System optimization method, device, electronic equipment, storage medium and program

Abstract

The application discloses an optimization method and device of a system, electronic equipment, a storage medium and a program, relates to the technical field of big data, and comprises the following steps: inputting a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, determining a target knowledge ontology based on a model output result and an output dimension requirement, wherein the preset fusion data model is a model for constructing the association relationship between the plurality of original data and is adjusted based on a diamond model template; processing the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, wherein the preset pruning strategy comprises at least one of the following: a white list pruning strategy and a divide-and-conquer pruning strategy; performing discrimination processing on the plurality of operation behaviors to obtain an operation and maintenance analysis result of the cloud storage system; and performing operation optimization on the cloud storage system according to the operation and maintenance analysis result. The problems that the observability technical implementation means is single in the related art, the system operation and maintenance efficiency is low, and the accuracy is not high are solved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of big data, in particular, relate to a system optimization method and device, electronic equipment, storage medium and program. BACKGROUND

[0002] In the cloud-native environment, the observability of the system becomes increasingly important, especially under the microservice architecture managed by Kubernetes (k8s for short). The relationship between services is complex and frequently adjusted with changes in business requirements and workloads, which leads to unprecedented challenges for the operation and maintenance team. Specifically, the traditional operation and maintenance method focuses on passive response, that is, intervention is performed only when the system has an exception or failure, which cannot meet the efficient operation and maintenance requirements in the modern cloud-native environment.

[0003] The observability technology in the related art mostly relies on a single data type, therefore, only part of the observability can be observed, and comprehensive correlation and analysis between data cannot be achieved, that is, due to the single focus on a specific type of data collection and analysis, the log, monitoring indicators, link data and alarm events and other information are scattered in different platforms and systems, making it difficult to analyze the correlation across data types and increasing the operation and maintenance cost. Secondly, when the system generates massive data, the related solutions have great pressure on data storage, retrieval and processing, and the complex data structure affects the grasp of the real-time state of the system; and the related technology cannot directly obtain the observability feedback of the system, which is not conducive to the early discovery and solution of potential problems, leading to an increase in repair cost and time.

[0004] In view of the problem that the single implementation means of the observability technology in the related art leads to low efficiency and low accuracy of system operation and maintenance, no effective solution has been proposed so far. SUMMARY

[0005] Embodiments of the present application provide a system optimization method and device, electronic equipment, storage medium and program to at least solve the problem that the single implementation means of the observability technology in the related art leads to low efficiency and low accuracy of system operation and maintenance.

[0006] According to one embodiment of the present application, a system optimization method is provided, comprising: inputting a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, determining a target knowledge ontology based on a model output result and an output dimension requirement, wherein the preset fusion data model is a model for constructing an association relationship between the plurality of original data adjusted based on a diamond model template; processing the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, wherein the preset pruning strategy comprises at least one of the following: a whitelist pruning strategy, a divide-and-conquer pruning strategy; performing discriminant processing on the plurality of operation behaviors to obtain an operation and maintenance analysis result of the cloud storage system; and performing operation optimization on the cloud storage system according to the operation and maintenance analysis result.

[0007] According to another embodiment of the present application, a system optimization apparatus is provided, comprising: a first determination module configured to input a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, and determine a target knowledge ontology based on a model output result and an output dimension requirement, wherein the preset fusion data model is a model for constructing an association relationship between the plurality of original data adjusted based on a diamond model template; a processing module configured to process the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, wherein the preset pruning strategy comprises at least one of the following: a whitelist pruning strategy, a divide-and-conquer pruning strategy; a discriminant module configured to perform discriminant processing on the plurality of operation behaviors to obtain an operation and maintenance analysis result of the cloud storage system; and an optimization module configured to perform operation optimization on the cloud storage system according to the operation and maintenance analysis result.

[0008] According to still another embodiment of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, wherein the computer program is configured to execute the steps in any of the method embodiments described above when running.

[0009] According to still another embodiment of the present application, an electronic device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in any of the method embodiments described above.

[0010] According to still another embodiment of the present application, a computer program product is provided, comprising a computer program, wherein the computer program is executed by a processor to implement the steps in any of the method embodiments described above.

[0011] By the present application, a plurality of original data in the cloud storage system in the operation and maintenance state is input into a preset fusion data model, the model is adjusted based on a diamond model template, and is used to construct the association relationship between the plurality of original data. Through the output result of the model and the specified output dimension (such as spatial dimension or time dimension), a target knowledge ontology is determined, and the target knowledge ontology is processed according to a preset pruning strategy, wherein the pruning strategy can include a whitelist pruning strategy and a divide-and-conquer pruning strategy. The whitelist strategy reduces the search range by limiting key entities and relationships, and ensures the accuracy and efficiency of the search; the divide-and-conquer strategy divides a large knowledge structure into a plurality of subsets that can be managed and analyzed, thereby avoiding the path explosion problem and improving the response speed of data processing. The plurality of operation behaviors optimized by the pruning strategy are discriminated and processed, legal application behaviors and abnormal situations are identified, and operation and maintenance analysis results of the cloud storage system are obtained. According to the operation and maintenance analysis results, the cloud storage system is optimized, including but not limited to adjusting the access control strategy, optimizing the resource configuration, upgrading the security protection measures, etc., so as to improve the stability and security of the system, and reduce the operation and maintenance cost. The above method solves the problem that the observability technology implementation means in the related art is single, the efficiency of system operation and maintenance is low, and the accuracy is not high, improves the operation and maintenance efficiency of the cloud storage system, shortens the fault positioning and solving time, and realizes the rapid optimization and iteration of the operation and maintenance process, improves the efficiency and accuracy of system operation and maintenance. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creating laborious work.

[0013] Figure 1 is a hardware structure block diagram of a server device of a system optimization method according to an embodiment of the present application;

[0014] Figure 2 is a flowchart of a system optimization method according to an embodiment of the present application;

[0015] Figure 3 is a flowchart of active observability determination based on multi-graph fusion according to an embodiment of the present application;

[0016] Figure 4 is an architecture diagram of a diamond model according to an embodiment of the present application;

[0017] Figure 5 is an architecture diagram of a data model according to an embodiment of the present application;

[0018] Figure 6is a schematic diagram of a space dimension knowledge ontology according to an embodiment of the present application;

[0019] Figure 7 is a schematic diagram of a time dimension knowledge ontology according to an embodiment of the present application;

[0020] Figure 8 is a flowchart of a white list pruning strategy according to an embodiment of the present application;

[0021] Figure 9 is a process diagram of sub-knowledge body generation in a divide-and-conquer pruning strategy according to an embodiment of the present application;

[0022] Figure 10 is a schematic diagram of sub-knowledge body merging in a divide-and-conquer pruning strategy according to an embodiment of the present application;

[0023] Figure 11 is a flowchart of active observation and judgment according to an embodiment of the present application;

[0024] Figure 12 is a structural block diagram of an optimization device of a system according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0026] It should be noted that, in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0027] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0028] As an optional implementation, the method embodiments provided in the embodiments of the present application can be executed in a server device or similar computing device. Taking the case of running on a server device, Figure 1 is a hardware structural block diagram of a server device of an optimization method of a system according to an embodiment of the present application. As shown in Figure 1As shown, the server device can include one or N (N is greater than or equal to one) Figure 1 The server device can further include a transmission device 106 for communication function and an input / output device 108. Those skilled in the art can understand that Figure 1 The structure shown is only schematic and does not limit the structure of the server device. For example, the server device can further include more or less components than those shown, or have a different configuration of components than those shown. Figure 1 The structure shown is only schematic and does not limit the structure of the server device. For example, the server device can further include more or less components than those shown, or have a different configuration of components than those shown. Figure 1 The structure shown is only schematic and does not limit the structure of the server device. For example, the server device can further include more or less components than those shown, or have a different configuration of components than those shown.

[0029] The memory 104 can be used to store computer programs, such as software programs of application software and modules, such as computer programs corresponding to the optimization method of the system in the embodiments of the present application. The processor 102 can execute various functional applications and data processing by running the computer programs stored in the memory 104, i.e. implement the method described above. The memory 104 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or N magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the server device through a network. Examples of the network can include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0030] The transmission device 106 is used to receive or send data via a network. The network can specifically include a wireless network provided by a communication provider of the server device. In one example, the transmission device 106 includes a network adapter (NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet in a wireless manner.

