Intelligent log assertion reasoning method and system driven by knowledge graph

Abstract

The application provides a knowledge graph driven intelligent log assertion reasoning method and system, relates to the technical field of log reasoning, comprises segment processing and semantic analysis on heterogeneous log data, constructs a knowledge graph space and establishes a time sequence and a cause-effect relationship between log event nodes, adopts a multi-hop reasoning mechanism to generate a fault diagnosis report and a processing suggestion, and realizes an automatically optimized operation and maintenance knowledge rule set. The application can improve fault diagnosis accuracy, shorten fault processing time, and realize intelligent operation and maintenance management.

Description

Technical Field

[0001] This invention relates to log reasoning technology, and more particularly to a knowledge graph-driven intelligent log assertion reasoning method and system. Background Technology

[0002] As information systems grow in scale and complexity, log data, as a crucial record of system operational status, becomes increasingly important for analysis and processing. In large-scale distributed systems, various servers, applications, and network devices generate massive amounts of heterogeneous log data. This data contains critical information about system operation and is invaluable for fault diagnosis, performance optimization, and security protection. Traditional log analysis methods rely primarily on human experience and simple rule matching, which are insufficient to address the operational challenges of today's complex IT environments. In recent years, with the development of artificial intelligence technology, machine learning-based log analysis methods have been widely applied, but they still suffer from insufficient knowledge representation and limited reasoning capabilities. Knowledge graphs, as a structured knowledge representation method, can effectively describe complex relationships between entities, providing new ideas and methods for intelligent log analysis.

[0003] However, existing log analysis technologies still have the following shortcomings and deficiencies: First, existing log analysis methods have limited semantic understanding capabilities for heterogeneous log data, making it difficult to accurately extract key information from logs and establish correlations between log events, resulting in inaccurate or incomplete analysis results. Second, traditional rule base management methods lack dynamic optimization mechanisms, failing to automatically adjust rule weights and priorities according to actual application scenarios, leading to rule base redundancy and low rule application efficiency. Finally, existing fault diagnosis systems mostly employ a single reasoning approach, making it difficult to handle complex reasoning tasks involving multiple steps and paths. They lack adaptability to scenarios requiring the integration of multiple information sources for decision-making and cannot effectively utilize historical experience knowledge for case reasoning and solution optimization. Summary of the Invention

[0004] This invention provides a knowledge graph-driven intelligent log assertion reasoning method and system, which can solve the problems in the prior art.

[0005] A first aspect of this invention provides a knowledge graph-driven intelligent log assertion reasoning method, comprising:

[0006] Obtain heterogeneous log data to be analyzed, segment the heterogeneous log data according to a preset time window to obtain multiple log data fragments; perform semantic parsing and structured processing on the log data fragments to construct log semantic vectors;

[0007] The log semantic vectors are mapped to a knowledge graph space, and the temporal and causal relationships between log event nodes are established based on the log semantic vectors. Weights are assigned based on the degree of association between nodes in the knowledge graph space, and an operation and maintenance knowledge rule set is constructed according to the weight assignment results. The rules in the operation and maintenance knowledge rule set are distributed and stored, and are updated and optimized in real time based on the usage frequency and accuracy of the rules.

[0008] A multi-hop reasoning mechanism is used to traverse paths in the knowledge graph space. Based on the reasoning results of the multi-hop reasoning mechanism, a fault diagnosis report and processing suggestions are generated. The fault diagnosis report and processing suggestions are matched with the historical case database for similarity. Based on the similarity matching results, the optimal processing solution is determined. Based on the execution results of the optimal processing solution, the knowledge graph space is dynamically updated to improve the set of operation and maintenance knowledge rules.

[0009] The heterogeneous log data is segmented according to a preset time window to obtain multiple log data fragments; semantic parsing and structuring are performed on the log data fragments to construct log semantic vectors, including:

[0010] Calculate the time interval between adjacent log events in heterogeneous log data, calculate the time window size based on the average and standard deviation of the time interval, and segment the heterogeneous log data according to the time window size to obtain multiple log data fragments;

[0011] Semantic parsing is performed on the log data fragments to construct a multi-level causal graph, and a vertical correlation matrix is ​​constructed based on the association relationships between nodes in the multi-level causal graph.

[0012] Based on the vertical correlation matrix, the log data fragment is subjected to time-series feature extraction to obtain a time-series feature vector. The causal correlation vector of the log data fragment is extracted from the multi-level causal graph. The time-series feature vector and the causal correlation vector are dynamically weighted to obtain an attention weight vector.

[0013] The temporal feature vector and the causal correlation vector are weighted and combined, and the result of the weighted combination is fused with the attention weight vector to construct the semantic vector of the log data fragment.

[0014] The log semantic vectors are mapped to a knowledge graph space, and temporal and causal relationships between log event nodes are established based on the log semantic vectors. Weights are assigned based on the degree of association between nodes in the knowledge graph space, and a set of operation and maintenance knowledge rules is constructed based on the results of the weight assignment, including:

[0015] Log semantic vectors are mapped to a knowledge graph space to obtain a knowledge representation. A probabilistic causal graph is constructed based on the knowledge representation. The probabilistic causal graph includes log event nodes and relation edges. The conditional probability between the log event node and its parent node is calculated to obtain the conditional dependency relationship. The causal strength between the log event nodes is calculated based on the partial derivative of the conditional dependency relationship and the conditional probability.

[0016] Based on the conditional dependency and the causal strength, the conditional probability distribution between log event nodes at adjacent time points is calculated using the probabilistic causal graph. The causal association strength is calculated based on the causal strength. The temporal association strength is calculated based on the conditional probability distribution. The degree of association between the log event nodes is obtained by performing feature interaction on the causal association strength and the temporal association strength through a self-attention mechanism.

[0017] An initial weight is calculated based on the degree of correlation. The initial weight and the historical weight are then used to perform feature interaction on the self-attention mechanism to obtain the final weight. Triggering conditions are set according to the degree of correlation, and execution actions are set according to the final weight. A set of operation and maintenance knowledge rules is then constructed based on the triggering conditions and the execution actions.

[0018] A multi-hop reasoning mechanism is used to traverse paths in the knowledge graph space. Based on the reasoning results of the multi-hop reasoning mechanism, a fault diagnosis report and processing suggestions are generated, including:

[0019] The multi-hop reasoning mechanism is used to perform iterative path traversal in the knowledge graph space. Each hop traversal is based on the current event node to predict the set of event nodes to be reached by the next hop. The migration probability of each event node in the event node set is calculated. The event nodes are filtered according to the migration probability to obtain candidate event nodes. The candidate event nodes are used as the starting nodes of the next hop to continue the path traversal until the traversal depth reaches a preset traversal threshold to obtain multiple candidate paths.

[0020] A deep residual network is constructed for the causal strength of adjacent event nodes in multiple candidate paths, and the cumulative causal strength is obtained by feature extraction and propagation of the causal strength using the deep residual network.

[0021] Based on the cumulative causal strength, the deep residual network is used to extract path similarity features and conflict features between the candidate paths to obtain a path conflict index. The cumulative causal strength and the path conflict index are input into the deep residual network for feature fusion to obtain a fault location index. The optimal path is determined based on the fault location index. A fault diagnosis report and processing suggestions are generated based on the optimal path and the historical processing experience base.

[0022] Based on the migration probability, event nodes are filtered to obtain candidate event nodes. These candidate event nodes are then used as the starting nodes for the next hop, and path traversal continues until the traversal depth reaches a preset traversal threshold, resulting in multiple candidate paths, including:

[0023] In the knowledge graph space, the neighboring nodes of the current event node are obtained as next-hop candidate nodes. The attention score is obtained by calculating the dot product of the query vector of the current event node and the key value vector of the next-hop candidate node using the feature mapping matrix. The attention score is then normalized to obtain the transfer probability.

[0024] The migration probability is compared with an adaptive filtering threshold, and next-hop candidate nodes with migration probabilities greater than the adaptive filtering threshold are selected as candidate event nodes.

[0025] The candidate event node is used as the new current event node. Based on the feature mapping matrix, the migration probability calculation and candidate event node screening are repeatedly performed. The candidate event node of each hop is recorded to form a traversal path. When the depth of the traversal path reaches a preset traversal depth threshold, the traversal stops, and multiple traversal paths are obtained as candidate paths.

[0026] The fault diagnosis report and the handling suggestions are matched with a historical case database for similarity. The optimal handling solution is determined based on the similarity matching results, including:

[0027] A multidimensional feature vector of a fault case is constructed, and a graph attention network is used to model the feature interaction of the multidimensional feature vector. The node similarity and edge weight between the fault diagnosis report and the case in the historical case library are calculated through the graph attention layer. The comprehensive similarity is obtained by weighted fusion of the node similarity and the edge weight.

[0028] The graph attention network is used to perform relational reasoning on the features of the fault diagnosis report, calculate the correlation strength between the current fault and historical cases, and filter out historical cases related to the current fault based on the correlation strength;

[0029] Candidate solutions exceeding a preset similarity threshold are matched with the historical cases. The graph attention network is used to calculate the difference in node representations between the adopted and unadopted candidate solutions to obtain the solution influence degree. The graph attention network is then used to fuse the comprehensive similarity, the solution influence degree, and their corresponding balance factors to obtain the reliability score of the candidate solution.

[0030] The candidate solutions are sorted in descending order based on the reliability score, and the candidate solution with the highest reliability score is selected as the initial optimal solution. The final fault handling solution is generated by combining the processing details in the historical cases corresponding to the initial optimal solution.

[0031] Based on the execution result of the optimal processing scheme, the knowledge graph space is dynamically updated, and the set of operation and maintenance knowledge rules is improved, including:

[0032] The execution result of the optimal processing scheme is subjected to feature extraction to obtain the result feature vector, and the association strength with the existing nodes in the knowledge graph space is calculated based on the result feature vector;

[0033] The nodes in the knowledge graph space are subjected to feature aggregation, the aggregation weight of the new knowledge is determined based on the association strength, and the new knowledge in the execution result is updated to the corresponding node in the knowledge graph space according to the aggregation weight.

[0034] The application effect of the newly added knowledge in the knowledge graph space is tracked, the credibility index of the newly added knowledge is calculated, the weight of the corresponding node in the knowledge graph space is adjusted based on the credibility index, and the relevant operation and maintenance knowledge rules are improved.

[0035] A second aspect of this invention provides a knowledge graph-driven intelligent log assertion reasoning system, comprising:

[0036] The first unit is used to acquire heterogeneous log data to be analyzed, segment the heterogeneous log data according to a preset time window to obtain multiple log data fragments, and perform semantic parsing and structured processing on the log data fragments to construct log semantic vectors.

[0037] The second unit is used to map the log semantic vector to a knowledge graph space, establish temporal and causal relationships between log event nodes based on the log semantic vector, assign weights based on the degree of association of nodes in the knowledge graph space, construct an operation and maintenance knowledge rule set according to the result of the weight assignment, distribute and store the rules in the operation and maintenance knowledge rule set, and update and optimize them in real time based on the usage frequency and accuracy of the rules.

