Hybrid cloud data center operation and maintenance system and method based on large language model

Abstract

The invention discloses a hybrid cloud data center operation and maintenance system based on a large language model and a method thereof. The system comprises an MCP module, a Deepseek local knowledge base and a Deepseek large language model interface. The MCP module is used for collecting a monitoring daily report of a hybrid cloud console, alarm information and historical curve data of standard components zabbix and Prometheus, active alarm information of a self-research platform, a security scanning report of server assets and professional knowledge generated by artificial experience, and uploading the collected data to the Deepseek local knowledge base; the Deepseek local knowledge base is deployed privately, comprises a vector database and is used for storing and vectorizing the collected data, supporting document import and formatting data, block vectorization processing, vector similarity search, manual search, an MCP learning path and an artificial learning path, and utilizing the networking function of the large language model to assist in collecting intelligence.

Description

Technical Field

[0001] This invention relates to the field of large language model technology, and in particular to a hybrid cloud data center operation and maintenance system and method based on a large language model. Background Technology

[0002] The operation and maintenance of existing hybrid cloud data centers faces numerous challenges. The company's servers utilize a hybrid cloud architecture, including Tencent Cloud, Huawei Cloud, Alibaba Cloud, AWS, and Oracle Cloud. Daily monitoring reports are generated on the console, with each vendor's output format differing, making the review of these reports extremely tedious. The daily generated Zabbix and Prometheus alerts, as well as proactive alerts from the self-developed platform, result in a large volume of information due to the numerous server assets and diverse business processes, making unified management difficult. Regarding server security, manual penetration testing and targeted simulated attacks are time-consuming, labor-intensive, and involve a heavy workload. High reliance on manual intervention: In traditional operations and maintenance, core processes such as resource optimization, vulnerability investigation, and alarm response rely on manual operation. Monitoring hybrid cloud resources requires manual compilation of daily reports from multiple platforms, which is time-consuming and prone to errors. Vulnerability identification relies on security personnel conducting penetration tests on each machine, which has limited coverage and a high false negative rate. Resource adjustments require an "application-approval-execution" process, which can lead to delays (such as untimely resource expansion during peak business periods causing interruptions).

[0003] Passive security protection: Enterprise security protection relies heavily on periodic manual scanning, making it difficult to respond to new vulnerabilities in real time (such as CVE database updates). Furthermore, attack script writing depends on expert experience, resulting in low verification efficiency and long window periods for patching high-risk vulnerabilities, thus highlighting security risks.

[0004] Difficulty in knowledge reuse: The troubleshooting experience and optimization solutions of senior operations and maintenance personnel are mostly stored in the form of documents and notes, lacking structured storage. New employees find it difficult to reuse them quickly, there is a large skill gap within the team, and historical cases cannot support automated decision-making. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a hybrid cloud data center operation and maintenance system and method based on a large language model.

[0006] To achieve the above objectives, this invention provides a hybrid cloud data center operation and maintenance system based on a large language model, including an MCP module, a Deepseek local knowledge base, and a Deepseek large language model interface. The MCP module collects daily monitoring reports from the hybrid cloud console, alarm information and historical curve data from standard components Zabbix and Prometheus, proactive alarm information from a self-developed platform, security scan reports of server assets, and professional knowledge generated through human experience. The collected data is then uploaded to the Deepseek local knowledge base. The Deepseek local knowledge base is privately deployed and includes a vector database. This module is used to store and quantify the collected data, supporting document import and formatted data, chunked vectorization processing, vector similarity search, manual search, MCP learning path and manual learning path, and utilizing the networking function of the large language model to assist in intelligence collection, including domain name information, company organizational structure and personnel contact information; the MCP module, in conjunction with the Deepseek local knowledge base, calls the Deepseek large language model interface to analyze the vulnerabilities or optimization items existing in the server, and generates formatted output based on the analysis results, and performs corresponding operations, including automatic adjustment of adjustable optimization items, security-related penetration testing and security scanning, and notification operations.

[0007] Preferably, the MCP module obtains the daily monitoring report of the hybrid cloud console by collecting the content of operation and maintenance email information, collects alarm information and historical curve data of the standard components zabbix and Prometheus by crawling, collects the proactive alarm information of the self-developed platform by obtaining DingTalk alarm group messages, and generates a security scan report of the server assets by executing security attack scripts.