[0031] In the embodiments of the present application, an optimization method of a system is provided, Figure 2 The flowchart of the optimization method of the system according to the embodiments of the present application is shown in FIG. 2, which includes the following steps: Figure 2

[0032] ​In step S202, multiple original data in the cloud storage system in the operation and maintenance state are input into a preset fusion data model, and a target knowledge ontology is determined based on a model output result and an output dimension requirement, wherein the preset fusion data model is a model for constructing the association relationship between the multiple original data, which is adjusted based on a diamond model template;

[0033] Optionally, various original data generated by the cloud storage system in the operation and maintenance state, including log data, monitoring indicators, link data, alarm events, etc., are input into a preset fusion data model. The model is adjusted based on a diamond model template, and the main function is to construct the association relationship between the original data. The data is integrated through time series and spatial topology dimensions to form a knowledge ontology. Thus, the scattered data islands are connected to provide a comprehensive and structured data perspective.

[0034] In step S204, the target knowledge ontology is processed according to a preset pruning strategy to obtain multiple operation behaviors, wherein the preset pruning strategy includes at least one of the following: a whitelist pruning strategy, a divide-and-conquer pruning strategy;

[0035] Optionally, in order to cope with the massive data of the cloud storage system and the complex query path problem, the target knowledge ontology needs to be optimized. Step S204 is implemented through a preset pruning strategy, which includes but is not limited to a whitelist pruning strategy and a divide-and-conquer pruning strategy. Specifically, the whitelist pruning strategy predefines key entities and relationships, and only analyzes these important parts in detail, excluding irrelevant or low-probability components, thereby improving the efficiency of data retrieval and analysis. The divide-and-conquer pruning strategy divides a large knowledge ontology into multiple smaller and relatively independent sub-ontologies, and then processes the sub-ontologies. Then, the locality of data is utilized to reduce the complexity of global search and improve the processing speed and accuracy.

[0036] In step S206, the multiple operation behaviors are discriminated to obtain operation and maintenance analysis results of the cloud storage system.

[0037] Optionally, the multiple operation behaviors after pruning optimization will be further discriminated to identify legal operations, false positive behaviors, unknown abnormalities or known abnormalities in the cloud storage system. Step S206 usually involves manual analysis, pattern matching or the use of large language models (LLM) and other intelligent tools to evaluate and discriminate the operation behaviors from different dimensions and depths. By quickly and accurately identifying abnormalities, the operation and maintenance team can quickly locate problems to provide a reference for subsequent fault handling and system optimization.

[0038] In step S208, the cloud storage system is optimized according to the operation and maintenance analysis results.

[0039] That is, based on the operation and maintenance analysis results, the operation of the cloud storage system is optimized. This may include adjusting system parameters, updating access control rules, optimizing network topology, repairing software vulnerabilities, or enhancing hardware configuration, etc. By implementing optimization decisions, the performance of the system can be improved, the failure rate can be reduced, the safety and integrity of the data can be ensured, and the operation and maintenance level and user experience of the entire cloud storage system can be improved.

[0040] Through the above method, a plurality of original data in the cloud storage system in the operation and maintenance state are input into a preset fusion data model, the model is adjusted based on the diamond model template, and is used to construct the association relationship between the plurality of original data. A target knowledge ontology is determined through the output result of the model and the specified output dimension (such as spatial dimension or time dimension), and the target knowledge ontology is processed according to a preset pruning strategy, wherein the pruning strategy can include a whitelist pruning strategy and a divide-and-conquer pruning strategy. The whitelist strategy reduces the search range by limiting key entities and relationships, ensuring the accuracy and efficiency of the search; the divide-and-conquer strategy divides a large knowledge structure into a plurality of subsets that can be managed and analyzed, thereby avoiding the path explosion problem and improving the response speed of data processing. The plurality of operation behaviors optimized by the pruning strategy are discriminated and processed to identify legal application behaviors and abnormal situations, and the operation and maintenance analysis results of the cloud storage system are obtained. According to the operation and maintenance analysis results, the operation of the cloud storage system is optimized, including but not limited to adjusting the access control strategy, optimizing the resource configuration, upgrading the security protection measures, etc., to improve the stability and security of the system, while reducing the operation and maintenance cost. The above method solves the problem that the observability technology implementation means in the related art is single, which leads to low efficiency of system operation and maintenance and low accuracy, improves the operation and maintenance efficiency of the cloud storage system, shortens the fault positioning and solving time, and realizes the rapid optimization and iteration of the operation and maintenance process, thereby improving the efficiency and accuracy of system operation and maintenance.

[0041] In one example embodiment, before inputting the plurality of original data in the cloud storage system in the operation and maintenance state into the preset fusion data model, the above method further comprises: obtaining asset information of physical resources corresponding to the cloud storage system, and topology information of network connection structure corresponding to the cloud storage system; determining the basic measure information in the diamond model template based on the asset information and the topology information.

[0042] Optionally, the asset information of the physical resources related to the cloud storage system and the topology information of the network connection structure are obtained and used as the basis for building the diamond model. The asset information here covers all physical device details that constitute the cloud storage system, such as server model, storage device capacity, network device configuration, etc., while the topology information refers to the interconnection relationship between devices, services, nodes in the system, including data flow path, network node connection state, etc.

[0043] In an example embodiment, before inputting the plurality of raw data in the cloud storage system in the operation and maintenance state into the preset fusion data model, the method further comprises: obtaining professional operation and maintenance information of the cloud storage system recorded in the Internet, wherein the professional operation and maintenance information at least includes: common faults and fault solving methods of the cloud storage system, abnormal patterns and abnormal solving methods of the cloud storage system; and determining the function information and the opponent information in the diamond model template according to the professional operation and maintenance information.

[0044] It can be understood that the professional operation and maintenance information usually includes common faults, fault solving methods, abnormal patterns and corresponding abnormal solving strategies of the cloud storage system, which are valuable experiences refined from the extensive knowledge base in the industry; in the analysis framework of the diamond model, the "function" dimension focuses on the internal operation ability and the achievable technical level of the system, and the "opponent" dimension focuses on the source of potential threats and abnormal behaviors. By integrating the professional operation and maintenance information on the Internet, according to the common fault solving methods, the specific functions and operations that can be performed by the cloud storage system in the normal operation state are refined; according to the description and classification of the abnormal patterns, different types of opponents that may adversely affect the cloud storage system are identified, which include but are not limited to hardware failure, software defect, network attack, operation error, etc.; and then, the function information and the opponent information are determined through the professional operation and maintenance information, so as to enhance the analysis ability and decision support level of the model in the face of complex operation and maintenance scenarios.

[0045] In an example embodiment, before inputting the plurality of raw data in the cloud storage system in the operation and maintenance state into the preset fusion data model, the method further comprises: in the case that an operation event occurs in the cloud storage system, obtaining multi-dimensional data of the operation event; and determining victim information in the diamond model template according to the multi-dimensional data.

[0046] Optionally, the multi-dimensional data refers to a data set collected from multiple angles or levels when analyzing the event. In the context of cloud storage system operation and maintenance, these data may come from the logs, monitoring indicators, link tracking information or alarm events of the system. In the diamond model, the "victim" dimension describes the objects affected by attacks or events. When an operation event occurs in the cloud storage system, by analyzing the multi-dimensional data of the event, it can be accurately determined which parts (such as specific services, data, hardware resources, etc.) are directly affected, as well as the degree, range and type of the influence. That is, by analyzing the collected multi-dimensional data, the system components or services directly affected by the event are identified, and these information is mapped to the "victim" dimension in the diamond model to form a detailed victim information description.

[0047] In summary, before constructing the knowledge ontology through multi-graph fusion, diverse information inside and outside the system is fully collected and integrated, including static configuration of assets and topology, professional operation and maintenance knowledge on the Internet, and multi-dimensional data of operation events, aiming to provide a more comprehensive, accurate and intelligent data basis for the fusion data model, thereby significantly improving the efficiency and accuracy of the observability judgment of the cloud storage system.

[0048] In an example embodiment, determining the target knowledge ontology based on the model output result and the output dimension requirement includes: in the case that the output dimension requirement is spatial dimension, determining the spatial connection relationship between different server components according to the server architecture and deployment relationship of the cloud storage system corresponding to the model output result; determining the target knowledge ontology of the spatial class based on the spatial connection relationship. In the case that the output dimension requirement is time dimension, determining the time stamp corresponding to different processes according to the event process corresponding to the cloud storage system in the model output result; sorting different processes based on the time stamp to obtain the target knowledge ontology of the time class.

