Computer equipment fault monitoring system and method based on artificial intelligence

Abstract

The present invention discloses a computer equipment fault monitoring system and method based on artificial intelligence, which relates to the technical field of computer equipment fault monitoring. The system includes data access, semantic analysis, knowledge graph construction, dynamic semantic association, data fusion processing, decision output and adaptive optimization modules. The data access module collects and standardizes hardware, software and network data; the semantic analysis module extracts and enhances semantic labels; the knowledge graph construction module forms a data semantic relationship network; the dynamic semantic association module screens potential semantic relationships; the data fusion processing module generates multi-dimensional feature vectors; the decision output module triggers fault warning; and the adaptive optimization module feeds back the knowledge graph construction. The method solves the problems of multi-source data alignment, semantic fusion and dynamic adaptation through event-driven interpolation, dynamic weight fusion, closed-loop feedback optimization, etc., improves fault monitoring accuracy and system adaptability, and is suitable for fault monitoring and early warning of computer equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of computer equipment fault monitoring, and in particular to a computer equipment fault monitoring system and method based on artificial intelligence. Background Art

[0002] With the advancement of Industry 4.0, the intelligence level of equipment continues to increase. Its fault monitoring faces three major challenges: heterogeneity of multi-source data, semantic complexity, and dynamic adaptability:

[0003] Industrial equipment often deploys a variety of sensors, including vibration, temperature, and current sensors, whose sampling frequencies can vary by several to dozens of times. Traditional time alignment methods (such as fixed-interval interpolation) can only process regularly sampled data and lack robustness against timing misalignments caused by unexpected events (such as equipment startup and shutdown, or sudden load changes). For example, a petrochemical company experienced misalignment between the timestamps of its compressor vibration sensor (1kHz) and temperature sensor (1Hz), resulting in a 300ms delay in fault warnings and millions of dollars in downtime losses.

[0004] Existing systems often use a fusion approach of "numerical feature concatenation + text keyword matching," failing to effectively mine deep semantic connections between data. For example, a robotic arm fault diagnosis system on a certain automotive production line identified anomalies solely based on the effective value of the vibration signal, ignoring crucial information such as "abnormal program termination" in the operation log, resulting in a false positive rate as high as 15%. Furthermore, one-hot encoding of text features, if relying on a fixed dictionary, struggles to capture new terminology introduced by equipment upgrades or process changes, limiting the model's generalization capabilities.

[0005] Traditional fault monitoring relies on manually preset thresholds and association rules, which are unable to cope with changes in equipment operating conditions and new fault modes. For example, a wind turbine's gearbox fault warning system sets vibration thresholds based on historical data. However, under extreme wind speeds, the normal vibration amplitude exceeds the threshold, resulting in frequent false alarms and a 20% increase in operation and maintenance costs. Furthermore, new faults (such as progressive performance degradation caused by sensor drift) are not covered by the rules, easily forming monitoring blind spots. Summary of the Invention

[0006] The purpose of the present invention is to provide a computer equipment fault monitoring system and method based on artificial intelligence to solve the problems raised in the prior art.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The computer equipment fault monitoring system based on artificial intelligence includes a data access module, a semantic analysis module, a knowledge graph construction module, a dynamic semantic association module, a data fusion processing module, a decision output module and an adaptive optimization module; the data access module collects three types of data, namely hardware, software and network, through a universal interface, and provides a unified structured input for the semantic analysis module after format standardization; the semantic analysis module extracts and enhances semantic labels from standardized data, and provides basic modeling materials at the semantic level for the knowledge graph construction module; the knowledge graph construction module abstracts semantic labels into three-layer nodes of equipment, indicators and faults, generates causal / co-occurrence association edges based on historical data and rules, forms a data semantic relationship network, and provides a knowledge basis for dynamic semantic association; the dynamic semantic The association module queries high-weight associated nodes in real time based on the knowledge graph, optimizes the association path through reinforcement learning, screens out potential semantic relationships that are strongly correlated with real-time data, and outputs them to the data fusion processing module; the data fusion processing module performs time alignment and weighted fusion of semantic features on multi-frequency data to generate a multi-dimensional feature vector containing deep semantic associations, providing the decision output module with structured data that can be directly used for fault analysis; the decision output module encapsulates the fused features into a standard format and outputs them, and at the same time triggers fault warnings based on preset rules, associates the processing suggestions in the knowledge graph, and provides feedback data for the adaptive optimization module; the adaptive optimization module discovers new fault modes through historical data backtracking, automatically adjusts system parameters based on real-time diagnostic feedback, and feeds back to the knowledge graph construction module.

[0009] The data access module includes a multi-source data acquisition unit and a format standardization unit;

[0010] The multi-source data acquisition unit is responsible for real-time collection of three core data types: computer device hardware sensor data, software log data, and network traffic data. Specifically, a universal adapter interface is first designed to obtain hardware data based on the device driver protocol, capture software logs through the log monitoring API, and then use network probes to capture traffic data in real time. The data collection frequency is dynamically controlled by the device status. In normal status, the basic frequency is used for collection, and the normal collection frequency is the system's general collection frequency. If the collection frequency is higher than the normal frequency for three consecutive times, it is determined to be an abnormal state, triggering high-frequency collection. The basic frequency and high-frequency collection interval are configured according to preset rules.

[0011] The format standardization unit is responsible for converting multi-source heterogeneous data into a unified structured intermediate format; specifically: defining a three-layer data description framework including a base layer, a content layer, and an extension layer; the base layer covers timestamps, device unique identifiers, and data type labels; the content layer stores raw data in key-value pairs; the extension layer records collection environment parameters; format conversion is achieved through regular expression matching and a protocol parser, and unified JSON format data is output.

[0012] The semantic parsing module includes a semantic tag extraction unit and a context semantic enhancement unit;

[0013] The semantic tag extraction unit extracts semantic tags from standardized data and establishes a mapping between data and business semantics. Specifically, it constructs a domain semantic dictionary containing basic semantic tags and composite semantic tags. It uses a rule engine to drive tag extraction. For numerical data, the corresponding tag is triggered when the indicator value exceeds a preset threshold. For text data, the tag is triggered by matching keywords with preset semantic rules.

[0014] The contextual semantic enhancement unit combines data context information to eliminate semantic ambiguity and enhance label accuracy. Specifically, a contextual association rule base is designed, and the rules include preconditions and enhancement logic. When multiple labels meet the preconditions within the same time window, the generation of composite semantic labels is triggered. The time window length is determined by preset parameters. The historical data of the contextual association rule base comes from the historical fusion data backtracked by the adaptive optimization module, and high-frequency co-occurrence label combinations are generated through cluster analysis.

[0015] The knowledge graph construction module includes a semantic node modeling unit and an association edge generation unit;

[0016] The semantic node modeling unit is responsible for abstracting semantic tags into knowledge graph nodes and defining node attributes. Specifically: a three-level node architecture is adopted to achieve cross-layer association through unique identifiers. Device layer nodes correspond to specific physical devices, and attributes include basic device information, network identification, and deployment environment. Index layer nodes correspond to performance / status indicators of device operation, and attributes include basic indicator information, threshold range, data type, and acquisition frequency. Fault layer nodes correspond to device fault types or abnormal states, and attributes include basic fault information, impact range, and historical occurrence frequency. Semantic tags are mapped to corresponding nodes through preset rules, and device layer tags directly extract unique device information. Identify and generate device layer nodes and associate them with hardware configuration information; parse the indicator layer numerical tags to match the indicator names and values ​​to the indicator layer nodes. If the preset fault threshold is exceeded, the fault association logic is triggered. The textual tags are mapped to the corresponding indicator nodes through the semantic dictionary and associated with the corresponding device layer nodes. The fault layer tags associate the indicator layer nodes with the device layer nodes through the unique identifier to form a device-indicator-fault triplet. The node attributes are initialized through the preset template, which contains the required fields and format specifications of each layer node. The device layer node is automatically generated when a new device is connected. When a new indicator is first collected, the indicator layer node is generated based on the semantic tag parsing and associated with the corresponding device layer node.