[0008] Preferably, when the analysis result is an adjustable optimization item and matches the preset adjustable item in the Deepseek local knowledge base, the MCP module calls the API interface provided by the server to automatically adjust.

[0009] Preferably, when the analysis result is security-related, the MCP module combines the vulnerability data from the Deepseek local knowledge base and online searches, as well as the characteristics of the target server, to identify potential vulnerabilities, and calls the Deepseek large language model interface to generate an executable attack script to simulate a security attack. The module then generates a security scan report of the server assets by executing the security attack script.

[0010] Preferably, the entire process of generating the executable attack script includes: the MCP module automatically scans the port information of the target server using the NMap tool, and calls the Deepseek large language model interface to generate the attack script based on the scan results and prompt words; the prompt words include analyzing the NMap scan results and setting the following constraints: using Metasploit and setting parameters, generating potential vulnerabilities, generating an executable attack script, and evaluating vulnerabilities according to three priority levels: high, medium, and low; the MCP module uses the generated attack script to execute attack commands to verify the vulnerability, and generates a vulnerability report after simulating the attack, as part of the security scan report.

[0011] Preferably, when the analysis result is a notification, the MCP module uses the Deepseek large language model interface to generate a corresponding vulnerability report and notifies the relevant operations and maintenance personnel via email, SMS or telephone. This operation belongs to the notification operation.

[0012] This invention also provides a hybrid cloud data center operation and maintenance method based on a large language model, the method being applied to claim 1. The hybrid cloud data center operation and maintenance system based on a large language model includes the following steps: Step S1: Collect daily monitoring reports from the hybrid cloud console, alarm information and historical curve data from standard components Zabbix and Prometheus, proactive alarm information from the self-developed platform, security scan reports of server assets, and professional knowledge generated by human experience through the MCP module; Step S2: Upload the collected data to the privately deployed Deepseek local knowledge base, and store and vectorize the data, supporting vector similarity search and manual search; Step S3: The MCP module, in conjunction with the Deepseek local knowledge base, calls the Deepseek large language model interface to analyze the vulnerabilities or optimization items existing in the server and generates formatted output; Step S4: Perform corresponding operations based on the analysis results, including: if it is an adjustable optimization item and matches a preset adjustable item, call the server-side API interface for automatic adjustment; if it is a security-related item, generate and execute an attack script to perform penetration testing and security scanning, and generate a report; if it is a notification-related item, notify relevant operation and maintenance personnel via email, SMS, or telephone.

[0013] Preferably, in step S1, the collection specifically includes: obtaining the daily monitoring report by collecting the content of operation and maintenance email information, collecting the alarm information and historical curve data by crawling, collecting the proactive alarm information by obtaining DingTalk alarm group messages, and generating the security scan report by executing a security attack script; in step S2, the Deepseek local knowledge base includes a vector database, supports importing documents and formatting data, block vectorization processing, human learning and MCP learning paths, and uses the networking function of the large language model to assist in collecting intelligence, including domain name information, company organizational structure and personnel contact information.

[0014] Preferably, in step S3, the analysis includes the MCP module combining the vulnerability data from the Deepseek local knowledge base and online searches, as well as the characteristics of the target server, to identify potential vulnerabilities, and calling the Deepseek large language model interface to generate an executable attack script for simulating a security attack, and generating a security scan report of the server assets by executing the security attack script.

[0015] Preferably, in step S4, when it is a security-related issue, the entire process of generating the attack script includes: automatically scanning the port information of the target server using the NMap tool, and generating the attack script by calling the Deepseek large language model interface based on the scan results and prompts; the prompts include analyzing the NMap scan results and setting the following constraints: using Metasploit and setting parameters, generating potential vulnerabilities, generating an executable attack script, and evaluating vulnerabilities according to three priority levels: high, medium, and low; the MCP module uses the generated attack script to execute attack commands to verify vulnerabilities and generates a vulnerability report after simulating the attack, as part of the security scan report.

[0016] The technical solution of this invention has the following beneficial effects: This invention establishes a hybrid cloud data center operation and maintenance system based on a large language model, which effectively solves problems such as low operation and maintenance efficiency, poor service stability, and low security under the hybrid cloud architecture. By establishing a localized knowledge base based on a large language model, it narrows the skill gap between operation and maintenance personnel and provides a standardized service operation and maintenance solution.

