship network. The previously generated operational status attribute data Z for the system component entity identifier C1, as well as the network latency X corresponding to the operational environment entity identifier E1 and the server load Y corresponding to E2, are associated with the entity nodes corresponding to C1, E1, and E2 in the initial entity relationship network, respectively. This way, each node not only has its identification information but also has associated attribute data, thereby generating an initial operation and maintenance knowledge graph.

[0046] At the same time, trigger rules based on time periods and system change events are set. For example, the time period is set to perform an inspection every M time units, and system change events include software updates and hardware replacements of the service system. When it is detected that the time reaches every M time units, or when a specific system change event or other preset trigger conditions occur, incremental entity relationship update processing is performed on the initial operation and maintenance knowledge graph. For example, after the system performs a software update, new log records may bring new system component entity identifiers, operating environment entity identifiers, and the relationship between them. At this time, the initial operation and maintenance knowledge graph needs to be updated according to the new log data, and new nodes, edges, and associated attributes need to be added.

[0047] Step S130: Call the pre-trained node feature extraction model, perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph, and generate a node operation status feature set and a node environment association feature set.

[0048] After the financial institution service system generates the initial operation and maintenance knowledge graph, the pre-trained node feature extraction model is called to perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph to obtain the node operation status feature set and the node environment association feature set.

[0049] Step S131: traverse the system component entity nodes in the operation and maintenance knowledge graph to obtain the operating status attribute data and environmental parameter attribute data associated with the system component entity nodes.

[0050] In the financial institution service system's operational knowledge graph, we begin traversing each system component entity node. For example, for the system component entity node C1 corresponding to the customer account login verification module, we retrieve its associated operational status attribute data Z, which represents the number of login requests processed per second, as well as associated environmental parameter attribute data, such as network latency X and server load Y. In this way, we obtain the corresponding operational status attribute data and environmental parameter attribute data for each system component entity node, preparing for subsequent feature extraction.

[0051] Step S132: calling the state feature encoding unit in the node feature extraction model, performing time series feature extraction processing on the operation state attribute data, and generating a node operation state feature set of the system component entity node.

[0052] With respect to the acquired running state attribute data Z of the system component entity node C1, the state feature encoding unit in the node feature extraction model is called.

[0053] Step S1321: performing time window division processing on the operating status attribute data to generate a plurality of state parameter subsequences of continuous time intervals.

[0054] Assume that the time range is divided into multiple consecutive time windows, each of length t. Taking the operational status attribute data Z of the system component entity node C1 as an example, it is divided into multiple time windows of length t in chronological order. The data within each time window forms a state parameter subsequence. For example, the Z data within the time interval [0, t] forms a state parameter subsequence Z1, the Z data within the time interval [t, 2t] forms another state parameter subsequence Z2, and so on.

[0055] Step S1322: performing fluctuation feature extraction processing on each of the state parameter subsequences to generate state fluctuation amplitude features and state change trend features corresponding to each time interval.

[0056] For each state parameter subsequence, such as Z1, analyze its data fluctuations. Calculate the difference between the maximum and minimum values ​​of the data within Z1 to obtain the state fluctuation amplitude feature, set as F1. Simultaneously, analyze the changing trend of the data within Z1, for example, by fitting the data using methods such as linear regression, to obtain the state change trend feature, set as T1. Similarly, perform the same fluctuation feature extraction process on other state parameter subsequences, such as Z2, to obtain the corresponding state fluctuation amplitude feature and state change trend feature.

[0057] Step S1323: performing multi-scale fusion processing on the state fluctuation amplitude feature and the state change trend feature to generate a time series fusion feature of the state parameter subsequence.

[0058] In this step, considering that the state fluctuation amplitude characteristics and state change trend characteristics have different focuses on reflecting the operating status of system component entities at different time scales, multi-scale fusion processing is performed to capture the operating status information more comprehensively.

[0059] First, let the state fluctuation amplitude feature set be F, which contains the fluctuation amplitude feature values ​​corresponding to different time intervals, such as F1 and F2. Each feature value represents the degree of fluctuation of the operating state parameter within the corresponding time interval. Let T be the state change trend feature set, which also contains the trend feature values ​​corresponding to the time interval, such as T1 and T2. These feature values ​​reflect the changing direction of the operating state parameters within the corresponding time interval.

[0060] To perform multi-scale fusion, we define weight sets for different scales. Assuming there are three different scales, we assign different weight sets W1, W2, and W3 to each. Each weight set contains weights corresponding to elements in F and T. For example, in the W1 set, there is weight w11 for F1 and w12 for T1; in the W2 set, there is weight w21 for F1 and w22 for T1; and in the W3 set, there is weight w31 for F1 and w32 for T1.

[0061] For each time interval, fusion is performed according to different scale weights. Taking the first time interval as an example, based on the weight set W1, the fused feature value M11 = w11 × F1 + w12 × T1 is calculated; based on the weight set W2, the fused feature value M21 = w21 × F1 + w22 × T1 is calculated; based on the weight set W3, the fused feature value M31 = w31 × F1 + w32 × T1 is calculated.

[0062] The fused feature values ​​of the same time interval at different scales are combined into a vector. For the first time interval, the fused vector V1 = [M11, M21, M31] is obtained. The other time intervals are processed in the same way to obtain a series of fused vectors V2, V3, and so on.

[0063] These fusion vectors comprehensively consider the information of state fluctuation amplitude characteristics and state change trend characteristics at different scales, arrange the fusion vectors of all time intervals in sequence, and form a time series fusion feature set of the state parameter subsequence, which is used as the time series fusion feature information of the state parameter subsequence.

[0064] Step S1324: Aggregate the time series fusion features of all time intervals to generate a node operation status feature set of the system component entity node.

