Operation and maintenance rule updating method, system and equipment, storage medium and program product

Abstract

The invention discloses an operation and maintenance rule updating method, system and device, a storage medium and a program product. The method comprises the steps of obtaining a plurality of abnormal features of a target device cluster and occurrence time of each abnormal feature; according to the plurality of abnormal features and the occurrence time of each abnormal feature, determining whether there is an abnormal feature having an association relationship among the plurality of abnormal features, the association relationship being used for representing that there is a causal relationship among the abnormal features; and under the condition that the abnormal features with the association relationship exist, updating the operation and maintenance rule of the target equipment cluster based on the abnormal features with the association relationship. The updated operation and maintenance rule conforms to the causal relationship among the abnormal features, the scientific rationality of the operation and maintenance rule is improved, the operation and maintenance rule can be hit in advance after updating, equipment operation and maintenance are carried out as early as possible to eliminate abnormities, occurrence of the abnormal features as results in the association relationship is reduced, the operation and maintenance effect is improved, and the operation and maintenance efficiency is improved. And the operation stability and reliability of the target equipment cluster are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, system, device, storage medium, and program product for updating operation and maintenance rules. Background Art

[0002] During server operation, abnormalities may occur in the network card, CPU (Central Processing Unit), motherboard, etc., and operation and maintenance rules need to be deployed to handle these abnormalities.

[0003] In related technologies, operation and maintenance rules are usually configured by experts based on abnormal situations that may occur in the server. When a certain abnormal situation occurs in the server and the abnormal situation hits the corresponding operation and maintenance rule, the operation and maintenance strategy corresponding to the operation and maintenance rule will be automatically executed.

[0004] However, experts configure O&M rules based on their experience, so some abnormal situations may not have corresponding O&M rules configured. Furthermore, some abnormal situations may be caused by other abnormal situations. Before an abnormal situation hits an O&M rule, the other abnormal situation may have existed for a while. The O&M rule hits too late, causing the server to be damaged for an extended period of time. Summary of the Invention

[0005] In response to the problem in the above-mentioned related technologies that operation and maintenance rules may be hit too late, causing the server to be damaged for too long, this application proposes an operation and maintenance rule updating method, system, device, storage medium and program product.

[0006] The first aspect of the present application provides a method for updating operation and maintenance rules, the method comprising:

[0007] Obtaining multiple abnormal features of the target device cluster and the occurrence time of each abnormal feature;

[0008] Determining, based on the multiple abnormal features and the occurrence time of each of the abnormal features, whether there is an abnormal feature with a correlation among the multiple abnormal features, wherein the correlation is used to represent a causal relationship between the abnormal features;

[0009] In the case where the abnormal features with the associated relationship exist, the operation and maintenance rules of the target device cluster are updated based on the abnormal features with the associated relationship.

[0010] A second aspect of the present application provides a device for updating operation and maintenance rules, the device comprising:

[0011] An acquisition module, configured to acquire multiple abnormal features of a target device cluster and the occurrence time of each abnormal feature;

[0012] a determination module, configured to determine, based on the plurality of abnormal features and the occurrence time of each of the abnormal features, whether there is an abnormal feature with a correlation among the plurality of abnormal features, wherein the correlation is used to indicate that there is a causal relationship between the abnormal features;

[0013] An updating module is configured to update the operation and maintenance rules of the target device cluster based on the abnormal features with the associated relationship when the abnormal features with the associated relationship exist.

[0014] The third aspect of the present application proposes an operation and maintenance rule update system, including a cloud server cluster and an operation and maintenance platform;

[0015] The cloud server in the cloud server cluster is used to obtain the operating data of the cloud server and send the operating data to the operation and maintenance platform;

[0016] The operation and maintenance platform is used to obtain multiple abnormal features of the cloud server cluster and the occurrence time of each abnormal feature based on the operation data of each cloud server in the cloud server cluster; determine whether there are abnormal features with correlation among the multiple abnormal features based on the multiple abnormal features and the occurrence time of each abnormal feature, and the correlation is used to characterize the existence of a causal relationship between the abnormal features; in the case of the existence of abnormal features with correlation, the operation and maintenance rules of the cloud server cluster are updated based on the abnormal features with correlation.

[0017] The fourth aspect of the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect above.

[0018] A fifth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method described in the first aspect above.

[0019] An embodiment of the sixth aspect of the present application provides a computer program product, including a computer program, which is executed by a processor to implement the method described in the first aspect above.

[0020] Based on the method for updating operation and maintenance rules described in the first aspect above, this application has at least the following beneficial effects or advantages:

[0021] The embodiments of the present application can explore the possible correlations between multiple abnormal features of a target device cluster and, if abnormal features with correlations are determined to exist, update the operation and maintenance rules of the target device cluster based on the abnormal features with correlations. By taking into account the mutual influence between abnormal features when setting the operation and maintenance rules of the target device cluster, the updated operation and maintenance rules can be more consistent with the inherent causal relationships between the various abnormal features that may be generated by the target device cluster, thereby improving the scientific rationality of the operation and maintenance rules. Since the causal relationship represents that the cause comes before the effect, the occurrence time of the abnormal feature that serves as the cause among the abnormal features with an associated relationship is earlier than the occurrence time of the abnormal feature that serves as the result. Therefore, the operation and maintenance rules of the target device cluster are updated based on the abnormal features with an associated relationship. The sequence of occurrence time between the abnormal features with a causal relationship is taken into account in the configuration of the operation and maintenance rules, which helps to hit the operation and maintenance rules in advance when the abnormal feature that serves as the cause among the abnormal features with an associated relationship occurs, so that the equipment can be operated and maintained as soon as possible to eliminate the abnormality, reduce the occurrence of the abnormal feature that serves as the result among the abnormal features with an associated relationship, improve the operation and maintenance effect of the target device cluster, and also improve the stability and reliability of the operation of the target device cluster.

[0022] The above description is only an overview of the technical solution of this application. In order to more clearly understand the technical means of this application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of this application more obvious and easy to understand, the specific implementation methods of this application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0024] Figure 1 This is a flowchart of a method for updating operation and maintenance rules according to some exemplary embodiments of the present application;

[0025] Figure 2 is a schematic diagram of an operation and maintenance rule updating system according to some exemplary embodiments of the present application;

[0026] Figure 3 A schematic diagram of an operation and maintenance system of a cloud server cluster in related technology;

[0027] Figure 4 This is a flow chart of an operation and maintenance rule updating system according to some exemplary embodiments of the present application;

[0028] Figure 51 is a flow chart illustrating a process of generating a feature association relationship according to an exemplary embodiment of the present application;

[0029] Figure 6 This is a schematic diagram of the operation and maintenance process of a cloud server according to an exemplary embodiment of the present application;

[0030] Figure 7 1 is a schematic structural diagram of an operation and maintenance rule updating device according to an exemplary embodiment of the present application;

[0031] Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an exemplary embodiment of the present application;

[0032] Figure 9 The figure is a schematic structural diagram of a storage medium according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0033] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0034] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0035] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the term "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or the like.

[0036] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0037] Network devices like gateways and routers, or servers, typically have operational rules deployed to handle anomalies such as network card failures, slow I / O (input and output) speeds, CPU failures, and motherboard failures. In related technologies, operational rules are typically configured by experts based on their experience and potential anomalies. When a server experiences an anomaly that matches a corresponding operational rule, the corresponding operational strategy is automatically executed.

[0038] However, when experts configure O&M rules based on their experience, some abnormalities may not have corresponding O&M rules configured, meaning that some abnormalities may be missed. Furthermore, some abnormalities may be caused by other abnormalities. Before an abnormality hits an O&M rule, the other abnormalities may have existed for some time. Therefore, O&M rules are hit too late, causing equipment to be damaged for an extended period of time.

[0039] Based on this, an embodiment of the present application provides a method for updating operation and maintenance rules. Based on multiple abnormal features of a target device cluster and the time of occurrence of each abnormal feature, the method determines whether there are any associated abnormal features among the multiple abnormal features. The association is used to indicate the existence of a causal relationship between the abnormal features. If there are associated abnormal features, the operation and maintenance rules for the target device cluster are updated based on the associated abnormal features.

[0040] This method can uncover causal relationships between different abnormal features, specifically determining whether one abnormal feature is the cause of another. Once such causal abnormal features are discovered, the target device cluster's operation and maintenance rules are updated based on these causal abnormal features. This allows the mutual influence of abnormal features to be considered during the deployment of the target device cluster's operation and maintenance rules, ensuring that the updated operation and maintenance rules better reflect the inherent logical relationships between the various abnormal features that may arise in the target device cluster. This improves the scientific rationality of the operation and maintenance rule deployment and enhances the target device cluster's operation and maintenance effectiveness.

[0041] The following describes in detail the technical solution of this application and how it solves the aforementioned technical problems using specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The following describes the embodiments of this application in detail with reference to the accompanying drawings.

[0042] Figure 1 A flowchart of a method for updating operation and maintenance rules provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method specifically includes the following steps 101-103.