[0038] The third unit is used to perform path traversal on the knowledge graph space using a multi-hop reasoning mechanism, generate a fault diagnosis report and processing suggestions based on the reasoning results of the multi-hop reasoning mechanism, perform similarity matching between the fault diagnosis report and the processing suggestions and the historical case library, determine the optimal processing solution based on the similarity matching results, and dynamically update the knowledge graph space based on the execution results of the optimal processing solution to improve the set of operation and maintenance knowledge rules.

[0039] A third aspect of the present invention provides an electronic device, comprising:

[0040] processor;

[0041] Memory used to store processor-executable instructions;

[0042] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0043] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0044] The beneficial effects of this application are as follows:

[0045] This invention utilizes a knowledge graph-driven intelligent log assertion reasoning method to achieve intelligent analysis and processing of heterogeneous log data, thereby improving the accuracy and efficiency of fault diagnosis.

[0046] This invention employs a multi-hop reasoning mechanism to traverse paths in the knowledge graph space, enabling the discovery of deep-seated fault correlations. It also combines this with a historical case database for similarity matching, providing maintenance personnel with more accurate fault diagnosis reports and handling suggestions, thus reducing the need for manual intervention.

[0047] The knowledge graph constructed by this invention can be dynamically updated and optimized according to the actual operation and maintenance situation. Through continuous improvement of the set of operation and maintenance knowledge rules, the system's diagnostic capabilities will continue to improve with the increase of usage time, and it has good adaptability and scalability. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating the knowledge graph-driven intelligent log assertion reasoning method according to an embodiment of the present invention.

[0049] Figure 2 This is a flowchart illustrating the construction process of semantic vectors for heterogeneous log data in an embodiment of the present invention.

[0050] Figure 3 This is a flowchart of the event node filtering process based on the attention mechanism in an embodiment of the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0053] Figure 1 This is a flowchart illustrating the knowledge graph-driven intelligent log assertion reasoning method according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0054] Obtain heterogeneous log data to be analyzed, segment the heterogeneous log data according to a preset time window to obtain multiple log data fragments; perform semantic parsing and structured processing on the log data fragments to construct log semantic vectors;

[0055] The log semantic vectors are mapped to a knowledge graph space, and the temporal and causal relationships between log event nodes are established based on the log semantic vectors. Weights are assigned based on the degree of association between nodes in the knowledge graph space, and an operation and maintenance knowledge rule set is constructed according to the weight assignment results. The rules in the operation and maintenance knowledge rule set are distributed and stored, and are updated and optimized in real time based on the usage frequency and accuracy of the rules.

[0056] A multi-hop reasoning mechanism is used to traverse paths in the knowledge graph space. Based on the reasoning results of the multi-hop reasoning mechanism, a fault diagnosis report and processing suggestions are generated. The fault diagnosis report and processing suggestions are matched with the historical case database for similarity. Based on the similarity matching results, the optimal processing solution is determined. Based on the execution results of the optimal processing solution, the knowledge graph space is dynamically updated to improve the set of operation and maintenance knowledge rules.

[0057] In one optional implementation, the heterogeneous log data is segmented according to a preset time window to obtain multiple log data fragments; semantic parsing and structuring are performed on the log data fragments to construct log semantic vectors, including:

[0058] Calculate the time interval between adjacent log events in heterogeneous log data, calculate the time window size based on the average and standard deviation of the time interval, and segment the heterogeneous log data according to the time window size to obtain multiple log data fragments;

[0059] Semantic parsing is performed on the log data fragments to construct a multi-level causal graph, and a vertical correlation matrix is ​​constructed based on the association relationships between nodes in the multi-level causal graph.

[0060] Based on the vertical correlation matrix, the log data fragment is subjected to time-series feature extraction to obtain a time-series feature vector. The causal correlation vector of the log data fragment is extracted from the multi-level causal graph. The time-series feature vector and the causal correlation vector are dynamically weighted to obtain an attention weight vector.

[0061] The temporal feature vector and the causal correlation vector are weighted and combined, and the result of the weighted combination is fused with the attention weight vector to construct the semantic vector of the log data fragment.

[0062] like Figure 2 As shown, the method includes:

[0063] Collect heterogeneous log data from different systems and devices. Configure a log collector to collect logs from different systems such as application servers, database servers, and network devices. Set the collection period to 5 minutes to ensure the timeliness of log data. Use a secure transmission protocol to transmit the collected log data to the central processing server. Perform integrity verification on the received log data and remove corrupt or incomplete log records. Examples of collected heterogeneous log data include: application server log "2023-06-15 08:32:15 [INFO] Transaction processed successfully, id=TX1001"; database log "2023-06-15 08:32:16.253-DB01-Query execution time:235ms, SQL: SELECT * FROM users WHERE id=10086"; network device log "Jun15 08:32:17 WARNLINK-DOWN: Interface GE1 / 0 / 1 is down, reason: signal loss".

[0064] The collected heterogeneous log data is preprocessed, parsing timestamps of different formats. For example, "2023-06-15 08:32:15" in the application server log is converted to the standard format "2023-06-15 08:32:15.000". The year (current year) is extracted from "Jun15 08:32:17" in the network device log and converted to "2023-06-15 08:32:17.000". Log level information, such as "INFO" and "WARN", is extracted, and case-sensitive and normalized. The logs are categorized into four levels: "INFO", "WARNING", "ERROR", and "DEBUG". Source information, such as application server identifier, database instance name, and network device name, is separated. The log content is cleaned by removing special characters and escape sequences, and replacing extra spaces with single spaces. Regular expressions are used to extract structured information, such as transaction ID, SQL statements, and interface names. The processed logs are then converted to a unified JSON format, including fields such as timestamp, level, source, content, and extracted structured information.

[0065] Calculate the time interval between adjacent log events in heterogeneous log data. Sort all preprocessed logs by timestamp from earliest to latest. Traverse the sorted log list. For the log at position i, calculate the difference between its timestamp and the timestamp of the log at position i-1, in milliseconds. Record the time difference for each pair of adjacent logs to form a time interval array. For the first log, which has no preceding logs, set the time interval to 0. Handle special cases, such as timestamp backwards (due to clock synchronization issues), by adjusting negative time intervals to 0. For the first 10 sorted logs, the calculated time intervals are [0, 1253, 127, 356, 189, 452, 278, 312, 195, 501] milliseconds.

[0066] The time window size is calculated based on the average and standard deviation of the time intervals. The sum of all values ​​in the time interval array is calculated, which is 3663 milliseconds in this example. Divide by the array length (10) to get the average value, which is 366.3 milliseconds. The difference between each time interval and the average value is calculated, resulting in [0-366.3,1253-366.3,127-366.3,...], i.e., [-366.3,886.7,-239.3,...]. The squares of these differences are calculated, resulting in [134185.69,786256.89,57264.49,...]. The average of the squared values ​​is calculated to get the variance. The square root of the variance is taken to get the standard deviation, which is 340.5 milliseconds in this example. The time window size is set to the average value plus twice the standard deviation, i.e., 366.3 + 2 × 340.5 = 1047.3 milliseconds, which is about 1 second.

[0067] Heterogeneous log data is segmented according to the calculated time window size to determine the time range, starting from the timestamp of the first log and ending with the timestamp of the last log. The time range is divided into multiple consecutive time periods according to the calculated 1-second window size. For each time period, all logs whose timestamps fall within that period are selected to form a log data segment. A unique identifier is assigned to each log data segment in the format "SEGMENT-YYYYMMDD-HHMMSS-Sequence Number". Meta-information of each segment is recorded, including time range, number of log entries, log level distribution, etc. After segmentation, the resulting log fragments are as follows: Fragment 1 (SEGMENT-20230615-083215-001) contains 8 log entries, with a time range from "2023-06-15 08:32:15.000" to "2023-06-15 08:32:15.999"; Fragment 2 (SEGMENT-20230615-083216-001) contains 6 log entries, with a time range from "2023-06-15 08:32:16.000" to "2023-06-15 08:32:16.999".

[0068] Semantic parsing is performed on log data fragments. Natural language processing techniques are applied to each log entry, using a pre-trained language model for word segmentation, part-of-speech tagging, and dependency parsing. Key entities in the logs are identified, such as device identifiers ("DB01"), operation objects ("Transaction", "InterfaceGE1 / 0 / 1"), and parameter values ​​("235ms", "TX1001"). Action information, such as "processed", "execution", and "down", is extracted, and the type and status of the action (success, failure, warning, etc.) are marked. Numerical information in the logs, such as time values, ID values, and error codes, is identified. The semantic structure of the logs is constructed, including elements such as subject (who), action (what to do), object (to what), result (how), and time (when). For each log fragment, the semantic structure of all logs within it is summarized to form a fragment-level semantic understanding. For a log entry in segment 1, "2023-06-15 08:32:15 [INFO] Transaction processed successfully, id=TX1001", the semantic parsing result is: Subject="System", Action="Processing", Object="Transaction", Result="Success", Parameter="id=TX1001", Time="2023-06-15 08:32:15", Level="INFO".

[0069] Construct a multi-level causal graph, defining its hierarchical structure, typically containing 3-4 levels, from bottom-level specific events to top-level system states; create bottom-level nodes, each corresponding to a specific log event, such as "Transaction TX1001 processed successfully," "Database query execution time 235ms," "Interface GE1 / 0 / 1 disconnected," etc.; create intermediate-level nodes, representing event groups or subsystem states, such as "Transaction processing flow," "Database performance," "Network connection status," etc.; create top-level nodes, representing system-level states or results, such as "System performance degradation," "Service interruption," "Normal operation," etc.; establish horizontal connections between nodes based on temporal relationships, if event A precedes event B in time and a causal relationship exists, then an edge is established from A to B; establish vertical connections between nodes based on domain knowledge, connecting bottom-level event nodes with relevant intermediate-level nodes, and connecting intermediate-level nodes with relevant top-level nodes; assign weights to each edge, representing the strength of the causal relationship, with weights ranging from [0,1], where larger values ​​indicate stronger relationships.

[0070] A vertical association matrix is ​​constructed based on the relationships between nodes in a multi-level causal graph. An empty matrix is ​​created, where rows represent lower-level nodes and columns represent upper-level nodes. For each lower-level node i and upper-level node j, a direct connection from i to j is checked. If a connection exists, the association strength between nodes is calculated, considering the following factors: temporal proximity (the proximity of the events occurring at different times), with a smaller time difference indicating a stronger association; semantic similarity (the similarity of the event content), calculated using a pre-trained language model to calculate the cosine similarity of the text embedding vectors; and domain knowledge (prior association strength defined based on expert experience), obtained by querying a predefined association rule base. The calculated association strength is then filled into the matrix position (i,j). If no connection exists, the matrix position (i,j) is filled with 0. For the vertical association matrix (partial) constructed in segment 1, the bottom-level nodes are ["TransactionTX1001 processed successfully", "Database query executed 235ms", "Interface GE1 / 0 / 1 disconnected"], the columns are the middle-level nodes ["Transaction processing flow", "Database performance", "Network connection status"], and the matrix values ​​are [[0.9,0.3,0.0],[0.7,0.8,0.0],[0.0,0.0,0.95]].