[0017] This invention collects multi-source data (such as daily hybrid cloud monitoring reports, Zabbix / Prometheus alarms, self-developed platform proactive alarms, security scan reports, and human experience knowledge) through the MCP module and uploads it to the private Deepseek local knowledge base, realizing data standardization and global visual monitoring, reducing the cumbersome operation of switching between multiple platforms, and improving operation and maintenance efficiency by more than 30%.

[0018] This invention breaks down data silos and achieves global visibility: by adapting the MCP module to multi-vendor hybrid cloud platforms, standard monitoring components and self-developed systems, it standardizes and uniformly stores heterogeneous data, supports cross-platform global monitoring, and avoids the inefficiency and errors of manual cross-system aggregation.

[0019] The Deepseek local knowledge base of this invention supports vector database storage, vectorization processing, and multi-dimensional search (such as vector similarity search and manual search). Combined with the networking function of the large language model, it assists in the collection of intelligence (such as domain name information and organizational structure), narrows the skill gap among operation and maintenance personnel, provides standardized solutions, and avoids the loss of tacit knowledge.

[0020] The system of this invention supports intelligent analysis and automated operation: optimization items can automatically call APIs to adjust resources; security items can generate and execute attack scripts to perform simulated penetration testing and security scanning, and generate reports; notification items can notify users via email / SMS / telephone, reducing manual intervention and enhancing service stability and security.

[0021] This invention integrates a local knowledge base with online intelligence, using a large language model to identify cross-system correlation anomalies, improving vulnerability identification accuracy to over 90%. Resource optimization suggestions are tailored to business scenarios, reducing misjudgments based on human experience. Security scan reports and attack scripts are automatically stored in the knowledge base, supporting dynamic iteration of vulnerability identification rules. Combined with real-time online intelligence, it enables rapid response to new threats, forming an automated security closed loop of "scan-verify-repair-re-scan," shortening the high-risk vulnerability remediation window by over 60% and reducing the risk of data leakage.

[0022] Human experience is structured and stored in a knowledge base, enabling automated reuse through vector retrieval. This helps new employees quickly solve problems, prevents knowledge loss due to staff turnover, and improves team troubleshooting efficiency. The local knowledge base is deployed privately, ensuring sensitive data stays within the enterprise and enhancing privacy. Attached Figure Description

[0023] Figure 1 This is a schematic diagram illustrating the principle of the hybrid cloud data center operation and maintenance system based on the large language model of this invention. Figure 2 This is a flowchart of the Deepseek local knowledge base of the present invention; Figure 3 A diagram illustrating the entire process of generating secure attack code by calling the Deepseek large language model interface for the MCP module. Detailed Implementation