[0065] In the financial institution service system, for the environmental parameter attribute data associated with the system component entity node C1, such as network delay X and server load Y, the environmental feature encoding unit in the node feature extraction model is called to generate a node environment-related feature set. The specific steps are as follows:

[0066] Step S133: calling the environmental feature encoding unit in the node feature extraction model, performing spatial feature extraction processing on the environmental parameter attribute data, and generating a node environment associated feature set of the system component entity node.

[0067] Step S1331: Obtain the environmental parameter attribute data of the operating environment entity node adjacent to the system component entity node in the operation and maintenance knowledge graph.

[0068] In the operation and maintenance knowledge graph, carefully search for adjacent operating environment entity nodes directly connected to system component entity node C1. Assuming C1's function is to process customer transaction requests, closely related adjacent operating environment entity nodes may include node E1 responsible for network transmission (corresponding to environmental factors related to network latency X) and server node E2 that handles transaction processing (corresponding to environmental factors related to server load Y). Obtain detailed environmental parameter attribute data related to network latency associated with E1. In addition to network latency X, this may also include related parameters such as network bandwidth and network packet loss rate, which are designated as B (network bandwidth) and L (network packet loss rate), respectively. Obtain detailed environmental parameter attribute data related to server load associated with E2. In addition to server load Y, this may also include related parameters such as CPU utilization and memory utilization, which are designated as U (CPU utilization) and M (memory utilization), respectively.

[0069] Step S1332: performing difference calculation processing on the environmental parameter attribute data of the system component entity node itself and the environmental parameter attribute data of the adjacent operating environment entity nodes to generate an environmental parameter difference feature set.

[0070] For the basic network delay X0 and basic server load Y0 assumed for the system component entity node C1 itself, the difference between the network delay X, network bandwidth B, network packet loss rate L of the adjacent operating environment entity node E1 and the server load Y, CPU usage U, and memory usage M of E2 is calculated respectively.

[0071] The network delay variability D_X = |X - X0| is calculated, representing the absolute difference between the actual network delay and the baseline network delay, reflecting the degree of deviation in network delay. The network bandwidth variability D_B = |B - B0| (assuming C1 corresponds to the baseline network bandwidth B0) is calculated, reflecting the difference between the network bandwidth and the baseline value. The network packet loss rate variability D_L = |L -L0| (assuming C1 corresponds to the baseline network packet loss rate L0) is calculated, showing the difference in network packet loss rate.

[0072] For server load, we calculate the server load variance D_Y = |Y - Y0| to reflect the deviation of the server load from the baseline value. We calculate the CPU usage variance D_U = |U - U0| (assuming C1 corresponds to the baseline CPU usage U0) to reflect changes in CPU usage. We calculate the memory usage variance D_M = |M - M0| (assuming C1 corresponds to the baseline memory usage M0) to show differences in memory usage.

[0073] These difference values ​​D_X, D_B, D_L, D_Y, D_U, and D_M are combined together to form an environmental parameter difference feature set D, which comprehensively reflects the differences between C1 itself and adjacent operating environment entity nodes in various environmental parameters.

[0074] Step S1333: Perform spatial correlation analysis based on physical topology constraints on the environmental parameter difference feature set, and determine the weighted environmental dependency strength characteristics between the system component entity node and the adjacent operating environment entity node in combination with the component environment dependency defined in the system architecture document.

[0075] Based on the system architecture documentation, clearly define the dependencies between the system component entity node C1 and the adjacent operating environment entity nodes E1 and E2. For example, the documentation indicates that C1 is highly dependent on network latency in the network environment (E1), and also has some dependence on network bandwidth and packet loss rate. It is also highly dependent on server load in the server environment (E2), and also has some dependence on CPU utilization and memory utilization.

[0076] Based on this dependency, we assign an initial dependency weight to each difference feature in the set D of environmental parameter difference features. Let the initial weight of network delay difference D_X be Wd_X, the initial weight of network bandwidth difference D_B be Wd_B, the initial weight of network packet loss rate difference D_L be Wd_L, the initial weight of server load difference D_Y be Wd_Y, the initial weight of CPU usage difference D_U be Wd_U, and the initial weight of memory usage difference D_M be Wd_M.

[0077] At the same time, consider physical topology constraints. From a physical topology perspective, if the network device (corresponding to E1) and the server processing customer transaction requests (corresponding to C1) are physically close and connected by a high-speed dedicated line, then network latency, network bandwidth, and packet loss rate may have a more direct and significant impact on C1. In this case, the weights of Wd_X, Wd_B, and Wd_L should be appropriately increased. If the server handling transaction processing (corresponding to E2) and C1 are in the same server cluster and C1 is highly dependent on that server's resources, then server load, CPU utilization, and memory utilization will have a more critical impact on C1. In this case, the weights of Wd_Y, Wd_U, and Wd_M should be appropriately increased. After adjusting the physical topology constraints, the final dependency weights Wd_X', Wd_B', Wd_L', Wd_Y', Wd_U', and Wd_M' are obtained.

[0078] Next, we combine the adjusted weights with the environmental parameter variance characteristics to calculate the weighted environmental dependency strength characteristics. For network delay variance D_X, the weighted environmental dependency strength characteristic is D_X × Wd_X'; for network bandwidth variance D_B, the weighted environmental dependency strength characteristic is D_B × Wd_B'; for network packet loss rate variance D_L, the weighted environmental dependency strength characteristic is D_L × Wd_L'; for server load variance D_Y, the weighted environmental dependency strength characteristic is D_Y × Wd_Y'; for CPU utilization variance D_U, the weighted environmental dependency strength characteristic is D_U × Wd_U'; and for memory utilization variance D_M, the weighted environmental dependency strength characteristic is D_M × Wd_M'.