[0043] Step 101: Acquire multiple abnormal features of a target device cluster and the occurrence time of each abnormal feature.

[0044] Step 102: Based on the multiple abnormal features and the occurrence time of each abnormal feature, determine whether there is an abnormal feature with a correlation relationship among the multiple abnormal features, where the correlation relationship is used to represent the existence of a causal relationship between the abnormal features.

[0045] Step 103: When there are abnormal features with associated relationships, the operation and maintenance rules of the target device cluster are updated based on the abnormal features with associated relationships.

[0046] The execution subject of the embodiment of the present application can be a terminal, a single server, a server cluster, a cloud server, etc. for executing the updating method of the operation and maintenance rules.

[0047] The target device cluster can be composed of multiple devices, including one or more of various types of devices, such as terminal devices, network devices, and server devices. Each type of device can be one or more. Terminal devices can include desktop computers, laptops, sensors, home appliances, and automotive terminals. Network devices can include routers and gateways. Server devices can include physical servers or cloud servers.

[0048] Abnormal features are features extracted from abnormal events occurring on each device in the target device cluster. These abnormal events can include network card failure, memory failure, network card jitter, slow data transmission rates, excessive processor utilization, slow I / O speeds, processor failures, and motherboard failures. Abnormal features are a further abstraction of abnormal events and are essentially another description of abnormal events. For example, abnormal events such as network card failure, memory failure, processor failure, and motherboard failure can be abstracted into the abnormal feature "hardware failure"; abnormal events such as network card jitter and slow data transmission rates can be abstracted into the abnormal feature "network anomaly"; and abnormal events such as excessive processor utilization and slow I / O speeds can be abstracted into the abnormal feature "excessive system load."

[0049] The occurrence time of an abnormal feature can be the occurrence time of the earliest abnormal event among the abnormal events corresponding to the abnormal feature. For example, the abnormal feature "hardware failure" is extracted based on the abnormal events "network card failure" and "memory failure". The occurrence time of "network card failure" is earlier than the occurrence time of "memory failure". In this case, the occurrence time of the abnormal feature "hardware failure" can be the occurrence time of the abnormal event "network card failure". Alternatively, in other embodiments, the occurrence time of the abnormal feature can also be the extraction time of the abnormal feature based on the abnormal events.

[0050] The above-mentioned association relationship is used to characterize the existence of a causal relationship between abnormal features. The association relationship includes at least two abnormal features, which can be divided into two categories. The two categories of abnormal features have a causal relationship, that is, one category of abnormal features is the cause of the other category of abnormal features. The category of abnormal features that serve as causes can include one or more abnormal features, and the category of abnormal features that serve as results can also include one or more abnormal features. As an example, the association relationship includes two abnormal features, one of which is the cause of the other. Suppose the two abnormal features are features A and B, and feature A is the cause of feature B. Then the association relationship can be expressed as feature A → feature B.

[0051] In an embodiment of the present application, multiple abnormal features and the occurrence time of each abnormal feature that occurred within a preset historical period of time in the target device cluster are obtained. Based on the obtained abnormal features and the occurrence time of each abnormal feature, the relationship between the abnormal features is analyzed. When the existence of abnormal features with associated relationships is determined, the operation and maintenance rules of the target device cluster are updated based on the associated abnormal features.

[0052] Specifically, the union of the first operation and maintenance rule corresponding to the abnormal feature as the cause and the second operation and maintenance rule corresponding to the abnormal feature as the result among the abnormal features with an associated relationship is used as the third operation and maintenance rule; the second operation and maintenance rule corresponding to the abnormal feature as the result configured in the target device cluster is replaced with the third operation and maintenance rule.

[0053] The first O&M rule is the one that is triggered when the abnormality characteristic that is the cause occurs. Hitting the first O&M rule triggers the execution of the corresponding O&M action, performing O&M on the device to eliminate the abnormality characteristic that is the cause. Similarly, the second O&M rule is the one that is triggered when the abnormality characteristic that is the result occurs.

[0054] The above-mentioned preset historical duration can be the past 30 minutes, one hour, one day, one week, one month or three months, etc. The embodiment of the present application does not limit the specific value of the preset historical duration, and it can be set according to needs in actual application.

[0055] Because associated abnormal characteristics have a causal relationship, the occurrence of the abnormal characteristic that is the cause has a significant impact on the occurrence of the abnormal characteristic that is the result, and may even play a decisive role. Therefore, the operation and maintenance of the abnormal characteristic that is the cause also has a significant impact on the occurrence of the abnormal characteristic that is the result. If the corresponding operation and maintenance rules can be triggered to eliminate the abnormal characteristic that is the cause when it occurs, it is very likely that the abnormal characteristic that is the result will not occur. Correspondingly, if the corresponding operation and maintenance rules are not triggered until the abnormal characteristic that is the result occurs, the abnormal characteristic that is the cause may persist for a long time, potentially causing significant damage to the equipment.

[0056] The embodiment of the present application can mine the possible correlations between multiple abnormal features of the target device cluster, and when it is determined that there are abnormal features with correlations, update the operation and maintenance rules of the target device cluster based on the abnormal features with correlations. Taking into account the mutual influence between abnormal features in the setting of the operation and maintenance rules of the target device cluster can make the updated operation and maintenance rules more consistent with the inherent causal relationship between various abnormal features that may be generated by the target device cluster, improve the scientific rationality of the operation and maintenance rules, and help to hit the operation and maintenance rules in advance when abnormal features with correlations occur, so as to operate and maintain the equipment as early as possible to eliminate the abnormality, reduce the occurrence of abnormal features as a result of abnormal features with correlations, improve the operation and maintenance effect of the target device cluster, and also improve the stability and reliability of the operation of the target device cluster.

[0057] In some embodiments of the present application, multiple abnormal features of the target device cluster may be obtained by:

[0058] Obtain information on each abnormal event generated by each device in the target device cluster within a preset historical period; for the abnormal event information corresponding to each device, extract the abnormal features and the occurrence time of each abnormal feature that occurred in the device within the preset historical period from the abnormal event information corresponding to the device; in the case where there are multiple repeated abnormal features in the abnormal features of the same device, delete the abnormal features except the abnormal feature with the earliest occurrence time among the repeated abnormal features.

[0059] The abnormal event information contains detailed information about the abnormal event that occurred on the device, including a description of the abnormal event, the time the abnormal event occurred, and device information about the device where the abnormal event occurred. The description can describe the specific abnormality of the abnormal event, such as a processor utilization rate of 90% or an I / O rate of 1%. The device information about the device where the abnormal event occurred can include a device identifier, a device model, and a website address.

[0060] In some embodiments of the present application, an agent application for collecting device data can be deployed on the devices in the target device cluster. During the operation of the device, the agent application collects the operation log and performance data of the device, and sends the collected operation log and performance data to the execution subject device of the method for updating the operation and maintenance rules of the embodiment of the present application. The execution subject can be any device such as a terminal or a server, or it can be a service or application deployed on a server or in the cloud. The above-mentioned operation log records events and error information during the operation of the device, such as system warnings and error information of the device, warnings and error information of the application on the device, etc. The performance data of the device may include the processor usage, memory usage, disk usage, etc. of the device.

[0061] The execution entity analyzes abnormal events that occurred on the device based on the received operation logs and performance data. Specifically, the execution entity may perform abnormality analysis based on the operation logs and performance data using preset expert rules, statistical rules, or machine learning and deep learning algorithms, thereby obtaining abnormal event information corresponding to the abnormal event that occurred on the device. Preset expert rules and statistical rules may be configured by operations and maintenance personnel and are used to determine the existence of constraints and judgment strategies for abnormal events. Machine learning and deep learning algorithms may include deep neural networks, which are used to predict the probability of abnormal events occurring on the device based on the operation logs and performance data.

[0062] In some embodiments of the present application, a mapping relationship between abnormal events and abnormal characteristics is preconfigured in the execution entity. This mapping relationship includes multiple mapping records, and each mapping record includes a corresponding relationship between at least one abnormal event and one abnormal characteristic. As an example, this mapping relationship can be shown in Table 1.

[0063] Table 1

[0064]

[0065] After obtaining the abnormal event information generated by each device in the target device cluster within the preset historical time period in the above manner, the execution entity queries the abnormal features corresponding to each abnormal event information based on the above mapping relationship, and uses the occurrence time of the earliest abnormal event among the abnormal events corresponding to the abnormal features as the occurrence time of the abnormal feature, or uses the time when the abnormal feature is obtained as the occurrence time of the abnormal feature.

[0066] If the device does not undergo operation and maintenance to eliminate an abnormal event when an abnormal event occurs, the abnormal event may continue to exist. In this case, the device will continue to issue an alarm for the abnormal event, resulting in multiple alarm data of the abnormal event in the device's operation log and performance data. This will lead to the identification of multiple identical abnormal events of the device based on the operation log and performance data, resulting in the final acquisition of multiple abnormal features of the device including multiple repeated abnormal features, but the occurrence time of these multiple repeated abnormal features is different.