[0024] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0025] Reference Figures 1 to 3This invention provides a hybrid cloud data center operation and maintenance system based on a large language model, including an MCP module, a Deepseek local knowledge base, and a Deepseek large language model interface. The MCP module collects daily monitoring reports from the hybrid cloud console, alarm information and historical curve data from standard components Zabbix and Prometheus, proactive alarm information from self-developed platforms, security scan reports of server assets, and professional knowledge generated through human experience, and uploads the collected data to the Deepseek local knowledge base. In this embodiment, the hybrid cloud monitoring reports are for multiple vendor platforms such as Tencent, Huawei, Alibaba, AWS, and Oracle, with varying formats and different indicator definitions. The MCP module adapts to the email protocols and parsing rules of each platform, converting scattered data into unified structured fields, allowing operation and maintenance personnel to view the hybrid cloud resource status globally through a single interface, avoiding the inefficiency of cross-platform switching. Regarding Zabbix and Prometheus data: Zabbix focuses on hardware indicators, while Prometheus excels at business time-series data; the two data are independent and their rules are not interoperable. The MCP module combines web crawling and APIs to pull two types of data in real time and associate them with server assets, providing the large language model with comprehensive "hardware + business" data. This helps identify cross-component correlation anomalies and improves anomaly detection accuracy. For self-developed platform alerts: Alerts from enterprise self-developed platforms are often pushed through tools like DingTalk groups, resulting in unstructured information that is difficult to integrate with standardized systems. The MCP module connects to the DingTalk API, parsing alert messages in real time and extracting key information. It then associates this information with hybrid cloud resource metrics and standard monitoring data to help the model pinpoint root causes, achieving a closed-loop business operation and maintenance process from alerts to root cause analysis. For security scan reports: The MCP module uses a built-in security script engine to regularly perform port scans and vulnerability baseline checks. Combined with attack simulation results, it generates reports containing "Vulnerability ID - Risk Level - Remediation Suggestions," providing the knowledge base with the latest security baseline data. This supports dynamic updates to vulnerability identification rules for the large language model, forming an automated security closed loop of "scanning - analysis - remediation," reducing the cost of manual penetration testing. For human experience and knowledge: The troubleshooting experience and optimization solutions of senior operations and maintenance personnel are often in document form, making reuse difficult. The MCP module uses a web interface and document parsing tools to convert this tacit knowledge into structured entries, building an "Operations and Maintenance Experience Base" in the knowledge base for junior personnel to retrieve and reuse. At the same time, it provides reasoning basis for large language models, standardizes processes, and narrows the skill gap within the team.The Deepseek local knowledge base is deployed privately and includes a vector database for storing and quantifying the collected data. It supports importing documents and formatted data, chunked vectorization processing, vector similarity search, manual search, MCP learning paths, and human learning paths. It also utilizes the networking capabilities of the large language model to assist in intelligence gathering, including domain information, company organizational structure, and personnel contact information. The private deployment resides on the enterprise intranet, ensuring data storage is independent of third parties, guaranteeing the security of sensitive data such as hybrid cloud resource configurations and vulnerability information, meeting compliance requirements, and allowing the enterprise to independently control data access permissions, reducing the risk of leakage. The vector database converts unstructured data (such as maintenance documents and alarm logs) into high-dimensional vector storage, overcoming the limitations of traditional keyword matching and preserving semantic information through vectors, providing a foundation for similarity search. Multi-type data processing supports importing documents, formatted data, and chunked vectorization processing, automatically classifying and storing unstructured and structured data, achieving unified storage of document experience, monitoring data, and asset information, forming a complete maintenance knowledge system.

[0026] Multi-dimensional search capabilities: Supports vector similarity search (automatically triggered by MCP or large language models, matching relevant knowledge to assist automated decision-making) and manual search (providing a web interface for operations and maintenance personnel to easily retrieve experience support, shortening fault handling time). Dual learning paths: MCP learning path (real-time data is automatically synchronized daily, triggering knowledge fusion and ensuring data timeliness); manual learning path (operations and maintenance personnel input experience and knowledge, which is updated after expert verification, storing tacit knowledge to prevent loss and ensure accuracy).

[0027] Networked Intelligence Gathering: Leveraging the networking capabilities of the large language model, this module collects domain information (registration information, IP binding relationships, assisting in associating domains with server assets), company organizational structure, and personnel contact information (synchronized updates ensure accurate notification delivery and avoid information harassment or failure), expanding knowledge boundaries to improve decision-making accuracy. The MCP module, combined with the Deepseek local knowledge base, calls the Deepseek large language model interface to analyze server vulnerabilities or optimization items. Based on the analysis results, it generates formatted output and performs corresponding operations, including automatic adjustment of adjustable optimization items, security penetration testing and security scanning, and notification operations. Specifically, the intelligent analysis of vulnerabilities and optimization items integrates real-time data (server ports, resource utilization, etc.) with historical data from the knowledge base (vulnerability records, optimization cases). Through deep analysis using the large language model, it identifies potential vulnerabilities and classifies them by risk, generating specific optimization suggestions to replace manual investigation, improving efficiency and accuracy, and avoiding improper resource allocation. Formatted Output: Results are presented in a standardized format (including problem type, description, suggestions, priority, etc.) to ensure direct parsing by the MCP, avoiding human ambiguity and facilitating archiving and auditing. Adjustable and Optimizable Items: When matching the knowledge base whitelist, automatically execute the process by calling the cloud platform API (such as scaling up) to reduce manual intervention and avoid business interruption; Security: Scan port information, combine it with attack scripts generated by the model to simulate attacks and verify vulnerabilities, generate scan reports and update them to the knowledge base, replacing manual testing and providing accurate remediation basis; Notification: When manual intervention is required, push notifications (including details, suggestions, etc.) based on knowledge base personnel information to ensure accountability and improve response efficiency.