[0079] These weighted environment dependency strength features are combined together to form a weighted environment dependency strength feature set W, which comprehensively considers the physical topology constraints and component environment dependencies, and more accurately reflects the environment dependency strength between C1 and adjacent operating environment entity nodes.

[0080] Step S1334: generating a node environment association feature set of the system component entity node according to the weighted environment dependency strength feature and the environment parameter difference feature set.

[0081] The weighted environmental dependency strength feature set W is integrated with the environmental parameter difference feature set D. First, the elements in the weighted environmental dependency strength feature set W are arranged in a set logical order. For example, the network-related and server-related weighted environmental dependency strength features D_X × Wd_X', D_B × Wd_B', and D_L × Wd_L' are sorted first, and the server-related weighted environmental dependency strength features D_Y × Wd_Y', D_U × Wd_U', and D_M × Wd_M' are sorted last.

[0082] Then, the elements in the environmental parameter difference feature set D are arranged in the same order and spliced ​​after W, thereby obtaining the node environment association feature set E. This node environment association feature set E comprehensively includes various information such as the spatial correlation and dependency relationship between the system component entity node C1 and the adjacent operating environment entity nodes.

[0083] Step S140: performing multi-level feature fusion processing based on the node operation status feature set and the node environment association feature set to generate a root cause location feature set for each system component entity.

[0084] After obtaining the node operation status feature set S and the node environment association feature set E of the system component entity node C1, a multi-level feature fusion process is performed to generate a root cause location feature set.

[0085] Step S141: determining a feature dimension corresponding to each operating state feature in the node operating state feature set and a feature dimension corresponding to each environment-related feature in the node environment-related feature set.

[0086] For the node operating state feature set S, which contains multiple operating state features, such as time series fusion features M1 and M2, each time series fusion feature has its corresponding feature dimension. For example, M1 may be obtained by weighted fusion of the state fluctuation amplitude feature F1 and the state change trend feature T1, and its feature dimension is related to the combination of F1 and T1. Assuming that F1 has dimension d1 and T1 has dimension d2, the feature dimension of M1 after weighted fusion is d1 + d2. Similarly, the feature dimension of each environment-related feature in the node environment-related feature set E is determined. For example, the environmental parameter difference feature D1 and the weighted environmental dependency intensity feature D1×Wd1' each have corresponding feature dimensions. Let the dimension of D1 be d3 and the dimension of D1×Wd1' be d4. Clarifying these feature dimensions is the basis for subsequent feature alignment and fusion.

[0087] Step S142: Perform feature alignment processing based on the self-attention mechanism on the node operation status feature set and the node environment association feature set to generate a dimensionally matched standardized feature set, perform element-level product processing on each standardized operation status feature and the corresponding environment association feature to generate a feature interaction vector.

[0088] The self-attention mechanism is used to perform feature alignment processing on the node operation status feature set S and the node environment-related feature set E. The self-attention mechanism can automatically learn the correlation between different features to adjust the dimensions of the features to make them match. Specifically, for each operation status feature in the node operation status feature set S, such as M1, the self-attention mechanism will calculate a weight matrix based on all the environment-related features in the node environment-related feature set E. M1 is weighted and transformed by the weight matrix so that its dimension matches the dimension of a certain environment-related feature in E. Similarly, other operation status features in S are processed similarly, and the environment-related features in E are also adjusted in dimension accordingly, thereby generating standardized feature sets with matching dimensions, which are set as S' and E' respectively.

[0089] Next, perform element-wise multiplication on each standardized operational status feature and its corresponding environment-related feature. For example, take an operational status feature M1' from the standardized feature set S' and its corresponding environment-related feature (assuming it's D1') from E'. Multiply each element in M1' by the corresponding element in D1' to obtain a new vector, which is the feature interaction vector and is designated as I1. Similarly, process all corresponding features in S' and E' to generate multiple feature interaction vectors.

[0090] Step S143: All the feature interaction vectors are concatenated in the order of feature dimensions to generate a state-environment cross-feature matrix.

[0091] The generated multiple feature interaction vectors, such as I1 and I2, are concatenated in order of their feature dimensions. Assuming feature interaction vector I1 has dimension d5 and I2 has dimension d6, I1 is first used as the first row of the matrix. Then, I2 is arranged in order of its feature dimensions as the second row, and so on. This generates a matrix, the state-environment cross-feature matrix, denoted as M. This state-environment cross-feature matrix incorporates the interaction information between the node's operational state features and the node's environmental association features.

[0092] Step S144: performing feature dimensionality reduction processing on the state-environment cross feature matrix to generate a state-environment fusion feature set after dimensionality reduction.

[0093] Use a suitable feature dimensionality reduction method to process the state-environment cross-feature matrix M. For example, the principal component analysis (PCA) method can be used. The basic principle of PCA is to project high-dimensional data into a low-dimensional space through linear transformation while retaining the main features of the data. For the state-environment cross-feature matrix M, PCA will calculate the covariance matrix of the data, and then find the eigenvalues ​​and eigenvectors of the covariance matrix. According to the size of the eigenvalue, the eigenvectors corresponding to the first few larger eigenvalues ​​are selected, and the matrix M is projected into the low-dimensional space spanned by these eigenvectors. Assume that after PCA processing, the matrix M is reduced from high dimension to a space of dimension n, and the reduced matrix M' is obtained. Take each row in M' as an element to form the reduced state-environment fusion feature set, set as F.

[0094] Step S145: performing residual connection processing on the state environment fusion feature set after dimensionality reduction and the node operation state feature set to generate a primary root cause location feature set.