[0017] The association edge generation unit generates causal edges, co-occurrence edges, and dependency edges between nodes based on historical data, domain knowledge, and device logical relationships, and constructs a dynamic semantic relationship network. Specifically, association edges are generated through data statistics and logical reasoning.

[0018] For the causal edge, it is set that when the indicator layer node A has an abnormal state, which includes but is not limited to a value exceeding the normal threshold range, and triggers the fault node B within the preset time, a causal edge is established, and its weight ω causal According to the probability of occurrence, the formula is as follows:

[0019] ;

[0020] Among them, ω causal is the co-occurrence edge weight, Count(A→B) is the number of times event A triggers event B, and TotalMonitoringTime is the total monitoring time; α is the recent data impact factor, with a value range of [0,1], and recent data is defined as the last 24 hours; ω initial is the initial weight, β is the environment and state correction factor, which is adjusted according to the operating status of the equipment and environmental factors;

[0021] For co-occurrence edges, if the frequency of two indicator layer nodes A and B appearing simultaneously within the preset time window is greater than or equal to the co-occurrence threshold, a co-occurrence edge is established. When the co-occurrence frequency is less than the threshold, the weight automatically decays to below 0.1 and is marked as an invalid edge. The weight calculation formula is as follows:

[0022] ;

[0023] Among them, ω co-occur represents the co-occurrence edge weight, indicating the strength of the co-occurrence relationship between indicator nodes A and B, with a value range of [0,1]. Frequency(A∩B) represents the frequency of simultaneous occurrence of nodes A and B within the preset window time, that is, the ratio of the number of co-occurrences between the two to the total monitoring time. Frequency(A) represents the frequency of node A appearing alone or with other nodes within the total monitoring time, that is, the ratio of the number of node A appearances to the total monitoring time. Frequency(B) represents the frequency of node B appearing alone or with other nodes within the total monitoring time, that is, the ratio of the number of node B appearances to the total monitoring time.

[0024] For dependency edges, hardware dependencies are based on the device hardware architecture, and the dependency relationship is preset through the knowledge base; software dependencies are based on system logic and are generated by parsing the software architecture document; the initial weight of the dependency edge is set in the range of [0.1-0.9], and is subsequently dynamically adjusted according to the node access frequency through the PageRank algorithm.

[0025] The dynamic semantic association module includes a real-time association query unit and an association path optimization unit;

[0026] The association query unit mines the potential semantic relationships that are strongly correlated with the input data in real time based on the knowledge graph, and outputs a set of high-weight association nodes. Specifically, GAT is used as the inference engine, the attention weight is dynamically coupled with the weight of the associated edge of the knowledge graph, the node association relationship is stored through the adjacency matrix, and the attention mechanism is used to focus on the high-weight edge. The semantic node set V corresponding to the current data is input. t , traverse the knowledge graph through breadth-first search, according to the preset search depth and association threshold θ assoc Filter associated nodes and generate associated node set V rel ;

[0027] The association path optimization unit dynamically optimizes the association path weights through reinforcement learning to improve the recognition accuracy of key semantic relationships. Specifically, a reinforcement learning framework is first used to construct a state space and action space based on historical fault diagnosis results to define a reward function R. The state space includes the node combination of the current association path; the action space retains and removes the two actions of the association edge. The formula of the reward function R is as follows:

[0028] ;

[0029] Among them, TP is the number of correctly detected faults, FN is the number of missed faults, FP is the number of false positives, TN is the number of true negatives, and λ is the false positive penalty coefficient, which ranges from [0,1] and is used to balance the detection accuracy and false positive risk. Then, through online learning, the associated edge weight ω is updated according to the formula new , the formula is as follows:

[0030] ;

[0031] Where γ is the learning rate, and its value range is [0,1]. is the reward function gradient, ω old The learning parameters are initialized through preset rules, gradually strengthening the weights of high-value paths and suppressing low-value paths, realizing adaptive optimization of associated paths and providing a semantic relationship network for data fusion processing.

[0032] The data fusion processing module includes a time alignment calibration unit and a semantic feature fusion unit;

[0033] The time alignment calibration unit performs time alignment on multi-source data of different frequencies by event-driven interpolation method to ensure the temporal consistency of semantic association; specifically: the timestamp of key events t main Based on the benchmark, low-frequency data and high-frequency data are processed separately. Key events include but are not limited to fault warnings and abnormal operation logs;

[0034] For low-frequency data, a linear interpolation formula is used to supplement the missing values ​​at the intermediate moments through linear fitting;

[0035] The semantic feature fusion unit fuses the semantic features of the associated data into a unified multi-dimensional feature vector to meet the input requirements of the fault monitoring model. Specifically, a weighted fusion mechanism is designed. First, the features of the associated data are normalized. For numerical features, the weights are weighted using the associated edge weights. The weights are normalized to generate weighted features. The formula is as follows:

[0036] ;

[0037] The weighted features are as follows:

[0038] ;

[0039] Among them, the associated edge weight ω i The causal edges, co-occurrence edges, and dependency edges from the knowledge graph are normalized to ensure the comparability of the weights of different types of edges; i represents the semantic feature of the i-th association; j is the index of the normalized sum of weights, which is used to calculate the sum of the associated edge weights; f i is the original feature value of the i-th associated data, which is divided into two types: numerical and text types; n is the current associated node set V rel The number of nodes in ;

[0040] For text features, the one-hot encoding algorithm is used to convert text keywords into binary numerical vectors. These are then concatenated with the numerical features by dimension to form a unified multidimensional feature vector F. The one-hot encoding is based on the domain semantic dictionary of the semantic parsing module, and the keyword set is automatically generated from high-frequency vocabulary in device logs. The vector formula is as follows:

[0041] ;

[0042] During the fusion process, the associated edge weight ω i Directly inherited from the output results of the dynamic semantic association module, it ensures that the fused feature vector contains deep semantic association information and provides structured input for the fault monitoring model.

[0043] The decision output module includes a fusion result generation unit and a fault warning triggering unit;

[0044] The fusion result generation unit encapsulates the multi-dimensional feature vector output by the data fusion processing module into standard structured data, supporting external system calls and visual display;

[0045] Specifically: First, a fusion data structure containing five elements is defined, namely device identification, timestamp, semantic label set, fusion feature vector and association path description; the device identification is extracted from the data access module’s unique device identification to ensure data traceability; the timestamp inherits the data access module’s microsecond timestamp to maintain temporal consistency; the semantic label set integrates the basic labels and composite labels generated by the semantic parsing module; the fusion feature vector directly adopts the multidimensional feature vector F output by the data fusion processing module, which contains the weighted fusion result of numerical and text features; the association path description records the high-weight association paths selected by the dynamic semantic association module;

[0046] Then, low-latency transmission is achieved through a preset message queue protocol. Transmission parameters are preset through configuration files and output to the fault monitoring model and visualization interface.

[0047] The fault warning trigger unit matches the warning rules in real time based on the fusion data, generates fault warning events and provides processing suggestions;

[0048] Specifically: Build an early warning rule library containing two types of rules: single-feature threshold rules and multi-feature association rules;

[0049] For single-feature threshold rules, three threshold levels are preset for numerical features, namely normal, warning, and fault;

[0050] For multi-feature association rules, multiple semantic labels Alet are combined by the logical operator AND. The formula is as follows:

[0051] ;

[0052] Among them, L i is the semantic label that triggers the warning; i=1,2,...,n;

[0053] Then, a forward chain reasoning engine is used. When the fused data meets the rule conditions, a warning event is triggered and the processing suggestions for the fault layer nodes in the knowledge graph are associated. The suggestion content is generated through a preset template, including the fault level, impact range and handling steps, to ensure the connection with the fault processing logic of the knowledge graph.