[0028] Furthermore, the MCP module obtains the daily monitoring report of the hybrid cloud console by collecting the content of operation and maintenance email information, collects alarm information and historical curve data of the standard components zabbix and Prometheus by crawling, collects the proactive alarm information of the self-developed platform by obtaining DingTalk alarm group messages, and generates a security scan report of the server assets by executing security attack scripts.

[0029] The MCP module uses targeted technologies such as email parsing, web crawling, DingTalk message listening, and secure script execution to achieve accurate, efficient, and comprehensive collection of various types of operation and maintenance data in a hybrid cloud environment. Breaking down data silos in hybrid cloud platforms and achieving global resource visibility, this system collects daily monitoring reports from hybrid cloud consoles (Tencent, Huawei, Alibaba, AWS, Oracle) via maintenance emails, resolving the issues of heterogeneous and fragmented data formats across multiple cloud vendors. It integrates standardized monitoring component data to build a full-link fault tracing system, collecting alarm information and historical curve data from Zabbix and Prometheus through web scraping to achieve linked analysis of hardware and business metrics. It also collects proactive alarm information from its self-developed platform by acquiring DingTalk alarm group messages, solving the problems of scattered alarms and delayed responses in enterprise-developed systems. Finally, it automatically generates security scan reports, constructing a dynamic protective barrier. By executing security attack scripts, it generates security scan reports for server assets, replacing traditional manual penetration testing and improving the accuracy and efficiency of security protection.

[0030] Furthermore, when the analysis result is an adjustable optimization item and matches the preset adjustable items in the Deepseek local knowledge base, the MCP module calls the API interface provided by the server to automatically adjust it, automatically operating based on verified rules, replacing the manual application-approval process; strictly following the preset range to avoid the risk of disordered operation; and standardizing the execution of similar adjustments to reduce problems caused by differences in human operation.

[0031] Furthermore, when the analysis result is security-related, the MCP module combines the Deepseek local knowledge base and vulnerability data from online searches, along with the characteristics of the target server, to identify potential vulnerabilities. It then calls the Deepseek large language model interface to generate an executable attack script to simulate a security attack and generates a security scan report of the server assets by executing the attack script. When the analysis result is security-related, the MCP module combines the local knowledge base, online vulnerability data, and server characteristics to identify vulnerabilities, calls the large language model to generate an attack script to simulate an attack, and generates a security report. Its core uses are as follows: Accurately identifying potential vulnerabilities: By integrating local historical vulnerability records, real-time online intelligence (such as CVE databases), and server characteristics (ports, service versions, etc.), it accurately locates risks (such as Apache specific version vulnerabilities), solving the problems of high false negative rates and narrow coverage in traditional manual scanning, increasing vulnerability identification accuracy to over 90%. Automated vulnerability verification: Executable attack scripts (such as Metasploit-based verification code) are automatically generated using large language models to simulate real attack logic and verify vulnerability exploitability. This replaces the tedious process of manually writing scripts, reducing verification time from days to hours. Targeted remediation support: Reports containing vulnerability details, risk level, affected assets, and customized remediation solutions are generated, clearly defining remediation paths (such as upgrading component versions or adjusting configurations), avoiding the problem of traditional reports only listing items and lacking guidance. Cost reduction and efficiency improvement: Automated processes replace manual penetration testing, reducing manpower by more than 60%. Full asset scanning time is reduced from days to hours, making it particularly suitable for rapid security checks before peak sales periods. Closed-loop security knowledge storage: Reports and scripts are automatically stored in a knowledge base, iterating vulnerability identification rules and reusing script templates to continuously improve scanning accuracy. Simultaneously, standardized remediation solutions narrow the skill gap within teams.