[0095] The reduced-dimensional state environment fusion feature set F is residually connected with the original node operation state feature set S. The purpose of the residual connection is to make the model easier to learn and train, and to avoid problems such as gradient vanishing. For each feature in the node operation state feature set S, such as M1, it is added to the corresponding feature (assuming it is F1) in the reduced-dimensional state environment fusion feature set F (here, under the premise of ensuring dimensionality uniformity) to obtain a new feature, set as R1=M1+F1. In the same way, all corresponding features in S and F are processed to generate a primary root cause location feature set, set as P. This primary root cause location feature set P contains both the information of the original node operation state features and the information of the state environment cross features, preparing for the further generation of the final root cause location feature set.

[0096] Step S146: performing nonlinear transformation processing on the primary root cause location feature set to generate a root cause location feature set of the system component entity.

[0097] Perform nonlinear transformation processing on the primary root cause location feature set P. Common nonlinear transformations can use activation functions, such as the ReLU function. For each feature in the primary root cause location feature set P, such as R1, it is transformed by the ReLU function. The ReLU function is defined as: if R1 is greater than 0, the output is R1 itself; if R1 is less than or equal to 0, the output is 0. Let the feature transformed by the ReLU function be R1'. Perform the same nonlinear transformation processing on all features in P to generate the root cause location feature set of the system component entity C1, set to G. The root cause location feature set G contains feature information after multi-level feature fusion and nonlinear transformation, which will be used for subsequent abnormal event backtracking analysis and processing.

[0098] Step S150: performing abnormal event backtracking analysis processing according to the root cause location feature set to generate a root cause location result of the target system and a corresponding operation and maintenance optimization strategy set.

[0099] Based on the root cause location feature set G of the system component entity C1, the abnormal event retrospective analysis process is started to generate the root cause location results of the target system (financial institution service system) and the corresponding operation and maintenance optimization strategy set.

[0100] Step S151: performing abnormality scoring processing on the root cause location feature set to generate an abnormality score value for each system component entity.

[0101] In order to perform anomaly scoring on the root cause location feature set G, we first need to define an anomaly scoring function. Assume that this function compares the features in the feature set G with the reference values ​​of the features under normal conditions. For each feature in the root cause location feature set G, such as G1, there is a corresponding normal state reference value, set to G1_ref. Using a distance metric such as Euclidean distance, the distance between G1 and G1_ref is calculated, set to d_G1. The distances between all features in G and the corresponding reference values ​​are comprehensively calculated (for example, by weighted summation, assuming that the weight of each feature is W_G1, W_G2, etc.) to obtain a comprehensive distance value, set to D. This comprehensive distance value D is the anomaly score value of the system component entity C1, set to A. In this way, an anomaly score value is generated for each system component entity.

[0102] Step S152: performing a sorting process on the system component entities according to the abnormality score values ​​to generate a candidate root cause entity sequence.

[0103] Collect the anomaly scores for all system component entities and sort them from highest to lowest. For example, in addition to system component entity C1, there are other component entities C2, C3, and so on, each with a corresponding anomaly score of A1, A2, A3, and so on. Compare these anomaly scores. Assuming A1 > A2 > A3, the system component entities are ranked from highest to lowest in order of anomaly score: C1, C2, C3. This generates a candidate root cause entity sequence, designated as Seq. This candidate root cause entity sequence serves as the basis for further analysis. Component entities with higher anomaly scores are more likely to be the root cause of the anomaly event.

[0104] Step S153: performing event correlation path verification processing on each system component entity in the candidate root cause entity sequence to determine the correlation path matching degree between the system component entity and the historical abnormal event mark.

[0105] For each system component entity, such as C1, in the candidate root cause entity sequence Seq, the event association path verification process is started. Review the previously generated operation and maintenance knowledge graph, which records the system component entities, operating environment entities, and event association relationships. Search for all event association paths related to C1 in the knowledge graph. These paths connect C1 with historical abnormal event markers. For example, in the operation and maintenance knowledge graph, there may be a path from C1 to a historical abnormal event marker, which contains some intermediate nodes, such as the operating environment entity node E1 and some association relationship descriptions.

[0106] To determine the degree of association path matching, we first define a matching calculation method. This method can be based on factors such as the path length, the importance of the nodes along the path, and the strength of the associations along the path. For the path from C1 to the historical anomaly event marker, the path length is calculated, denoted as L. Each node along the path has an importance weight, such as W_C1 for C1 and W_E1 for E1. The associations along the path also have strength values, such as S1 for the association between C1 and E1. By combining these factors (for example, using a weighted summation method, assuming W_L for length, W_W for node importance, and W_S for association strength), we obtain a matching value for the association path, denoted as M1. Similarly, the matching values ​​for the association paths between other system component entities in the candidate root cause entity sequence Seq and the historical anomaly event marker are calculated, resulting in their respective matching values.

[0107] Step S154: performing weighted fusion processing on the associated path matching degree and the anomaly degree score value according to the preset path matching weight coefficient and the anomaly degree weight coefficient to generate a comprehensive root cause score for each system component entity.

[0108] Set the preset path matching weight coefficient to W_p and the anomaly weight coefficient to W_a. For system component entity C1, its associated path matching degree is M1, and its anomaly score is A1. Using the weighted fusion formula: Comprehensive root cause score = W_p × M1 + W_a × A1, the comprehensive root cause score for C1 is calculated and set as Score1. Similarly, for the other system component entities in the candidate root cause entity sequence Seq, the same weighted fusion formula is used to calculate their comprehensive root cause scores based on their respective associated path matching degrees and anomaly scores. In this way, a comprehensive root cause score is generated for each system component entity that comprehensively considers the associated path matching degree and anomaly degree.

[0109] Step S155: generating a root cause location result of the target system according to descending order of the comprehensive root cause scores, and generating the operation and maintenance optimization strategy set based on the attribute characteristics of the system component entities in the root cause location result.