[0067] Since the algorithm used to determine whether there are associated abnormal features may not be able to process duplicate abnormal features, or duplicate abnormal features may affect the accuracy of the algorithm, after obtaining multiple abnormal features for each device in the above manner, the multiple abnormal features of the same device are traversed to determine whether there are duplicate abnormal features among them. If there are no duplicate abnormal features, subsequent processing is performed based on these multiple abnormal features. If there are duplicate abnormal features, the abnormal feature with the earliest occurrence time among these multiple duplicate abnormal features is retained, and the other duplicate abnormal features are deleted.

[0068] This method obtains multiple anomaly features and the occurrence time of each feature for the target device cluster within a preset historical period, and then deduplicates the anomaly features obtained for each device. By extracting anomaly features from numerous abnormal events, the data for subsequent processing becomes more refined, reducing the amount of data to be processed, helping to reduce the amount of computation and improve efficiency. Deduplication also prepares data for subsequent exploration of correlations between anomaly features, helping to improve the accuracy of subsequent correlation analysis and, in turn, the accuracy of updated operation and maintenance rules.

[0069] In some embodiments of the present application, multiple abnormal features of a target device cluster and the occurrence time of each abnormal feature are obtained through the above method. The multiple abnormal features of a device in the target device cluster within a preset historical period can be used as a piece of abnormal data. In this way, each device in the target device cluster will have a corresponding piece of abnormal data, and these multiple abnormal data are combined into an abnormal feature set. Then, based on this abnormal feature set and the occurrence time of each abnormal feature, it can be determined whether there are abnormal features with a correlation among the multiple abnormal features by the following methods, specifically including:

[0070] According to the occurrence time of each abnormal feature, the time series relationship between each abnormal feature is determined, and the time series relationship is used to characterize the chronological relationship of the occurrence time of each abnormal feature; according to multiple abnormal features, a feature relationship set of multiple abnormal features is generated through a preset feature mining algorithm, and the feature relationship set includes multiple feature relationships, and the feature relationship is used to characterize the causal relationship between each abnormal feature belonging to the same feature relationship; according to the above-mentioned time series relationship and feature relationship set, it is determined whether there are abnormal features with correlation relationships among the multiple abnormal features of the target device cluster.

[0071] The above-mentioned temporal relationship can be obtained by sorting the abnormal features in order from early to late according to the occurrence time of each abnormal feature. The preset feature mining algorithm may include a mining algorithm for mining association rules such as the FP-Growth (Frequent Pattern Growth) algorithm or the Apriori (association rule algorithm) algorithm. Taking the FP-Growth algorithm as an example, the FP-Growth algorithm is an effective algorithm for discovering frequent item sets in data mining, where a frequent item set is a set of items (or articles) that frequently appear in multiple transactions. In an embodiment of the present application, if an abnormal feature often appears together with another abnormal feature, then the two abnormal features are a frequent item set, indicating that there may be a certain causal relationship between the two abnormal features, such as one abnormal feature is the cause of another abnormal feature.

[0072] Multiple abnormal features of the target device cluster in the abnormal feature set are input into a preset feature mining algorithm. The preset feature mining algorithm is used to mine the relationships between the different abnormal features. If the abnormal features are not correlated with each other, the preset feature mining algorithm outputs an empty set, indicating that no abnormal features with a correlation exist among the multiple abnormal features of the target device cluster.

[0073] If the abnormal feature set contains different abnormal features that frequently occur together, the preset mining algorithm will mine these frequently occurring abnormal features and output them as feature relationships. A feature relationship includes multiple abnormal features, each of which has a causal relationship. The multiple feature relationships output by the preset feature mining algorithm constitute the feature relationship set.

[0074] The different abnormal features that appear together may refer to different abnormal features that often appear in the same abnormal data in the abnormal feature set.

[0075] Taking the FP-Growth algorithm as an example, multiple pieces of anomaly data from the target device cluster in the anomaly feature set are fed into the FP-Growth algorithm. The algorithm then mines frequent itemsets that may exist in the anomaly feature set. Assume that, among the multiple pieces of anomaly data in the anomaly feature set, anomaly features A and B frequently appear together, and features E and F frequently appear together. The frequent itemsets mined by the FP-Growth algorithm include A→B, B→A, E→F, and F→E. These frequent itemsets represent the characteristic relationships mentioned above, resulting in the final set of characteristic relationships: {A→B, B→A, E→F, F→E}. The "→" character represents a causal relationship. For example, A→B indicates that A is the cause of B, while B→A indicates that B is the cause of A. Since the FP-Growth algorithm is used to mine frequent itemsets and cannot process time series information, it outputs various possible situations in which abnormal features affect each other for different abnormal features with a certain causal relationship. For example, if there is a certain causal relationship between abnormal features A and B, the FP-Growth algorithm will output both A→B and B→A.

[0076] After obtaining the feature relationship set obtained by the preset feature mining algorithm, the system then determines whether any abnormal features in the target device cluster have associated relationships based on the temporal relationships between the multiple abnormal features of the target device cluster and the feature relationship set. Introducing the temporal relationships of abnormal features based on the preset feature mining algorithm helps to more clearly identify abnormal features with true causal relationships from the feature relationship set.

[0077] The above embodiment uses a preset feature mining algorithm to identify abnormal features with causal relationships among multiple abnormal features of a target device cluster. Based on the output of the preset feature mining algorithm and combined with the temporal relationships between the multiple abnormal features, the resulting association relationship is well aligned with the temporal relationships between the abnormal features. The resulting association relationship is more closely aligned with the actual causal logic between the corresponding abnormal features, resulting in a high degree of accuracy in determining the association relationship. This helps improve the accuracy of subsequent updates to operation and maintenance rules based on the association relationship, thereby enhancing the operation and maintenance effectiveness of the target device cluster.

[0078] In some embodiments of the present application, determining whether there is an abnormal feature with a correlation relationship among multiple abnormal features based on the above-mentioned time series relationship and feature relationship set specifically includes:

[0079] According to the above-mentioned time series relationship, the feature relationships that do not meet the preset time series conditions are eliminated from the feature relationship set; the preset time series conditions are used to constrain the occurrence time of the abnormal feature as the cause of two abnormal features with a causal relationship to be earlier than the occurrence time of the abnormal feature as the result; in the case where there are remaining feature relationships in the feature relationship set after elimination, the evaluation index of the remaining feature relationship is calculated, and the evaluation index is used to characterize the accuracy of the remaining feature relationship as an association relationship; in the case where there is a target feature relationship whose evaluation index is greater than a preset threshold, the abnormal feature corresponding to the target feature relationship is determined as an abnormal feature with an association relationship.

[0080] For example, in the feature relationship set {A→B, B→A, E→F, F→E} in the above example, assume that in the temporal relationship, abnormal feature A occurs earlier than abnormal feature B, and abnormal feature E occurs earlier than abnormal feature F. Based on this temporal relationship, the feature relationships B→A and F→E are removed from the feature relationship set {A→B, B→A, E→F, F→E}, and the feature relationship set after removal is {A→B, E→F}.

[0081] In some embodiments, the feature relationship set may become an empty set after the above elimination operation. In this case, it is determined that no abnormal features with associated relationships exist in the target device cluster.

[0082] If there are remaining feature relationships in the feature relationship set after elimination, the evaluation index needs to be calculated for each remaining feature relationship. Only when the evaluation index is greater than the preset threshold, the feature relationship is determined to be a correlation relationship that can truly characterize the causal relationship between abnormal features.

[0083] In the above embodiment, feature relationships that do not meet the preset time sequence conditions are eliminated, ensuring that the occurrence time of the abnormal feature serving as the cause in the remaining feature relationships is always earlier than the occurrence time of the abnormal feature serving as the result. This ensures that the abnormal features in the final determined association relationship conform to the temporal sequence of cause and effect in the causal relationship. For the feature relationships remaining after the elimination operation, the evaluation indicators of these feature relationships are used to determine whether these feature relationships can truly represent causal relationships. This further improves the accuracy of the final determined association relationships.

[0084] In some embodiments of the present application, removing feature relationships that do not meet preset timing conditions from the feature relationship set specifically includes:

[0085] From the above-mentioned time series relationship, determine the time series relationship between the first abnormal feature and the second abnormal feature corresponding to the first characteristic relationship, where the first characteristic relationship is any characteristic relationship in the characteristic relationship set, and the first characteristic relationship is used to characterize that the first abnormal feature is the cause of the second abnormal feature; if the time series relationship between the first abnormal feature and the second abnormal feature indicates that the occurrence time of the first abnormal feature is later than the occurrence time of the second abnormal feature, then eliminate the first characteristic relationship from the characteristic relationship set.

[0086] In the first feature relationship, the first abnormal feature serving as the cause may include one or more abnormal features, and the second abnormal feature serving as the result may also include one or more abnormal features. If both the first abnormal feature and the second abnormal feature include multiple abnormal features, the first feature relationship is determined to satisfy a preset timing condition if the latest abnormal feature among the multiple abnormal features included in the first abnormal feature occurs earlier than the earliest abnormal feature among the multiple abnormal features included in the second abnormal feature. Otherwise, the first feature relationship is determined to not satisfy the preset timing condition, and the first feature relationship is removed from the feature relationship set.