[0054] The self-adaptive optimization module includes a historical data backtracking unit and a system parameter tuning unit;

[0055] The historical data backtracking unit mines new fault modes through historical data and improves the fault association relationship of the knowledge graph;

[0056] Specifically: Use a sliding time window to trace back historical fusion data and identify abnormal patterns through cluster analysis; first perform anomaly detection and calculate the anomaly score AnomalyScore(X) for each data point X. The calculation formula is as follows:

[0057] ;

[0058] Among them, ci is the i-th cluster center, k is the preset number of clusters, and Distance is obtained using the Euclidean distance formula; then the pattern is marked, and when AnomalyScore(X)>θ cluster When , it is marked as a potential failure mode, θ cluster A clustering anomaly threshold is preset. Finally, the review process is triggered through a preset workflow, which includes the system automatically marking abnormal patterns, sending review requests to administrators, and automatically adding candidates to the candidate pool if not reviewed within 72 hours. After manual confirmation, the indicator-fault association relationship corresponding to the new fault pattern is added to the knowledge graph, and the fault layer nodes and associated edges are updated to ensure the self-evolution capability of the knowledge graph.

[0059] The system parameter tuning unit dynamically adjusts the system core parameters according to the fault monitoring feedback and optimizes the semantic fusion and association logic;

[0060] Specifically: Building a closed-loop feedback system includes three steps:

[0061] First, obtain the diagnostic results of the fault monitoring model, including accuracy, missed detection rate, and false detection rate. Then, calculate the parameter adjustment gradient using the gradient formula, as follows:

[0062] ;

[0063] in, is the learning rate, is the partial derivative of the reward function with respect to the parameter θ. The reward function R directly adopts the reward function R of the above-mentioned associated path optimization unit;

[0064] Finally, an automated script is used to adjust the semantic parsing rules, association thresholds, and fusion weight parameters according to the preset algorithm. The adjustment step is dynamically determined by the algorithm without the need for human intervention, forming a closed loop of diagnostic feedback-parameter optimization-performance improvement, ensuring that the system continues to adapt to changes in equipment operation scenarios.

[0065] The computer equipment fault monitoring method based on artificial intelligence includes the following steps:

[0066] S1. The multi-source data acquisition unit of the data access module acquires hardware sensor data, software log data, and network traffic data of computer devices in real time, and dynamically adjusts the acquisition frequency based on the device status. The collected data is processed by the format standardization unit and converted into a unified JSON format containing the base layer, content layer, and extension layer through regular expression matching and protocol parser, providing structured input for subsequent semantic analysis.

[0067] S2, the semantic parsing module, first performs semantic mapping on the standardized data through the semantic tag extraction unit: when numerical data exceeds a preset threshold, a basic tag is triggered, and when text data is labeled, a corresponding tag is generated through keyword matching. Then, the contextual semantic enhancement unit combines the co-occurring tags based on the time window and device status preconditions to logically combine them and generate composite semantic tags, eliminating ambiguity and improving tag accuracy, providing semantic material for knowledge graph construction.

[0068] S3, the knowledge graph construction module, abstracts semantic labels into three layers of nodes: device, indicator, and fault. Device-layer nodes associate hardware configurations with network identifiers; indicator-layer nodes define performance thresholds and acquisition frequencies; and fault-layer nodes label fault levels and impact ranges. Through the association edge generation unit, causal edges, co-occurrence edges, and dependency edges are established based on historical data statistics and logical reasoning, forming a semantic relationship network between devices, indicators, and faults, providing a knowledge foundation for dynamic association.

[0069] S4. The dynamic semantic association module utilizes the real-time association query unit, based on the adjacency matrix and attention mechanism of the knowledge graph, to traverse the graph through breadth-first search, screening high-weight association nodes according to the preset search depth and association threshold. Subsequently, the association path optimization unit adopts a reinforcement learning framework, with fault diagnosis accuracy as the reward function, to update the association edge weights through online learning, strengthen the weights of high-frequency fault paths, and suppress low-value associations, thus achieving accurate screening of the potential semantic relationships of real-time data and outputting a set of high-value association nodes to the data fusion module.

[0070] S5. The data fusion processing module first uses the time alignment unit to use the key event timestamp as a benchmark, using linear interpolation to supplement missing values ​​for low-frequency data and generating an alignment sequence for high-frequency data using the sliding window mean to ensure the consistency of multi-source data time series. Then, the semantic feature fusion unit normalizes and weights the numerical features according to the associated edge weights, converts the text features into binary vectors through one-hot encoding, and then splices them with the numerical features to form a multidimensional feature vector containing deep semantic associations, providing structured input for fault decision making.

[0071] S6. The decision output module encapsulates the fused features into a standard format and transmits them to the monitoring model or visualization interface with low latency through the message queue. At the same time, the fault warning trigger unit generates warning events through forward chain reasoning based on the single-feature threshold and multi-feature association rules, and associates the processing suggestions in the knowledge graph. The adaptive optimization module clusters and analyzes abnormal patterns through the historical data backtracking unit, and updates the knowledge graph after manual review. The system parameter tuning unit dynamically adjusts the semantic parsing rules and association threshold parameters based on diagnostic feedback, forming a data collection-decision-making-optimization closed loop, and continuously improving the accuracy and adaptability of system fault monitoring.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] 1. Improved spatiotemporal alignment accuracy for multi-source data, ensuring temporal consistency in fault correlation analysis: This invention achieves high-precision time alignment of multi-frequency data through event-driven interpolation and sliding window mean filtering. For low-frequency data, the timestamps of key events (such as abnormal equipment startup and shutdown, or sudden parameter changes) are used as a benchmark, and intermediate moments are dynamically supplemented through a linear interpolation formula to control timestamp errors within a preset microsecond range. For high-frequency data, a sliding window algorithm with an adaptive window size (the window size is dynamically adjusted by preset parameters) is used to calculate the mean, suppressing noise while preserving high-frequency features. This mechanism ensures strict temporal alignment of multi-source data, providing a high-quality, temporally consistent data foundation for subsequent semantic correlation analysis, significantly improving the accuracy of fault causal relationship identification.

[0074] 2. Semantic-enhanced feature fusion technology to deeply explore potential fault associations between data: Through dynamic weight allocation and cross-modal feature encoding, the present invention achieves deep semantic fusion of numerical and textual data. The association edge weights are directly inherited from the reinforcement learning results of the dynamic semantic association module. After normalization, a multi-dimensional feature vector is generated through a weighted formula, so that high-value semantic relationships (such as causal edges and co-occurrence edges) dominate the feature space. For text-based log data, keywords are converted into binary vectors through a one-hot encoding algorithm, and then spliced ​​with numerical features by dimension to form a unified feature representation that includes device status, operation logs, and environmental parameters. This technology breaks through the limitations of traditional single-modal analysis and significantly improves the feature representation capabilities in complex fault scenarios.

[0075] 3. A closed-loop feedback self-optimization system enables dynamic system adaptation and new fault detection: Based on historical data backtracking and parameter gradient adjustment, this invention establishes the self-evolutionary capabilities of the fault monitoring system. The historical data backtracking unit identifies potential fault modes using a sliding time window and cluster analysis formula, and automatically updates the knowledge graph after manual review, enabling the system to continuously detect new faults. The system parameter tuning unit dynamically adjusts core parameters such as semantic parsing rules and association thresholds based on the gradient calculation of the reinforcement learning reward function R, adapting to changes in equipment operating conditions without manual intervention. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 This is a system architecture diagram of the computer equipment fault monitoring system based on artificial intelligence of the present invention;

[0077] Figure 2 The following is a system workflow diagram of the computer equipment fault monitoring system based on artificial intelligence of the present invention. DETAILED DESCRIPTION

[0078] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0079] Example: Figure 1-Figure 2 As shown, the present invention provides a technical solution.

[0080] The computer equipment fault monitoring system based on artificial intelligence includes a data access module, a semantic analysis module, a knowledge graph construction module, a dynamic semantic association module, a data fusion processing module, a decision output module and an adaptive optimization module; the data access module collects three types of data, namely hardware, software and network, through a universal interface, and provides a unified structured input for the semantic analysis module after format standardization; the semantic analysis module extracts and enhances semantic labels from standardized data, and provides basic modeling materials at the semantic level for the knowledge graph construction module; the knowledge graph construction module abstracts semantic labels into three-layer nodes of equipment, indicators and faults, generates causal / co-occurrence association edges based on historical data and rules, forms a data semantic relationship network, and provides a knowledge basis for dynamic semantic association; the dynamic semantic The association module queries high-weight associated nodes in real time based on the knowledge graph, optimizes the association path through reinforcement learning, screens out potential semantic relationships that are strongly correlated with real-time data, and outputs them to the data fusion processing module; the data fusion processing module performs time alignment and weighted fusion of semantic features on multi-frequency data to generate a multi-dimensional feature vector containing deep semantic associations, providing the decision output module with structured data that can be directly used for fault analysis; the decision output module encapsulates the fused features into a standard format and outputs them, and at the same time triggers fault warnings based on preset rules, associates the processing suggestions in the knowledge graph, and provides feedback data for the adaptive optimization module; the adaptive optimization module discovers new fault modes through historical data backtracking, automatically adjusts system parameters based on real-time diagnostic feedback, and feeds back to the knowledge graph construction module.