[0071] Based on the vertical correlation matrix, time-series features are extracted from log data fragments. Events in the log fragments are sorted by timestamps to form an event sequence. Time interval features between events are calculated, including minimum interval, maximum interval, average interval, and standard deviation. The distribution of different levels of logs in the log fragments is statistically analyzed, such as the proportion of INFO, WARNING, and ERROR. The frequency of specific types of events is calculated, such as the number of transactions per second and the number of errors per minute. Patterns in the event sequence are identified, such as "event B frequently occurs after event A" and "events C and D always occur in pairs". A sliding window (window size is 1 / 3 of the fragment size, and step size is 1 / 2 of the window size) is applied to calculate local time-series features. The entropy value of the event sequence is extracted to reflect the complexity and uncertainty of the sequence. Combining the above features, a 64-dimensional time-series feature vector is constructed. For segment 1, the extracted time-series feature vector (partial) is [0.235, 0.128, 0.375, 0.0, 0.42, 0.0, 0.75, 0.5, 0.25, 0.0, ...], which represent the average time interval (seconds), the standard deviation of the time interval, the maximum time interval, the proportion of error events, the proportion of INFO level events, the proportion of WARNING level events, the proportion of transaction events, the proportion of database events, the proportion of network events, and the proportion of system events, respectively.

[0072] The causal relationship vectors of log data segments are extracted from the multi-level causal graph. The direct causal strength of each pair of events (A, B) in the segment is calculated. If there is an edge from A to B, the strength is the edge weight; otherwise, it is 0. The in-degree (number of edges pointing to the node) and out-degree (number of edges originating from the node) of each event node in the segment are calculated. The degree centrality of the node is calculated, which is equal to the sum of the in-degree and out-degree divided by twice the total number of nodes. The proximity centrality of the node is calculated, which is the reciprocal of the average shortest path length from the node to all other nodes. The betweenness centrality of the node is calculated, which is the number of times the node appears in the shortest path between all pairs of nodes. Global features of the graph, such as average path length and clustering coefficient, are calculated. These features are integrated to construct a 48-dimensional causal relationship vector. For segment 1, the extracted causal association vector (partial) is [0.8,0.65,0.9,0.2,0.75,0.3,0.45,0.6,0.15,0.83,...], which represent the average direct causal strength, the minimum causal strength between event pairs, the maximum causal strength between event pairs, the average out-degree of ERROR-level events, the average in-degree of INFO-level events, the average degree centrality of nodes, the maximum degree centrality, the average proximity centrality, the average betweenness centrality, and the graph density, respectively.

[0073] Dynamic weight allocation is performed on the temporal feature vector and causal association vector. The 64-dimensional temporal feature vector and the 48-dimensional causal association vector are concatenated to form a 112-dimensional combined feature vector. A self-attention mechanism is constructed, including a query transformation matrix, a key transformation matrix, and a value transformation matrix, all with dimensions of 112×64. The combined feature vector is converted into a query vector with a dimension of 64 through the query transformation matrix. The combined feature vector is converted into a key vector with a dimension of 64 through the key transformation matrix. The dot product of the query vector and the key vector is calculated to obtain the attention score. The attention score is divided by 8 (the square root of the vector dimension 64) to reduce its value. The softmax function is applied to the scaled attention score to obtain normalized attention weights. It is ensured that the sum of all weights is 1, and each weight value reflects the importance of the corresponding feature. For segment 1, the calculated attention weight vector (partial) is [0.03,0.02,0.05,0.01,0.06,0.02,0.04,0.05,0.01,0.07,...], and the sum of all 112 weight values ​​is 1.

[0074] The temporal feature vector and causal correlation vector are weighted and combined, and the 64-dimensional temporal feature vector and the 48-dimensional causal correlation vector are concatenated to form a 112-dimensional combined feature vector. The 112-dimensional attention weight vector is then multiplied element-wise with the combined feature vector, that is, each feature value is multiplied by its corresponding attention weight. The weighted feature vector is then calculated, and the dimension remains 112. For segment 1, the partial result after weighted combination is [0.03×0.235=0.00705,0.02×0.128=0.00256,0.05×0.375=0.01875,0.01×0.0=0.0,0.06×0.42=0.0252,...].

[0075] The weighted combination result is fused with the attention weight vector to construct the semantic vector of the log data fragment. A three-layer perceptron network is constructed with 112×2=224 nodes in the input layer (concatenation of the weighted feature vector and the attention weight vector), 256 and 192 nodes in the hidden layers, and 128 nodes in the output layer. The activation function is ReLU, i.e., max(0,x). The input is nonlinearly transformed, resulting in a 256-dimensional intermediate representation after passing through the first layer. Batch normalization is applied to normalize the feature values ​​to a distribution with a mean of 0 and a variance of 1. After passing through the second layer, a 192-dimensional intermediate representation is obtained. Batch normalization is applied again. A residual connection is added to add the input of the first layer to the output of the second layer (the dimension matching needs to be adjusted through linear transformation). After passing through the output layer, a 128-dimensional log semantic vector is obtained. The output vector is L2 normalized to make the Euclidean norm of the vector 1. For segment 1, the generated 128-dimensional log semantic vector (partial) is [0.152,-0.237,0.428,0.015,-0.356,0.073,0.291,-0.105,0.468,-0.224,...].

[0076] In one optional implementation, the log semantic vector is mapped to a knowledge graph space, and temporal and causal relationships between log event nodes are established based on the log semantic vector; weights are assigned based on the degree of association between nodes in the knowledge graph space, and a set of operation and maintenance knowledge rules is constructed based on the results of the weight assignment, including:

[0077] Log semantic vectors are mapped to a knowledge graph space to obtain a knowledge representation. A probabilistic causal graph is constructed based on the knowledge representation. The probabilistic causal graph includes log event nodes and relation edges. The conditional probability between the log event node and its parent node is calculated to obtain the conditional dependency relationship. The causal strength between the log event nodes is calculated based on the partial derivative of the conditional dependency relationship and the conditional probability.

[0078] Based on the conditional dependency and the causal strength, the conditional probability distribution between log event nodes at adjacent time points is calculated using the probabilistic causal graph. The causal association strength is calculated based on the causal strength. The temporal association strength is calculated based on the conditional probability distribution. The degree of association between the log event nodes is obtained by performing feature interaction on the causal association strength and the temporal association strength through a self-attention mechanism.

[0079] An initial weight is calculated based on the degree of correlation. The initial weight and the historical weight are then used to perform feature interaction on the self-attention mechanism to obtain the final weight. Triggering conditions are set according to the degree of correlation, and execution actions are set according to the final weight. A set of operation and maintenance knowledge rules is then constructed based on the triggering conditions and the execution actions.

[0080] A large amount of IT system operation logs, including application logs, system logs, and network logs, are collected in advance. The collected logs are preprocessed, including log parsing, field extraction, and time normalization. For structured logs, field information is directly extracted; for unstructured logs, regular expressions or deep learning methods are used for log parsing to extract key information. For example, from the original log "2023-05-15 08:23:45.123 ERROR [Thread-5] Connection refused: database connection pool exhausted", the timestamp "2023-05-15 08:23:45.123", log level "ERROR", thread information "Thread-5", and log content "Connection refused: database connection pool exhausted" are extracted.

[0081] The preprocessed log content is semantically vectorized. A pre-trained language model is used to convert the log text into a high-dimensional semantic vector. The BERT model is then used to encode the log text, and the average value of the last hidden state is obtained as the log semantic vector. The log semantic vector has 768 dimensions, representing the semantic information of the log content. Taking the above log as an example, some semantic vector values ​​obtained after BERT encoding are [0.235, -0.156, 0.421, ..., 0.187]. To improve efficiency, principal component analysis is used to reduce the 768-dimensional vector to 128 dimensions, resulting in a compressed log semantic vector [0.315, 0.246, -0.187, ..., 0.209].

[0082] Log semantic vectors are mapped to a knowledge graph space to obtain a knowledge representation. The knowledge graph space is a pre-built domain knowledge base containing entities such as IT system components, states, and events, as well as their relationships. The process involves mapping log semantic vectors to the knowledge graph space, calculating the similarity between the log semantic vectors and existing nodes in the knowledge graph, and using cosine distance as the measure of similarity. The top K nodes with the highest similarity are selected as candidate mapping nodes, with K set to 5. If the highest similarity exceeds a threshold (set to 0.85), the log is mapped to that node; otherwise, a new node is created. For the log showing database connection pool exhaustion, its semantic vector has a similarity of 0.92 with the "database connection error" node in the knowledge graph, exceeding the threshold, therefore it is mapped to that node.

[0083] Probabilistic causal graphs are constructed based on knowledge representation. A probabilistic causal graph is a directed graph structure where nodes represent log events and edges represent causal or temporal relationships between events. The steps for constructing a probabilistic causal graph are: sorting the mapped log event nodes by timestamp; grouping log events with similar times based on a time window (set to 10 minutes); establishing initial causal relationships for each group of log events based on prior knowledge and statistical rules; and optimizing the causal structure using a causal discovery algorithm. In practical applications, a typical probabilistic causal graph includes nodes such as "high CPU utilization," "insufficient memory," "database connection errors," and "slow application response," as well as the causal edges between them.

[0084] Conditional dependencies are derived by calculating the conditional probabilities between log event nodes and their parent nodes. For each node in the probabilistic causal graph, the conditional probability of its occurrence under different parent node states is calculated, and the frequency of occurrence of a node and its parent node is statistically analyzed from historical log data. The conditional probability of a node under a given parent node state is then calculated. Taking the "Slow Application Response" node as an example, its parent nodes are "High CPU Utilization" and "Database Connection Error". The statistics show that: when both "High CPU Utilization" and "Database Connection Error" exist, the conditional probability of "Slow Application Response" is 0.95; when only "High CPU Utilization" exists, the conditional probability is 0.75; when only "Database Connection Error" exists, the conditional probability is 0.85; and when neither parent node exists, the conditional probability is 0.05.

[0085] The causal strength between log event nodes is calculated based on the partial derivatives of conditional dependencies and conditional probabilities. Causal strength represents the degree of influence of one event on another, with a value range of [0,1]. To calculate causal strength, the partial derivative of the conditional probability with respect to the parent node's state is calculated to measure the impact of changes in the parent node's state on the child node's probability. The partial derivative values ​​are then normalized to obtain the causal strength. For the causal strength calculation of "database connection anomaly" on "slow application response": when other parent nodes ("high CPU utilization") exist, the conditional probability increases from 0.75 to 0.95, an increase of 0.2; when other parent nodes do not exist, the conditional probability increases from 0.05 to 0.85, an increase of 0.8. The weighted average of these increments (weights based on the frequency of occurrence of various conditions) yields an unnormalized causal strength of 0.35. After normalization, the final causal strength is 0.7.

[0086] Based on conditional dependencies and causal strength, a probabilistic causal graph is used to calculate the conditional probability distribution between log event nodes at adjacent time points. Adjacent time points refer to two points in time that are close together, typically separated by a few seconds to a few minutes. The conditional probability distribution represents the probability of each event occurring at the next time point, given that the event state at the current time point is known. A Bayesian network is constructed based on the structure of the probabilistic causal graph and the conditional probability table; the posterior probability distribution is calculated using the variable elimination algorithm. In practical applications, given that "high CPU utilization" and "insufficient memory" events have occurred at the current time point, the calculated conditional probability of "database connection error" at the next time point is 0.65, and the conditional probability of "slow application response" is 0.78.