[0049] In the case that the output dimension requirement is spatial dimension, the spatial connection relationship between the server architecture and components of the cloud storage system is focused on. The fusion data model analyzes and extracts the component distribution in the system, the connection mode between servers, and the data flow direction, etc. For example, the fusion data model parses the server architecture in the cloud storage system, identifies the location information, connection mode and dependency relationship between components. According to the model output result, a spatial connection graph between server components is established. This includes determining which components are physically adjacent, which components are connected through the network, and the data flow path between components. Based on the above analysis, a spatial class knowledge ontology is constructed with the spatial connection relationship as the core. This ontology not only reflects the physical or logical layout of the components, but also integrates the component attributes, running state and potential fault factors, providing a comprehensive spatial perspective for the operation and maintenance object.

[0050] Optionally, when the output dimension requirement is time dimension, the occurrence order and time point of the event process are focused on. By analyzing the time stamp in the model output result, an accurate timeline of the event can be constructed, including: the fusion data model extracts the operation time stamp of different processes from the event record, including the start time, end time and occurrence time of key operations. The extracted time stamp is sorted to form an ordered event chain, showing the evolution path of the event process over time. Based on the result of time sorting, a time class knowledge ontology is constructed. This ontology not only records the sequence of events, but also may include the frequency, periodicity characteristics of events, and the relevance to other events, helping the operation and maintenance object to understand the dynamic development of events and the time sequence characteristics of system behavior.

[0051] In summary, through detailed analysis of spatial and temporal dimensions, a highly structured knowledge ontology is constructed, providing strong data support and intelligent decision-making basis for observability analysis of cloud storage systems, significantly improving the quality and efficiency of operation and maintenance work.

[0052] In one example embodiment, the target knowledge ontology is processed according to a preset pruning strategy to obtain a plurality of operation behaviors, including: in the case where the preset pruning strategy is a whitelist pruning strategy, obtaining business requirements or alarm standards set by the operation and maintenance object in the cloud storage system; generating a target whitelist according to the business requirements or alarm standards; filtering the target knowledge ontology carrying the event process based on the target whitelist; determining a plurality of operation behaviors that meet the target whitelist according to the filtering result.

[0053] According to the running state and business target of the cloud storage system, specific business requirements or alarm prompts are set or obtained. These requirements or prompts are usually key indicators, operation types or preset abnormal mode thresholds that the system needs to focus on. Based on the above business requirements or alarm prompts, the operation and maintenance object or the automated system generates a target whitelist. This whitelist includes entities, components, operation types and time windows directly related to the current business requirements or alarm prompts, and is the focus of subsequent data retrieval and analysis. Using the generated target whitelist, the target knowledge ontology carrying the event process is filtered. This process eliminates components and operations that are not related to the current business requirements or alarm prompts, and only retains information within the whitelist. According to the filtered result, a series of operation behaviors that match the business requirements or alarm prompts are more clearly identified. These operation behaviors may be normal business execution actions, or may be potential abnormal or fault behaviors.

[0054] In summary, by implementing the whitelist pruning strategy, more focus can be placed on operation behaviors that are truly worth attention, providing a high-quality data basis for subsequent abnormal analysis, root cause positioning and even expert experience accumulation, thereby optimizing the operation and maintenance process of the cloud storage system and improving the stability and security of system operation.

[0055] In one example embodiment, the target knowledge ontology is processed according to a preset pruning strategy to obtain a plurality of operation behaviors, including: in the case where the preset pruning strategy is a divide-and-conquer pruning strategy, according to the divide-and-conquer type corresponding to the divide-and-conquer pruning strategy; segmenting the target knowledge ontology through the divide-and-conquer type to obtain a plurality of sub-knowledge ontologies; merging the plurality of sub-knowledge ontologies, and determining a plurality of operation behaviors according to the merging result.

[0056] It should be noted that the divide-and-conquer type can be set according to different standards, such as the functional category of system components, geographical distribution, network connection relationship, or data type. Based on the selected divide-and-conquer type, the entire target knowledge ontology is divided into several independent sub-knowledge ontologies. Each sub-knowledge ontology contains specific entities, relationships, and attributes related to the divide-and-conquer type. Each sub-knowledge ontology is independently analyzed, which can include anomaly detection, pattern matching, performance evaluation, etc. The specific analysis content depends on the operation and maintenance goals and requirements. After completing the independent analysis of the sub-knowledge ontologies, their results are merged and processed to reconstruct a global perspective and identify cross-sub-ontology associations and patterns. Based on the results of the merging process, multiple operation behaviors are determined, which include normal business operations, potential abnormal behaviors, or direct fault trigger points.

[0057] In summary, by the above-mentioned manner, the complex problem is decomposed, greatly reducing the size of single data processing, and each sub-knowledge ontology has lower structure and complexity compared to the original knowledge ontology, reducing data redundancy and computational waste in the analysis process, and ensuring that the computing resources are more efficiently utilized.

[0058] In an example embodiment, the multiple operation behaviors are discriminated to obtain operation and maintenance analysis results of the cloud storage system, including: determining a target trace subgraph corresponding to the multiple operation behaviors; using a preset rule or a trained large language model to discriminate the target trace subgraph; determining different behavior classifications corresponding to the multiple operation behaviors according to the discrimination result, wherein the different behavior classifications at least include one of the following: legal behavior, false positive behavior, unknown abnormal behavior, and known abnormal behavior; manually confirming the different behavior classifications, and determining the operation and maintenance analysis results of the cloud storage system according to the confirmation result.

[0059] After the pruning processing based on the whitelist or the divide-and-conquer strategy, a series of operation behaviors closely related to the current business requirements or alarm prompts are obtained, which have been optimized. Next, in order to more deeply understand and analyze these operation behaviors, it is necessary to construct their target trace subgraphs. The target trace subgraph is a part of the graph data structure related to a specific operation behavior in the knowledge ontology, which visualizes the entities, relationships, and time series involved in the behavior, facilitating subsequent analysis and discrimination.

[0060] Optionally, a series of preset rules can be formulated based on historical data and experience to quickly identify whether certain behavior patterns meet the requirements of normal system operation. The advantage of rule-based discrimination is fast execution speed and high accuracy for common behavior classification. For more complex and pattern-difficult-to-determine operation behaviors, a trained large language model can be called to perform in-depth analysis. The LLM model can understand text, logs and descriptive information, and convert them into high-level concepts and reasoning to identify subtle signs of abnormal behavior. By combining the rapid discrimination ability of preset rules and the deep understanding ability of large language models, the operation behaviors in the target traceability subgraph can be comprehensively and meticulously discriminated to ensure that no important details are missed.

[0061] Further, according to the discrimination result, the multiple operation behaviors are classified into different behavior categories, including but not limited to: legal behavior, indicating behavior that fully meets system expectations and preset rules, and does not require additional intervention. False positive behavior, indicating behavior that was initially suspected to be abnormal but actually falls within the normal range, and requires rule adjustment or parameter optimization. Unknown abnormal behavior, indicating behavior that is unexpected and does not conform to the normal pattern but has not been confirmed as a fault, and may require further investigation and analysis. Known abnormal behavior, indicating behavior that has been identified as a fault pattern or abnormal situation, and requires immediate measures to correct or fault locate.

[0062] In addition, for these classifications, human confirmation is also required to ensure the accuracy and reasonableness of the discrimination. During the human confirmation process, operation experts can combine machine discrimination results and their own experience to correct or supplement behavior classification, ensuring that the final operation analysis results reflect both the analysis advantages of intelligent systems and the judgment wisdom of human experts. The final operation analysis results will combine machine discrimination and human confirmation to give a comprehensive evaluation of the current state of the cloud storage system, including but not limited to: system health status, abnormal behavior overview, and subsequent action recommendations.

[0063] In summary, through the above implementation, multiple methods are used to judge operation information, ensuring the accuracy and reliability of the operation analysis results, providing data reference for fault prevention, anomaly detection and performance optimization of the cloud storage system.

[0064] In an example embodiment, the cloud storage system is optimized according to the operation and maintenance analysis results, including: optimizing the first type of operation behavior corresponding to the known abnormal behavior in the operation and maintenance analysis results through a preset abnormal handling process, wherein the preset abnormal handling process is associated with the cloud storage system and is used to control the repeated occurrence of the known abnormal behavior in the cloud storage system; optimizing the second type of operation behavior corresponding to the unknown abnormal behavior in the operation and maintenance analysis results through an expert customized process, wherein the expert customized process is used to control the target solution formulated by the expert manual judgment system environment and system historical data; and optimizing the third type of operation behavior corresponding to the legal behavior in the operation and maintenance analysis results through a record and learning process, wherein the record and learning process is used to record and learn the content and execution process of the legal behavior.