[0087] Based on the temporal sequence of abnormal features with causal relationships represented by the feature relationships, the feature relationships in which the occurrence time of the abnormal features as causes is later than the occurrence time of the abnormal features as results are eliminated from the feature relationship set. The occurrence time of the abnormal features as causes in the remaining feature relationships is earlier than the occurrence time of the abnormal features as results, so that the temporal sequence relationship of the abnormal features in the remaining feature relationships conforms to the logical relationship of cause before result in the causal relationship, which helps to improve the accuracy of the finally determined association relationship.

[0088] In some embodiments of the present application, in order to facilitate the description of the specific calculation process of calculating the evaluation index of the remaining feature relationships, any feature relationship among the remaining feature relationships is referred to as a second feature relationship, the second feature relationship corresponds to the third abnormal feature and the fourth abnormal feature, and the third abnormal feature is the cause of the fourth abnormal feature. Calculating the evaluation index of the remaining feature relationships specifically includes:

[0089] The number of first devices in the target device cluster that have the third abnormal feature and the number of target devices that have both the third abnormal feature and the fourth abnormal feature are determined respectively; and an evaluation index of the second characteristic relationship is calculated based on the number of first devices and the number of target devices.

[0090] The abnormal features are extracted based on abnormal events that occur on devices in the target device cluster. For the second characteristic relationship, the number of first devices in the target device cluster that have the third abnormal feature corresponding to the second characteristic relationship, and the number of target devices that have both the third abnormal feature and the fourth abnormal feature are counted, where the first device may include one or more devices. The evaluation index of the second characteristic relationship is calculated based on the number of first devices and the number of target devices. The evaluation index of the calculated second characteristic relationship is made to conform to statistical laws, and the obtained evaluation index can more accurately characterize the degree to which the second characteristic relationship can truly reflect the causal relationship between the third abnormal feature and the fourth abnormal feature.

[0091] In some embodiments of the present application, the aforementioned evaluation metrics may include one or more of confidence, imbalance rate, and lift. Confidence is used to characterize the probability of occurrence of an abnormal feature as a result given the occurrence of the abnormal feature as the cause in a feature relationship. Imbalance rate is used to characterize the difference between the number of occurrences of the abnormal feature as the cause and the number of occurrences of the abnormal feature as the result in a feature relationship. Lift is used to characterize the degree to which the occurrence of the abnormal feature as the cause increases the probability of occurrence of the abnormal feature as the result in a feature relationship.

[0092] Calculate the evaluation index of the second characteristic relationship based on the above-stated number of first devices and the number of target devices, specifically including:

[0093] A first ratio between the number of target devices and the number of first devices is calculated to obtain a confidence level of the second characteristic relationship; the confidence level is used to characterize the probability of the fourth abnormal feature occurring under the premise that the third abnormal feature occurs.

[0094] The above-mentioned number of target devices refers to the number of devices in the target device cluster that have both the third abnormal characteristic and the fourth abnormal characteristic.

[0095] The above confidence can be calculated by the following formula (1):

[0096] P(B|A)=count(A∪B) / count(A)…(1)

[0097] In formula (1), A is the third anomaly feature, and B is the fourth anomaly feature. P(B|A) is the probability of the fourth anomaly feature B occurring given the third anomaly feature A, also known as the confidence level. count(A∪B) represents the number of target devices, and count(A) represents the number of first devices.

[0098] As can be seen from formula (1), the confidence level actually calculates the proportion of devices that experience both the third and fourth abnormal characteristics among all devices that experience the third abnormal characteristic. This proportion can reflect the impact of the occurrence of the third abnormal characteristic on the occurrence of the fourth abnormal characteristic. In other words, given the occurrence of the third abnormal characteristic, the probability of the fourth abnormal characteristic occurring is the above confidence level. Therefore, this confidence level can well reflect the accuracy with which the second characteristic relationship can characterize the causal relationship between the third and fourth abnormal characteristics. The greater the confidence level, the more accurately the second characteristic relationship can characterize the causal relationship between the third and fourth abnormal characteristics.

[0099] In some embodiments, when the number of occurrences of the third abnormal feature differs significantly from the number of occurrences of the fourth abnormal feature, the fourth abnormal feature will occur each time the third abnormal feature occurs. For example, assume that a total of 3,000 abnormal data items are collected in the target device cluster, and abnormal feature B occurs in each abnormal data item, while abnormal feature A occurs in only four abnormal data items, and the occurrence time of abnormal feature A is earlier than the occurrence time of abnormal feature B. Then, abnormal feature B will occur each time abnormal feature A occurs, and abnormal feature A is likely to be mistakenly judged as the cause of abnormal feature B. Based on this, the embodiment of the present application also provides an evaluation indicator, imbalance rate, to evaluate the degree of difference between the number of occurrences of the third abnormal feature and the fourth abnormal feature.

[0100] Specifically, the number of second devices in the target device cluster that have the fourth abnormal feature is determined; a first ratio between the number of target devices and the number of the above-mentioned first devices is calculated; a second ratio between the total number of devices in the target device cluster and the number of second devices is calculated, and the product of the first ratio and the second ratio is calculated to obtain the imbalance rate of the second characteristic relationship. The imbalance rate is used to characterize the degree of difference between the number of occurrences of the third abnormal feature and the number of occurrences of the fourth abnormal feature.

[0101] The second device may include one or more devices. The imbalance rate may be calculated using the following formula (2):

[0102] IR(A,B)=|sup(A)-sup(B)| / [sup(A)+sup(B)-sup(A∪B)]…(2)

[0103] In the above formula (2), IR(A,B) is the imbalance rate, sup(A) is the support of the third abnormal feature A, sup(A) = count(A) / count(total), which indicates the proportion of devices with the third abnormal feature A among all devices in the target device cluster. sup(B) is the support of the fourth abnormal feature B, sup(B) = count(B) / count(total), which indicates the proportion of devices with the fourth abnormal feature B among all devices in the target device cluster. sup(A∪B) is the support of both the third abnormal feature A and the fourth abnormal feature B, sup(A∪B) = count(A∪B) / count(total), which indicates the proportion of devices with both the third abnormal feature A and the fourth abnormal feature B among all devices in the target device cluster.

[0104] Formula (2) shows that the imbalance rate is calculated as the difference between the number of occurrences of the third abnormal feature A and the number of occurrences of the fourth abnormal feature B, as a percentage of the total number of occurrences of the third abnormal feature A and the fourth abnormal feature B. The total number of occurrences here is obtained by subtracting the number of occurrences of both the third abnormal feature A and the fourth abnormal feature B. The greater the imbalance rate, the greater the difference between the number of occurrences of the third and fourth abnormal features. The smaller the imbalance rate, the smaller the difference between the number of occurrences of the third and fourth abnormal features.

[0105] For example, in the example above, among the 3,000 abnormal data, abnormal feature B occurred 3,000 times, and abnormal feature A occurred 4 times. According to the above formula (2), the imbalance rate is 0.999. This indicates that there is a serious imbalance between the number of occurrences of abnormal features A and B. Therefore, it is unreasonable to regard abnormal feature A as the cause of abnormal feature B.

[0106] As can be seen from the above examples, the imbalance rate evaluation metric effectively identifies feature relationships with imbalanced occurrences of abnormal features. This imbalance rate accurately eliminates these feature relationships, thereby improving the accuracy of the final determined association. In particular, for feature relationships with high confidence, combining the imbalance rate evaluation metric can further eliminate those that fail to truly represent causal relationships from those that meet the confidence requirements.

[0107] The calculation of the lift specifically includes: determining the number of second devices in the target device cluster that have the fourth abnormal feature; calculating the ratio between the number of first devices and the total number of devices in the target device cluster to obtain a first support; calculating the ratio between the number of second devices and the total number of devices to obtain a second support; calculating the ratio between the number of target devices and the total number of devices to obtain a third support; and calculating the lift of the second feature relationship based on the first support, the second support, and the third support. The lift is used to characterize the degree to which the occurrence of the third abnormal feature increases the probability of the occurrence of the fourth abnormal feature.

[0108] The above-mentioned improvement can be calculated by the following formula (3):

[0109] Lift(B|A)=P(B|A) / P(B)=[count(A∪B) / count(A)]*[count(total) / count(B)]…(3)

[0110] In formula (3), Lift(B|A) is the lift, P(B|A) is the confidence level, and P(B) is the proportion of devices in the target device cluster that exhibit the fourth abnormal feature B. Count(A∪B) represents the number of target devices, count(A) represents the number of first devices, count(total) represents the total number of devices in the target device cluster, and count(B) represents the number of second devices.