[0110] The comprehensive root cause scores of all system component entities are collected and sorted in descending order. For example, if the comprehensive root cause scores of system component entities C1, C2, and C3 are Score 1, Score 2, and Score 3, respectively, and Score 1 > Score 2 > Score 3, then the root cause location results, arranged in descending order, are C1, C2, and C3. This root cause location result indicates that, based on the current analysis, system component entity C1 is most likely the root cause of the anomaly, followed by C2 and C3.

[0111] Generate an operation and maintenance optimization strategy set based on the attribute characteristics of the system component entities in the root cause location results. For the system component entities that rank high in the root cause location results, such as C1, analyze their attribute characteristics. For example, the operating status attribute data of C1 may show that its efficiency in processing login requests is low, and the environmental parameter attribute data may show that high network latency has an impact on it. Based on these attribute characteristics, corresponding operation and maintenance optimization strategies can be generated. For example, for network latency issues, a strategy for optimizing network configuration can be generated; for issues with low efficiency in processing login requests, a strategy for optimizing module algorithms or increasing resource allocation can be generated. These strategies generated for the attribute characteristics of different system component entities are combined together to form an operation and maintenance optimization strategy set to help financial institutions solve abnormal problems in service systems and improve system stability and performance.

[0112] Next, consider the steps involved in model training. The node feature extraction model is responsible for extracting useful features from nodes in the operation and maintenance knowledge graph during the entire root cause location process. This node feature extraction model primarily consists of a state feature encoding unit and an environment feature encoding unit.

[0113] First, we collect a large amount of operational knowledge graph data from financial institutions' service systems. This operational knowledge graph data contains the operational status attribute data and environmental parameter attribute data of numerous system component entity nodes, along with the corresponding correct node operational status feature sets and node environment-related feature sets as labels. For example, for multiple different system component entity nodes C_i (i=1, 2, 3,...), we collect their operational status attribute data, such as various operational indicator data within different time windows, as well as environmental parameter attribute data, such as related network latency, server load, and so on. At the same time, through manual labeling or other reliable methods, we determine the correct node operational status feature set S_i and node environment-related feature set E_i corresponding to each C_i. This data is organized into a training dataset, designated Train_data.

[0114] The state feature encoding unit of the node feature extraction model can employ a recurrent neural network (RNN) or its variants, such as a long short-term memory (LSTM) architecture. Taking the LSTM as an example, it features input, forget, and output gates, effectively processing time series data and is suitable for extracting temporal features from operational state attribute data. The environmental feature encoding unit can employ a convolutional neural network (CNN) architecture, which effectively extracts spatial features and is suitable for extracting spatial features from environmental parameter attribute data. The model's input is the operational state attribute data and environmental parameter attribute data of the system component's physical nodes, and its output is a set of node operational state features and a set of node-environment-related features.

[0115] Set parameters for the training process, such as the learning rate, set to lr. The learning rate determines the step size of each parameter update. Also set the number of training rounds, set to epoch, which represents the number of times the model completes the training dataset. Also set the batch size, set to batch_size, which is the number of samples selected from the training dataset during each training session. For example, set the learning rate lr to a small value to ensure model training stability, set the number of training rounds epoch to an appropriate value so that the model can fully learn the data characteristics, and set the batch size batch_size to a moderate value to balance training efficiency and memory usage.

[0116] During training, the training dataset (Train_data) is divided into multiple mini-batches of data according to batch size (batch_size). Within each mini-batch, the operating status attribute data is input into the state feature encoding unit (LSTM structure), and the environmental parameter attribute data is input into the environment feature encoding unit (CNN structure). The state feature encoding unit uses the LSTM gating mechanism to extract temporal features from the operating status attribute data and outputs a predicted node operating status feature set, designated S_pred. The environment feature encoding unit uses the CNN convolutional and pooling layers to extract spatial features from the environmental parameter attribute data and outputs a predicted node-environment correlation feature set, designated E_pred.

[0117] Then, calculate the loss function between the prediction result and the label. The mean square error loss function can be used. Taking the node operation status feature set as an example, for each eigenvalue S_pred_i in the predicted node operation status feature set S_pred and the eigenvalue S_i_i in the corresponding label S_i, calculate the square of their difference, that is, (S_pred_i-S_i_i)². Accumulate the squares of these differences of all eigenvalues ​​and then divide them by the total number of eigenvalues ​​to obtain the mean square error loss of the node operation status feature set, set as Loss_S. Similarly, for the node environment association feature set, calculate the mean square error loss between the predicted E_pred and the label E, set as Loss_E. The total loss function Loss is the sum of Loss_S and Loss_E, that is, Loss=Loss_S+Loss_E.

[0118] Based on the calculated loss function, an optimization algorithm is used to update the parameters of the node feature extraction model. Common optimization algorithms include stochastic gradient descent (SGD) and its variants, such as Adagrad, Adadelta, and Adam. The Adam optimization algorithm, for example, combines the advantages of Adagrad and Adadelta and can adaptively adjust the learning rate. In each training iteration, the Adam optimization algorithm updates the parameters based on the gradient of the loss function with respect to the model parameters. The gradient represents the rate of change of the loss function at the current parameter position. By moving the parameters in the opposite direction of the gradient, the loss function can be gradually reduced.

[0119] Specifically, for each parameter θ in the model, the Adam optimization algorithm first calculates the gradient g, which reflects the change in the loss function with respect to the parameter θ. Then, the Adam optimization algorithm maintains two variables, one is the first-order moment estimate m of the gradient, and the other is the second-order moment estimate v of the gradient. In each iteration, the first-order moment estimate m and the second-order moment estimate v are updated according to the current gradient g. For example, for the first-order moment estimate m, it is updated by the formula m=β1*m+(1-β1)*g, where β1 is a hyperparameter close to 1, usually set to 0.9. For the second-order moment estimate v, it is updated by the formula v=β2*v+(1-β2)*g², where β2 is also a hyperparameter close to 1, usually set to 0.999.