[0087] Causal strength is calculated based on causal intensity. Causal strength measures the degree of association between two event nodes based on causal relationships. For directly connected nodes, causal strength equals the total causal strength. For indirectly connected nodes, causal strength equals the product of the causal strengths of each edge on the path, taking the maximum value across all paths. For example, there are two paths from "high CPU utilization" to "slow application response": the direct path has a causal strength of 0.6; the indirect path via "database connection error" has a causal strength of 0.5 × 0.7 = 0.35; the maximum value of 0.6 is taken as the causal strength.

[0088] Temporal correlation strength is calculated based on conditional probability distribution. Temporal correlation strength measures the degree of association between events at adjacent time points. It involves calculating the mutual information between the current event and the next event, and normalizing the mutual information value to the [0,1] interval to obtain the temporal correlation strength. In practical applications, the calculated mutual information value between "insufficient memory" and the next event "database connection error" is 0.43, and the normalized temporal correlation strength is 0.65.

[0089] The correlation between log event nodes is obtained by using a self-attention mechanism to interact with the causal and temporal correlation strengths. The self-attention mechanism captures the interrelationships between different features, constructing a feature matrix where each row contains the causal and temporal correlation strengths of a pair of event nodes. The feature matrix is ​​then input into the self-attention layer to calculate attention weights. The features are then weighted and summed based on these attention weights to obtain the overall correlation strength. For example, the causal correlation strength for "high CPU utilization" and "slow application response" is 0.6, the temporal correlation strength is 0.72, and the overall correlation strength after self-attention calculation is 0.68.

[0090] The initial weight is calculated based on the correlation degree, representing the importance of the event in the operation and maintenance rules. For each event node, its average correlation degree with all other nodes is calculated; the sigmoid function is applied to map the average correlation degree to the [0,1] interval to obtain the initial weight. In the actual system, the average correlation degree of the "database connection anomaly" event is 0.73, and the initial weight after mapping by the sigmoid function is 0.85.

[0091] The self-attention mechanism is used to perform feature interaction between the initial weights and historical weights to obtain the final weights. The historical weights refer to the experience weights accumulated from past operation and maintenance practices. A weight feature vector is constructed, which includes the initial weights and historical weights. This vector is input into the self-attention layer to calculate the attention score. The weights are then weighted and fused based on the attention score to obtain the final weights. For the "database connection anomaly" event, its initial weight is 0.85, its historical weight is 0.78, and its final weight after fusion through the self-attention mechanism is 0.82.

[0092] Trigger conditions are set based on the degree of correlation. Trigger conditions refer to the conditions that activate operation and maintenance rules. Strongly correlated event combinations are identified based on the correlation between event nodes. Event combinations with a correlation degree exceeding a threshold (set to 0.65) are set as trigger conditions. For complex conditions, conditional logic (AND, OR, NOT) can be used for combination. In practical applications, an example of a set trigger condition is: "High CPU utilization" AND "Insufficient memory" AND "Database connection error," where the correlation degrees of these three events are 0.68, 0.72, and 0.75 respectively, all exceeding the threshold.

[0093] The execution actions are set based on the final weight. Execution actions refer to the operations that need to be performed after the operation and maintenance rules are triggered. The corresponding processing priority is determined based on the final weight of the event node; the higher the weight, the higher the processing priority. Appropriate processing actions are selected based on the weight and event type. For the above triggering conditions, the execution actions are set as follows: increase the database connection pool size (weight 0.82); restart the application service (weight 0.75); increase server memory resources (weight 0.68).

[0094] A set of operation and maintenance (O&M) knowledge rules is constructed based on trigger conditions and execution actions. These rules adopt an "IF-THEN" structure, where the IF part represents the trigger condition and the THEN part represents the execution action. The steps for constructing the rule set are: combining the set trigger conditions and execution actions into rules; assigning a unique identifier to each rule; setting the priority of the rules, based on the highest weight of the execution action within the rule; and storing the rules in the rule base. An example of the final constructed O&M knowledge rule is as follows: Rule ID "R001", priority 0.82, trigger conditions "high CPU utilization AND insufficient memory AND database connection error", and execution actions "increase database connection pool size; restart application service; increase server memory resources".

[0095] The completed set of operation and maintenance knowledge rules can be directly applied to automated operation and maintenance systems. When the monitoring system detects a combination of events that meet the trigger conditions, it automatically executes the corresponding operations to achieve automatic fault repair. In a test environment of an e-commerce platform, this method achieved an 85% success rate in automated processing, a 37% improvement compared to traditional methods based on manually written rules. The average fault repair time was reduced from 30 minutes to 8 minutes, significantly improving system reliability and operational efficiency.

[0096] In one optional implementation, a multi-hop reasoning mechanism is used to traverse paths in the knowledge graph space, and the generation of a fault diagnosis report and processing suggestions based on the reasoning results of the multi-hop reasoning mechanism includes:

[0097] The multi-hop reasoning mechanism is used to perform iterative path traversal in the knowledge graph space. Each hop traversal is based on the current event node to predict the set of event nodes to be reached by the next hop. The migration probability of each event node in the event node set is calculated. The event nodes are filtered according to the migration probability to obtain candidate event nodes. The candidate event nodes are used as the starting nodes of the next hop to continue the path traversal until the traversal depth reaches a preset traversal threshold to obtain multiple candidate paths.

[0098] A deep residual network is constructed for the causal strength of adjacent event nodes in multiple candidate paths, and the cumulative causal strength is obtained by feature extraction and propagation of the causal strength using the deep residual network.

[0099] Based on the cumulative causal strength, the deep residual network is used to extract path similarity features and conflict features between the candidate paths to obtain a path conflict index. The cumulative causal strength and the path conflict index are input into the deep residual network for feature fusion to obtain a fault location index. The optimal path is determined based on the fault location index. A fault diagnosis report and processing suggestions are generated based on the optimal path and the historical processing experience base.

[0100] A knowledge graph space containing knowledge related to equipment failures is pre-constructed. This knowledge graph includes event nodes of various types, such as equipment component nodes, failure phenomenon nodes, failure cause nodes, and handling solution nodes, as well as relationship edges between nodes, such as "cause," "manifests as," and "solution." Each event node in the knowledge graph contains a unique identifier, node type, and attribute information. For example, for failure scenarios of automated equipment on an industrial production line, event nodes include "bearing overheating," "abnormal vibration," "insufficient lubrication," and "bearing replacement." Each event node is converted into a 128-dimensional feature vector by a pre-trained encoder for subsequent similarity calculation and inference analysis.

[0101] The multi-hop reasoning mechanism performs iterative path traversal in the knowledge graph space, starting from the initial fault phenomenon node, such as "abnormal equipment vibration" (node ​​ID N001), whose feature vector is [0.25, -0.18, 0.36, ..., 0.42]. It initializes the feature mapping matrix, including the query matrix, key-value matrix, and value matrix, each with a dimension of 128×64, to map the node feature vector to the query vector, key-value vector, and value vector. It then queries the knowledge graph database to obtain all adjacent nodes directly connected to the current node N001, including "bearing fault" (N002), "gear wear" (N003), "motor fault" (N004), and "loose fasteners" (N005), etc. These nodes constitute the next-hop candidate node set.

[0102] The feature vector of the current node N001 is mapped to the query vector using a feature mapping matrix, and the feature vectors of each candidate node are mapped to key-value vectors. The dot product between the query vector and each key-value vector is calculated to obtain the original attention score. For nodes N002 to N005, the original scores are 18.2, 12.6, 8.4, and 6.2, respectively. The original scores are divided by a scaling factor of 8 (the square root of the vector dimension 64), and then normalized using the softmax function to obtain the transition probabilities of 0.48, 0.33, 0.12, and 0.07, respectively. A transition probability threshold of 0.15 is set, and nodes with a transition probability greater than the threshold are selected as candidate event nodes, namely N002 (0.48>0.15) and N003 (0.33>0.15), while N004 (0.12<0.15) and N005 (0.07<0.15) are filtered out.

[0103] The selected candidate event nodes are used as the new current nodes, and the above traversal process continues. Taking node N002 "bearing failure" as an example, its adjacent nodes include "bearing overheating" (N006), "insufficient lubrication" (N007), and "bearing aging" (N008). The migration probabilities are calculated to be 0.52, 0.35, and 0.13, respectively. A threshold of 0.15 is applied for filtering, and nodes N006 and N007 are retained. Similarly, for node N003 "gear wear", its adjacent nodes "gear material problem" (N009) and "excessive load" (N010) are obtained. The migration probabilities are calculated and filtered, and node N009 is retained (migration probability 0.65). In this way, starting from the initial node, multiple paths are formed by traversing step by step.

[0104] A preset traversal threshold of 4 is set, meaning that a maximum of 4 hops are explored. When the path depth reaches 4, further traversal of that path stops. This results in multiple candidate paths, such as: Path 1: N001→N002→N006→N011→N015, representing "abnormal equipment vibration" → "bearing failure" → "bearing overheating" → "cooling system failure" → "replace cooling components"; Path 2: N001→N002→N007→N012→N016, representing "abnormal equipment vibration" → "bearing failure" → "insufficient lubrication" → "lubrication system blockage" → "clean lubrication system"; Path 3: N001→N003→N009→N013→N017, representing "abnormal equipment vibration" → "gear wear" → "gear material problem" → "material fatigue" → "replace with high-strength gears".

[0105] After obtaining multiple candidate paths, it is necessary to evaluate the causal strength of adjacent event nodes in the paths. Causal strength represents the probability that one event causes another event, with a value ranging from [0,1]. The larger the value, the stronger the causal relationship. For each pair of adjacent nodes in each path, the causal strength is calculated using a pre-trained causal relationship evaluation model. Taking path 1 as an example, the causal strengths of each pair of adjacent nodes are: (N001,N002)=0.85, (N002,N006)=0.92, (N006,N011)=0.78, and (N011,N015)=0.83. Similar calculations are performed on paths 2 and 3 to obtain the causal strength values ​​of each pair of nodes.

[0106] To conduct in-depth analysis of causal strength, a deep residual network was constructed. This network contains multiple residual blocks, each consisting of two convolutional layers and a skip connection, effectively mitigating the gradient vanishing problem in deep networks. The network input is the causal strength sequence of adjacent node pairs in the path, and the output is the cumulative causal strength. Specifically, the causal strength sequence in the path is converted into a feature matrix with dimensions of path number × maximum path length × feature dimension, where the feature dimension is 1 (a single causal strength value). After processing through three residual blocks, each containing two convolutional layers (3×1 kernel size, 64 output channels), a ReLU activation function and a batch normalization layer are added in between. Max pooling and fully connected layers are then used to output the cumulative causal strength of each path. For the three paths mentioned above, the calculated cumulative causal strengths are 0.82, 0.75, and 0.68, respectively, indicating that path 1 has the strongest overall causal correlation and is the correct fault diagnosis path.