[0065] Optionally, for the operation behavior that has been explicitly identified by the system as abnormal and classified as the first type, the operation and maintenance object will follow the preset abnormal handling process for optimization. This process usually includes but is not limited to: abnormal behavior analysis, immediate response measures, preventive optimization, wherein the abnormal behavior analysis mainly analyzes the root cause, impact range and potential failure mode of the known abnormal behavior. The immediate response measures are to take immediate response measures such as restarting the service, isolating the faulty component, adjusting the resource allocation, etc. according to the nature and severity of the abnormal behavior, to quickly restore the normal state of the system. The preventive optimization is to optimize the system configuration, update the alarm threshold, and strengthen the monitoring strategy based on the known abnormal behavior, to prevent the recurrence of the same type of abnormal behavior, thereby reducing the future operation and maintenance risk. That is, through the standardized emergency response mechanism of the preset abnormal handling process, the identified abnormal behavior can be responded to in the first time, avoiding the evolution of small problems into bigger failures, and ensuring the continuity and stability of system operation.

[0066] Optionally, for those behaviors that have not been classified as abnormal in the current rules and cognitive system, but show irregular behavior patterns, i.e. the second type of operation behavior, the operation and maintenance object will adopt the expert customized process to formulate targeted operation optimization strategies. This process includes the following steps:

[0067] Step 1, senior operation and maintenance objects analyze the context of the abnormal behavior in depth, combining system environment and historical data to explore the underlying causes.

[0068] Step 2, based on the judgment results, formulate individualized solutions or adjustment strategies, which may involve upgrading specific components, setting up monitoring thresholds for special events, or introducing new data processing logic.

[0069] Step 3, apply the customized solution to the system, observe its effect, and verify the effectiveness of the solution through continuous monitoring and testing, and iterate and optimize if necessary.

[0070] That is, the expert customization process makes full use of the wisdom and experience of human experts, can flexibly cope with unknown challenges of the system, and find innovative solutions for complex problems.

[0071] Optionally, for the first type of operation behavior judged to be legal, the operation and maintenance object will not be ignored, but will be optimized through the recording and learning process, and the system efficiency and user experience will be improved. For example, record the execution process of legal behavior, the resources involved, the time consumed, and the impact on system performance, etc. Detailed data basis for subsequent analysis and optimization. Use the recorded data to analyze the optimization potential of the behavior, such as minimizing resource consumption, shortening execution time, and reasonably arranging concurrent operations. Through continuous learning and practice, the best practices are refined to improve the overall efficiency of the system. The experience and optimization points learned from legal behavior are fed back to the preset rules and operation and maintenance processes, making them more perfect and intelligent, and laying a better foundation for future operation and maintenance work.

[0072] In summary, it can quickly respond to known abnormalities, flexibly cope with unknown challenges, and also excavate optimization potential from legal behavior, thereby comprehensively improving the operation and maintenance level of the cloud storage system, and ensuring its continuous, stable and efficient operation in a complex and changing environment.

[0073] In one example embodiment, after optimizing the operation of the cloud storage system according to the operation and maintenance analysis results, the above method further comprises: counting new knowledge content appearing in the operation optimization; using the backfeeding data corresponding to the new knowledge content to adjust the parameter relationship of the preset fusion data model.

[0074] When the operation parameters of the cloud storage system are adjusted, the components are upgraded, or the fault handling strategy is changed according to the analysis results, each optimization will bring new observation and learning opportunities. These new knowledge contents may include: unknown abnormal behavior patterns revealed in the optimization process, such as performance bottlenecks under certain hardware configurations, connection failures under certain network layouts, etc. Specific operations that have been proven to solve the problem, such as restarting a certain service, fine-tuning parameters, or modifying code, etc. After the operation and maintenance analysis and optimization measures are implemented, the change trend of the running state and performance indicators of the cloud storage system reflects the effect of the measures. Through continuous testing and optimization, a set of best practices for handling similar operation and maintenance problems is accumulated, which covers the whole process from problem identification to solution. The statistics of new knowledge content is not only to record history, but more importantly, they can be used as backfeeding data to adjust the parameters and relationships of the preset fusion data model, so that the model is closer to the actual operation and maintenance environment, and its prediction and analysis capabilities are improved.

[0075] Optionally, the adjustment process can include: (1) Based on the abnormal patterns and repair solutions verified in the optimization process, adjust the parameter values related to them in the model, so that the model can more accurately identify these patterns and make corresponding early warning or processing recommendations. (2) Summarize the newly discovered system behavior changes and best practices into the model, update the association rules between entities, and make the ontology more complete and accurate, reflecting the latest system architecture and operation strategy. (3) Based on the new knowledge content, optimize the data processing algorithm and pruning strategy, such as adjusting the selection criteria of the whitelist or the divide-and-conquer strategy, to make it more suitable for processing operation data in the current environment.

[0076] In summary, knowledge feedback is an important link in the cloud storage system operation analysis and operation optimization process. It not only promotes the accurate adjustment of model parameter relationships, but also promotes the continuous improvement of system operation strategies, ensuring that the system can maintain high levels of operational stability and fault handling capabilities when facing increasingly complex operation challenges.

[0077] In an example embodiment, after the operation optimization of the cloud storage system according to the operation analysis result, the above method further comprises: updating the access control rules of the cloud storage system, the asset list corresponding to the cloud storage system, and the network topology information corresponding to the cloud storage system according to the optimization result of the operation optimization; and adjusting a plurality of data transmission paths in the cloud storage system based on the access control rules, the asset list, and the network topology information.

[0078] Optionally, the operation analysis result may reveal deficiencies or overuse of internal data access, such as the need for more access rights for some users or services, or the need to strengthen access restrictions for some sensitive resources. Based on these analyses, the operation object will adjust the access control rules of the cloud storage system to ensure data security and compliance. In the optimization process, the cloud storage system may introduce new hardware, software resources, or upgrade the functions of existing resources or change their status. In order to accurately reflect these changes, the asset list needs to be updated in a timely manner to ensure that the operation object has the most comprehensive asset view for resource management and troubleshooting. Optimization measures may involve adjusting network connections, such as adding network nodes, optimizing data transmission paths, or enhancing network security. These changes need to be reflected in the network topology information to support subsequent network structure-based operation decisions, such as network capacity planning and traffic optimization.

[0079] After the access control rules, asset list, and network topology information are updated, the secure data transmission path is re-planned according to the updated access control rules, so that the data stream needs to pass through the risk area or through a more secure network channel for transmission, to enhance the security of data transmission.

[0080] In an example embodiment, after the operation optimization of the cloud storage system is performed according to the operation and maintenance analysis result, the method further comprises: determining an optimization duration for which the cloud storage system performs the operation optimization; in a case where the optimization duration is greater than a preset duration, sending maintenance alarm information to the operation and maintenance object of the cloud storage system; and in a case where the optimization duration is less than or equal to the preset duration, sending maintenance normal information to the operation and maintenance object of the cloud storage system.

[0081] That is, according to the comparison result of the optimization duration and the preset duration, the corresponding feedback information is sent to the operation and maintenance object: if the optimization duration is greater than the preset duration, it may mean that the optimization operation encounters unexpected complexity, resulting in longer system interruption or performance degradation than expected. At this time, the system will send maintenance alarm information to inform the operation and maintenance personnel to urgently intervene, check the optimization process, and take remedial measures to restore system performance as soon as possible and avoid greater impact on business. If the optimization duration is less than or equal to the preset duration, it indicates that the optimization operation is successfully completed within the predetermined time, and the impact on the normal operation of the system is within a controllable range. At this time, the system will send maintenance normal information to inform the operation and maintenance personnel that the optimization is successful and the system is running in good condition, and no urgent intervention is needed, but regular checks on the long-term effect of the optimization measures are still needed to ensure the continuous stability of the system.

[0082] In summary, by introducing the monitoring and feedback mechanism of the optimization duration, not only the efficiency of the operation and maintenance operation and the stability of the system operation are ensured, but also the continuous optimization of the operation and maintenance strategy is promoted, providing higher level operation and maintenance management and security protection for the cloud storage system.

[0083] In an example embodiment, after the maintenance alarm information is sent to the operation and maintenance object of the cloud storage system in a case where the optimization duration is greater than the preset duration, the method further comprises: determining the number of occurrences of the maintenance alarm information in a target operation period; in a case where the number of occurrences is greater than a preset number of times, determining that the optimization strategy of the operation optimization of the cloud storage system needs to be adjusted; and in a case where the number of occurrences is less than or equal to the preset number of times, determining that the optimization strategy of the operation optimization of the cloud storage system does not need to be adjusted.