[0120] Next, the first-order moment estimate m and the second-order moment estimate v are corrected for deviations to obtain the corrected first-order moment estimate m_hat and second-order moment estimate v_hat. For example, m_hat=m / (1-β1^t), v_hat=v / (1-β2^t), where t represents the current number of iterations. Finally, based on the corrected first-order moment estimate m_hat and second-order moment estimate v_hat, as well as the learning rate lr, the parameter θ is updated. The update formula is θ=θ-lr*m_hat / (sqrt(v_hat)+ε), where ε is a very small constant, usually set to 1e-8, to prevent the denominator from being zero. In this way, the model parameters are continuously updated in each training iteration, so that the model's prediction results gradually approach the label.

[0121] During the training process, the performance of the node feature extraction model needs to be regularly evaluated to determine whether the model has converged and achieved the expected results. The training dataset Train_data is divided into a training set and a validation set according to a set ratio. For example, most of the data is used as the training set for model training, and the remaining small part of the data is used as the validation set.

[0122] After each epoch in the training process, the model is evaluated using the validation set data. The operational status attribute data in the validation set is input into the state feature encoding unit, and the environmental parameter attribute data is input into the environment feature encoding unit. The model outputs the predicted node operational status feature set and the node environment association feature set. The mean squared error loss function is also used to calculate the loss between the predicted results and the labels in the validation set, which is set to Val_Loss. Other evaluation metrics, such as precision and recall, can also be calculated to more comprehensively evaluate model performance.

[0123] Accuracy can be calculated based on the degree of match between predicted features and label features. For example, for a node's operational status feature set, a matching rule is defined, such as a match between predicted and label features within a set error range. The accuracy of the node's operational status feature set is calculated by counting the ratio of the number of matching feature values ​​to the total number of feature values, and is set to Accuracy_S. Similarly, the accuracy of the node's environment-related feature set is calculated, and is set to Accuracy_E. The recall calculation focuses on measuring the proportion of positive examples (i.e., features that match the label) correctly identified by the model to actual positive examples. These evaluation metrics can be used to understand the model's performance on the validation set and determine whether the model is overfitting or underfitting.

[0124] If the model's loss on the validation set continues to decrease and its accuracy continues to increase, it indicates that the model is continuously learning and improving. However, if the loss on the validation set begins to increase while the loss on the training set continues to decrease, overfitting may have occurred. In this case, it is necessary to adjust the model structure or training parameters, such as reducing model complexity or adding regularization terms. Regularization terms can be added to the loss function to penalize the complexity of the model and prevent the model from overfitting the training data. For example, the L2 regularization term is implemented by adding the sum of the squares of the parameters multiplied by a regularization coefficient to the loss function. Let the regularization coefficient be λ. Then, the loss function after adding the L2 regularization term is Loss=Loss_original+λ*sum(θ²), where Loss_original is the original loss function and sum(θ²) represents the sum of the squares of all model parameters.

[0125] Model training is considered complete when the model's performance metrics (such as loss function, accuracy, and recall) on the validation set no longer show significant improvement within a set number of epochs, or when the preset performance target is reached. For example, if the preset accuracy target is Accuracy_target, training is terminated when the model's accuracy Accuracy_S and Accuracy_E on the validation set remain above Accuracy_target for multiple consecutive epochs, and the loss function Val_Loss stabilizes within a small range and no longer decreases significantly. The resulting node feature extraction model is now a trained model and can be used to extract attribute features from system component entity nodes in the operation and maintenance knowledge graph, generating a node operation status feature set and a node environment association feature set.

[0126] During the root cause location process of the operation and maintenance of the entire financial institution service system, a variety of technical means are used to protect privacy and prevent leakage of data involved in obtaining the historical operation and maintenance log data set of the target system and the subsequent processing.

[0127] During the data collection phase, operation and maintenance log data collected from various modules of the financial institution's service system is encrypted. Before entity relationship identification is performed on the historical operation and maintenance log dataset, sensitive information in the data is anonymized. For example, system component entity identifiers and operating environment entity identifiers mentioned in the system operation status records in the log sequence are anonymized if these identifiers may contain sensitive information, such as component identifiers associated with specific customer accounts or environment identifiers associated with specific geographic locations. Furthermore, a strict access control mechanism is established to ensure that only authorized personnel or modules can access and process operation and maintenance data. Different roles within the financial institution's service system, such as operation and maintenance personnel and data analysts, are assigned different access rights based on their job responsibilities and needs. For example, an operation and maintenance personnel may only be allowed to view and process a portion of log data related to daily operations and maintenance, while a data analyst may, after undergoing a specific approval process, have access to the entire historical operation and maintenance log dataset and related processing results. At the system level, access control is implemented through authentication and authorization modules. When a user or module requests access to operation and maintenance data, authentication is first performed to verify the requester's identity information, such as username and password. If the identity verification is successful, the permission database is queried based on the role information to determine whether the requester has the permission to access the requested data. Only when both the identity verification and permission verification are successful is the requester allowed to access the corresponding data.

[0128] After analyzing and processing data and generating relevant results, such as root cause location results and O&M optimization strategy sets, if these results still contain sensitive information, data masking is performed. For example, if the root cause location results include detailed operational status information about system components related to specific customer transactions, this information may need to be masked. Data replacement or masking techniques can be used to replace sensitive numerical information, such as transaction amounts, with a processed substitute value. For example, consider dividing the transaction amount range into multiple intervals and assigning a fixed substitute value to each interval. For example, let the transaction amount be Amount. When Amount is in the interval [Lower1, Upper1], it is replaced with Substitute1; when Amount is in the interval [Lower2, Upper2], it is replaced with Substitute2, and so on. This way, when the root cause location results and O&M optimization strategy sets are displayed or communicated externally, sensitive information is masked, reducing the risk of data leakage.