[0107] Building upon the accumulated causal strength, a deep residual network is further utilized to extract path similarity and conflict features between candidate paths. Path similarity features reflect the degree of similarity between different paths in terms of node content and structure, while conflict features reflect the mutually exclusive or contradictory relationships between paths. Specifically, each path is encoded as a fixed-length vector representation using a pre-trained path encoder to obtain path vectors; the cosine similarity between path vectors is calculated to construct a path similarity matrix; and the path similarity matrix is ​​input into a deep residual network, where multiple convolutional layers extract local and global similarity patterns between paths.

[0108] For each pair of paths, conflict nodes are detected. For example, path 1 contains "cooling system failure" while path 2 contains "lubrication system blockage." These two causes usually do not coexist, thus a conflict exists. A path conflict index is calculated based on the number and importance of the detected conflict nodes. For the three paths mentioned above, the path similarity matrix is: [(1.0,0.6,0.3),(0.6,1.0,0.4),(0.3,0.4,1.0)], and the path conflict indices are as follows: 0.7 for path 1 and path 2, 0.8 for path 1 and path 3, and 0.6 for path 2 and path 3.

[0109] The cumulative causal strength and path conflict index are input into a deep residual network for feature fusion to obtain the fault location index. A fused feature vector is constructed, containing the cumulative causal strength of each path and the conflict index with other paths. The fused feature vector is then input into a deep residual network containing four residual blocks, each containing two fully connected layers and one skip connection. Through forward propagation of the network, the fault location index for each path is obtained. For the three paths mentioned above, the calculated fault location indices are 0.89, 0.72, and 0.65, respectively. A higher fault location index indicates that the path is the correct fault diagnosis path. Based on the fault location index, path 1 (index value 0.89) is determined to be the optimal path.

[0110] Based on the optimal path and historical processing experience base, a fault diagnosis report and processing suggestions are generated. The node sequence in the optimal path is analyzed to extract fault phenomena, causes and solution information; the historical processing experience base is queried to retrieve historical cases similar to the optimal path; detailed information such as processing steps, required tools and precautions in historical cases is extracted; and a structured fault diagnosis report and processing suggestions are generated by combining current fault information and historical experience.

[0111] For path 1 (N001→N002→N006→N011→N015), the generated diagnostic report includes: Fault phenomenon description: "The equipment exhibits abnormal vibration at a frequency of 35Hz and an amplitude of 0.8mm"; Fault cause analysis: "Abnormal vibration is caused by bearing failure; bearing overheating is due to cooling system failure, with coolant temperature reaching 85℃, far exceeding the normal operating temperature of 45℃"; Severity assessment: "The fault level is urgent; failure to address it promptly will result in complete bearing damage and equipment shutdown." The generated handling recommendations include: Solution: "Replace the cooling component, model CL-435"; Operation steps: "Turn off the equipment power; remove the outer protective cover; inspect the cooling system; replace the damaged cooling component; add the specified type of coolant; reinstall the protective cover; start the equipment for testing"; Required tools: "Wrench set, sealing ring, coolant CL-T62"; Precautions: "Ensure the coolant level is within specifications, avoiding overfilling or underfilling; check the sealing ring for integrity to prevent coolant leakage"; Estimated repair time: "2.5 hours".

[0112] The method of this invention has shown significant effectiveness in practical industrial environments. In equipment fault diagnosis at a manufacturing enterprise, compared with traditional rule-based methods, the fault diagnosis accuracy of this invention has increased by 23%, and the average fault resolution time has been shortened by 35%. Especially for complex fault scenarios, such as multi-source faults and hidden faults, this invention, through multi-hop inference and deep residual network analysis, can uncover deeper causal relationships, providing more accurate diagnostic results and handling suggestions, and significantly improving fault handling efficiency and success rate.

[0113] In one optional implementation, event nodes are filtered according to the migration probability to obtain candidate event nodes. These candidate event nodes are then used as the starting nodes for the next hop to continue path traversal until the traversal depth reaches a preset traversal threshold, resulting in multiple candidate paths, including:

[0114] In the knowledge graph space, the neighboring nodes of the current event node are obtained as next-hop candidate nodes. The attention score is obtained by calculating the dot product of the query vector of the current event node and the key value vector of the next-hop candidate node using the feature mapping matrix. The attention score is then normalized to obtain the transfer probability.

[0115] The migration probability is compared with an adaptive filtering threshold, and next-hop candidate nodes with migration probabilities greater than the adaptive filtering threshold are selected as candidate event nodes.

[0116] The candidate event node is used as the new current event node. Based on the feature mapping matrix, the migration probability calculation and candidate event node screening are repeatedly performed. The candidate event node of each hop is recorded to form a traversal path. When the depth of the traversal path reaches a preset traversal depth threshold, the traversal stops, and multiple traversal paths are obtained as candidate paths.

[0117] like Figure 3 As shown, the method includes:

[0118] A knowledge graph space is constructed, containing multiple event nodes and the edges connecting them. Each event node includes information such as event ID, event type, and event attributes, while the edges represent the causal, temporal, or relational relationships between events. Taking the anomaly detection scenario in financial transactions as an example, the event nodes in the knowledge graph include "account opening," "large-amount transfer," and "cross-border transaction," while the edges include "account A transfers funds to account B" and "transaction C occurs after transaction D." Each event node in the knowledge graph space is encoded as a high-dimensional feature vector, typically with 64 to 256 dimensions, for subsequent similarity calculations and attention mechanism operations.

[0119] Taking a financial transaction scenario as an example, the starting event node could be a suspicious large-amount transfer event with the following characteristics: event ID "E10086", event type "large-amount transfer", and event attributes including "transfer amount 500,000 yuan", "occurrence time 2023-06-15 10:23:45", and "account balance percentage 98%". This event is encoded as a 128-dimensional feature vector. The goal of path traversal is to find the event chain related to this suspicious transfer to help analyze whether there is any illegal behavior.

[0120] In the knowledge graph space, the adjacent nodes of the current event node are obtained as next-hop candidate nodes. Taking the starting event node "E10086" as an example, by querying the relational database of the knowledge graph, the directly connected adjacent nodes are obtained, including events "E10087" (receiving account information), "E10088" (transfer account historical behavior), and "E10089" (related transactions), etc. These adjacent nodes form the set of next-hop candidate nodes. In this embodiment, the node "E10086" has 5 adjacent nodes, which constitute the first-layer set of next-hop candidate nodes.

[0121] To calculate the migration probability from the current event node to the next-hop candidate node, an attention mechanism is used to compute the probability using a feature mapping matrix. This feature mapping matrix includes a query matrix, a key-value matrix, and a value matrix, which are used to map the event node's feature vector to a query vector, a key-value vector, and a value vector, respectively. In this embodiment, the feature mapping matrix has a dimension of 128×64, mapping the 128-dimensional event node feature vector to a 64-dimensional query / key / value vector.

[0122] The specific calculation process is as follows: For the current event node "E10086", its feature vector is mapped to a query vector through the query matrix; for each next-hop candidate node ("E10087", "E10088", "E10089", etc.), its feature vector is mapped to a key vector through the key-value matrix; the dot product of the query vector and each key-value vector is calculated to obtain the original attention score; the original attention score is divided by the scaling factor (usually the square root of the vector dimension, which is 8 in this example), and then the softmax function is applied for normalization to obtain the final transfer probability.

[0123] In this embodiment, the migration probabilities of event "E10086" to each next-hop candidate node are calculated as follows: the migration probability to "E10087" is 0.35, to "E10088" is 0.28, to "E10089" is 0.22, to "E10090" is 0.10, and to "E10091" is 0.05. These migration probabilities reflect the association strength between the current event node and each next-hop candidate node; a higher probability indicates a stronger association.

[0124] After obtaining the migration probability, it is compared with an adaptive filtering threshold. Next-hop candidate nodes with migration probabilities greater than the adaptive filtering threshold are selected as candidate event nodes. The adaptive filtering threshold is dynamically adjusted based on the current traversal depth and the migration probability distribution. The calculation formula is: base threshold plus a decay term that increases with traversal depth. In this embodiment, the base threshold is set to 0.15, the decay factor is set to 0.05, and the current traversal depth is 1. Therefore, the adaptive filtering threshold is 0.15 + 0.05 × 1 = 0.2.

[0125] The migration probabilities of each next-hop candidate node are compared with an adaptive filtering threshold of 0.2. The filtering results are as follows: "E10087" (0.35>0.2), "E10088" (0.28>0.2), and "E10089" (0.22>0.2) are selected as candidate event nodes, while "E10090" (0.10<0.2) and "E10091" (0.05<0.2) are filtered out. In this way, only nodes with a high correlation to the current event node are retained, effectively reducing the search space and improving the efficiency and quality of path traversal.

[0126] The selected candidate event nodes are used as the new current event nodes, and the process of calculating the migration probability and selecting candidate event nodes continues. Taking candidate event node "E10087" as an example, it is used as the new current event node, and the above steps are repeated: its neighboring nodes are obtained as next-hop candidate nodes (including "E10092", "E10093", etc.); the migration probability is calculated through the feature mapping matrix; and an adaptive selection threshold is applied (at this time, the depth is 2, and the threshold is 0.15 + 0.05 × 2 = 0.25) to select nodes with a migration probability greater than the threshold as new candidate event nodes.

[0127] During the path traversal, candidate event nodes for each hop are recorded, forming a traversal path. Taking the starting node "E10086" as an example, a traversal path would be: "E10086" → "E10087" → "E10092" → "E10095", representing the flow from a suspicious large transfer to the receiving account, then to the account's historical transaction records, and finally to the associated offshore account. This path reveals a chain of fund transfers, which helps in analyzing whether there are any irregularities.

[0128] When the depth of the traversal path reaches a preset traversal depth threshold, traversal stops, and multiple traversal paths are obtained as candidate paths. In this embodiment, the preset traversal depth threshold is set to 4, indicating that a maximum of 4 hops are explored. Through the above process, starting from the initial event node "E10086", multiple candidate paths are finally obtained, including: Path 1: "E10086"→"E10087"→"E10092"→"E10095"; Path 2: "E10086"→"E10087"→"E10093"→"E10097"; Path 3: "E10086"→"E10088"→"E10094"→"E10098"; Path 4: "E10086"→"E10089"→"E10096"→"E10099", etc.

[0129] To further optimize the path traversal process, a path pruning strategy can be introduced. When the traversal depth is large, the number of candidate paths can grow explosively. By setting a maximum number of nodes to retain at each level, the computational complexity can be effectively controlled. In this embodiment, a maximum of three candidate event nodes with the highest migration probability are retained at each level, and the remaining nodes are pruned. In addition, a path deduplication strategy can be applied to avoid repeatedly visiting the same nodes on the same path and prevent loops.