[0081] The data access module includes a multi-source data acquisition unit and a format standardization unit;

[0082] The multi-source data acquisition unit is responsible for real-time collection of three core data types: computer device hardware sensor data, software log data, and network traffic data. Specifically, a universal adapter interface is first designed to obtain hardware data based on the device driver protocol, capture software logs through the log monitoring API, and then use network probes to capture traffic data in real time. The data collection frequency is dynamically controlled by the device status. In normal status, the basic frequency is used for collection, and the normal collection frequency is the system's general collection frequency. If the collection frequency is higher than the normal frequency for three consecutive times, it is determined to be an abnormal state, triggering high-frequency collection. The basic frequency and high-frequency collection interval are configured according to preset rules.

[0083] The format standardization unit is responsible for converting multi-source heterogeneous data into a unified structured intermediate format; specifically: defining a three-layer data description framework including a base layer, a content layer, and an extension layer; the base layer covers timestamps, device unique identifiers, and data type labels; the content layer stores raw data in key-value pairs; the extension layer records collection environment parameters; format conversion is achieved through regular expression matching and a protocol parser, and unified JSON format data is output.

[0084] The semantic parsing module includes a semantic tag extraction unit and a context semantic enhancement unit;

[0085] The semantic tag extraction unit extracts semantic tags from standardized data and establishes a mapping between data and business semantics. Specifically, it constructs a domain semantic dictionary containing basic semantic tags and composite semantic tags. It uses a rule engine to drive tag extraction. For numerical data, the corresponding tag is triggered when the indicator value exceeds a preset threshold. For text data, the tag is triggered by matching keywords with preset semantic rules.

[0086] The contextual semantic enhancement unit combines data context information to eliminate semantic ambiguity and enhance label accuracy. Specifically, a contextual association rule base is designed, and the rules include preconditions and enhancement logic. When multiple labels meet the preconditions within the same time window, the generation of composite semantic labels is triggered. The time window length is determined by preset parameters. The historical data of the contextual association rule base comes from the historical fusion data backtracked by the adaptive optimization module, and high-frequency co-occurrence label combinations are generated through cluster analysis.

[0087] The knowledge graph construction module includes a semantic node modeling unit and an association edge generation unit;

[0088] The semantic node modeling unit is responsible for abstracting semantic tags into knowledge graph nodes and defining node attributes. Specifically: a three-level node architecture is adopted to achieve cross-layer association through unique identifiers. Device layer nodes correspond to specific physical devices, and attributes include basic device information, network identification, and deployment environment. Index layer nodes correspond to performance / status indicators of device operation, and attributes include basic indicator information, threshold range, data type, and acquisition frequency. Fault layer nodes correspond to device fault types or abnormal states, and attributes include basic fault information, impact range, and historical occurrence frequency. Semantic tags are mapped to corresponding nodes through preset rules, and device layer tags directly extract unique device information. Identify and generate device layer nodes and associate them with hardware configuration information; parse the indicator layer numerical tags to match the indicator names and values ​​to the indicator layer nodes. If the preset fault threshold is exceeded, the fault association logic is triggered. The textual tags are mapped to the corresponding indicator nodes through the semantic dictionary and associated with the corresponding device layer nodes. The fault layer tags associate the indicator layer nodes with the device layer nodes through the unique identifier to form a device-indicator-fault triplet. The node attributes are initialized through the preset template, which contains the required fields and format specifications of each layer node. The device layer node is automatically generated when a new device is connected. When a new indicator is first collected, the indicator layer node is generated based on the semantic tag parsing and associated with the corresponding device layer node.

[0089] The association edge generation unit generates causal edges, co-occurrence edges, and dependency edges between nodes based on historical data, domain knowledge, and device logical relationships, and constructs a dynamic semantic relationship network. Specifically, association edges are generated through data statistics and logical reasoning.

[0090] For the causal edge, it is set that when the indicator layer node A has an abnormal state, which includes but is not limited to a value exceeding the normal threshold range, and triggers the fault node B within the preset time, a causal edge is established, and its weight ω causal According to the probability of occurrence, the formula is as follows:

[0091] ;

[0092] Among them, ω causal is the co-occurrence edge weight, Count(A→B) is the number of times event A triggers event B, and TotalMonitoringTime is the total monitoring time; α is the recent data impact factor, with a value range of [0,1], and recent data is defined as the last 24 hours; ω initial is the initial weight, β is the environment and state correction factor, which is adjusted according to the operating status of the equipment and environmental factors;

[0093] For co-occurrence edges, if the frequency of two indicator layer nodes A and B appearing simultaneously within the preset time window is greater than or equal to the co-occurrence threshold, a co-occurrence edge is established. When the co-occurrence frequency is less than the threshold, the weight automatically decays to below 0.1 and is marked as an invalid edge. The weight calculation formula is as follows:

[0094] ;

[0095] Among them, ω co-occur represents the co-occurrence edge weight, indicating the strength of the co-occurrence relationship between indicator nodes A and B, with a value range of [0,1]. Frequency(A∩B) represents the frequency of simultaneous occurrence of nodes A and B within the preset window time, that is, the ratio of the number of co-occurrences between the two to the total monitoring time. Frequency(A) represents the frequency of node A appearing alone or with other nodes within the total monitoring time, that is, the ratio of the number of node A appearances to the total monitoring time. Frequency(B) represents the frequency of node B appearing alone or with other nodes within the total monitoring time, that is, the ratio of the number of node B appearances to the total monitoring time.

[0096] For dependency edges, hardware dependencies are based on the device hardware architecture, and the dependency relationship is preset through the knowledge base; software dependencies are based on system logic and are generated by parsing the software architecture document; the initial weight of the dependency edge is set in the range of [0.1-0.9], and is subsequently dynamically adjusted according to the node access frequency through the PageRank algorithm.

[0097] The dynamic semantic association module includes a real-time association query unit and an association path optimization unit;

[0098] The association query unit mines the potential semantic relationships that are strongly correlated with the input data in real time based on the knowledge graph, and outputs a set of high-weight association nodes. Specifically, GAT is used as the inference engine, the attention weight is dynamically coupled with the weight of the associated edge of the knowledge graph, the node association relationship is stored through the adjacency matrix, and the attention mechanism is used to focus on the high-weight edge. The semantic node set V corresponding to the current data is input. t , traverse the knowledge graph through breadth-first search, according to the preset search depth and association threshold θ assoc Filter associated nodes and generate associated node set V rel ;

[0099] The association path optimization unit dynamically optimizes the association path weights through reinforcement learning to improve the recognition accuracy of key semantic relationships. Specifically, a reinforcement learning framework is first used to construct a state space and action space based on historical fault diagnosis results to define a reward function R. The state space includes the node combination of the current association path; the action space retains and removes the two actions of the association edge. The formula of the reward function R is as follows:

[0100] ;

[0101] Among them, TP is the number of correctly detected faults, FN is the number of missed faults, FP is the number of false positives, TN is the number of true negatives, and λ is the false positive penalty coefficient, which ranges from [0,1] and is used to balance the detection accuracy and false positive risk. Then, through online learning, the associated edge weight ω is updated according to the formula new , the formula is as follows:

[0102] ;

[0103] Where γ is the learning rate, and its value range is [0,1]. is the reward function gradient, ω old The learning parameters are initialized through preset rules, gradually strengthening the weights of high-value paths and suppressing low-value paths, realizing adaptive optimization of associated paths and providing a semantic relationship network for data fusion processing.