[0084] In an example embodiment, after the number of occurrences is greater than the preset number of times in a case where the optimization duration is greater than the preset duration, the method further comprises: determining a plurality of processes corresponding to the operation optimization; obtaining a plurality of use priorities corresponding to the plurality of processes, respectively; and in a case where a target use priority corresponding to a manual process is a non-highest priority, adjusting the priority of the manual process to a highest execution priority.

[0085] In an example embodiment, after the operation optimization of the cloud storage system according to the operation and maintenance analysis result, the method further comprises: obtaining a historical operation and maintenance period of the cloud storage system; determining a target operation and maintenance period corresponding to the operation optimization; and in a case where the historical operation and maintenance period is greater than or equal to the target operation and maintenance period, recording the current operation optimization as an optimization reference of the cloud storage system.

[0086] In an example embodiment, after the operation optimization of the cloud storage system according to the operation and maintenance analysis result, the method further comprises: obtaining feedback information of the operation optimization of the operation and maintenance object of the cloud storage system; generating an optimization score of the operation optimization according to the feedback information; and in a case where the optimization score is less than a preset score, determining the current operation optimization as an invalid optimization.

[0087] The execution subject of the above steps can be a server, a terminal, etc., but is not limited thereto.

[0088] In order to facilitate understanding of the embodiments of the present application, the related scenarios are explained and described, but do not limit the present application.

[0089] As an optional implementation, the optional embodiment of the present application proposes a multi-graph fusion-based active observability determination method. The diamond model is improved for multi-graph fusion to construct a knowledge ontology data model. The data of the basic data layer and the diamond model layer are integrated, and the knowledge ontology is constructed from the time and space dimensions. The multi-source data is structured, the data island problem is solved, and the characteristics and attributes of the operation and maintenance object are fully described to provide a basis for analysis. Further, the knowledge ontology is divided into sub-ontologies for retrieval analysis by the divide-and-conquer strategy. The white list strategy is used to set a key entity relationship white list based on experience for accurate analysis, reduce the search range, solve the massive data retrieval problem, and improve the efficiency. Finally, the active observation research and judgment idea is adopted, combined with artificial analysis, pattern matching, and LLM intelligent agent to describe application behavior. The data monetization is quickly realized, the accuracy of artificial research and judgment is improved, the knowledge is updated by knowledge backfeeding, the active anomaly and root cause analysis are realized, the potential problems are predicted, and the ability of the system to cope with complex situations is enhanced. Then, through systematic process design, the complete link processing from raw data to anomaly analysis and optimization feedback is realized, and the efficiency and accuracy of data processing in the operation and maintenance process are improved. In addition, the closed-loop feedback mechanism can continuously optimize the system operation and maintenance strategy, so that the system has stronger adaptability and stability when facing complex and variable application scenarios, reduces the probability of system failure, and improves the overall operation and maintenance level.

[0090] Optionally, Figure 3 is a flowchart of a multi-graph fusion-based active observability determination method according to an embodiment of the present application.

[0091] Step 1, taking original data as input, the original data is aggregated by data model, multi-graph fusion and regular update, etc. to build knowledge ontology. Through the above steps, multi-source data is integrated to provide a structured knowledge base for subsequent analysis; wherein, the knowledge ontology indicates the formalization of knowledge in a specific field and the structure of organization, including concepts, relationships and constraints, etc.

[0092] Step 2, the knowledge ontology is optimized by white list strategy and divide and conquer strategy to transform into application behavior. The white list strategy limits the legal operation range, and the divide and conquer strategy decomposes and handles complex problems to optimize the system structure.

[0093] Step 3, the application behavior is actively observed and judged by artificial analysis, pattern matching and large language model, etc. to identify normal and abnormal situations in the application behavior; finally, the application behavior is analyzed and the root cause is analyzed, and the analysis result is knowledge backfeeding, feedback to the data model link, to realize the closed-loop optimization of the whole operation process.

[0094] Optionally, the above data model is a multi-graph fusion data model, which is established based on a diamond model. It should be noted that, Figure 4 is an architectural diagram of the diamond model according to the embodiments of the present application. The diamond model as a whole presents a rhombus, and the four vertices are Adversary, Victim, Capability and Infrastructure. Adversary represents the party that launches an attack or causes an event; Victim is the object that suffers from the attack or event; Capability refers to the technical ability of the attacker; and Infrastructure is the environment on which the attack relies or acts. In addition, there are Social-Operational Object-Political (Social-Operational Object-Political) dimension and Technology dimension. The meta-features of the diamond model include but are not limited to time, stage, result, direction, means, resources, etc., which are used to further characterize the event characteristics.

[0095] Optionally, the theoretical core of the above model is to be able to completely characterize the characteristics and attributes of an event, so in the field of operation, especially in the direction of observability, it can better characterize the synthesis of objects of interest such as indicators, logs, links, alarms, assets, network, etc. Based on this, a data model for multi-graph fusion to build knowledge ontology is constructed based on the above diamond model.

[0096] Optionally, Figure 5is a schematic diagram of the architecture of the data model according to the embodiments of the present application, wherein the basic data layer contains log data, monitoring indicators, link data, alarm events and other basic data. These data are the original input of the entire system, reflecting the system running state from different dimensions; the diamond model layer includes: asset map depicting asset information of physical resources in the entire cluster, represented as topology between entities, network topology showing network connection structure, both corresponding to infrastructure in the diamond model, and also the basic environment focused on observability; expert experience is represented as professional knowledge in the operation and maintenance field, common faults and abnormal patterns, corresponding to function and adversary in the diamond model; the traceability graph combines the four dimension data (log, link, indicator, alarm) focused on by observability, used to track the process of events, corresponding to victim in the diamond model. After fusing multiple correlation graphs, the knowledge ontology model is constructed according to the two dimensions of time and space, covering all the data mentioned above.

[0097] Optionally, Figure 6 is a schematic diagram of the spatial dimension knowledge ontology according to the embodiments of the present application, which presents different levels and types of server components and their spatial connection relationships. In addition, Figure 7 is a schematic diagram of the time dimension knowledge ontology according to the embodiments of the present application. In addition to the spatial relationship, since most of the main events inside the system are carried out around the process, such as reading and writing files, receiving and sending data, creating processes and other operations, these events are often associated in the time dimension.

[0098] Optionally, as the system scale continues to expand and the business complexity increases, the amount of data grows exponentially, and the performance of traditional data storage and retrieval technology decreases dramatically when facing such a large amount of data. Analyzing these data requires complex algorithms and a large amount of computing resources, so the white list pruning strategy and the divide-and-conquer pruning strategy can be used to optimize the structure of the data and solve the problem of explosion of massive data retrieval paths.

[0099] Optionally, Figure 8 is a flowchart of the white list pruning strategy according to the embodiments of the present application. The white list pruning strategy includes: through business requirements and historical experience, the application-centered analysis of traceability graph nodes and edge information will eventually stabilize, and the number of newly added nodes and edges will gradually decrease, making the white list filtering idea feasible. First, a white list containing key entities and relationships is defined in advance. Second, during data retrieval, only entities and relationships that meet the white list conditions are analyzed and processed in depth, excluding those unrelated to the current query target or with less possibility. For example Figure 8 : According to business requirements or alarm prompts, the white list filtering configuration is determined, and the corresponding system process is associated in the knowledge ontology, thereby realizing pruning.

[0100] Optionally,Figure 9 is a process diagram of sub-knowledge body generation in the divide-and-conquer pruning strategy according to an embodiment of the present application. First, all network services, network topology corresponding access control rules, monitoring alarm lists and other information are listed, and on the basis of this information, a loop is traversed to determine different network service type classifications, and whether service i and service j have access relationships or the types of service i and service j are the same, whether the current network service is allowed by the network access control rule, and whether there are alarm events for service i and service j. In the case where service i and service j have access relationships or the types of service i and service j are the same, and (&&) the network access control rule is allowed, and (&&) there are alarm events for service i and service j, the network services from service i to service j are added as a separate segment (sub-knowledge body).

[0101] Optionally, the network service type classification can include Web services, Lightweight Directory Access Protocol services (LDAP services), Structured Query Language services (SQL services), File Transfer Protocol services (FTP services), and the like.

[0102] Figure 10 is a diagram of sub-knowledge body merging according to an embodiment of the present application, which is mainly used to divide a large and complex knowledge ontology into multiple smaller and relatively independent sub-ontologies, and then perform detailed data retrieval and analysis within the sub-ontologies.