[0129] Figure 2This diagram illustrates exemplary hardware and software components of a knowledge graph-based root cause location system 100, which can implement the concepts of this application, as provided in some embodiments of this application. For example, the processor 120 can be used in the knowledge graph-based root cause location system 100 to perform the functions described in this application.

[0130] The knowledge graph-based root cause location system 100 can be a general-purpose server or a special-purpose server, both of which can be used to implement the knowledge graph-based root cause location method of this application. Although only one server is shown in this application, for convenience, the functions described in this application can be implemented in a distributed manner on multiple similar platforms to balance the processing load.

[0131] For example, the operation and maintenance root cause location system 100 combined with the knowledge graph may include a network port 110 connected to the network, one or more processors 120 for executing program instructions, a communication bus 130, and different forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the operation and maintenance root cause location system 100 combined with the knowledge graph may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The method of the present application can be implemented according to these program instructions. The operation and maintenance root cause location system 100 combined with the knowledge graph also includes an I / O interface 150 between the computer and other input and output devices.

[0132] For ease of explanation, only one processor is described in the operation and maintenance root cause positioning system 100 combined with the knowledge graph. However, it should be noted that the operation and maintenance root cause positioning system 100 combined with the knowledge graph in the present application may also include multiple processors, so the steps performed by one processor described in the present application may also be performed jointly or individually by multiple processors. For example, if the processor of the operation and maintenance root cause positioning system 100 combined with the knowledge graph executes step A and step B, it should be understood that step A and step B may also be performed jointly by two different processors or individually in one processor. For example, the first processor executes step A, the second processor executes step B, or the first processor and the second processor execute steps A and B together.

[0133] In addition, an embodiment of the present invention also provides a readable storage medium, in which computer-executable instructions are preset. When the processor executes the computer-executable instructions, the above-mentioned operation and maintenance root cause location method combined with the knowledge graph is implemented.

[0134] It should be noted that in order to simplify the description of the present invention and thus help understand one or more embodiments of the invention, in the foregoing description of the embodiments of the present invention, multiple features are sometimes combined into one embodiment, figure or description thereof.

Claims

1. A method for locating the root cause of operation and maintenance combined with knowledge graph, characterized in that: The method comprises: Obtain a historical operation and maintenance log data set of the target system, wherein the historical operation and maintenance log data set includes multiple log sequences, each log sequence consisting of at least one system operation status record and a corresponding abnormal event marker; Performing entity relationship recognition processing on the historical operation and maintenance log data set to generate an operation and maintenance knowledge graph containing system component entities, operating environment entities, and event association relationships; Calling a pre-trained node feature extraction model to perform attribute feature extraction operations on the nodes corresponding to each system component entity in the operation and maintenance knowledge graph to generate a node operation status feature set and a node environment association feature set; Performing multi-level feature fusion processing based on the node operation status feature set and the node environment association feature set to generate a root cause location feature set for each system component entity; Performing backtracking analysis of abnormal events based on the root cause location feature set to generate a root cause location result of the target system and a corresponding operation and maintenance optimization strategy set; The performing entity relationship recognition processing on the historical operation and maintenance log data set to generate an operation and maintenance knowledge graph containing system component entities, operating environment entities, and event association relationships includes: Performing entity recognition processing on the system operation status records in the log sequence to identify the system component entity identifiers and the operation environment entity identifiers involved in the system operation status records; Performing relationship extraction processing on the abnormal event markers in the log sequence to extract the association relationship descriptor between the system component entity identifier and the operating environment entity identifier in the abnormal event marker; Constructing an initial entity relationship network according to the system component entity identifier, the operating environment entity identifier and the association relationship descriptor; Performing attribute association processing on the initial entity relationship network, associating the operating state parameters corresponding to the system component entity identifier and the environmental parameters corresponding to the operating environment entity identifier in the log sequence to the corresponding entity nodes in the initial entity relationship network, and generating an initial operation and maintenance knowledge graph, wherein trigger rules based on time periods and system change events are set, and when a preset trigger condition is detected, performing incremental entity relationship update processing on the initial operation and maintenance knowledge graph; The performing of multi-level feature fusion processing based on the node operation state feature set and the node environment association feature set to generate a root cause location feature set for each system component entity includes: Determine a feature dimension corresponding to each operating state feature in the node operating state feature set and a feature dimension corresponding to each environment-related feature in the node environment-related feature set; Performing feature alignment processing based on a self-attention mechanism on the node operation state feature set and the node environment association feature set to generate a dimensionally matched standardized feature set, performing element-wise product processing on each standardized operation state feature and the corresponding environment association feature to generate a feature interaction vector; All the feature interaction vectors are concatenated in order of feature dimensions to generate a state-environment cross feature matrix; Performing feature dimensionality reduction processing on the state-environment cross feature matrix to generate a state-environment fusion feature set after dimensionality reduction; Performing residual connection processing on the state environment fusion feature set after dimensionality reduction and the node operation state feature set to generate a primary root cause location feature set; Nonlinear transformation is performed on the primary root cause location feature set to generate a root cause location feature set of the system component entity.

2. The operation and maintenance root cause location method combined with knowledge graph according to claim 1 is characterized in that: The performing entity recognition processing on the system operation status record in the log sequence to identify the system component entity identifier and the operation environment entity identifier involved in the system operation status record includes: Performing structured parsing processing on the system operation status record to separate the component identification field, the environment parameter field, and the status description field contained in the system operation status record; Calling a predefined component entity dictionary to perform matching processing on the component identification field to identify the system component entity identifier corresponding to the component identification field; Calling a predefined environment entity dictionary to perform matching processing on the environment parameter field, and identifying the operating environment entity identifier corresponding to the environment parameter field; The operating status parameter in the status description field is associated with the system component entity identifier to generate operating status attribute data of the system component entity identifier.