[0104] The data fusion processing module includes a time alignment calibration unit and a semantic feature fusion unit;

[0105] The time alignment calibration unit performs time alignment on multi-source data of different frequencies by event-driven interpolation method to ensure the temporal consistency of semantic association; specifically: the timestamp of key events t main Based on the benchmark, low-frequency data and high-frequency data are processed separately. Key events include but are not limited to fault warnings and abnormal operation logs;

[0106] For low-frequency data, a linear interpolation formula is used to supplement the missing values ​​at the intermediate moments through linear fitting;

[0107] The semantic feature fusion unit fuses the semantic features of the associated data into a unified multi-dimensional feature vector to meet the input requirements of the fault monitoring model. Specifically, a weighted fusion mechanism is designed. First, the features of the associated data are normalized. For numerical features, the weights are weighted using the associated edge weights. The weights are normalized to generate weighted features. The formula is as follows:

[0108] ;

[0109] The weighted features are as follows:

[0110] ;

[0111] Among them, the associated edge weight ω i The causal edges, co-occurrence edges, and dependency edges from the knowledge graph are normalized to ensure the comparability of the weights of different types of edges; i represents the semantic feature of the i-th association; j is the index of the normalized sum of weights, which is used to calculate the sum of the associated edge weights; f i is the original feature value of the i-th associated data, which is divided into two types: numerical and text types; n is the current associated node set V rel The number of nodes in ;

[0112] For text features, the one-hot encoding algorithm is used to convert text keywords into binary numerical vectors. These are then concatenated with the numerical features by dimension to form a unified multidimensional feature vector F. The one-hot encoding is based on the domain semantic dictionary of the semantic parsing module, and the keyword set is automatically generated from high-frequency vocabulary in device logs. The vector formula is as follows:

[0113] ;

[0114] During the fusion process, the associated edge weight ω i Directly inherited from the output results of the dynamic semantic association module, it ensures that the fused feature vector contains deep semantic association information and provides structured input for the fault monitoring model.

[0115] The decision output module includes a fusion result generation unit and a fault warning triggering unit;

[0116] The fusion result generation unit encapsulates the multi-dimensional feature vector output by the data fusion processing module into standard structured data, supporting external system calls and visual display;

[0117] Specifically: First, a fusion data structure containing five elements is defined, namely device identification, timestamp, semantic label set, fusion feature vector and association path description; the device identification is extracted from the data access module’s unique device identification to ensure data traceability; the timestamp inherits the data access module’s microsecond timestamp to maintain temporal consistency; the semantic label set integrates the basic labels and composite labels generated by the semantic parsing module; the fusion feature vector directly adopts the multidimensional feature vector F output by the data fusion processing module, which contains the weighted fusion result of numerical and text features; the association path description records the high-weight association paths selected by the dynamic semantic association module;

[0118] Then, low-latency transmission is achieved through a preset message queue protocol. Transmission parameters are preset through configuration files and output to the fault monitoring model and visualization interface.

[0119] The fault warning trigger unit matches the warning rules in real time based on the fusion data, generates fault warning events and provides processing suggestions;

[0120] Specifically: Build an early warning rule library containing two types of rules: single-feature threshold rules and multi-feature association rules;

[0121] For single-feature threshold rules, three threshold levels are preset for numerical features, namely normal, warning, and fault;

[0122] For multi-feature association rules, multiple semantic labels Alet are combined by the logical operator AND. The formula is as follows:

[0123] ;

[0124] Among them, L i is the semantic label that triggers the warning; i=1,2,...,n;

[0125] Then, a forward chain reasoning engine is used. When the fused data meets the rule conditions, a warning event is triggered and the processing suggestions for the fault layer nodes in the knowledge graph are associated. The suggestion content is generated through a preset template, including the fault level, impact range and handling steps, to ensure the connection with the fault processing logic of the knowledge graph.

[0126] The self-adaptive optimization module includes a historical data backtracking unit and a system parameter tuning unit;

[0127] The historical data backtracking unit mines new fault modes through historical data and improves the fault association relationship of the knowledge graph;

[0128] Specifically: Use a sliding time window to trace back historical fusion data and identify abnormal patterns through cluster analysis; first perform anomaly detection and calculate the anomaly score AnomalyScore(X) for each data point X. The calculation formula is as follows:

[0129] ;

[0130] Among them, ci is the i-th cluster center, k is the preset number of clusters, and Distance is obtained using the Euclidean distance formula; then the pattern is marked, and when AnomalyScore(X)>θ cluster When , it is marked as a potential failure mode, θ cluster A clustering anomaly threshold is preset. Finally, the review process is triggered through a preset workflow, which includes the system automatically marking abnormal patterns, sending review requests to administrators, and automatically adding candidates to the candidate pool if not reviewed within 72 hours. After manual confirmation, the indicator-fault association relationship corresponding to the new fault pattern is added to the knowledge graph, and the fault layer nodes and associated edges are updated to ensure the self-evolution capability of the knowledge graph.

[0131] The system parameter tuning unit dynamically adjusts the system core parameters according to the fault monitoring feedback and optimizes the semantic fusion and association logic;

[0132] Specifically: Building a closed-loop feedback system includes three steps:

[0133] First, obtain the diagnostic results of the fault monitoring model, including accuracy, missed detection rate, and false detection rate. Then, calculate the parameter adjustment gradient using the gradient formula, as follows:

[0134] ;

[0135] in, is the learning rate, is the partial derivative of the reward function with respect to the parameter θ. The reward function R directly adopts the reward function R of the above-mentioned associated path optimization unit;

[0136] Finally, an automated script is used to adjust the semantic parsing rules, association thresholds, and fusion weight parameters according to the preset algorithm. The adjustment step is dynamically determined by the algorithm without the need for human intervention, forming a closed loop of diagnostic feedback-parameter optimization-performance improvement, ensuring that the system continues to adapt to changes in equipment operation scenarios.

[0137] The computer equipment fault monitoring method based on artificial intelligence includes the following steps:

[0138] S1. The multi-source data acquisition unit of the data access module acquires hardware sensor data, software log data, and network traffic data of computer devices in real time, and dynamically adjusts the acquisition frequency based on the device status. The collected data is processed by the format standardization unit and converted into a unified JSON format containing the base layer, content layer, and extension layer through regular expression matching and protocol parser, providing structured input for subsequent semantic analysis.

[0139] S2, the semantic parsing module, first performs semantic mapping on the standardized data through the semantic tag extraction unit: when numerical data exceeds a preset threshold, a basic tag is triggered, and when text data is labeled, a corresponding tag is generated through keyword matching. Then, the contextual semantic enhancement unit combines the co-occurring tags based on the time window and device status preconditions to logically combine them and generate composite semantic tags, eliminating ambiguity and improving tag accuracy, providing semantic material for knowledge graph construction.

[0140] S3, the knowledge graph construction module, abstracts semantic labels into three layers of nodes: device, indicator, and fault. Device-layer nodes associate hardware configurations with network identifiers; indicator-layer nodes define performance thresholds and acquisition frequencies; and fault-layer nodes label fault levels and impact ranges. Through the association edge generation unit, causal edges, co-occurrence edges, and dependency edges are established based on historical data statistics and logical reasoning, forming a semantic relationship network between devices, indicators, and faults, providing a knowledge foundation for dynamic association.

[0141] S4. The dynamic semantic association module utilizes the real-time association query unit, based on the adjacency matrix and attention mechanism of the knowledge graph, to traverse the graph through breadth-first search, screening high-weight association nodes according to the preset search depth and association threshold. Subsequently, the association path optimization unit adopts a reinforcement learning framework, with fault diagnosis accuracy as the reward function, to update the association edge weights through online learning, strengthen the weights of high-frequency fault paths, and suppress low-value associations, thus achieving accurate screening of the potential semantic relationships of real-time data and outputting a set of high-value association nodes to the data fusion module.

[0142] S5. The data fusion processing module first uses the time alignment unit to use the key event timestamp as a benchmark, using linear interpolation to supplement missing values ​​for low-frequency data and generating an alignment sequence for high-frequency data using the sliding window mean to ensure the consistency of multi-source data time series. Then, the semantic feature fusion unit normalizes and weights the numerical features according to the associated edge weights, converts the text features into binary vectors through one-hot encoding, and then splices them with the numerical features to form a multidimensional feature vector containing deep semantic associations, providing structured input for fault decision making.