[0103] Optionally, Figure 11 is a flowchart of active observation and judgment according to an embodiment of the present application. Raw data is first converted into a traceability graph, which structures and graphically presents chaotic data in a visualized manner, facilitating subsequent analysis and processing. Based on the traceability graph, rules or large language model (LLM) judgment can quickly identify legal application behaviors, false positives, unknown abnormalities, and known abnormalities from a large amount of data, enabling rapid conversion of data into valuable information to assist operation and decision-making, and realizing rapid monetization of data. Using rules or LLM to judge the traceability graph, with the help of pre-set rules and the intelligent analysis capability of the large language model, different types of application behaviors and abnormal situations can be quickly distinguished, improving the efficiency of judgment. For false positives, unknown abnormalities, and known abnormalities, further identification and confirmation are made through manual judgment, combined with the experience and knowledge of professional personnel, to improve the accuracy of judgment. At the same time, knowledge bodies participate in root cause analysis to provide knowledge support for judgment, which also helps to improve the overall judgment efficiency and accuracy, and effectively cope with complex situations when dealing with large-scale service-generated data.

[0104] It should be noted that the experience accumulated in the manual research and the newly discovered knowledge will be fed back to the knowledge body through the knowledge feedback mechanism. After the knowledge body is updated, on the one hand, it provides more accurate knowledge basis for root cause analysis, and on the other hand, it optimizes the basis of rule or LLM research and judgment, so that the system can more accurately and efficiently research and judge based on the updated knowledge body when facing similar data and scenes in the future, realize the continuous evolution of the ability, and continuously improve the level of the system in dealing with various situations.

[0105] In summary, by adopting the above-mentioned embodiments, the following effects are achieved: 1. The application of the diamond model in the field of observability is optimized: the classic diamond model is improved in a targeted manner to construct a data model suitable for multi-graph fusion to construct a knowledge ontology. By integrating the basic data layer (log, monitoring indicators, links, alarm events, etc.) and the diamond model layer (asset atlas, network topology, expert experience, and traceability graph), a knowledge ontology is constructed from the time and space dimensions, fully describing the characteristics and attributes of the objects of interest in the operation and maintenance field, effectively solving the data island problem, and providing comprehensive and structured data basis for observability analysis. 2. The optimization efficiency of large-scale knowledge structure is improved: based on the pruning idea, the divide-and-conquer strategy and the whitelist strategy are designed. The divide-and-conquer strategy divides the huge and complex knowledge ontology into multiple relatively independent sub-ontologies, and performs data retrieval and analysis within the sub-ontologies. The whitelist strategy pre-sets a whitelist containing key entities and relationships according to business requirements and historical experience, and only analyzes the parts that meet the conditions during retrieval. These two strategies effectively reduce the search target structure, solve the problem of explosion of massive data retrieval paths, and improve the efficiency of data retrieval and analysis. 3. The overall framework's active research and judgment capability is improved: based on the active observation and judgment idea, with the help of manual analysis, pattern matching, LLM intelligent agent, and other means, the application behavior is continuously described. It can quickly realize data monetization, identify legal application behavior, false positives, unknown abnormalities, and known abnormalities from a large amount of data. The accuracy of research and judgment is improved by combining manual research and judgment with professional experience, and the knowledge body is continuously updated through the knowledge feedback mechanism to realize active anomaly analysis and root cause analysis, and then predict potential problems, so that the system has the ability to actively respond to complex situations and improves the overall operation and maintenance level.

[0106] From the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above-mentioned embodiments can be realized by means of software and a general hardware platform as necessary, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for causing a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present application.

[0107] There is also provided in the embodiments a system optimization apparatus for implementing the above embodiments and preferred embodiments, which has been described and will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.

[0108] Figure 12 is a structural block diagram of an optimization apparatus of a system according to the embodiments of the present application, as shown in Figure 12 The apparatus comprises:

[0109] A first determination module 1202 is configured to input a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, determine a target knowledge ontology based on a model output result and an output dimension requirement, wherein the preset fusion data model is a model for constructing an association relationship between the plurality of original data, which is adjusted based on a diamond model template.

[0110] A processing module 1204 is configured to process the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, wherein the preset pruning strategy comprises at least one of the following: a white list pruning strategy, a divide-and-conquer pruning strategy.

[0111] A discrimination module 1206 is configured to perform discrimination processing on the plurality of operation behaviors to obtain an operation and maintenance analysis result of the cloud storage system.

[0112] An optimization module 1208 is configured to perform operation optimization on the cloud storage system according to the operation and maintenance analysis result.

[0113] The above device inputs a plurality of original data in the cloud storage system in the operation and maintenance state into a preset fusion data model. The model is adjusted based on a diamond model template and is used to construct the association relationship between the plurality of original data. A target knowledge ontology is determined based on the output result of the model and a specified output dimension (such as a spatial dimension or a time dimension). The target knowledge ontology is processed according to a preset pruning strategy. The pruning strategy can include a whitelist pruning strategy and a divide-and-conquer pruning strategy. The whitelist strategy limits key entities and relationships to reduce the search range and ensure the accuracy and efficiency of the search. The divide-and-conquer strategy divides a large knowledge structure into a plurality of subsets that can be managed and analyzed, thereby avoiding the path explosion problem and improving the response speed of data processing. The plurality of operation behaviors optimized by the pruning strategy are discriminated and processed to identify legal application behaviors and abnormal situations, and operation and maintenance analysis results of the cloud storage system are obtained. According to the operation and maintenance analysis results, the cloud storage system is optimized, including but not limited to adjusting the access control strategy, optimizing the resource configuration, upgrading the security protection measures, etc., to improve the stability and security of the system, and reduce the operation and maintenance cost. The above method solves the problem that the observability technology implementation means in the related art is single, which leads to low efficiency of system operation and maintenance and low accuracy, improves the operation and maintenance efficiency of the cloud storage system, shortens the fault positioning and solving time, and realizes the rapid optimization and iteration of the operation and maintenance process, improves the efficiency and accuracy of system operation and maintenance.

[0114] In an example embodiment, the above device further includes a second determination module configured to, before inputting the plurality of original data in the cloud storage system in the operation and maintenance state into the preset fusion data model, obtain asset information of a physical resource corresponding to the cloud storage system and topology information of a network connection structure corresponding to the cloud storage system, and determine the basic measure information in the diamond model template based on the asset information and the topology information.

[0115] In an example embodiment, the above device further includes a third determination module configured to, before inputting the plurality of original data in the cloud storage system in the operation and maintenance state into the preset fusion data model, obtain professional operation and maintenance information of the cloud storage system recorded in the Internet, wherein the professional operation and maintenance information at least includes common faults and fault solving methods of the cloud storage system, abnormal patterns and abnormal solving methods of the cloud storage system, and determine the function information and the opponent information in the diamond model template according to the professional operation and maintenance information.

[0116] In an example embodiment, the above device further includes a fourth determination module configured to, before inputting the plurality of original data in the cloud storage system in the operation and maintenance state into the preset fusion data model, obtain multi-dimensional data of an operation event in the case that the operation event occurs in the cloud storage system, and determine the victim information in the diamond model template according to the multi-dimensional data.

[0117] In an example embodiment, the first determining module is further configured to, when the output dimension requirement is a spatial dimension, determine a spatial connection relationship between different server components according to a server architecture and a deployment relationship of the cloud storage system corresponding to the model output result; and determine a target knowledge ontology of a spatial class based on the spatial connection relationship. When the output dimension requirement is a time dimension, determine a timestamp corresponding to different processes according to an event process of the cloud storage system corresponding to the model output result; and sort the different processes based on the timestamp to obtain a target knowledge ontology of a time class.

[0118] In an example embodiment, the processing module is further configured to, when the preset pruning strategy is a whitelist pruning strategy, obtain a business requirement or an alarm standard set by the operation and maintenance object in the cloud storage system; generate a target whitelist according to the business requirement or the alarm standard; filter the target knowledge ontology carrying the event process based on the target whitelist; and determine a plurality of operation behaviors that meet the target whitelist according to a filtering result.

[0119] In an example embodiment, the processing module is further configured to, when the preset pruning strategy is a divide-and-conquer pruning strategy, determine a divide-and-conquer type corresponding to the divide-and-conquer pruning strategy; perform segmented processing on the target knowledge ontology through the divide-and-conquer type to obtain a plurality of sub-knowledge ontologies; perform merging processing on the plurality of sub-knowledge ontologies, and determine a plurality of operation behaviors according to a merging result.