[0111] Formula (3) shows that lift refers to the ratio of the probability of the fourth abnormal feature B occurring given the occurrence of the third abnormal feature A to the probability of the fourth abnormal feature B occurring in the total data set. If the third abnormal feature A indeed triggers the fourth abnormal feature B, the probability of the fourth abnormal feature B occurring given the occurrence of the third abnormal feature A will be greater than the probability of the fourth abnormal feature B occurring in the total data set, making the lift (Lift(B|A)) greater than 1. The stronger the causal relationship between the third abnormal feature A and the fourth abnormal feature B, the higher the lift. Using lift as an evaluation metric, we can intuitively quantify the degree to which the occurrence of the third abnormal feature A increases the probability of the occurrence of the fourth abnormal feature B, which helps to improve the accuracy of the final determined association.

[0112] After removing feature relationships that do not meet the timing requirements from the feature relationship set output by the preset feature mining algorithm, the evaluation index of each remaining feature relationship in the feature relationship set is calculated using the above method. The evaluation index of each feature relationship is then compared with the corresponding preset threshold. In the case where the evaluation index includes confidence, the confidence of the feature relationship is compared with the preset confidence threshold. If the confidence of the feature relationship is greater than or equal to the preset confidence threshold, it is determined that the confidence of the feature relationship meets the confidence requirement of the association relationship.

[0113] When the evaluation index includes the imbalance rate, the imbalance rate of the feature relationship is compared with the preset imbalance rate threshold. If the imbalance rate of the feature relationship is less than or equal to the preset imbalance rate threshold, it is determined that the imbalance rate of the feature relationship meets the imbalance rate requirement of the association relationship.

[0114] When the evaluation index includes lift, the lift of the feature relationship is compared with a preset lift threshold. If the lift of the feature relationship is greater than or equal to the preset lift threshold, it is determined that the lift of the feature relationship meets the lift requirement of the association relationship.

[0115] The preset confidence threshold may be 0.85, 0.9, 0.95, 0.98, etc. The preset imbalance rate threshold may be 0.7, 0.6, 0.5, 0.4, etc. The preset lift threshold may be 1, 1.2, 1.5, 1.8, etc. The embodiments of the present application do not limit the specific values ​​of the preset confidence threshold, the preset imbalance rate threshold, and the preset lift threshold, and they can be set as needed in actual applications.

[0116] If all indicators included in the evaluation index of the characteristic relationship meet the corresponding preset threshold requirements, the characteristic relationship is determined to be able to truly represent the causal relationship of the abnormal characteristics and the characteristic relationship is determined to be an association relationship. If at least one indicator among the indicators included in the evaluation index of the characteristic relationship does not meet the corresponding preset threshold requirements, the characteristic relationship is determined to be unable to truly represent the causal relationship of the abnormal characteristics and is eliminated.

[0117] If, through the above method, it is ultimately determined that the evaluation index of each feature relationship does not meet the corresponding threshold requirement, it is determined that no abnormal features with associated relationships exist in the target device cluster. If at least one associated relationship is ultimately determined, it is determined that no abnormal features with associated relationships exist in the target device cluster.

[0118] When a correlation is determined, the operation and maintenance rules of the target device cluster are updated based on the abnormal characteristics of the correlation, including:

[0119] The union of the first operation and maintenance rule corresponding to the abnormal feature as the cause and the second operation and maintenance rule corresponding to the abnormal feature as the result among the abnormal features with an associated relationship is used as the third operation and maintenance rule; the second operation and maintenance rule corresponding to the abnormal feature as the result configured in the target device cluster is replaced with the third operation and maintenance rule.

[0120] The first O&M rule is the one that is triggered when the abnormality characteristic that is the cause occurs. Hitting the first O&M rule triggers the execution of the corresponding O&M action, performing O&M on the device to eliminate the abnormality characteristic that is the cause. Similarly, the second O&M rule is the one that is triggered when the abnormality characteristic that is the result occurs.

[0121] The union of the first and second operation and maintenance rules is used as the third operation and maintenance rule, and the operation and maintenance rule corresponding to the abnormal characteristic as the result is adjusted to the third operation and maintenance rule. In this way, in the operation and maintenance rules configured for the target device cluster, the operation and maintenance rule corresponding to the abnormal characteristic as the cause is the first operation and maintenance rule, and the operation and maintenance rule corresponding to the abnormal characteristic as the result is the third operation and maintenance rule. The third operation and maintenance rule is the union of the first and second operation and maintenance rules. Therefore, when the abnormal characteristic as the cause occurs, both the first and third operation and maintenance rules will be hit. When the abnormal characteristic as the result occurs, the third operation and maintenance rule will be hit. Since the abnormal characteristic as the cause occurs earlier than the abnormal characteristic as the result, the third operation and maintenance rule will be hit when the abnormal characteristic as the cause occurs, triggering the corresponding operation and maintenance action. Compared to the original situation where only the second operation and maintenance rule was corresponding to the abnormal characteristic as the result, the updated operation and maintenance rule will be hit earlier, triggering the operation and maintenance action, allowing for more timely operation and maintenance of the equipment and shortening the time it takes for the equipment to be damaged. Moreover, after the update, the third operation and maintenance rules corresponding to the resulting abnormal features contain richer rules, and more situations can hit the third operation and maintenance rules, which can effectively reduce the missed operation and maintenance situations caused by some abnormal situations that cannot hit the operation and maintenance rules before the update.

[0122] In other embodiments of the present application, before replacing the second operation and maintenance rule corresponding to the resulting abnormal feature with the third operation and maintenance rule, it is also possible to first determine whether the third operation and maintenance rule can truly achieve a better operation and maintenance effect than the original second operation and maintenance rule.

[0123] Specifically, when the resulting abnormal feature is configured with a second operation and maintenance rule, first operation and maintenance data obtained by running for a preset time is obtained, and when the resulting abnormal feature is configured with a third operation and maintenance rule, second operation and maintenance data obtained by running for a preset time is obtained; based on the first operation and maintenance data and the second operation and maintenance data, operation and maintenance difference data is determined, and the operation and maintenance difference data is used to characterize the difference in the abnormal feature hitting rules in the two cases of configuring the second operation and maintenance rule and the third operation and maintenance rule; based on the operation and maintenance difference data, when it is determined that the third operation and maintenance rule meets the preset operation and maintenance validity condition, the operation of replacing the second operation and maintenance rule corresponding to the second abnormal feature configured in the target device cluster with the third operation and maintenance rule is executed.

[0124] The above-mentioned preset duration can be 3 days, 5 days or a week, etc. The embodiment of the present application does not limit the specific value of the preset duration, and it can be set according to needs in actual application. The above-mentioned preset operation and maintenance validity condition is used to characterize that the operation and maintenance effect of the third operation and maintenance rule is better than the operation and maintenance effect of the second operation and maintenance rule. The preset operation and maintenance validity condition may include conditions for constraining the operation and maintenance effect of the third operation and maintenance rule to be better than the operation and maintenance effect of the second operation and maintenance rule. For example, the preset operation and maintenance validity condition may include the hit rate of the third operation and maintenance rule being higher than the hit rate of the second operation and maintenance rule, the earliest hit time of the third operation and maintenance rule being earlier than the earliest hit time of the second operation and maintenance rule, etc.

[0125] The first operation and maintenance data includes the abnormal characteristics generated by each device in the target device cluster when the second operation and maintenance rule is configured, the operation and maintenance rules that the abnormal characteristics hit, and the records of the operation and maintenance actions triggered by hitting the operation and maintenance rules. The second operation and maintenance data includes the abnormal characteristics generated by each device in the target device cluster when the third operation and maintenance rule is configured, the operation and maintenance rules that the abnormal characteristics hit, and the records of the operation and maintenance actions triggered by hitting the operation and maintenance rules. The operation and maintenance difference data includes the following: when the second operation and maintenance rule is configured and when the third operation and maintenance rule is configured, the same abnormal characteristics hit different operation and maintenance rules; the same abnormal characteristics hit the same operation and maintenance rule at different times; the same abnormal characteristics do not hit the operation and maintenance rule in one case but hit the operation and maintenance rule in another case; etc.

[0126] In some embodiments of the present application, after obtaining operation and maintenance difference data by comparing the first operation and maintenance data with the second operation and maintenance data, the operation and maintenance difference data can be sent to a preset operation and maintenance terminal for display, and the preset operation and maintenance terminal can be a terminal of an operation and maintenance expert. The operation and maintenance expert determines whether the operation and maintenance effect of the third operation and maintenance rule is better than the operation and maintenance effect of the second operation and maintenance rule by browsing the operation and maintenance difference data. If it is determined to be better, the preset operation and maintenance terminal returns an indication information indicating that the third operation and maintenance rule is updated and valid to the execution subject of the embodiment of the present application. After receiving the indication information, the execution subject determines that the third operation and maintenance rule can meet the preset operation and maintenance validity conditions, and then replaces the second operation and maintenance rule corresponding to the second abnormal feature configured in the target device cluster with the third operation and maintenance rule.

[0127] Through the above method, the first operation and maintenance data corresponding to the second operation and maintenance rule and the second operation and maintenance data corresponding to the third operation and maintenance rule within a preset time period are traced back to analyze the operation and maintenance difference data between the two. Based on the operation and maintenance difference data, it is evaluated whether the operation and maintenance effect of the third operation and maintenance rule is better than that of the second operation and maintenance rule. Only when it is determined that the effect is better, the second operation and maintenance rule is updated to the third operation and maintenance rule, thereby improving the accuracy and reliability of the operation and maintenance rule update and effectively improving the operation and maintenance effect of the target device cluster.