[0032] Furthermore, the entire process of generating the executable attack script includes: the MCP module automatically scans the target server's port information using the NMap tool, and calls the Deepseek large language model interface to generate the attack script based on the scan results and prompts; the prompts include analyzing the NMap scan results and setting the following constraints: using Metasploit and setting parameters, generating potential vulnerabilities, generating an executable attack script, and evaluating vulnerabilities according to high, medium, and low priority levels; the MCP module uses the generated attack script to execute attack commands to verify the vulnerability and generates a vulnerability report after the simulated attack, as part of the security scan report. This process, through a closed-loop design of NMap scanning, large language model script generation, and simulated attack verification, achieves accurate identification and quantitative assessment of security vulnerabilities. Its core functions are as follows: accurate collection of port information, laying the foundation for vulnerability analysis; the MCP module automatically calls the NMap tool to scan the target server's ports, obtaining open ports, running services, and version information. This data provides accurate basis for subsequent vulnerability analysis, avoids blind scanning, and improves scanning efficiency by more than 30%. Constrained script generation ensures attack executability and standardization. Based on NMap results and structured hints, scripts are generated using the Deepseek large language model interface. Tool standardization: The Metasploit framework is used uniformly to ensure script compatibility. Parameter explicitness: Key parameters such as target IP, port, and attack payload are included. Risk grading: Vulnerabilities are categorized as "high, medium, and low" to assist in prioritizing high-risk handling. Simulated attacks verify vulnerability authenticity, avoiding false alarms and misjudgments. Attack scripts are executed to simulate real attacks, and the exploitability of vulnerabilities is determined by the returned results. This process filters out vulnerabilities that are "theoretically existing but actually patched," ensuring the accuracy of security scan reports. Structured vulnerability reports are output to support efficient remediation. Simulated attack results are integrated into a report containing "port information - service version - vulnerability details - verification process - remediation suggestions," providing the operations team with "ready-to-use" remediation guidelines and shortening the vulnerability handling cycle by more than 50%.

[0033] Furthermore, when the analysis result is a notification, the MCP module uses the Deepseek large language model interface to generate a corresponding vulnerability report and notifies relevant operations and maintenance personnel via email, SMS, or telephone. This operation falls under the notification category. In this embodiment, a clear and standard vulnerability report is generated using a large language model, facilitating quick understanding by operations and maintenance personnel; email, SMS, or telephone are selected based on urgency to accurately notify the relevant responsible persons, avoiding irrelevant interference; and the manual notification process is replaced, reaching recipients within minutes, thus saving time for vulnerability remediation.

[0034] This invention also provides a hybrid cloud data center operation and maintenance method based on a large language model. This method is applied to a hybrid cloud data center operation and maintenance system based on a large language model and includes the following steps: Step S1: Collect daily monitoring reports from the hybrid cloud console, alarm information and historical curve data from standard components Zabbix and Prometheus, proactive alarm information from the self-developed platform, security scan reports of server assets, and professional knowledge generated through human experience via the MCP module; Step S2: Upload the collected data to a privately deployed Deepseek local knowledge base, and store and vectorize the data. The system supports vector similarity search and manual search. Step S3: The MCP module, combined with the Deepseek local knowledge base, calls the Deepseek large language model interface to analyze vulnerabilities or optimization items on the server and generates formatted output. Step S4: Based on the analysis results, corresponding operations are performed, including: if it is an adjustable optimization item and matches a preset adjustable item, the server-side API interface is called for automatic adjustment; if it is a security-related item, an attack script is generated and executed for penetration testing and security scanning, and a report is generated; if it is a notification item, relevant operations and maintenance personnel are notified via email, SMS, or telephone.

[0035] Furthermore, in step S1, the collection specifically includes: obtaining the daily monitoring report by collecting the content of operation and maintenance email information, collecting the alarm information and historical curve data by crawling, collecting the proactive alarm information by obtaining DingTalk alarm group messages, and generating the security scan report by executing a security attack script; in step S2, the Deepseek local knowledge base includes a vector database, supports importing documents and formatting data, block vectorization processing, human learning and MCP learning paths, and utilizes the networking function of the large language model to assist in collecting intelligence, including domain name information, company organizational structure and personnel contact information.

[0036] Furthermore, in step S3, the analysis includes the MCP module combining the vulnerability data from the Deepseek local knowledge base and online searches, as well as the characteristics of the target server, to identify potential vulnerabilities, and calling the Deepseek large language model interface to generate an executable attack script for simulating a security attack, and generating a security scan report of the server assets by executing the security attack script.

[0037] Furthermore, in step S4, when it is a security-related issue, the entire process of generating the attack script includes: automatically scanning the port information of the target server using the NMap tool, and generating the attack script by calling the Deepseek large language model interface based on the scan results and prompts; the prompts include analyzing the NMap scan results and setting the following constraints: using Metasploit and setting parameters, generating potential vulnerabilities, generating an executable attack script, and evaluating vulnerabilities according to three priority levels: high, medium, and low; the MCP module uses the generated attack script to execute attack commands to verify vulnerabilities and generates a vulnerability report after simulating the attack, as part of the security scan report.