[0143] S6. The decision output module encapsulates the fused features into a standard format and transmits them to the monitoring model or visualization interface with low latency through the message queue. At the same time, the fault warning trigger unit generates warning events through forward chain reasoning based on the single-feature threshold and multi-feature association rules, and associates the processing suggestions in the knowledge graph. The adaptive optimization module clusters and analyzes abnormal patterns through the historical data backtracking unit, and updates the knowledge graph after manual review. The system parameter tuning unit dynamically adjusts the semantic parsing rules and association threshold parameters based on diagnostic feedback, forming a data collection-decision-making-optimization closed loop, and continuously improving the accuracy and adaptability of system fault monitoring. Example

[0144] Using server Server-001 in a data center as the monitoring target, the system first collects multi-source data in real time through the data access module. Hardware sensors collect metrics such as CPU temperature and memory usage at a base rate of once per second. If the CPU temperature exceeds the 80°C warning threshold three times consecutively (e.g., 85°C, 88°C, and 90°C at 2:00 PM), the system automatically switches to high-frequency data collection (10 times per second). This dynamic control mechanism responds to anomalies in real time based on device status, avoiding redundant data collection while ensuring high-density capture of abnormal data. Software logs capture key events such as "Memory allocation failed" through API monitoring, and network probes capture bandwidth utilization data in real time (e.g., an average of 95% between 2:00 PM and 2:10 PM exceeding the 80% threshold). All data is converted into a unified JSON format using standardized units, including timestamps, device IDs (e.g., Server-001), data values ​​(e.g., CPU temperature 85°C), and environmental parameters (e.g., rack location), providing structured input for subsequent semantic analysis. This process normalizes heterogeneous data using regular expressions and protocol parsers, addressing format compatibility issues for hardware, software, and network data.

[0145] The semantic parsing module performs semantic transformation on standardized data. Numerical data is triggered by pre-set thresholds using basic labels. For example, a CPU temperature of 85°C (exceeding the fault threshold of 85°C) is labeled "CPU high temperature (fault)" and a memory usage of 92% (exceeding the warning threshold of 85%) is labeled "Memory high load (warning)." Text-based logs are mapped to a semantic dictionary by matching keywords, mapping "Memory allocation failed" to "Memory allocation failure (software exception)." More importantly, contextual semantic enhancement technology, using a rule base generated by clustering historical data, detected the co-occurrence of "CPU high temperature," "Memory high load," and "Memory allocation failure" within the time window of 2:00 PM to 2:05 PM, triggering the composite label "System resource overload (critical)." This technology analyzes multi-label co-occurrence patterns to eliminate ambiguity in individual labels and improve the accuracy of fault semantics.

[0146] The knowledge graph construction module abstracts semantic labels into a three-layer node network: the device layer defines the hardware configuration of Server-001 (e.g., Dell R740 model), the indicator layer sets dynamic thresholds (e.g., the normal CPU temperature range [20°C, 70°C]), and the fault layer associates the fault impact range (e.g., "server overheating" affects application services A / B). When generating association edges, the causal edge weight is calculated using the following formula:

[0147]

[0148] For example, the edge "CPU temperature abnormality → server overheating" has 20 triggers within 30 days and a total monitoring time of 720 hours. Combined with the recent data impact factor α = 0.7 (focusing on the last 24 hours) and the high-load environment correction factor β = 1.2, the resulting weight is 0.091, reflecting the impact of recent anomalies on the failure. The co-occurrence edge weight is calculated using the set intersection frequency formula as follows:

[0149]

[0150] It was found that "CPU high temperature" and "memory high load" appeared together for 60 hours in 100 hours, with a weight of 0.632, reflecting a strong correlation between the two.

[0151] The dynamic semantic association module uses a graph attention network (GAT) to traverse the knowledge graph. Starting from the current abnormal node (e.g., "CPU temperature = 85°C"), it searches for nodes with a weight ≥ 0.6 within two hops, quickly locating potential faults such as "server overheating" and "memory overflow." GAT uses an attention mechanism to focus on high-weight edges, improving the efficiency of association queries. Subsequently, reinforcement learning uses fault diagnosis accuracy as the reward function R, assuming TP = 80 (correct detection), FN = 10 (missed detection), and FP = 5 (false detection). By adjusting edge weights (e.g., increasing the weight of "CPU high temperature → server overheating" from 0.091 to 0.15), it strengthens high-frequency fault paths and suppresses low-value associations.

[0152] The data fusion processing module solves the challenge of aligning multi-frequency data. For low-frequency, missing CPU temperature data (e.g., 14:00:05), event-driven linear interpolation is used to calculate the intermediate value of 86.5°C using the preceding and following timestamps (85°C at 14:00:00 and 88°C at 14:00:10) to ensure time series consistency. For high-frequency memory usage data (1 time / second), the average (e.g., 93.6%) is taken over a 5-second sliding window to filter out noise. Semantic feature fusion weights numerical features according to the associated edge weights. Text logs are converted into binary vectors using one-hot encoding (e.g., "memory allocation failure" corresponds to [0, 1, 0]). These are then concatenated with the numerical features to create a 10-dimensional vector, integrating deep semantic associations (e.g., the causal relationship between hardware anomalies and software logs).

[0153] Finally, the decision output module triggers an early warning based on the fused data: when the "CPU high temperature AND memory high load" rule is met, a "system resource overload" early warning is generated, and the associated processing suggestions in the knowledge graph (such as checking the cooling system and expanding the memory) are associated. The adaptive optimization module uses a sliding window to look back at historical data and uses cluster analysis (such as Euclidean distance to calculate anomaly scores) to discover a new fault mode of "CPU temperature > 85°C and memory usage > 90%". The knowledge graph is updated after manual review; at the same time, the association threshold is dynamically adjusted according to the diagnostic feedback (such as from 0.6 to 0.55), and the gradient formula is used to calculate the error. Achieve parameter self-optimization, form a closed loop of "data collection-semantic analysis-decision feedback-system evolution", and continuously improve fault monitoring accuracy in complex scenarios.

[0154] This embodiment demonstrates the entire technology chain from data collection to intelligent decision-making. Through core technologies such as dynamic data alignment, semantic enhancement fusion, and reinforcement learning optimization, it solves the problem of correlation analysis of multi-source heterogeneous data and realizes accurate detection of computer equipment failures and system self-evolution.

[0155] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. Computer equipment fault monitoring system based on artificial intelligence, characterized by: It includes a data access module, a semantic analysis module, a knowledge graph construction module, a dynamic semantic association module, a data fusion processing module, a decision output module, and an adaptive optimization module. The data access module collects hardware, software, and network data through a universal interface, and provides unified structured input for the semantic analysis module after format standardization. The semantic analysis module extracts and enhances semantic tags from the standardized data, providing basic modeling materials at the semantic level for the knowledge graph construction module. The knowledge graph construction module abstracts semantic labels into three-layer nodes: equipment, indicators, and faults. It generates causal / co-occurrence association edges based on historical data and rules, forming a data semantic relationship network and providing a knowledge basis for dynamic semantic association. The dynamic semantic association module queries high-weight association nodes in real time based on the knowledge graph, optimizes association paths through reinforcement learning, screens out potential semantic relationships that are strongly correlated with real-time data, and outputs them to the data fusion processing module. The data fusion processing module performs time alignment and weighted fusion of semantic features on multi-frequency data to generate a multi-dimensional feature vector containing deep semantic associations, providing the decision output module with structured data that can be directly used for fault analysis. The decision output module encapsulates the fused features into a standard format and outputs them. At the same time, it triggers fault warnings based on preset rules, associates the processing suggestions in the knowledge graph, and provides feedback data for the adaptive optimization module. The adaptive optimization module discovers new fault modes through historical data backtracking, automatically adjusts system parameters in combination with real-time diagnostic feedback, and feeds back to the knowledge graph construction module.