[0120] In an example embodiment, the determining module is further configured to determine a target traceability subgraph corresponding to the plurality of operation behaviors; determine the target traceability subgraph using a preset rule or a trained large language model; determine different behavior classifications corresponding to the plurality of operation behaviors according to a determination result, wherein the different behavior classifications at least include one of the following: a legal behavior, a false positive behavior, an unknown abnormal behavior, and a known abnormal behavior; perform artificial confirmation on the different behavior classifications, and determine an operation and maintenance analysis result of the cloud storage system according to a confirmation result.

[0121] In an example embodiment, the optimization module is further configured to perform operation optimization on a first type of operation behavior corresponding to a known abnormal behavior in the operation and maintenance analysis result through a preset abnormal handling process, wherein the preset abnormal handling process is associated with the cloud storage system and is used to control repeated occurrence of the known abnormal behavior; perform operation optimization on a second type of operation behavior corresponding to an unknown abnormal behavior in the operation and maintenance analysis result through an expert customized process, wherein the expert customized process is used to control a target solution developed by an expert artificial judgment system environment and system historical data; and perform operation optimization on a third type of operation behavior corresponding to a legal behavior in the operation and maintenance analysis result through a recording and learning process, wherein the recording and learning process is used to record and learn content and an execution process of the legal behavior.

[0122] In an example embodiment, the apparatus further includes a first adjustment module configured to, after the cloud storage system is optimized for operation according to the operation and maintenance analysis result, count new knowledge content that appears in the operation optimization; and adjust parameter relationships of the preset fusion data model using backfeeding data corresponding to the new knowledge content.

[0123] In an example embodiment, the apparatus further includes a second adjustment module configured to, after the cloud storage system is optimized for operation according to the operation and maintenance analysis result, update access control rules of the cloud storage system, an asset list corresponding to the cloud storage system, and network topology information corresponding to the cloud storage system according to an optimization result of the operation optimization; and adjust a plurality of data transmission paths in the cloud storage system based on the access control rules, the asset list, and the network topology information.

[0124] In an example embodiment, the apparatus further includes a fifth determination module configured to, after the cloud storage system is optimized for operation according to the operation and maintenance analysis result, determine an optimization duration for which the cloud storage system performs the operation optimization; and send maintenance alarm information to an operation and maintenance object of the cloud storage system in a case where the optimization duration is greater than a preset duration, or send maintenance normal information to the operation and maintenance object of the cloud storage system in a case where the optimization duration is less than or equal to the preset duration.

[0125] In an example embodiment, the fifth determination module further includes a determination unit configured to, after the maintenance alarm information is sent to the operation and maintenance object of the cloud storage system in the case where the optimization duration is greater than the preset duration, determine a number of occurrences of the maintenance alarm information in a target operation period; and determine that the cloud storage system needs to adjust an optimization strategy of the operation optimization in a case where the number of occurrences is greater than a preset number, or determine that the cloud storage system does not need to adjust the optimization strategy of the operation optimization in a case where the number of occurrences is less than or equal to the preset number.

[0126] In an example embodiment, the fifth determination module further includes an adjustment unit configured to, after it is determined that the cloud storage system needs to adjust the optimization strategy of the operation optimization in the case where the number of occurrences is greater than the preset number, determine a plurality of processes corresponding to the operation optimization; obtain a use priority corresponding to each of the plurality of processes; and adjust a priority of an artificial process to a highest execution priority in a case where a target use priority corresponding to the artificial process is a non-highest priority.

[0127] In an example embodiment, the apparatus further includes a recording module configured to, after the cloud storage system is optimized for operation according to the operation and maintenance analysis result, obtain a historical operation and maintenance period of the cloud storage system; determine a target operation and maintenance period corresponding to the operation optimization; and record the current operation optimization as an optimization reference of the cloud storage system in a case where the historical operation and maintenance period is greater than or equal to the target operation and maintenance period.

[0128] In an example embodiment, the apparatus further includes a scoring module configured to score the cloud storage system after the operation optimization based on the operation and maintenance analysis result. The method further includes obtaining feedback information of the operation and maintenance object of the cloud storage system on the operation optimization; generating an optimization score of the operation optimization based on the feedback information; and determining the current operation optimization as invalid optimization in a case where the optimization score is less than a preset score.

[0129] It should be noted that each of the above modules can be implemented by software or hardware, and for the latter, the following implementation manners can be used, but are not limited thereto: all of the modules are located in the same target processor; or each of the modules is located in a different target processor in an arbitrary combination.

[0130] Embodiments of the present application also provide a computer readable storage medium having a computer program stored therein, wherein the computer program is configured to execute the steps in any of the method embodiments described above when executed.

[0131] Embodiments of the present application also provide an electronic device including a target storage having a computer program stored therein and a target processor configured to execute the computer program to perform the steps in any of the method embodiments described above.

[0132] Embodiments of the present application also provide a computer program product including a computer program, wherein the computer program is executed by a processor to implement the steps in any of the method embodiments described above.

[0133] Embodiments of the present application also provide another computer program product including a non-volatile computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the steps in any of the method embodiments described above.

[0134] Embodiments of the present application also provide a computer program including computer instructions stored in a computer readable storage medium; a processor of a computer device reads the computer instructions from the computer readable storage medium, and executes the computer instructions to cause the computer device to perform the steps in any of the method embodiments described above.

[0135] The specific examples in the present embodiment can refer to the examples described in the above embodiments and example embodiments, which will not be described herein again.

[0136] Those skilled in the art will further realize that the mere concepts, teachings, examples, and steps described in the foregoing description are not meant to limit or restrict the scope of the present application in any way but are merely provided to illustrate the principles and concepts of the present application. Thus, the scope of the present application should not be limited to the specific examples described herein, but should be given the broadest possible scope commensurate with the principles and the novel features disclosed and taught herein.

[0137] It is apparent that those skilled in the art can make various modifications and improvements without departing from the scope of the present application. Therefore, the described embodiments are only for the purpose of illustration and are not intended to limit the present application. The present application should be limited only by the scope of the appended claims, and all modifications and improvements made within the scope of the present application are intended to be included therein.

[0138] The above provides a kind of system optimization method, device, equipment, storage medium and program provided by the present application in detail.The principle and implementation of the present application are described in this paper by applying specific examples, the above example is only for helping to understand the method of the present application and its core idea.It should be pointed out that, for the ordinary skilled in the art, under the premise of not departing from the principle of the present application, the present application can be improved and modified in several ways, and these improvements and modifications also fall within the scope of the claims of the present application.

Claims

1. A method of optimizing a system, characterized by, The method comprises the following steps: inputting a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, determining a target knowledge ontology based on a model output result and an output dimension requirement, wherein the preset fusion data model is a model for constructing the association relationship between a plurality of original data based on a diamond model template adjustment; processing the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, wherein the preset pruning strategy comprises at least one of the following: a white list pruning strategy, a divide-and-conquer pruning strategy; discriminating the plurality of operation behaviors to obtain an operation and maintenance analysis result of the cloud storage system; optimizing the operation of the cloud storage system according to the operation and maintenance analysis result; wherein the target knowledge ontology comprises at least one of the following: a space type knowledge ontology, a time type knowledge ontology; the space type knowledge ontology is used to record the component distribution between different physical components in the cloud storage system, the connection mode between servers and the data flow direction; the time type knowledge ontology is used to record the time sequence characteristics of a plurality of original data corresponding events and the association with other events; wherein the divide-and-conquer pruning strategy is used to divide the target knowledge ontology into a plurality of relatively independent sub-ontologies, and data retrieval analysis is performed in the sub-ontologies; the white list pruning strategy is used to pre-set a white list containing key entities and relationships according to the business requirements and historical experience of the cloud storage system, and only the part meeting the conditions is analyzed in depth during retrieval; wherein the model for constructing the association relationship between a plurality of original data based on the diamond model template adjustment comprises: using the asset graph and network topology between different physical components in the cloud storage system as the infrastructure in the diamond model template; using the professional knowledge in the operation and maintenance field as the function in the diamond model template; using the common faults and abnormal patterns of the cloud storage system as the opponent in the diamond model template; using the multi-dimensional data for tracking event processes as the victim in the diamond model template.

2. The optimization method of the system according to claim 1, characterized in that, Before inputting a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, the method further comprises: obtaining asset information of physical resources corresponding to the cloud storage system and topology information of network connection structure corresponding to the cloud storage system; determining infrastructure information in the diamond model template based on the asset information and the topology information.