[0128] If the third operation and maintenance rule is determined not to meet the preset operation and maintenance validity conditions through the above method, the target relationship corresponding to the third operation and maintenance rule can also be added to the preset invalid relationship set. If the target relationship is again determined to exist in the target device cluster, the target relationship is determined to be invalid based on the preset invalid relationship set. Subsequent operation and maintenance rule updates are no longer based on this target relationship, which can save computing resources.

[0129] In an embodiment of the present application, the possible associations between multiple abnormal features of the target device cluster are mined, and when it is determined that there are abnormal features with associations, the operation and maintenance rules of the target device cluster are updated based on the abnormal features with associations. Taking into account the mutual influence between abnormal features in the setting of the operation and maintenance rules of the target device cluster can make the updated operation and maintenance rules more consistent with the inherent causal relationship between various abnormal features that may be generated by the target device cluster, improve the scientific rationality of the operation and maintenance rules, and help to hit the operation and maintenance rules in advance when abnormal features with associations occur, so as to operate and maintain the equipment as soon as possible to eliminate the abnormalities and reduce the occurrence of abnormal features as a result of abnormal features with associations. By updating the operation and maintenance rules, more abnormal situations can hit the operation and maintenance rules, reducing the situation of missed operation and maintenance when abnormal features cannot hit the operation and maintenance rules, improving the operation and maintenance effect of the target device cluster, and also improving the stability and reliability of the operation of the target device cluster.

[0130] Some embodiments of the present application also provide an operation and maintenance rule update system, such as Figure 2 As shown, the system includes a cloud server cluster and an operation and maintenance platform;

[0131] The cloud server in the cloud server cluster is used to obtain the operating data of the cloud server and send the operating data to the operation and maintenance platform;

[0132] The operation and maintenance platform is used to obtain multiple abnormal features of the cloud server cluster and the occurrence time of each abnormal feature based on the operation data of each cloud server in the cloud server cluster; based on the multiple abnormal features and the occurrence time of each abnormal feature, determine whether there are abnormal features with correlation among the multiple abnormal features, and the correlation relationship is used to characterize the existence of a causal relationship between the abnormal features; in the case of the existence of abnormal features with correlation, the operation and maintenance rules of the cloud server cluster are updated based on the abnormal features with correlation.

[0133] The aforementioned cloud server operational data includes the cloud server's operational logs and performance data. Each cloud server in the cloud server cluster has an agent application installed. This agent application is responsible for collecting the cloud server's operational data and uploading it to the operations and maintenance platform. The operations and maintenance platform can be a physical server independent of the cloud server cluster, a cloud server, or a service or application deployed in the cloud.

[0134] Cloud servers upload their operational data to the operation and maintenance platform. Based on this operational data, the platform identifies abnormal characteristics and their occurrence times in the cloud server cluster, explores possible correlations between these abnormal characteristics, and updates the cloud server cluster's operation and maintenance rules based on these correlated abnormal characteristics. Taking the interplay of abnormal characteristics into account when setting operation and maintenance rules ensures that updated operation and maintenance rules better reflect the inherent causal relationships between various abnormal characteristics that may arise in cloud servers, improving the scientific rationality of the operation and maintenance rules. This helps ensure that correlated abnormal characteristics are matched to the operation and maintenance rules in advance, allowing for faster device operation and maintenance to resolve the anomaly and reducing the occurrence of abnormal characteristics that are the result of correlated abnormal characteristics. Updating operation and maintenance rules also ensures that more abnormal situations are matched to the operation and maintenance rules, reducing the number of missed operations and maintenance due to abnormal characteristics that fail to match the operation and maintenance rules. This improves the operation and maintenance effectiveness of cloud servers and enhances the stability and reliability of cloud server cluster operations.

[0135] In order to more intuitively reflect the difference between the embodiments of the present application and the related art, Figure 3 and 4 Provide explanation. Figure 3 The diagram shows the operation and maintenance system of the cloud server cluster in the related art. Figure 4A schematic diagram of an operation and maintenance rule updating system in an embodiment of the present application is shown.

[0136] like Figure 3 As shown, a cloud server cluster includes multiple cloud servers, each of which has an agent application installed. The operation and maintenance platform includes an anomaly detection system and an operation and maintenance center. The agent application on the cloud server collects operational data from the cloud servers and uploads it to the anomaly detection system. The anomaly detection system analyzes the operational data to identify abnormal events occurring on the cloud servers. It then extracts anomaly feature data based on these anomalies and transmits this feature data to the operation and maintenance center. If the anomaly features in the feature data match the operation and maintenance rules, the operation and maintenance center executes the corresponding operation and maintenance actions to address the abnormality in the cloud servers in the cloud server cluster.

[0137] exist Figure 3 Based on the system structure of the related art shown, Figure 4 As shown, the present embodiment adds a rule update module and an update evaluation module to the operation and maintenance platform. After the anomaly perception system extracts abnormal feature data based on the abnormal event, it transmits this feature data, including the abnormal features and the time of their occurrence, to the rule update module. The rule update module performs data preprocessing on the received feature data, generates feature time series relationships between the abnormal features, and uses a preset feature mining algorithm to mine possible correlations between the abnormal features. Figure 4 The FP-Growth algorithm is used as an example to illustrate the preset feature mining algorithm. The rule updating module obtains the final feature association relationship based on the feature temporal relationship and the feature relationship set output by the FP-Growth algorithm. The process of generating the feature association relationship by the rule updating module can be as follows: Figure 5 As shown, the feature data set is first deduplicated, and the feature time series relationship is generated based on the deduplicated feature data set. The frequent item sets are extracted based on the deduplicated feature data set. Based on the extracted frequent item sets, an FP-tree (frequent pattern tree) is generated through the FP-Growth algorithm. Then, the final feature association relationship is obtained based on the feature time series relationship and the generated FP-tree.

[0138] like Figure 4As shown, the operation and maintenance center will also transmit the original operation and maintenance rules configured for the cloud server cluster to the rule update module. The rule update module generates updated rules based on the original operation and maintenance rules and the generated feature association relationships, and transmits the updated rules to the update evaluation module. The update evaluation module performs operation and maintenance backtracking based on the updated rules and the original rules before the update, and analyzes the operation and maintenance difference data of multiple hits, fewer hits, earlier hits, and later hits in the operation and maintenance data generated under the two operation and maintenance rules before and after the update. If the operation and maintenance difference data is confirmed by the operation and maintenance experts that the updated operation and maintenance rules have better operation and maintenance effects, the updated rules will be sent to the operation and maintenance center. The operation and maintenance center replaces the operation and maintenance rules before the update with the updated rules. If the operation and maintenance experts confirm that the updated operation and maintenance rules do not achieve better operation and maintenance effects based on the operation and maintenance difference data, the updated rules will not be adopted, and the unadopted updated rules will be returned to the rule update module. After the rule update module receives an update rule that is not adopted, it adds the association relationship corresponding to the update rule to the preset invalid relationship set. When the association relationship is determined again later, it can be determined based on the preset invalid relationship set that the association relationship is invalid for the update of the operation and maintenance rules and no subsequent update operations will be performed.

[0139] Among them, for the operation and maintenance rules in the operation and maintenance center, including the original rules that have not been updated and the updated rules after the update, the process of operating and maintaining the cloud servers in the cloud server cluster based on the operation and maintenance rules can be as follows: Figure 6 The proxy application in the cloud server collects logs, such as Figure 6 The system logs collected in the system log record the network card failure, and the performance data collected indicates that the disk read delay is 1000ms. The abnormality perception system in the operation and maintenance platform perceives abnormalities based on the data collected by the agent application, such as Figure 6 As shown in Figure 1, the abnormality perception system detects a network card connection warning, the warning level is a serious warning, and also detects a slow virtual machine speed, the warning level is a serious warning. The abnormality perception system extracts features based on the detected abnormal events, such as Figure 6 The anomaly features extracted include network card jitter and slow I / O. After the anomaly detection system transmits these features to the operations center, the center determines that these features match the relevant operation and maintenance rules for network card failures causing slow I / O, and executes the corresponding operation and maintenance action, "offline migration."

[0140] Through testing of the operation and maintenance rule update system provided in the embodiment of the present application, it was confirmed that the probability that the update rules launched by the update system were eventually verified by operation and maintenance experts to be effective reached 73%, the probability that the abnormal features would hit the operation and maintenance rules in advance after the update reached 80%, and the longest advance time for hitting the operation and maintenance rules reached the hour level.

[0141] The embodiments of the present application utilize a pre-set feature mining algorithm, combined with the temporal relationships between abnormal features, to achieve mining of feature associations that consider temporal relationships. When updating rules, the update logic based on the union of operation and maintenance rules corresponding to abnormal features with causal relationships is adopted. This can cover the operation and maintenance conditions of the original operation and maintenance rules, avoid missed and late operation and enable early detection and discovery of scenarios where the original operation and maintenance rules had missed operations.