[0038] As can be seen from the above embodiments, the present invention collects multi-source data (such as daily monitoring reports of hybrid cloud, zabbix / Prometheus alarms, proactive alarms from self-developed platforms, security scan reports, and human experience knowledge) uniformly through the MCP module, and uploads it to the private Deepseek local knowledge base, thereby achieving data standardization and global visual monitoring, reducing the cumbersome operation of switching between multiple platforms, and improving operation and maintenance efficiency by more than 30%.

[0039] This invention breaks down data silos and achieves global visibility: by adapting the MCP module to multi-vendor hybrid cloud platforms, standard monitoring components and self-developed systems, it standardizes and uniformly stores heterogeneous data, supports cross-platform global monitoring, and avoids the inefficiency and errors of manual cross-system aggregation.

[0040] The Deepseek local knowledge base of this invention supports vector database storage, vectorization processing, and multi-dimensional search (such as vector similarity search and manual search). Combined with the networking function of the large language model, it assists in the collection of intelligence (such as domain name information and organizational structure), narrows the skill gap among operation and maintenance personnel, provides standardized solutions, and avoids the loss of tacit knowledge.

[0041] The system of this invention supports intelligent analysis and automated operation: optimization items can automatically call APIs to adjust resources; security items can generate and execute attack scripts to perform simulated penetration testing and security scanning, and generate reports; notification items can notify users via email / SMS / telephone, reducing manual intervention and enhancing service stability and security.

[0042] This invention integrates a local knowledge base with online intelligence, using a large language model to identify cross-system correlation anomalies, improving vulnerability identification accuracy to over 90%. Resource optimization suggestions are tailored to business scenarios, reducing misjudgments based on human experience. Security scan reports and attack scripts are automatically stored in the knowledge base, supporting dynamic iteration of vulnerability identification rules. Combined with real-time online intelligence, it enables rapid response to new threats, forming an automated security closed loop of "scan-verify-repair-re-scan," shortening the high-risk vulnerability remediation window by over 60% and reducing the risk of data leakage.

[0043] Human experience is structured and stored in a knowledge base, enabling automated reuse through vector retrieval. This helps new employees quickly solve problems, prevents knowledge loss due to staff turnover, and improves team troubleshooting efficiency. The local knowledge base is deployed privately, ensuring sensitive data stays within the enterprise and enhancing privacy.

[0044] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural transformations made using the contents of the present invention's specification and drawings under the inventive concept of the present invention, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A hybrid cloud data center operation and maintenance system based on a large language model, characterized in that, The system includes an MCP module, a Deepseek local knowledge base, and a Deepseek large language model interface. The MCP module collects daily monitoring reports from the hybrid cloud console, alarm information and historical curve data from standard components Zabbix and Prometheus, proactive alarm information from the self-developed platform, security scan reports of server assets, and professional knowledge generated through human experience. It then uploads the collected data to the Deepseek local knowledge base. The Deepseek local knowledge base is privately deployed and includes a vector database for storing and quantizing the collected data. It supports importing documents and formatting data, block vectorization processing, vector similarity search, manual search, MCP learning paths, and manual learning paths, as well as utilizing the network capabilities of the large language model to assist in intelligence gathering. The MCP module, in conjunction with the Deepseek local knowledge base, calls the Deepseek large language model interface to analyze vulnerabilities or optimizations existing in the server. Based on the analysis results, it generates formatted output and performs corresponding operations, including automatic adjustment of adjustable optimizations, security penetration testing and security scanning, and notification operations.

2. The hybrid cloud data center operation and maintenance system based on a large language model according to claim 1, characterized in that, The MCP module obtains the daily monitoring report of the hybrid cloud console by collecting the content of operation and maintenance emails, collects alarm information and historical curve data of the standard components zabbix and Prometheus by crawling, collects the proactive alarm information of the self-developed platform by obtaining DingTalk alarm group messages, and generates a security scan report of the server assets by executing security attack scripts.

3. The hybrid cloud data center operation and maintenance system based on a large language model according to claim 1, characterized in that, When the analysis result is an adjustable optimization item and matches the preset adjustable item in the Deepseek local knowledge base, the MCP module calls the API interface provided by the server to automatically adjust.