[0130] Experimental evaluations show that the method of this invention significantly improves both efficiency and quality compared to traditional breadth-first or depth-first traversal. Tested on a financial knowledge graph containing 100,000 event nodes and 500,000 relationship edges, the average path traversal time of the method of this invention is 0.8 seconds, while traditional breadth-first traversal requires 6.3 seconds. Path quality evaluation shows that the critical path discovered by the method of this invention has an accuracy of 87.5%, a recall of 82.3%, and an F1 score of 84.8%, while the F1 score of the traditional method is only 65.2%. This indicates that the strategy of this invention, through migration probability and adaptive screening thresholds, can effectively identify important associations between events and generate high-quality candidate paths.

[0131] In one optional implementation, the fault diagnosis report and the processing suggestions are matched with a historical case database for similarity, and the optimal processing solution is determined based on the result of the similarity matching, including:

[0132] A multidimensional feature vector of a fault case is constructed, and a graph attention network is used to model the feature interaction of the multidimensional feature vector. The node similarity and edge weight between the fault diagnosis report and the case in the historical case library are calculated through the graph attention layer. The comprehensive similarity is obtained by weighted fusion of the node similarity and the edge weight.

[0133] The graph attention network is used to perform relational reasoning on the features of the fault diagnosis report, calculate the correlation strength between the current fault and historical cases, and filter out historical cases related to the current fault based on the correlation strength;

[0134] Candidate solutions exceeding a preset similarity threshold are matched with the historical cases. The graph attention network is used to calculate the difference in node representations between the adopted and unadopted candidate solutions to obtain the solution influence degree. The graph attention network is then used to fuse the comprehensive similarity, the solution influence degree, and their corresponding balance factors to obtain the reliability score of the candidate solution.

[0135] The candidate solutions are sorted in descending order based on the reliability score, and the candidate solution with the highest reliability score is selected as the initial optimal solution. The final fault handling solution is generated by combining the processing details in the historical cases corresponding to the initial optimal solution.

[0136] Receive fault diagnosis reports and preliminary handling suggestions. The diagnosis report includes equipment identification "EQP-10389", fault type "abnormal bearing vibration", fault phenomenon description "abnormal noise occurs during equipment operation, vibration frequency exceeds the standard", key parameter abnormal values ​​"vibration frequency 73Hz, temperature 67℃" and other information. The preliminary handling suggestions include solutions such as "replace the bearing" and "adjust the bearing lubrication".

[0137] For the received fault diagnosis report, a multi-dimensional feature vector is constructed to extract equipment features, including equipment model "M2106", operating time "5237 hours", and operating environment "industrial workshop, temperature 35℃, humidity 60%"; fault features are extracted, including fault code "E-435", fault location "main bearing", fault duration "28 hours", vibration frequency "73Hz", and abnormal temperature value "67℃"; and handling suggestion features are extracted, including suggested operation type "replace part" and estimated repair time "4 hours". The required resources are "bearing model XB-428, special tool T-56"; for textual features such as fault phenomenon descriptions, a BERT pre-trained model is used to convert them into 768-dimensional dense vectors, and then the dimensionality is reduced to 64 dimensions through a linear layer; for categorical features such as equipment model and fault codes, one-hot encoding is used to convert them into vectors; for numerical features such as running time and vibration frequency, min-max normalization is performed to convert them to the [0,1] interval; the various feature vectors are concatenated to form the final 128-dimensional fault case feature vector.

[0138] After constructing the feature vectors, a graph attention network is used to model the feature interactions of the multi-dimensional feature vectors, constructing a graph structure. Each fault case is treated as a node, and edges are established between nodes based on conditions such as the same equipment model, similar fault type, and related operation steps. The graph attention network parameters are initialized, including the number of attention heads (8), the hidden layer dimension (64-dimensional), and the number of graph attention layers (3 layers). For each graph attention layer, the input node features are transformed into query vectors, key vectors, and value vectors through a linear transformation. The dot product of the query vector and the key vector is calculated and divided by a scaling factor (square root of 8) to obtain the original attention score. The softmax function is applied to the original attention score to obtain the normalized attention weights. The attention weights are multiplied by the value vectors and summed to obtain the output of the current attention head. The outputs of multiple attention heads are concatenated and a linear transformation is performed to obtain the final output of the layer. Residual connections and layer normalization are added, the current layer output is added to the input, and then normalized. The above steps are repeated to stack multiple graph attention layers to obtain the final node representation.

[0139] After the graph attention network is trained, the node similarity and edge weights between the fault diagnosis report and the cases in the historical case library are calculated to obtain the node representation vectors of the current fault case and each case in the historical case library. The cosine similarity between the node representation vectors is calculated to obtain the node similarity matrix. The attention scores between nodes are extracted from the attention layer of the graph attention network as edge weights. According to the predefined weighting coefficients (node ​​similarity weight 0.7, edge weight 0.3), the node similarity and edge weights are fused to obtain the comprehensive similarity. For the bearing fault case and the historical case HS-7832, the node similarity is 0.86 and the edge weight is 0.75. The comprehensive similarity is calculated to be 0.86×0.7+0.75×0.3=0.827.

[0140] Based on the obtained comprehensive similarity, the association strength between the current fault and historical cases is calculated. Path information of the current fault node and historical case nodes in the graph structure is extracted, including the shortest path length and edge weights on the path. Combining node representation similarity and path information, the association strength is calculated by weighted summation, with weights of 0.6 for node similarity and 0.4 for path information. A threshold of 0.65 for association strength is set, and historical cases with association strength greater than the threshold are filtered out. For the bearing fault example, the association strength with historical case HS-7832 is calculated to be 0.86×0.6+0.74×0.4=0.81, and the association strength with historical case HS-6215 is 0.82×0.6+0.72×0.4=0.78, both exceeding the threshold of 0.65, and are thus filtered as relevant cases.

[0141] For the candidate solutions in the preliminary processing suggestions, the impact degree of the solutions is calculated. A similarity threshold of 0.75 is set, and candidate solutions with a comprehensive similarity greater than the threshold are selected. A hypothetical node representation after adopting a candidate solution is constructed by fusing the feature vector of the candidate solution with the current fault node representation. A node representation that does not adopt a candidate solution is constructed, i.e., the current fault node representation remains unchanged. The Euclidean distance between these two node representations is calculated to obtain the solution impact degree. For the "replace bearing" solution, a node representation A after adopting the solution and a node representation B without adopting the solution are constructed, and the Euclidean distance is calculated to obtain a solution impact degree of 0.76. For the "adjust bearing lubrication" solution, node representations for both cases are constructed in the same way, and the solution impact degree is calculated to be 0.65.

[0142] Calculate the reliability score of the candidate solutions, setting the balance factor for overall similarity to 0.5 and the balance factor for solution influence to 0.5; multiply the overall similarity by its balance factor, and multiply the solution influence by its balance factor; add the two together to obtain the reliability score of the candidate solution; for the "replace bearing" solution, the reliability score = 0.827 × 0.5 + 0.76 × 0.5 = 0.794; for the "adjust bearing lubrication" solution, the reliability score = 0.792 × 0.5 + 0.65 × 0.5 = 0.721.

[0143] The final fault handling plan is generated based on the reliability score. The candidate plans are sorted in descending order of reliability score. The candidate plan with the highest reliability score is selected as the initial optimal plan. In this example, the "replace bearing" plan (score 0.794) is selected. The processing details in the historical cases (HS-7832 and HS-6215) related to the initial optimal plan are found. The operation steps, required tools and materials, precautions and other information in the processing details are extracted. The information is integrated to generate the final fault handling plan, including the following specific steps: (1) Prepare the bearing model XB-428 to be replaced and the special disassembly and assembly tool T-56; (2) Turn off the power of the equipment and release the residual power. Energy; (3) Remove the outer protective cover and use a special disassembly tool to remove the damaged bearing; (4) Check the bearing seat surface for wear. If the wear exceeds 0.02mm, it needs to be repaired; (5) Install the new bearing and ensure that the position is accurately aligned with a deviation of no more than 0.005mm; (6) Add the specified type of grease YZ-102 and apply it evenly. The amount used is 15-20 grams; (7) Reinstall the protective cover and tighten all fasteners. The torque is controlled at 35-40 N·m; (8) Start the equipment for testing and monitor whether the vibration value returns to the normal level (should be below 20Hz); (9) Record the maintenance process and results, including the serial number of the replaced parts, test data, etc.

[0144] In the method validation phase, tests were conducted on 100 typical fault cases. Results showed that the graph attention network-based method achieved an accuracy of 92.3%, while the traditional keyword matching method achieved only 67.5%, representing a 24.8% improvement. The average fault resolution time was reduced from 5.3 hours to 3.4 hours, a 35.8% decrease. The success rate of solution execution increased from 83.6% to 94.2%, a 10.6 percentage point improvement. Particularly for complex equipment faults, this method, by mining implicit knowledge from historical cases, provides more precise solutions, effectively improving fault handling efficiency and success rate.

[0145] In one optional implementation, based on the execution result of the optimal processing scheme, the knowledge graph space is dynamically updated to improve the set of operation and maintenance knowledge rules, including:

[0146] The execution result of the optimal processing scheme is subjected to feature extraction to obtain the result feature vector, and the association strength with the existing nodes in the knowledge graph space is calculated based on the result feature vector;

[0147] The nodes in the knowledge graph space are subjected to feature aggregation, the aggregation weight of the new knowledge is determined based on the association strength, and the new knowledge in the execution result is updated to the corresponding node in the knowledge graph space according to the aggregation weight.

[0148] The application effect of the newly added knowledge in the knowledge graph space is tracked, the credibility index of the newly added knowledge is calculated, the weight of the corresponding node in the knowledge graph space is adjusted based on the credibility index, and the relevant operation and maintenance knowledge rules are improved.

[0149] The system extracts features from the execution results of the optimal handling solution to obtain a feature vector. During feature extraction, the system analyzes key information points of the execution results, including data on fault resolution, execution time, resource consumption, and scope of impact. For example, for a network device fault handling, the system extracts key information such as "router - configuration reset - recovery in 5 minutes - no data loss - low business impact" and converts this information into a feature vector, such as [0.85, 0.92, 0.76, 0.94, 0.89], where each value represents the quantized value of the corresponding feature.

[0150] Based on the extracted feature vectors, the association strength between the extracted feature vectors and existing nodes in the knowledge graph space is calculated. The association strength calculation employs a similarity matching mechanism, comparing the differences between feature vectors using a vector space distance metric. In practical applications, it was found that the association strength between the execution result and the "Network Device - Configuration Anomaly" node in the knowledge graph is 0.87, with the "Router - Performance Problem" node it is 0.65, and with the "Network Interruption - Hardware Failure" node it is 0.32. These association strength values ​​guide the system in determining the attribution location of new knowledge.

[0151] Feature aggregation is performed on nodes in the knowledge graph space. Nodes with a correlation strength exceeding a preset threshold (e.g., 0.6) are selected as aggregation targets. Then, the aggregation weight of the new knowledge is determined based on the correlation strength. The aggregation weight is usually set to the normalized value of the correlation strength. For example, for the two nodes that exceed the threshold, aggregation weights of 0.57 and 0.43 are set respectively (0.87 / (0.87+0.65) and 0.65 / (0.87+0.65)).