[0142] Corresponding to the embodiment of the aforementioned method for updating operation and maintenance rules, the present application also provides an embodiment of an apparatus for updating operation and maintenance rules. Figure 7 FIG. 1 is a schematic diagram of a structure of an operation and maintenance rule updating device according to an exemplary embodiment, wherein the device is used to execute the operation and maintenance rule updating method provided in any of the above embodiments, such as Figure 7 As shown, the updating device of the operation and maintenance rules includes:

[0143] Acquisition module 201, used to acquire multiple abnormal features of the target device cluster and the occurrence time of each abnormal feature;

[0144] Determination module 202, for determining whether there is an abnormal feature with a correlation among the multiple abnormal features based on the multiple abnormal features and the occurrence time of each abnormal feature, where the correlation is used to indicate that there is a causal relationship between the abnormal features;

[0145] The updating module 203 is configured to update the operation and maintenance rules of the target device cluster based on the abnormal features with associated relationships when there are abnormal features with associated relationships.

[0146] The above-mentioned determination module 202 is used to determine the time series relationship between each abnormal feature based on the occurrence time of each abnormal feature, and the time series relationship is used to characterize the chronological relationship of the occurrence time of each abnormal feature; based on multiple abnormal features, a feature relationship set of multiple abnormal features is generated through a preset feature mining algorithm, and the feature relationship set includes multiple feature relationships, and the feature relationship is used to characterize the existence of a causal relationship between each abnormal feature belonging to the same feature relationship; based on the time series relationship and the feature relationship set, it is determined whether there is an abnormal feature with a correlation relationship among the multiple abnormal features.

[0147] The above-mentioned determination module 202 is specifically used to eliminate feature relationships that do not meet preset time sequence conditions from the feature relationship set based on time sequence relationships; the preset time sequence conditions are used to constrain the occurrence time of the abnormal feature that serves as the cause of two abnormal features with a causal relationship to be earlier than the occurrence time of the abnormal feature that serves as the result; in the case where there are remaining feature relationships in the feature relationship set after elimination, the evaluation index of the remaining feature relationship is calculated, and the evaluation index is used to characterize the accuracy of the remaining feature relationship as an association relationship; in the case where there is a target feature relationship whose evaluation index is greater than a preset threshold, the abnormal feature corresponding to the target feature relationship is determined as an abnormal feature with an association relationship.

[0148] The above-mentioned determination module 202 is used to determine the time series relationship between the first abnormal feature and the second abnormal feature corresponding to the first characteristic relationship from the time series relationship, where the first characteristic relationship is any characteristic relationship in the characteristic relationship set, and the first characteristic relationship is used to characterize that the first abnormal feature is the cause of the second abnormal feature; if the time series relationship between the first abnormal feature and the second abnormal feature indicates that the occurrence time of the first abnormal feature is later than the occurrence time of the second abnormal feature, then the first characteristic relationship is eliminated from the characteristic relationship set.

[0149] In some embodiments of the present application, the second characteristic relationship is any characteristic relationship among the remaining characteristic relationships, the second characteristic relationship corresponds to the third abnormal feature and the fourth abnormal feature, and the third abnormal feature is the cause of the fourth abnormal feature; the above-mentioned determination module 202 is used to respectively determine the first device in the target device cluster where the third abnormal feature occurs and the second device where the fourth abnormal feature occurs; based on the first device and the second device, calculate the evaluation index of the second characteristic relationship.

[0150] The above-mentioned determination module 202 is used to determine the number of target devices that have both the third abnormal feature and the fourth abnormal feature based on the first device and the second device; calculate the first ratio between the number of target devices and the number of first devices to obtain the confidence of the second characteristic relationship; the confidence is used to characterize the probability of the fourth abnormal feature occurring under the premise of the occurrence of the third abnormal feature; and / or, calculate the second ratio between the total number of devices in the target device cluster and the number of second devices, calculate the product between the first ratio and the second ratio, and obtain the imbalance rate of the second characteristic relationship, the imbalance rate is used to characterize the degree of difference between the number of occurrences of the third abnormal feature and the number of occurrences of the fourth abnormal feature; and / or, calculate the ratio between the number of first devices and the total number of devices to obtain the first support; calculate the ratio between the number of second devices and the total number of devices to obtain the second support; calculate the ratio between the number of target devices and the total number of devices to obtain the third support; calculate the lift of the second characteristic relationship based on the first support, the second support and the third support, the lift is used to characterize the degree to which the occurrence of the third abnormal feature increases the probability of the occurrence of the fourth abnormal feature.

[0151] Update module 203 is used to take the union of the first operation and maintenance rule corresponding to the abnormal feature as the cause and the second operation and maintenance rule corresponding to the abnormal feature as the result among the abnormal features with an associated relationship as the third operation and maintenance rule; and replace the second operation and maintenance rule corresponding to the abnormal feature as the result configured in the target device cluster with the third operation and maintenance rule.

[0152] The device also includes: an update validity determination module, which is used to obtain first operation and maintenance data obtained by running for a preset time when the resulting abnormal feature is configured with a second operation and maintenance rule, and to obtain second operation and maintenance data obtained by running for a preset time when the resulting abnormal feature is configured with a third operation and maintenance rule; based on the first operation and maintenance data and the second operation and maintenance data, determine operation and maintenance difference data, the operation and maintenance difference data is used to characterize the difference in the abnormal feature hitting the rule in the two cases of configuring the second operation and maintenance rule and the third operation and maintenance rule; based on the operation and maintenance difference data, when it is determined that the third operation and maintenance rule meets the preset operation and maintenance validity condition, execute the operation of replacing the second operation and maintenance rule corresponding to the resulting abnormal feature configured in the target device cluster with the third operation and maintenance rule.

[0153] The device also includes: a preset invalid relationship set management module, which is used to determine that the third operation and maintenance rule does not meet the preset operation and maintenance validity conditions, and add the target association relationship corresponding to the third operation and maintenance rule to the preset invalid relationship set; when it is determined again that the target association relationship exists in the target device cluster, the target association relationship is determined to be an invalid association relationship based on the preset invalid relationship set.

[0154] The acquisition module 201 is used to obtain information on various abnormal events generated by the target device cluster within a preset historical period; extract various abnormal features and the occurrence time of each abnormal feature that occurred in the target device cluster within the preset historical period from each abnormal event information; in the case where there are multiple repeated abnormal features in the extracted abnormal features, delete the abnormal features except the abnormal feature with the earliest occurrence time among the repeated abnormal features.

[0155] The operation and maintenance rule updating device provided in the embodiment of the present application and the operation and maintenance rule updating method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0156] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0157] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components illustrated as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0158] Some embodiments of the present application further provide an electronic device corresponding to the operation and maintenance rule updating method provided in the aforementioned embodiment, so as to execute the aforementioned operation and maintenance rule updating method.

[0159] Figure 8 This is a hardware structure diagram of an electronic device according to an exemplary embodiment. The electronic device includes: a communication interface 601, a processor 602, a memory 603, and a bus 604. The communication interface 601, the processor 602, and the memory 603 communicate with each other via the bus 604. The processor 602 executes the operation and maintenance rule updating method described above by reading and executing machine-executable instructions corresponding to the control logic of the operation and maintenance rule updating method in the memory 603. The details of this method are described in the above embodiments and are not repeated here.

[0160] The memory 603 mentioned in the embodiments of the present application can be any electronic, magnetic, optical or other physical storage device, and can contain stored information, such as executable instructions, data, etc. Specifically, the memory 603 can be RAM (Random Access Memory), flash memory, a storage drive (such as a hard disk drive), any type of storage disk (such as an optical disk, DVD, etc.), or a similar storage medium, or a combination thereof. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 601 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used.

[0161] The bus 604 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 603 is used to store programs, and the processor 602 executes the programs after receiving an execution instruction.

[0162] The processor 602 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 602 or the instruction in the form of software. The above-mentioned processor 602 can be a general-purpose processor, including a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware controls, etc. The various methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or can be completed by a combination of hardware and software modules in the decoding processor.

[0163] The electronic device provided in the embodiment of the present application and the method for updating the operation and maintenance rules provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0164] The present application also provides a computer-readable storage medium corresponding to the method for updating the operation and maintenance rules provided in the above embodiment. Figure 9 As shown, the computer-readable storage medium is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, the method for updating the operation and maintenance rules provided by any of the aforementioned embodiments will be executed.

[0165] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0166] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the method for updating operation and maintenance rules provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0167] An embodiment of the present application also provides a computer program product corresponding to the method for updating operation and maintenance rules provided in the aforementioned embodiment. The computer program product includes a computer program, which is executed by a processor to implement the method for updating operation and maintenance rules provided in the aforementioned embodiment.

[0168] The computer program product provided in the above-mentioned embodiments of the present application and the method for updating operation and maintenance rules provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0169] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered merely as exemplary, and the true scope and spirit of the present application are indicated by the claims.