4. The hybrid cloud data center operation and maintenance system based on a large language model according to claim 1, characterized in that, When the analysis result is security-related, the MCP module combines the vulnerability data from the DeepSeek local knowledge base and online searches, as well as the characteristics of the target server, to identify potential vulnerabilities. It then calls the DeepSeek large language model interface to generate an executable attack script to simulate a security attack and generates a security scan report of the server assets by executing the security attack script.

5. The hybrid cloud data center operation and maintenance system based on a large language model according to claim 4, characterized in that, The entire process of generating an executable attack script includes: the MCP module automatically scans the port information of the target server using the NMap tool, and calls the Deepseek large language model interface to generate the attack script based on the scan results and prompts; the prompts include analyzing the NMap scan results and setting the following constraints: using Metasploit and setting parameters, generating potential vulnerabilities, generating an executable attack script, and evaluating vulnerabilities according to three priority levels: high, medium, and low; the MCP module uses the generated attack script to execute attack commands to verify the vulnerability and generates a vulnerability report after simulating the attack, as part of the security scan report.

6. The hybrid cloud data center operation and maintenance system based on a large language model according to claim 1, characterized in that, When the analysis result is a notification, the MCP module uses the Deepseek large language model interface to generate a corresponding vulnerability report and notifies the relevant operations and maintenance personnel via email, SMS or telephone. This operation belongs to the notification operation.

7. A hybrid cloud data center operation and maintenance method based on a large language model, characterized in that, The method is applied to the hybrid cloud data center operation and maintenance system based on the large language model as described in claim 1, and includes the following steps: Step S1, collecting daily monitoring reports from the hybrid cloud console, alarm information and historical curve data from standard components Zabbix and Prometheus, proactive alarm information from the self-developed platform, security scan reports of server assets, and professional knowledge generated by human experience through the MCP module; Step S2, uploading the collected data to the privately deployed Deepseek local knowledge base, and storing and vectorizing the data to support vector similarity search and manual search; Step S3, the MCP module, in conjunction with the Deepseek local knowledge base, calls the Deepseek large language model interface to analyze the vulnerabilities or optimization items existing in the server and generates formatted output; Step S4, performing corresponding operations based on the analysis results, including: if it is an adjustable optimization item and matches a preset adjustable item, calling the server-side API interface for automatic adjustment; if it is a security-related item, generating and executing an attack script for penetration testing and security scanning, and generating a report; if it is a notification-related item, notifying relevant operation and maintenance personnel via email, SMS, or telephone.

8. The hybrid cloud data center operation and maintenance method based on a large language model according to claim 7, characterized in that, In step S1, the collection specifically includes: obtaining the daily monitoring report by collecting the content of operation and maintenance emails; collecting the alarm information and historical curve data by crawling; collecting the proactive alarm information by obtaining DingTalk alarm group messages; and generating the security scan report by executing a security attack script. In step S2, the Deepseek local knowledge base includes a vector database, supports importing documents and formatting data, block vectorization processing, human learning and MCP learning paths, and utilizes the networking function of the large language model to assist in collecting intelligence, including domain name information, company organizational structure and personnel contact information.

9. The hybrid cloud data center operation and maintenance method based on a large language model according to claim 7, characterized in that, In step S3, the analysis includes the MCP module combining the vulnerability data from the Deepseek local knowledge base and online searches, as well as the characteristics of the target server, to identify potential vulnerabilities, and calling the Deepseek large language model interface to generate an executable attack script for simulating a security attack, and generating a security scan report of the server assets by executing the security attack script.

10. The hybrid cloud data center operation and maintenance method based on a large language model according to claim 9, characterized in that, In step S4, when the target is a security class, the entire process of generating the attack script includes: automatically scanning the port information of the target server using the NMap tool, and generating the attack script by calling the Deepseek large language model interface based on the scan results and prompts; the prompts include analyzing the NMap scan results and setting the following constraints: using Metasploit and setting parameters, generating potential vulnerabilities, generating an executable attack script, and evaluating vulnerabilities according to three priority levels: high, medium, and low; the MCP module uses the generated attack script to execute attack commands to verify vulnerabilities and generates a vulnerability report after simulating the attack, which is part of the security scan report.

Images