2. The computer equipment fault monitoring system based on artificial intelligence according to claim 1, characterized in that: The data access module includes a multi-source data acquisition unit and a format standardization unit; The multi-source data acquisition unit is responsible for real-time collection of three core data types: computer device hardware sensor data, software log data, and network traffic data. Specifically, a universal adapter interface is first designed to obtain hardware data based on the device driver protocol, capture software logs through the log monitoring API, and then use network probes to capture traffic data in real time. The data collection frequency is dynamically controlled by the device status. In normal status, the basic frequency is used for collection, and the normal collection frequency is the system's general collection frequency. If the collection frequency is higher than the normal frequency for three consecutive times, it is determined to be an abnormal state, triggering high-frequency collection. The basic frequency and high-frequency collection interval are configured according to preset rules. The format standardization unit is responsible for converting multi-source heterogeneous data into a unified structured intermediate format; specifically: defining a three-layer data description framework including a base layer, a content layer, and an extension layer; the base layer covers timestamps, device unique identifiers, and data type labels; the content layer stores raw data in key-value pairs; the extension layer records collection environment parameters; format conversion is achieved through regular expression matching and a protocol parser, and unified JSON format data is output.

3. The computer equipment fault monitoring system based on artificial intelligence according to claim 1, characterized in that: The semantic parsing module includes a semantic tag extraction unit and a context semantic enhancement unit; The semantic tag extraction unit extracts semantic tags from the standardized data and establishes a mapping between the data and the business semantics. Specifically, it constructs a domain semantic dictionary containing basic semantic tags and composite semantic tags. It uses a rule engine to drive tag extraction and triggers corresponding tags for numerical data when the indicator value exceeds a preset threshold. For text data, tags are triggered by matching keywords with preset semantic rules; The contextual semantic enhancement unit combines data context information to eliminate semantic ambiguity and enhance label accuracy. Specifically, a contextual association rule base is designed, and the rules include preconditions and enhancement logic. When multiple labels meet the preconditions within the same time window, the generation of composite semantic labels is triggered. The time window length is determined by preset parameters. The historical data of the contextual association rule base comes from the historical fusion data backtracked by the adaptive optimization module, and high-frequency co-occurrence label combinations are generated through cluster analysis.

4. The computer equipment fault monitoring system based on artificial intelligence according to claim 1, characterized in that: The knowledge graph construction module includes a semantic node modeling unit and an association edge generation unit; The semantic node modeling unit is responsible for abstracting semantic tags into knowledge graph nodes and defining node attributes. Specifically: a three-level node architecture is adopted to achieve cross-layer association through unique identifiers. Device layer nodes correspond to specific physical devices, and attributes include basic device information, network identification, and deployment environment. Index layer nodes correspond to performance / status indicators of device operation, and attributes include basic indicator information, threshold range, data type, and acquisition frequency. Fault layer nodes correspond to device fault types or abnormal states, and attributes include basic fault information, impact range, and historical occurrence frequency. Semantic tags are mapped to corresponding nodes through preset rules, and device layer tags directly extract unique device information. Identify and generate device layer nodes and associate them with hardware configuration information; parse the indicator layer numerical tags to match the indicator names and values ​​to the indicator layer nodes. If the preset fault threshold is exceeded, the fault association logic is triggered. The textual tags are mapped to the corresponding indicator nodes through the semantic dictionary and associated with the corresponding device layer nodes. The fault layer tags associate the indicator layer nodes with the device layer nodes through the unique identifier to form a device-indicator-fault triplet. The node attributes are initialized through the preset template, which contains the required fields and format specifications of each layer node. The device layer node is automatically generated when a new device is connected. When a new indicator is first collected, the indicator layer node is generated based on the semantic tag parsing and associated with the corresponding device layer node. The association edge generation unit generates causal edges, co-occurrence edges, and dependency edges between nodes based on historical data, domain knowledge, and device logical relationships, and constructs a dynamic semantic relationship network. Specifically, association edges are generated through data statistics and logical reasoning. For the causal edge, it is set that when the indicator layer node A has an abnormal state, which includes but is not limited to a value exceeding the normal threshold range, and triggers the fault node B within the preset time, a causal edge is established, and its weight ω causal According to the probability of occurrence, the formula is as follows: ； Among them, ω causal is the co-occurrence edge weight, Count(A→B) is the number of times event A triggers event B, and TotalMonitoringTime is the total monitoring time; α is the recent data impact factor, with a value range of [0,1], and recent data is defined as the last 24 hours; ω initial is the initial weight, β is the environment and state correction factor, which is adjusted according to the operating status of the equipment and environmental factors; For co-occurrence edges, if the frequency of two indicator layer nodes A and B appearing simultaneously within the preset time window is greater than or equal to the co-occurrence threshold, a co-occurrence edge is established. When the co-occurrence frequency is less than the threshold, the weight automatically decays to below 0.1 and is marked as an invalid edge. The weight calculation formula is as follows: ； Among them, ω co-occur represents the co-occurrence edge weight, indicating the strength of the co-occurrence relationship between indicator nodes A and B, with a value range of [0,1]. Frequency(A∩B) represents the frequency of simultaneous occurrence of nodes A and B within the preset window time, that is, the ratio of the number of co-occurrences between the two to the total monitoring time. Frequency(A) represents the frequency of node A appearing alone or with other nodes within the total monitoring time, that is, the ratio of the number of node A appearances to the total monitoring time. Frequency(B) represents the frequency of node B appearing alone or with other nodes within the total monitoring time, that is, the ratio of the number of node B appearances to the total monitoring time. For dependency edges, hardware dependencies are based on the device hardware architecture, and the dependency relationship is preset through the knowledge base; software dependencies are based on system logic and are generated by parsing the software architecture document; the initial weight of the dependency edge is set in the range of [0.1-0.9], and is subsequently dynamically adjusted according to the node access frequency through the PageRank algorithm.

5. The computer equipment fault monitoring system based on artificial intelligence according to claim 1, characterized in that: The dynamic semantic association module includes a real-time association query unit and an association path optimization unit; The association query unit mines the potential semantic relationships that are strongly correlated with the input data in real time based on the knowledge graph, and outputs a set of high-weight association nodes. Specifically, GAT is used as the inference engine, the attention weight is dynamically coupled with the weight of the associated edge of the knowledge graph, the node association relationship is stored through the adjacency matrix, and the attention mechanism is used to focus on the high-weight edge. The semantic node set V corresponding to the current data is input. t , traverse the knowledge graph through breadth-first search, according to the preset search depth and association threshold θ assoc Filter associated nodes and generate associated node set V rel ; The association path optimization unit dynamically optimizes the association path weights through reinforcement learning to improve the recognition accuracy of key semantic relationships. Specifically, a reinforcement learning framework is first used to construct a state space and action space based on historical fault diagnosis results to define a reward function R. The state space includes the node combination of the current association path; the action space retains and removes the two actions of the association edge. The formula of the reward function R is as follows: ； Among them, TP is the number of correctly detected faults, FN is the number of missed faults, FP is the number of false positives, TN is the number of true negatives, and λ is the false positive penalty coefficient, which ranges from [0,1] and is used to balance the detection accuracy and false positive risk. Then, through online learning, the associated edge weight ω is updated according to the formula new , the formula is as follows: ； Where γ is the learning rate, and its value range is [0,1]. is the reward function gradient, ω old The learning parameters are initialized through preset rules, gradually strengthening the weights of high-value paths and suppressing low-value paths, realizing adaptive optimization of associated paths and providing a semantic relationship network for data fusion processing.