[0170] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0171] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for updating operation and maintenance rules, characterized in that: The method comprises: Obtaining multiple abnormal features of the target device cluster and the occurrence time of each abnormal feature; Determining, based on the multiple abnormal features and the occurrence time of each of the abnormal features, whether there is an abnormal feature with a correlation among the multiple abnormal features, wherein the correlation is used to represent a causal relationship between the abnormal features; In the case where the abnormal features with the associated relationship exist, the operation and maintenance rules of the target device cluster are updated based on the abnormal features with the associated relationship.

2. The method according to claim 1, characterized in that The determining, based on the multiple abnormal features and the occurrence time of each abnormal feature, whether there is an abnormal feature with a correlation among the multiple abnormal features includes: Determining a temporal relationship between the abnormal features according to the occurrence time of each abnormal feature, wherein the temporal relationship is used to characterize the order of occurrence time of each abnormal feature; Generating a feature relationship set of the plurality of abnormal features using a preset feature mining algorithm based on the plurality of abnormal features, wherein the feature relationship set includes a plurality of feature relationships, and the feature relationships are used to characterize the existence of a causal relationship between the abnormal features belonging to the same feature relationship; According to the time series relationship and the feature relationship set, it is determined whether there is an abnormal feature with an associated relationship among the multiple abnormal features.

3. The method according to claim 2, characterized in that The determining, based on the time series relationship and the feature relationship set, whether there is an abnormal feature with an associated relationship among the multiple abnormal features includes: Eliminating, from the feature relationship set, feature relationships that do not satisfy a preset time sequence condition based on the time sequence relationship; the preset time sequence condition is used to constrain, of two abnormal features with a causal relationship, the occurrence time of the abnormal feature as the cause to be earlier than the occurrence time of the abnormal feature as the result; In the case where there are remaining feature relationships in the feature relationship set after elimination, calculating an evaluation index of the remaining feature relationships, the evaluation index being used to characterize the accuracy of the remaining feature relationships as the association relationships; In the case that there is a target feature relationship in which the evaluation index is greater than a preset threshold, the abnormal feature corresponding to the target feature relationship is determined as the abnormal feature having the association relationship.

4. The method according to claim 3, characterized in that Eliminating feature relationships that do not meet preset time sequence conditions from the feature relationship set based on the time sequence relationship between the abnormal features includes: Determining, from the time series relationship, a time series relationship between a first abnormal feature and a second abnormal feature corresponding to a first characteristic relationship, where the first characteristic relationship is any characteristic relationship in the set of characteristic relationships, and the first characteristic relationship is used to indicate that the first abnormal feature is a cause of the second abnormal feature; If the temporal relationship between the first abnormal feature and the second abnormal feature indicates that the occurrence time of the first abnormal feature is later than the occurrence time of the second abnormal feature, the first feature relationship is removed from the feature relationship set.

5. The method according to claim 3, characterized in that The second characteristic relationship is any characteristic relationship among the remaining characteristic relationships, the second characteristic relationship corresponds to the third abnormal characteristic and the fourth abnormal characteristic, and the third abnormal characteristic is the cause of the fourth abnormal characteristic; The calculating of the evaluation index of the remaining feature relationship includes: respectively determining the number of first devices in the target device cluster that have the third abnormal characteristic, and the number of target devices that have both the third abnormal characteristic and the fourth abnormal characteristic; An evaluation index of the second characteristic relationship is calculated according to the number of the first devices and the number of the target devices.

6. The method according to claim 5, characterized in that The calculating, according to the number of the first devices and the number of the target devices, an evaluation index of the second characteristic relationship includes: A first ratio between the number of target devices and the number of the first devices is calculated to obtain a confidence level of the second characteristic relationship; the confidence level is used to characterize the probability of the fourth abnormal feature occurring under the premise that the third abnormal feature occurs.

7. The method according to claim 5 or 6, characterized in that The calculating, according to the number of the first devices and the number of the target devices, an evaluation index of the second characteristic relationship includes: Determining the number of second devices in the target device cluster that have the fourth abnormal characteristic; Calculating a first ratio between the number of target devices and the number of first devices; calculating a second ratio between the total number of devices in the target device cluster and the number of second devices; The product of the first ratio and the second ratio is calculated to obtain an imbalance rate of the second characteristic relationship, where the imbalance rate is used to represent the degree of difference between the number of occurrences of the third abnormal characteristic and the number of occurrences of the fourth abnormal characteristic.

8. The method according to claim 5 or 6, characterized in that The calculating, according to the number of the first devices and the number of the target devices, an evaluation index of the second characteristic relationship includes: Determining the number of second devices in the target device cluster that have the fourth abnormal characteristic; Calculating the ratio between the number of the first devices and the total number of devices in the target device cluster to obtain a first support; calculating the ratio between the number of the second devices and the total number of devices to obtain a second support; calculating the ratio between the number of the target devices and the total number of devices to obtain a third support; The lift of the second feature relationship is calculated based on the first support, the second support, and the third support, where the lift is used to represent the degree to which the occurrence probability of the fourth abnormal feature is improved by the occurrence of the third abnormal feature.

9. The method according to any one of claims 1 to 6, characterized in that The updating of the operation and maintenance rules of the target device cluster based on the abnormal features having the associated relationship includes: The union of the first operation and maintenance rule corresponding to the abnormal feature as the cause and the second operation and maintenance rule corresponding to the abnormal feature as the result among the abnormal features with the associated relationship is used as the third operation and maintenance rule; The second operation and maintenance rule corresponding to the resulting abnormal feature configured in the target device cluster is replaced with the third operation and maintenance rule.

10. The method according to claim 9, characterized in that Before replacing the second operation and maintenance rule corresponding to the abnormal feature as a result configured in the target device cluster with the third operation and maintenance rule, the method further includes: Acquire first operation and maintenance data obtained by running for a preset time period when the second operation and maintenance rule is configured for the abnormal feature as the result, and acquire second operation and maintenance data obtained by running for the preset time period when the third operation and maintenance rule is configured for the abnormal feature as the result; Determining operation and maintenance difference data based on the first operation and maintenance data and the second operation and maintenance data, wherein the operation and maintenance difference data is used to characterize the difference in abnormal feature hit rules between the two situations where the second operation and maintenance rule and the third operation and maintenance rule are configured; When it is determined based on the operation and maintenance difference data that the third operation and maintenance rule meets the preset operation and maintenance validity condition, the operation of replacing the second operation and maintenance rule corresponding to the resulting abnormal feature configured in the target device cluster with the third operation and maintenance rule is performed.

11. The method according to claim 10, characterized in that The method further comprises: Determining that the third operation and maintenance rule does not meet the preset operation and maintenance validity condition, and adding the target association relationship corresponding to the third operation and maintenance rule to a preset invalid relationship set; When it is determined again that the target association relationship exists in the target device cluster, the target association relationship is determined to be an invalid association relationship based on the preset invalid relationship set.

12. The method according to any one of claims 1 to 6, characterized in that The obtaining of multiple abnormal features of the target device cluster includes: Obtain information about each abnormal event generated by each device in the target device cluster within a preset historical period; For the abnormal event information corresponding to each device, extract the abnormal features and the occurrence time of each abnormal feature that occurred in the device within the preset historical period from the abnormal event information corresponding to the device; When there are a plurality of repeated abnormal features among the abnormal features of the same device, abnormal features other than the abnormal feature with the earliest occurrence time among the plurality of repeated abnormal features are deleted.

13. A device for updating operation and maintenance rules, characterized in that: The device comprises: An acquisition module, configured to acquire multiple abnormal features of a target device cluster and the occurrence time of each abnormal feature; a determination module, configured to determine, based on the plurality of abnormal features and the occurrence time of each of the abnormal features, whether there is an abnormal feature with a correlation among the plurality of abnormal features, wherein the correlation is used to indicate that there is a causal relationship between the abnormal features; An updating module is configured to update the operation and maintenance rules of the target device cluster based on the abnormal features with the associated relationship when the abnormal features with the associated relationship exist.

14. A system for updating operation and maintenance rules, characterized in that: Including cloud server clusters and operation and maintenance platforms; The cloud server in the cloud server cluster is used to obtain the operating data of the cloud server and send the operating data to the operation and maintenance platform; The operation and maintenance platform is configured to obtain, based on the operation data of each cloud server in the cloud server cluster, a plurality of abnormal features of the cloud server cluster and an occurrence time of each abnormal feature; Based on the multiple abnormal features and the occurrence time of each of the abnormal features, determine whether there are abnormal features with correlation among the multiple abnormal features, and the correlation is used to characterize the existence of a causal relationship between the abnormal features; in the case of the existence of abnormal features with correlation, the operation and maintenance rules of the cloud server cluster are updated based on the abnormal features with correlation.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor executes the program to implement the method according to any one of claims 1 to 12.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method according to any one of claims 1 to 12.

17. A computer program product comprising a computer program, characterized in that The computer program is executed by a processor to implement the method according to any one of claims 1 to 12.

Images