3. The operation and maintenance root cause location method combined with knowledge graph according to claim 1 is characterized in that: The performing of relationship extraction processing on the abnormal event marker in the log sequence to extract the association relationship descriptor between the system component entity identifier and the operating environment entity identifier in the abnormal event marker includes: Performing semantic parsing processing on the abnormal event marker to identify the abnormal state description segment corresponding to the system component entity identifier and the environment change description segment corresponding to the operating environment entity identifier in the abnormal event marker; Performing word segmentation processing on the abnormal state description segment and the environmental change description segment to generate a plurality of word nodes, and performing dependency syntax analysis processing on the plurality of word nodes to construct a dependency tree structure of the abnormal state description segment and the environmental change description segment; Extracting a root node and a leaf node including the system component entity identifier and the operating environment entity identifier from the dependency tree structure, generating a key node sequence, and performing a path traversal process on the key node sequence to identify all directed edge paths between a node corresponding to the system component entity identifier and a node corresponding to the operating environment entity identifier; Performing causal strength calculation processing on each of the directed edge paths to generate a causal strength value of the directed edge path, which specifically includes: extracting verb trigger word nodes in the directed edge path, and calculating the causal semantic similarity of the verb trigger word nodes in the historical event library; obtaining a time difference parameter between the node corresponding to the system component entity identifier and the node corresponding to the operating environment entity identifier, performing normalization processing on the time difference parameter to generate a time proximity feature; performing weighted sum processing on the causal semantic similarity and the time proximity feature to generate a causal strength value of the directed edge path; Arrange the directed edge paths in descending order according to the causal strength values, and select the directed edge path corresponding to the highest causal strength value as the causal association path between the system component entity identifier and the operating environment entity identifier; The association relationship descriptor is generated according to the causal association path, and the type of the association relationship descriptor is marked as an abnormal event trigger relationship.

4. The operation and maintenance root cause location method combined with knowledge graph according to claim 1 is characterized in that: The calling of the pre-trained node feature extraction model performs an attribute feature extraction operation on the node corresponding to each system component entity in the operation and maintenance knowledge graph to generate a node operation status feature set and a node environment association feature set, including: Traversing the system component entity nodes in the operation and maintenance knowledge graph to obtain the operating status attribute data and environmental parameter attribute data associated with the system component entity nodes; Calling the state feature encoding unit in the node feature extraction model to perform time series feature extraction processing on the operation state attribute data to generate a node operation state feature set of the system component entity node; Invoking the environmental feature encoding unit in the node feature extraction model to perform spatial feature extraction processing on the environmental parameter attribute data to generate a node environment associated feature set of the system component entity node; The node operation status feature set and the node environment association feature set are associated and stored in the corresponding system component entity node in the operation and maintenance knowledge graph.

5. The operation and maintenance root cause location method combined with knowledge graph according to claim 4 is characterized in that: The calling of the state feature encoding unit in the node feature extraction model to perform time series feature extraction processing on the operation state attribute data to generate a node operation state feature set of the system component entity node includes: Performing time window division processing on the operating status attribute data to generate a plurality of state parameter subsequences of consecutive time intervals; Performing fluctuation feature extraction processing on each state parameter subsequence to generate state fluctuation amplitude features and state change trend features corresponding to each time interval; Performing multi-scale fusion processing on the state fluctuation amplitude feature and the state change trend feature to generate a time series fusion feature of the state parameter subsequence; Aggregate the time series fusion features of all time intervals to generate a node operation status feature set of the system component entity node.

6. The operation and maintenance root cause location method combined with knowledge graph according to claim 4 is characterized in that: The calling of the environmental feature encoding unit in the node feature extraction model to perform spatial feature extraction processing on the environmental parameter attribute data to generate a node environment associated feature set of the system component entity node includes: Obtaining environmental parameter attribute data of the operating environment entity node adjacent to the system component entity node in the operation and maintenance knowledge graph; Performing difference calculation processing on the environmental parameter attribute data of the system component entity node itself and the environmental parameter attribute data of the adjacent operating environment entity nodes to generate an environmental parameter difference feature set; Performing a spatial correlation analysis based on physical topology constraints on the environmental parameter difference feature set, and determining a weighted environmental dependency strength feature between the system component entity node and the adjacent operating environment entity node in combination with the component environment dependency relationship defined in the system architecture document; A node environment association feature set of the system component entity node is generated according to the weighted environment dependency intensity feature and the environment parameter difference feature set.

7. The operation and maintenance root cause location method combined with knowledge graph according to claim 1 is characterized in that: The performing of abnormal event retrospective analysis processing according to the root cause location feature set to generate a root cause location result of the target system and a corresponding operation and maintenance optimization strategy set includes: Performing anomaly scoring processing on the root cause location feature set to generate an anomaly score value for each system component entity; Sorting the system component entities according to the abnormality score values ​​to generate a candidate root cause entity sequence; Performing event correlation path verification processing on each system component entity in the candidate root cause entity sequence to determine the correlation path matching degree between the system component entity and the historical abnormal event marker; According to the preset path matching weight coefficient and the abnormality weight coefficient, a weighted fusion process is performed on the associated path matching degree and the abnormality score value to generate a comprehensive root cause score for each system component entity; A root cause location result of the target system is generated according to descending order of the comprehensive root cause scores, and the operation and maintenance optimization strategy set is generated based on attribute characteristics of system component entities in the root cause location result.

8. An operation and maintenance root cause location system combined with knowledge graph, characterized by: It includes a processor and a memory, the memory is connected to the processor, the memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to implement the operation and maintenance root cause positioning method combined with knowledge graph as described in any one of claims 1 to 7 above.

Images