[0152] Based on the calculated aggregation weights, the system updates the corresponding nodes in the knowledge graph space with the newly added knowledge from the execution results. This update process includes not only adding new attributes to existing nodes but also creating new related edges or child nodes. For example, for a new method to handle router configuration anomalies, the system adds a new handling solution child node under the "Network Devices - Configuration Anomalies" node, along with the corresponding operation steps, applicable conditions, and expected results. Simultaneously, the system updates the "Router - Performance Issues" node based on the aggregation weights, adding related knowledge about performance issues caused by configuration anomalies.

[0153] Record the recommendation and practical application of this knowledge, including metrics such as the number of recommendations, adoption rate, and the proportion of successful problem-solving. For example, a newly added router configuration reset method was recommended 10 times, adopted 8 times, successfully solved the problem 7 times, required additional operation to solve the problem once, and was not adopted in 2 cases where other solutions were chosen.

[0154] The credibility index of newly added knowledge is calculated based on statistical data on application effectiveness. The credibility index comprehensively considers factors such as adoption rate, success rate, and application scope. For the example above, the credibility index of the knowledge is calculated to be 0.82 (considering an 80% adoption rate, an 87.5% success rate, and an applicability coefficient).

[0155] The weights of corresponding nodes in the knowledge graph space are dynamically adjusted based on the calculated credibility index, following the principle of "increasing weight for high credibility and decreasing weight for low credibility." For knowledge with a credibility index of 0.82, the system increases its weight in the "Network Device - Configuration Anomaly" node from the initial 0.5 to 0.72, giving it a higher priority in future recommendations.

[0156] Based on the application of new knowledge, the relevant operation and maintenance knowledge rules are improved. The rule improvement includes optimizing trigger conditions, refining applicable scenarios, adding pre-checks, and adjusting execution parameters. For example, it is found that the configuration reset method works better on a certain model of router, so a device model judgment condition is added to the rule; or it is found that the configuration file needs to be backed up before execution, so a mandatory backup operation step is added to the rule.

[0157] Through this dynamic update mechanism, the knowledge graph space continuously learns from operational practices, improves the set of operational knowledge rules, and gradually enhances the intelligence level of the operational system. In a real-world large-scale data center operational scenario, after three months of dynamic knowledge updates, the system's fault handling recommendation accuracy increased from the initial 72% to 93%, and the average fault resolution time was shortened by 46%, effectively reducing the workload of operational personnel and improving service quality.

[0158] The method further includes:

[0159] The log collection layer collects log data generated by various servers and applications. It configures log collection tools to monitor and collect log files at specified paths in real time. Specifically, it creates a collection configuration file specifying the log file path, collection frequency, and filtering rules. For example, for database server logs, the collection path is configured as " / var / log / mysql / error.log", and the collection frequency is once every 5 seconds; for application server logs, the collection path is configured as " / opt / application / logs / *.log", and the collection frequency is once every 3 seconds. The collection tool periodically checks the log files for new content according to the configuration and sends any new content to the log processing module.

[0160] The collected log data is segmented according to a preset time window, resulting in multiple log data fragments. The time window is calculated by first determining the time interval between adjacent log events in the heterogeneous log data. Specifically, this involves extracting the timestamp of each log entry, calculating the difference between two adjacent timestamps, and obtaining an array of time intervals. For example, for 100 log entries generated by an application service within one minute, the calculated time interval array would be [0.5 seconds, 0.8 seconds, 0.3 seconds, 1.2 seconds, ...]. The average value is calculated based on these time intervals, which is 0.7 seconds in this example; the standard deviation is also calculated, which is 0.4 seconds in this example. The time window size is set to the average value plus twice the standard deviation, i.e., 0.7 + 2 × 0.4 = 1.5 seconds. This method can adapt to the generation characteristics of different types of logs, preventing related logs from being segmented into different fragments due to an excessively small window, and preventing irrelevant logs from being mixed together due to an excessively large window.

[0161] Heterogeneous log data is segmented according to a calculated time window size, resulting in multiple log data fragments. Starting from the start time of the log data, a time window is created every 1.5 seconds, and all logs falling within that window are grouped into one fragment. If a window contains no logs, it is skipped. For the logs of the aforementioned application service, approximately 40 log fragments are obtained after segmentation, with each fragment containing 2-3 log records.

[0162] Semantic parsing is performed on log data fragments to construct a multi-level causal graph. The first step in semantic parsing is log structuring, employing different processing strategies depending on the log format. For structured logs (such as JSON and XML formats), the fields are directly parsed; for semi-structured logs (such as key-value pairs), regular expressions are used to extract key-value pairs; for unstructured logs (such as plain text), regular expressions are used to match fields such as timestamps, log levels, and message content. For example, for a log with the format "2023-10-01 12:00:00 ERROR DB connection failed", the regular expression "(\d{4}-\d{2}-\d{2}\d{2}:\d{2}:\d{2})(\w+)(.*)" is used to extract the timestamp "2023-10-01 12:00:00", the log level "ERROR", and the message content "DB connection failed".

[0163] After structuring, semantic analysis is performed to identify key entities, operations, and states in the logs, creating a domain-specific vocabulary that includes common operation verbs (such as "start," "connect," and "fail"), entity nouns (such as "database," "server," and "thread"), and state adjectives (such as "success," "timeout," and "exception"). These elements are then identified from the logs through lexical matching and contextual analysis. For example, the logs above identify the operation "connection," the entity "DB," and the state "failed."

[0164] A multi-level causal graph is constructed based on semantic analysis results. This graph contains three levels: event layer, component layer, and system layer. Event layer nodes represent specific log events, such as "database connection failure"; component layer nodes represent the status of system components, such as "database connection pool exception"; and system layer nodes represent the overall system status, such as "system unavailable". Nodes are connected by causal edges, with the edge weight representing the strength of the causal relationship. The construction of causal edges is based on temporal relationships and domain knowledge. Temporal relationships refer to the possibility of a causal relationship from A to B if event A always occurs before event B; domain knowledge refers to predefined dependencies between components and fault propagation patterns. For example, in the constructed graph, there is a causal edge with a weight of 0.8 between the "database connection failure" node and the "database connection pool exception" node, indicating that the database connection failure is likely caused by a connection pool exception.

[0165] A vertical association matrix is ​​constructed based on the relationships between nodes in a multi-level causal graph. This matrix describes the association strength between nodes at different levels and is a two-dimensional matrix where rows represent lower-level nodes and columns represent higher-level nodes. Specifically, it iterates through each pair of nodes connected across levels in the graph, extracts their edge weights, and fills them into the corresponding positions in the matrix. If there is no direct connection between two nodes, the strength of the indirect connection is calculated using a path algorithm, and the maximum value among multiple paths is taken. For example, for the graph above, some of the constructed vertical association matrix values ​​are: the association strength from the event "database connection failure" to the component "database connection pool exception" is 0.8, and the association strength from the event "application startup timeout" to the system "system unavailable" is 0.6.

[0166] Temporal feature extraction is performed on log data segments based on the vertical correlation matrix to obtain a temporal feature vector. The temporal features reflect the patterns of log events changing over time. The extraction method calculates the temporal distribution characteristics of events within a log segment, including event frequency, event interval, and event sequence pattern. Specifically, events in the log segment are sorted by time, and indicators such as average event interval, event frequency, and the proportion of burst events are calculated to form a 64-dimensional temporal feature vector. For example, for a certain log segment, the extracted temporal feature vector might contain values ​​[0.3, 0.5, 0.1, 0.0, 0.7, ...], representing error event frequency, average event interval (seconds), maximum event interval (seconds), event sequence entropy, and the proportion of high-priority events, respectively.

[0167] Causal correlation vectors are extracted from log data fragments using a multi-level causal graph. These vectors describe the strength of the causal relationships between log events. The extraction method analyzes the position and connectivity of events within the log fragment within the causal graph, calculating key indicators such as the causal influence and degree of influence of the event. Specifically, this involves calculating the in-degree, out-degree, and centrality of event nodes to form a 48-dimensional causal correlation vector. For example, for a log fragment containing the "database connection failure" event, the extracted causal correlation vector might have values ​​of [0.8, 0.3, 0.6, 0.4, 0.7, ...], representing average causal strength, minimum causal strength, maximum causal strength, proportion of critical events, and anomaly propagation speed, respectively.

[0168] A dynamic weight allocation is performed on the temporal feature vector and the causal correlation vector to obtain an attention weight vector. This dynamic weight allocation adaptively adjusts the importance of different features based on the characteristics of the current log segment. The implementation involves concatenating the temporal feature vector and the causal correlation vector to form the input, and then calculating the attention weight of each feature using a self-attention mechanism. The self-attention mechanism includes three steps: query transformation, key-value transformation, and attention score calculation. The output is a 112-dimensional attention weight vector with the same dimensions as the input vector. For the log segment mentioned above, the calculated attention weight vector has partial values ​​of [0.02, 0.05, 0.01, 0.03, 0.04, ...], with a total weight value of 1, reflecting the importance of each feature in the current context.

[0169] The temporal feature vector and the causal correlation vector are weighted and combined by multiplying each feature value by its corresponding attention weight. For example, the first element of the temporal feature vector, 0.3 (representing the frequency of error events), is multiplied by its corresponding weight of 0.02 to obtain a weighted value of 0.006. This process is repeated to calculate the weighted values ​​of all features, forming a weighted combined vector.

[0170] The weighted combination result is fused with the attention weight vector to construct a semantic vector for the log data segment. Feature fusion is implemented using a multilayer perceptron, which includes an input layer, two hidden layers, and an output layer. The input is the concatenation of the weighted combination vector and the attention weight vector, and the output is a 128-dimensional log semantic vector. For example, for the log segment mentioned above, the generated semantic vector has partial values ​​of [0.25, -0.18, 0.42, 0.07, -0.31, ...], which comprehensively represents the semantic information of the log segment.

[0171] Based on the generated semantic vectors, log assertion operations are performed. Log assertions are a technical means of verifying whether log content meets expectations. The implementation involves defining an assertion rule configuration file, which includes pattern matching rules, threshold conditions, and assertion actions. The configuration file uses YAML format and contains fields such as rule name, pattern expression, log level, threshold conditions, and action definition. For example, for an assertion rule for a database connection failure: the rule name is "db connection failure The pattern expression is "DB connection failed", the log level is "ERROR", the threshold condition is "occurring more than 3 times within 5 minutes", and the action is "send an alert email to the database administrator".

[0172] The assertion engine loads the rule configuration file and performs assertion verification on the semantic vector of each log segment. The verification process includes three steps: pattern matching, condition evaluation, and action execution. Pattern matching uses regular expressions or keyword searches to check whether the log content conforms to the pattern defined by the rule; condition evaluation checks whether the matched logs meet the threshold conditions defined by the rule; and action execution triggers the operation defined by the rule when the condition is met, such as generating an alarm or sending a notification. In the example of the database connection failure mentioned above, if three ERROR-level logs matching "DB connection failed" are detected within 5 minutes, the assertion engine will trigger an alarm operation to notify the database administrator.