3. The optimization method of the system according to claim 1, characterized in that, Before inputting a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, the method further comprises: obtaining professional operation and maintenance information of the cloud storage system recorded in the Internet, wherein the professional operation and maintenance information at least comprises: common faults and fault solving methods of the cloud storage system, abnormal patterns and abnormal solving methods of the cloud storage system; determining function information and opponent information in the diamond model template according to the professional operation and maintenance information.

4. The optimization method of the system according to claim 1, characterized in that, Before inputting a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, the method further comprises: in the case that an operation event occurs in the cloud storage system, obtaining multi-dimensional data of the operation event; Determine victim information in a diamond model template according to the multi-dimensional data.

5. The optimization method of the system according to claim 1, characterized in that, Determine a target knowledge ontology based on the model output result and the output dimension requirement, including: In the case that the output dimension requirement is a spatial dimension, determine a spatial connection relationship between different server components according to the server architecture and deployment relationship of the cloud storage system corresponding to the model output result; Determine a target knowledge ontology of the spatial class based on the spatial connection relationship; In the case that the output dimension requirement is a time dimension, determine a timestamp corresponding to different processes according to the event process of the cloud storage system corresponding to the model output result; Sort the different processes based on the timestamp to obtain a target knowledge ontology of the time class.

6. The optimization method of the system according to claim 1, characterized in that, Process the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, including: In the case that the preset pruning strategy is a whitelist pruning strategy, obtain a business requirement or an alarm standard set by an operation and maintenance object in the cloud storage system; Generate a target whitelist according to the business requirement or the alarm standard; Filter the target knowledge ontology carrying the event process based on the target whitelist; Determine a plurality of operation behaviors conforming to the target whitelist according to the filtering result.

7. The optimization method of the system according to claim 1, characterized in that, Process the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, including: In the case that the preset pruning strategy is a divide-and-conquer pruning strategy, determine a divide-and-conquer type corresponding to the divide-and-conquer pruning strategy; Segment the target knowledge ontology according to the divide-and-conquer type to obtain a plurality of sub-knowledge ontologies; Merge the plurality of sub-knowledge ontologies and determine a plurality of operation behaviors according to a merging result.

8. The optimization method of the system according to claim 1, characterized in that, Determine an operation and maintenance analysis result of the cloud storage system by discriminating the plurality of operation behaviors, including: Determine a target traceability subgraph corresponding to the plurality of operation behaviors; Discriminate the target traceability subgraph using a preset rule or a trained large language model; Determine different behavior classifications corresponding to the plurality of operation behaviors according to a discrimination result, wherein the different behavior classifications at least include one of the following: a legal behavior, a false positive behavior, an unknown abnormal behavior, and a known abnormal behavior; Artificially confirm the different behavior classifications and determine an operation and maintenance analysis result of the cloud storage system according to a confirmation result.

9. The optimization method of the system according to claim 1, characterized in that, Optimize the operation of the cloud storage system according to the operation and maintenance analysis result, including: Optimize a first type of operation behavior corresponding to a known abnormal behavior in the operation and maintenance analysis result through a preset abnormal handling process, wherein the preset abnormal handling process is associated with the cloud storage system and is used to control the repeated occurrence of the known abnormal behavior in the cloud storage system; Optimize a second type of operation behavior corresponding to an unknown abnormal behavior in the operation and maintenance analysis result through an expert customization process, wherein the expert customization process is used to control a target solution developed by an expert artificial judgment system environment and system historical data; Optimize a third type of operation behavior corresponding to a legal behavior in the operation and maintenance analysis result through a recording and learning process, wherein the recording and learning process is used to record and learn the content and execution process of the legal behavior.

10. The optimization method of the system according to claim 9, characterized in that, After the operation optimization of the cloud storage system according to the operation and maintenance analysis result, the method further comprises: statistically obtaining new knowledge content in the operation optimization; using the corresponding backfeeding data of the new knowledge content to adjust the parameter relationship of the preset fusion data model.

11. The optimization method of the system according to claim 1, characterized in that, After the operation optimization of the cloud storage system according to the operation and maintenance analysis result, the method further comprises: updating the access control rules of the cloud storage system, the asset list corresponding to the cloud storage system, and the network topology information corresponding to the cloud storage system according to the optimization result of the operation optimization; adjusting multiple data transmission paths in the cloud storage system based on the access control rules, the asset list, and the network topology information.

12. The optimization method of the system according to claim 1, characterized in that, After the operation optimization of the cloud storage system according to the operation and maintenance analysis result, the method further comprises: determining the optimization duration of the cloud storage system for performing the operation optimization; in the case where the optimization duration is greater than a preset duration, sending maintenance alarm information to the operation and maintenance object of the cloud storage system; in the case where the optimization duration is less than or equal to a preset duration, sending maintenance normal information to the operation and maintenance object of the cloud storage system.

13. The optimization method of the system according to claim 12, characterized in that, After the maintenance alarm information is sent to the operation and maintenance object of the cloud storage system in the case where the optimization duration is greater than a preset duration, the method further comprises: determining the number of occurrences of the maintenance alarm information in a target operation period; in the case where the number of occurrences is greater than a preset number, determining that the cloud storage system needs to adjust the optimization strategy of the operation optimization; in the case where the number of occurrences is less than or equal to a preset number, determining that the cloud storage system does not need to adjust the optimization strategy of the operation optimization.

14. The optimization method of the system according to claim 13, characterized in that, After it is determined that the cloud storage system needs to adjust the optimization strategy of the operation optimization in the case where the number of occurrences is greater than a preset number, the method further comprises: determining multiple processes corresponding to the operation optimization; obtaining the use priority corresponding to each of the multiple processes; in the case where the target use priority of an artificial process is a non-highest priority, adjusting the priority of the artificial process to a highest execution priority.

15. The optimization method of the system according to claim 1, characterized in that, After the operation optimization of the cloud storage system according to the operation and maintenance analysis result, the method further comprises: obtaining the historical operation and maintenance period of the cloud storage system; determining a target operation and maintenance period corresponding to the operation optimization; in the case where the historical operation and maintenance period is greater than or equal to the target operation and maintenance period, recording the current operation optimization as an optimization reference of the cloud storage system.

16. The method of optimization of the system of claim 1, characterized in that, After the operation optimization of the cloud storage system according to the operation and maintenance analysis result, the method further comprises: obtaining feedback information of the operation and maintenance object of the cloud storage system on the operation optimization; generating an optimization score of the operation optimization according to the feedback information; in the case where the optimization score is less than a preset score, determining the current operation optimization as an invalid optimization.

17. An optimization apparatus of a system, characterized by comprising: comprises: The first determining module is configured to input a plurality of original data in a cloud storage system in an operation and maintenance state into a preset fusion data model, and determine a target knowledge ontology based on a model output result and an output dimension requirement, wherein the preset fusion data model is a model for constructing an association relationship between the plurality of original data based on a diamond model template adjustment. The processing module is configured to process the target knowledge ontology according to a preset pruning strategy to obtain a plurality of operation behaviors, wherein the preset pruning strategy includes at least one of a white list pruning strategy and a divide-and-conquer pruning strategy. The discrimination module is configured to discriminate the plurality of operation behaviors to obtain an operation and maintenance analysis result of the cloud storage system. The optimization module is configured to perform operation optimization on the cloud storage system according to the operation and maintenance analysis result, wherein the target knowledge ontology includes at least one of a space type knowledge ontology and a time type knowledge ontology, the space type knowledge ontology is used to record component distribution between different physical components in the cloud storage system, connection modes between servers, and data flow directions, and the time type knowledge ontology is used to record time sequence characteristics of a plurality of original data corresponding events and association with other events. The divide-and-conquer pruning strategy is used to divide the target knowledge ontology into a plurality of relatively independent sub-ontologies, and data retrieval analysis is performed in the sub-ontologies, and the white list pruning strategy is used to pre-set a white list containing key entities and relationships according to business requirements and historical experience of the cloud storage system, and only parts meeting the conditions are analyzed in depth during retrieval. The model for constructing the association relationship between the plurality of original data based on the diamond model template adjustment includes: using an asset graph and a network topology between different physical components in the cloud storage system as infrastructure in the diamond model template, using professional knowledge in the operation and maintenance field as function in the diamond model template, using common faults and abnormal patterns of the cloud storage system as opponents in the diamond model template, and using multi-dimensional data for tracking event processes as victims in the diamond model template.

18. An electronic device, comprising: The system comprises: a memory configured to store a computer program; a processor configured to execute the computer program to implement the steps of the optimization method of the system as claimed in any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program is executed by the processor to implement the steps of the optimization method of the system as claimed in any one of claims 1 to 16.

20. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the optimization method of the system as claimed in any one of claims 1 to 16.

Images