6. The computer equipment fault monitoring system based on artificial intelligence according to claim 1, characterized in that: The data fusion processing module includes a time alignment calibration unit and a semantic feature fusion unit; The time alignment calibration unit performs time alignment on multi-source data of different frequencies by event-driven interpolation method to ensure the temporal consistency of semantic association; specifically: the timestamp of key events t main Based on the benchmark, low-frequency data and high-frequency data are processed separately. Key events include but are not limited to fault warnings and abnormal operation logs; For low-frequency data, a linear interpolation formula is used to supplement the missing values ​​at the intermediate moments through linear fitting; The semantic feature fusion unit fuses the semantic features of the associated data into a unified multi-dimensional feature vector to meet the input requirements of the fault monitoring model. Specifically, a weighted fusion mechanism is designed. First, the features of the associated data are normalized. For numerical features, the weights are weighted using the associated edge weights. The weights are normalized to generate weighted features. The formula is as follows: ； The weighted features are as follows: ； Among them, the associated edge weight ω i The causal edges, co-occurrence edges, and dependency edges from the knowledge graph are normalized to ensure the comparability of the weights of different types of edges; i represents the semantic feature of the i-th association; j is the index of the normalized sum of weights, which is used to calculate the sum of the associated edge weights; f i is the original feature value of the i-th associated data, which is divided into two types: numerical and text types; n is the current associated node set V rel The number of nodes in ; For text features, the one-hot encoding algorithm is used to convert text keywords into binary numerical vectors. These are then concatenated with the numerical features by dimension to form a unified multidimensional feature vector F. The one-hot encoding is based on the domain semantic dictionary of the semantic parsing module, and the keyword set is automatically generated from high-frequency vocabulary in device logs. The vector formula is as follows: ； During the fusion process, the associated edge weight ω i Directly inherited from the output results of the dynamic semantic association module, it ensures that the fused feature vector contains deep semantic association information and provides structured input for the fault monitoring model.

7. The computer equipment fault monitoring system based on artificial intelligence according to claim 1, characterized in that: The decision output module includes a fusion result generation unit and a fault warning triggering unit; The fusion result generation unit encapsulates the multi-dimensional feature vector output by the data fusion processing module into standard structured data, supporting external system calls and visual display; Specifically: First, a fusion data structure containing five elements is defined, namely device identification, timestamp, semantic label set, fusion feature vector and association path description; the device identification is extracted from the data access module’s unique device identification to ensure data traceability; the timestamp inherits the data access module’s microsecond timestamp to maintain temporal consistency; the semantic label set integrates the basic labels and composite labels generated by the semantic parsing module; the fusion feature vector directly adopts the multidimensional feature vector F output by the data fusion processing module, which contains the weighted fusion result of numerical and text features; the association path description records the high-weight association paths selected by the dynamic semantic association module; Then, low-latency transmission is achieved through a preset message queue protocol. Transmission parameters are preset through configuration files and output to the fault monitoring model and visualization interface. The fault warning trigger unit matches the warning rules in real time based on the fusion data, generates fault warning events and provides processing suggestions; Specifically: Build an early warning rule library containing two types of rules: single-feature threshold rules and multi-feature association rules; For single-feature threshold rules, three threshold levels are preset for numerical features, namely normal, warning, and fault; For multi-feature association rules, multiple semantic labels Alet are combined by the logical operator AND. The formula is as follows: ； Among them, L i is the semantic label that triggers the warning; i=1,2,...,n; Then, a forward chain reasoning engine is used. When the fused data meets the rule conditions, a warning event is triggered and the processing suggestions for the fault layer nodes in the knowledge graph are associated. The suggestion content is generated through a preset template, including the fault level, impact range and handling steps, to ensure the connection with the fault processing logic of the knowledge graph.

8. The computer equipment fault monitoring system based on artificial intelligence according to claim 1, characterized in that: The self-adaptive optimization module includes a historical data backtracking unit and a system parameter tuning unit; The historical data backtracking unit mines new fault modes through historical data and improves the fault association relationship of the knowledge graph; Specifically: Use a sliding time window to trace back historical fusion data and identify abnormal patterns through cluster analysis; first perform anomaly detection and calculate the anomaly score AnomalyScore(X) for each data point X. The calculation formula is as follows: ； Among them, ci is the i-th cluster center, k is the preset number of clusters, and Distance is obtained using the Euclidean distance formula; then the pattern is marked, and when AnomalyScore(X)>θ cluster When , it is marked as a potential failure mode, θ cluster A clustering anomaly threshold is preset. Finally, the review process is triggered through a preset workflow, which includes the system automatically marking abnormal patterns, sending review requests to administrators, and automatically adding candidates to the candidate pool if not reviewed within 72 hours. After manual confirmation, the indicator-fault association relationship corresponding to the new fault pattern is added to the knowledge graph, and the fault layer nodes and associated edges are updated to ensure the self-evolution capability of the knowledge graph. The system parameter tuning unit dynamically adjusts the system core parameters according to the fault monitoring feedback and optimizes the semantic fusion and association logic; Specifically: Building a closed-loop feedback system includes three steps: First, obtain the diagnostic results of the fault monitoring model, including accuracy, missed detection rate, and false detection rate. Then, calculate the parameter adjustment gradient using the gradient formula, as follows: ； in, is the learning rate, is the partial derivative of the reward function with respect to the parameter θ. The reward function R directly adopts the reward function R of the above-mentioned associated path optimization unit; Finally, an automated script is used to adjust the semantic parsing rules, association thresholds, and fusion weight parameters according to the preset algorithm. The adjustment step is dynamically determined by the algorithm without the need for human intervention, forming a closed loop of diagnostic feedback-parameter optimization-performance improvement, ensuring that the system continues to adapt to changes in equipment operation scenarios.

9. An artificial intelligence-based computer equipment fault monitoring method, applied to the artificial intelligence-based computer equipment fault monitoring system according to claims 1-8, characterized in that: The following steps are involved: S1. The multi-source data acquisition unit of the data access module acquires hardware sensor data, software log data, and network traffic data of computer devices in real time, and dynamically adjusts the acquisition frequency based on the device status. The collected data is processed by the format standardization unit and converted into a unified JSON format containing the base layer, content layer, and extension layer through regular expression matching and protocol parser, providing structured input for subsequent semantic analysis. S2, the semantic parsing module first performs semantic mapping on the standardized data through the semantic label extraction unit: when the numerical data exceeds the preset threshold, the basic label is triggered, and the corresponding label is generated by keyword matching for text data; Then, the contextual semantic enhancement unit combines the time window and the device state precondition to logically combine the co-occurring tags to generate composite semantic tags, eliminating ambiguity and improving tag accuracy, providing semantic materials for knowledge graph construction; S3, the knowledge graph construction module, abstracts semantic labels into three layers of nodes: device, indicator, and fault. Device-layer nodes associate hardware configurations with network identifiers; indicator-layer nodes define performance thresholds and acquisition frequencies; and fault-layer nodes label fault levels and impact ranges. Through the association edge generation unit, causal edges, co-occurrence edges, and dependency edges are established based on historical data statistics and logical reasoning, forming a semantic relationship network between devices, indicators, and faults, providing a knowledge foundation for dynamic association. S4, the dynamic semantic association module uses the real-time association query unit, based on the adjacency matrix and attention mechanism of the knowledge graph, to traverse the graph through breadth-first search, and select high-weight association nodes according to the preset search depth and association threshold; Then, the association path optimization unit adopts a reinforcement learning framework, uses fault diagnosis accuracy as a reward function, and updates the association edge weights through online learning. This strengthens the weights of high-frequency fault paths and suppresses low-value associations, enabling accurate screening of potential semantic relationships in real-time data and outputting a set of high-value association nodes to the data fusion module. S5. The data fusion processing module first uses the time alignment calibration unit to use the key event timestamp as the benchmark, uses linear interpolation to supplement missing values ​​for low-frequency data, and generates an alignment sequence for high-frequency data through the sliding window mean to ensure the consistency of the time series of multi-source data; Then, the semantic feature fusion unit normalizes and weights the numerical features according to the associated edge weights, converts the text features into binary vectors through one-hot encoding, and then concatenates them with the numerical features to form a multidimensional feature vector containing deep semantic associations, providing structured input for fault decision-making. S6. The decision output module encapsulates the fused features into a standard format and transmits them to the monitoring model or visualization interface via a message queue with low latency. Simultaneously, the fault warning trigger unit generates warning events through forward chain reasoning based on single-feature thresholds and multi-feature association rules, and associates them with processing suggestions in the knowledge graph. The adaptive optimization module clusters and analyzes abnormal patterns through the historical data backtracking unit, and updates the knowledge graph after manual review; the system parameter tuning unit dynamically adjusts the semantic parsing rules and associated threshold parameters based on diagnostic feedback, forming a data collection-decision-making-optimization closed loop, and continuously improving the accuracy and adaptability of system fault monitoring.

Images