[0173] Assertion results are output in a structured format, including the assertion status (success / failure), the matched log content, timestamp, level information, and assertion rule details. For example, an assertion result might be: status="failure", rule="db". connection failure The log entry matches "2023-10-01 12:00:00 ERROR DB connection failed", the assertion time is "2023-10-01 12:05:00", the trigger condition is "occurred 3 times within 5 minutes", the actual number of times is "4 times", the severity is "high", and the handling suggestion is "check the database connection pool configuration and database service status".

[0174] The implementation of this invention has yielded significant results. In the testing environment of an internet company, the error interception rate increased by 45%, from 60% with manual review to 87% with automated assertions; fault location time was reduced from an average of 30 minutes to 9 minutes, a reduction of 70%; the workload of manual log review was reduced by 83%, greatly improving development and operation efficiency; test coverage increased by 42%, filling the blind spots of traditional functional testing; and the cost of handling production environment incidents was reduced by 65%, creating considerable economic benefits for the company.

[0175] A second aspect of this invention provides a knowledge graph-driven intelligent log assertion reasoning system, comprising:

[0176] The first unit is used to acquire heterogeneous log data to be analyzed, segment the heterogeneous log data according to a preset time window to obtain multiple log data fragments, and perform semantic parsing and structured processing on the log data fragments to construct log semantic vectors.

[0177] The second unit is used to map the log semantic vector to a knowledge graph space, establish temporal and causal relationships between log event nodes based on the log semantic vector, assign weights based on the degree of association of nodes in the knowledge graph space, construct an operation and maintenance knowledge rule set according to the result of the weight assignment, distribute and store the rules in the operation and maintenance knowledge rule set, and update and optimize them in real time based on the usage frequency and accuracy of the rules.

[0178] The third unit is used to perform path traversal on the knowledge graph space using a multi-hop reasoning mechanism, generate a fault diagnosis report and processing suggestions based on the reasoning results of the multi-hop reasoning mechanism, perform similarity matching between the fault diagnosis report and the processing suggestions and the historical case library, determine the optimal processing solution based on the similarity matching results, and dynamically update the knowledge graph space based on the execution results of the optimal processing solution to improve the set of operation and maintenance knowledge rules.

[0179] A third aspect of the present invention provides an electronic device, comprising:

[0180] processor;

[0181] Memory used to store processor-executable instructions;

[0182] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0183] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0184] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A knowledge graph driven intelligent log assertion reasoning method, characterized in that, The method comprises the following steps: acquiring heterogeneous log data to be analyzed, segmenting the heterogeneous log data according to a preset time window to obtain a plurality of log data segments; performing semantic analysis and structural processing on the log data segments to construct a log semantic vector; mapping the log semantic vector to a knowledge graph space, establishing a time sequence relationship and a causal relationship between log event nodes based on the log semantic vector, performing weight distribution based on the correlation degree of nodes in the knowledge graph space, constructing a set of operation and maintenance knowledge rules according to the weight distribution result, performing distributed storage on the rules in the set of operation and maintenance knowledge rules, and performing real-time updating and optimization based on the usage frequency and accuracy of the rules; performing path traversal on the knowledge graph space using a multi-hop reasoning mechanism, generating a fault diagnosis report and a processing suggestion according to the reasoning result of the multi-hop reasoning mechanism, comprising: performing iterative path traversal on the knowledge graph space using a multi-hop reasoning mechanism, predicting a set of event nodes reached by the next hop based on the current event node at each hop traversal, calculating the migration probability of each event node in the set of event nodes, filtering the event nodes according to the migration probability to obtain candidate event nodes, taking the candidate event nodes as the starting nodes of the next hop to continue path traversal, and obtaining a plurality of candidate paths until the traversal depth reaches a preset traversal threshold; constructing a deep residual network for the causal strength of adjacent event nodes in a plurality of candidate paths, and extracting features of the causal strength using the deep residual network to obtain cumulative causal strength; extracting path similarity features and conflict features between the candidate paths using the deep residual network according to the cumulative causal strength to obtain a path conflict indicator, inputting the cumulative causal strength and the path conflict indicator into the deep residual network for feature fusion to obtain a fault positioning indicator, determining an optimal path according to the fault positioning indicator, generating a fault diagnosis report and a processing suggestion based on the optimal path and a historical processing experience library; performing similarity matching on the fault diagnosis report and the processing suggestion with a historical case library, determining an optimal processing scheme according to the similarity matching result; and dynamically updating the knowledge graph space based on the execution result of the optimal processing scheme to improve the set of operation and maintenance knowledge rules.

2. The method of claim 1, wherein, segmenting the heterogeneous log data according to a preset time window to obtain a plurality of log data segments; performing semantic analysis and structural processing on the log data segments to construct a log semantic vector, comprising: calculating the time interval between adjacent log events in the heterogeneous log data, calculating the time window size according to the average value and the standard deviation of the time interval, and segmenting the heterogeneous log data according to the time window size to obtain a plurality of log data segments; performing semantic analysis on the log data segments, constructing a multi-level causal graph, and constructing a vertical correlation matrix based on the correlation between nodes in the multi-level causal graph; extracting a time sequence feature vector from the log data segment based on the vertical correlation matrix, extracting a causal correlation vector of the log data segment from the multi-level causal graph, and performing dynamic weight distribution on the time sequence feature vector and the causal correlation vector to obtain an attention weight vector; performing weighted combination on the time sequence feature vector and the causal correlation vector, performing feature fusion on a result of the weighted combination and the attention weight vector, and constructing a semantic vector of the log data segment.

3. The method of claim 1, wherein, mapping the log semantic vector to a knowledge graph space, and establishing a time sequence relationship and a causal relationship between log event nodes based on the log semantic vector; performing weight distribution based on a correlation degree of nodes in the knowledge graph space, and constructing an operation and maintenance knowledge rule set according to a result of the weight distribution, including: mapping the log semantic vector to a knowledge graph space to obtain a knowledge representation, constructing a probabilistic causal graph based on the knowledge representation, the probabilistic causal graph including log event nodes and relationship edges, calculating a conditional probability between the log event nodes and parent nodes thereof to obtain a conditional dependence relationship, and calculating a causal strength between the log event nodes according to a partial derivative of the conditional dependence relationship and the conditional probability; calculating a conditional probability distribution between log event nodes at adjacent time points by using the probabilistic causal graph based on the conditional dependence relationship and the causal strength, calculating a causal correlation strength based on the causal strength, calculating a time sequence correlation strength based on the conditional probability distribution, and performing feature interaction on the causal correlation strength and the time sequence correlation strength by a self-attention mechanism to obtain a correlation degree between the log event nodes; calculating an initial weight based on the correlation degree, performing feature interaction on the initial weight and a historical weight by the self-attention mechanism to obtain a final weight, setting a trigger condition according to the correlation degree, setting an execution action according to the final weight, and constructing an operation and maintenance knowledge rule set based on the trigger condition and the execution action.

4. The method of claim 1, wherein, filtering event nodes according to the migration probability to obtain candidate event nodes, and continuing path traversal with the candidate event nodes as starting nodes of next hops until a traversal depth reaches a preset traversal threshold to obtain a plurality of candidate paths, including: obtaining adjacent nodes of a current event node in a knowledge graph space as next-hop candidate nodes, calculating an attention score by calculating a dot product of a query vector of the current event node and key value vectors of the next-hop candidate nodes by using a feature mapping matrix, and normalizing the attention score to obtain a migration probability; comparing the migration probability with an adaptive filtering threshold, and filtering out next-hop candidate nodes with a migration probability greater than the adaptive filtering threshold as candidate event nodes; taking the candidate event nodes as new current event nodes, repeatedly performing migration probability calculation and candidate event node filtering based on the feature mapping matrix, recording the candidate event nodes at each hop to form a traversal path, and stopping traversal when a depth of the traversal path reaches a preset traversal depth threshold to obtain a plurality of traversal paths as candidate paths.

5. The method of claim 1, wherein, The fault diagnosis report and the processing suggestion are matched with a historical case library in similarity, and an optimal processing scheme is determined according to a result of the similarity matching, including: A multi-dimensional feature vector of a fault case is constructed, feature interaction modeling is performed on the multi-dimensional feature vector by using a graph attention network, node similarity and edge weight between the fault diagnosis report and cases in the historical case library are calculated through a graph attention layer, and a comprehensive similarity is obtained based on weighted fusion of the node similarity and the edge weight; The graph attention network is used for relation reasoning on features of the fault diagnosis report, an association strength of a current fault and historical cases is calculated, and historical cases related to the current fault are selected based on the association strength; The candidate schemes and the historical cases exceeding a preset similarity threshold are matched, a scheme influence degree is calculated by using the graph attention network to calculate a difference between node representations of the candidate schemes and the candidate schemes not being adopted, and a reliability score of the candidate schemes is obtained by fusing the comprehensive similarity, the scheme influence degree and a corresponding balance factor through the graph attention network; The candidate schemes are sorted in descending order based on the reliability scores, an initial optimal scheme with the highest reliability score is selected as an initial optimal scheme, and a final fault processing scheme is generated by combining processing details in the historical cases corresponding to the initial optimal scheme.

6. The method of claim 1, wherein, Based on an execution result of the optimal processing scheme, the knowledge graph space is dynamically updated, and the set of operation and maintenance knowledge rules is improved, including: A result feature vector is obtained by feature extraction on the execution result of the optimal processing scheme, an association strength with existing nodes in the knowledge graph space is calculated based on the result feature vector; Features of nodes in the knowledge graph space are aggregated, an aggregation weight of new knowledge is determined based on the association strength, and the new knowledge in the execution result is updated to corresponding nodes in the knowledge graph space according to the aggregation weight; An application effect of the new knowledge in the knowledge graph space is tracked, a credibility index of the new knowledge is calculated, and the weight of the corresponding node in the knowledge graph space is adjusted based on the credibility index and related operation and maintenance knowledge rules are improved.

7. An intelligent log assertion reasoning system driven by a knowledge graph for implementing the method of any one of the preceding claims 1-6, characterized in that, Including: A first unit is configured to acquire heterogeneous log data to be analyzed, segment the heterogeneous log data according to a preset time window to obtain a plurality of log data segments, and perform semantic analysis and structural processing on the log data segments to construct a log semantic vector. A second unit is configured to map the log semantic vector to a knowledge graph space, establish a time sequence relationship and a causal relationship between log event nodes based on the log semantic vector, perform weight distribution based on an association degree of nodes in the knowledge graph space, construct a set of operation and maintenance knowledge rules according to a result of the weight distribution, store the rules in the set of operation and maintenance knowledge rules in a distributed manner, and update and optimize the rules in real time based on a usage frequency and an accuracy of the rules. A third unit is configured to perform path traversal on the knowledge graph space by using a multi-hop reasoning mechanism, and generate a fault diagnosis report and a processing suggestion according to a reasoning result of the multi-hop reasoning mechanism. ​ The fault diagnosis report and the processing suggestion are matched with a historical case library in similarity, an optimal processing scheme is determined according to a result of the similarity matching, and the knowledge graph space is dynamically updated based on an execution result of the optimal processing scheme to perfect the operation and maintenance knowledge rule set.

8. An electronic device, comprising: Comprise: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored by the memory to execute the method of any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions, when executed by the processor, implement the method of any one of claims 1 to 6.

Images