Intelligent operation and maintenance management method based on big data algorithm
By constructing a dynamic fault association map and a reverse tracing algorithm, the problem of being unable to quantify the potential for fault propagation at risk nodes in traditional operation and maintenance methods is solved. This enables accurate location of vulnerable points in the system and rapid root cause analysis, thereby improving system resilience and operation and maintenance efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HANGZHOU FOCUS TECHNOLOGY CO LTD
- Filing Date
- 2025-10-15
- Publication Date
- 2026-05-22
AI Technical Summary
Traditional operation and maintenance methods cannot effectively characterize and utilize dynamic topology relationships, lack quantitative assessment of the potential for fault propagation at risk nodes, resulting in a lack of basis for operation and maintenance decisions, an inability to prioritize resource allocation for high-risk vulnerabilities, and a lack of brute force in building system resilience.
Based on big data algorithms, a dynamic fault association map is constructed. Potential risk nodes are identified through multi-source heterogeneous operation and maintenance data. Fault propagation simulation and severity quantification assessment are carried out. Combined with reverse tracing algorithms, the fault propagation path is accurately located and the root cause analysis is achieved.
It enables precise location of the points in the system with the strongest fault propagation capability and the most severe business impact, thereby improving system resilience, reducing business risks, shortening fault location time, and improving the accuracy and efficiency of operation and maintenance decisions.
Smart Images
Figure CN121301065B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of big data technology, specifically to an intelligent operation and maintenance management method based on big data algorithms. Background Technology
[0002] In modern, complex, large-scale distributed systems, operational data exhibits characteristics of being multi-sourced, heterogeneous, high-dimensional, and dynamically interconnected. Performance metrics, log events, call chains, and configuration data are linked by numerous implicit and time-varying relationships, collectively forming a vast, dynamically evolving network of system state dependencies. Traditional operational methods typically rely on static rules or single-dimensional thresholds for anomaly detection, failing to effectively characterize and utilize this dynamic topological interconnection. Their core limitation lies in the fact that even if isolated "potential risk nodes" are identified through certain methods, they lack the ability to quantitatively assess the failure propagation potential of these risk nodes. The system cannot answer the crucial question: "Which potential risk node, once it fails, will trigger the most severe business-level cascading failure along the implicit interconnected links?" This leads to a lack of basis for operational decisions, preventing the prioritization of resource allocation (such as hardening, redundancy design, or contingency planning) for truly high-risk vulnerabilities. Instead, it passively waits for failures to occur before responding, resulting in a lack of direction in building system resilience. Summary of the Invention
[0003] The purpose of this invention is to provide an intelligent operation and maintenance management method based on big data algorithms to address the problems mentioned in the background. Specific technical issues include how to simulate fault propagation and quantify the severity of identified potential risk nodes based on dynamic fault correlation graphs, thereby accurately locating the most vulnerable points in the system with the strongest fault propagation capabilities and the most severe business impact. This addresses the problem that traditional methods cannot identify the highest priority targets from numerous potential risks, providing precise decision-making basis for proactive capacity planning, disaster recovery design, and emergency drills.
[0004] To achieve the above objectives, the present invention provides an intelligent operation and maintenance management method based on big data algorithms, specifically including the following method steps:
[0005] S1. Input multi-source heterogeneous operation and maintenance data, including performance indicator data, text log data, call chain data, and configuration item change data. The purpose of this step is to provide a comprehensive and diverse data foundation for subsequent analysis. By aggregating various heterogeneous data sources such as performance indicators, logs, call chains, and configuration data, a basis is provided for building a graph model that can truly reflect the static dependencies and dynamic relationships of the system, ensuring the accuracy and reliability of subsequent analysis results.
[0006] S2. Construct and continuously update a dynamic fault association graph based on multi-source heterogeneous operation and maintenance data, by identifying and creating operation and maintenance entity nodes and event entity nodes; create edges between nodes based on the inherent relationships between multi-source heterogeneous operation and maintenance data, including static dependencies and dynamic associations; continuously monitor new multi-source heterogeneous operation and maintenance data, and incrementally update the nodes and edges in the dynamic fault association graph in real time, adjusting the edge weights; where:
[0007] Static dependencies are obtained directly from the deployment relationships in the configuration item change data; dynamic relationships are calculated in real time by analyzing the co-occurrence information in the text log data, the call sequence relationship in the call chain data, and the correlation of performance indicator data.
[0008] The core effect of step S2 is to integrate discrete multi-source data into a unified, dynamically evolving knowledge graph. By distinguishing between static dependencies and dynamic associations and updating edge weights in real time, it makes the complex and implicit inter-component relationships within the system explicit and quantifiable, providing a highly realistic dynamic network model for subsequent risk propagation analysis. This is a prerequisite for conducting accurate fault impact simulation.
[0009] S3. Based on a predefined time period, initiate a full-map scan of the dynamic fault association graph, detect abnormal topologies that meet risk conditions using a graph pattern recognition algorithm, and mark the core nodes constituting the abnormal topology as potential risk nodes; the process of the graph pattern recognition algorithm detecting abnormal topologies specifically includes:
[0010] The topology of the dynamic fault association map is matched with a predefined pattern template, which represents the risk conditions of the anomaly.
[0011] When the topology of a local subgraph is detected to meet any of the risk conditions, it is determined that there is an abnormal topology at that location.
[0012] Based on the pattern rules corresponding to the matched pattern template, multiple core nodes are identified and determined from the multiple nodes constituting the abnormal topology, and they are marked as potential risk nodes.
[0013] The role of step S3 is to proactively and automatically screen out local structures that conform to specific risk patterns from the dynamic fault association map. It solves the problem that traditional threshold alarms cannot identify complex topological risks, and realizes the leap from "detecting node anomalies" to "identifying structural anomalies", thereby first locating the "risk suspects" (potential risk nodes) that may cause faults, and clarifying the target objects for subsequent in-depth quantitative assessment.
[0014] S4. For potential risk nodes, based on their abnormal topology and edge weights in the dynamic fault association graph, perform dynamic impact diffusion simulation to calculate the diffusion range and severity quantification value of the impact on related services after each potential risk node fails, and mark them as fault propagation vulnerability points based on the severity quantification value; the specific execution process of dynamic impact diffusion simulation includes:
[0015] Potential risk nodes are used as the starting points for simulating faults, and their abnormal topology is used as the network. The weights of the edges in the graph are used as the probability of fault propagation along the edges.
[0016] An iterative algorithm is used to simulate the recursive propagation of the fault state along the outgoing edge to neighboring nodes, and the state changes of the affected nodes are calculated.
[0017] After the simulation terminates, the results are summarized and the diffusion range and severity quantification values are calculated; the calculation process for the severity quantification value specifically includes:
[0018] Aggregate all nodes marked as affected in the dynamic impact diffusion simulation, where the contribution value of each affected node is the product of its preset business criticality weight and the intensity of the simulated failure it suffers; sum the contribution values of all affected nodes as the quantification value of the severity of this simulation;
[0019] All potential risk nodes are sorted according to their severity quantification values, and nodes with a ranking higher than a certain threshold are further marked as vulnerability points for fault propagation.
[0020] Step S4 is crucial for resolving core technical issues. It simulates the outbreak and propagation of faults in the specific network environment of each "suspected risk node" and ultimately calculates the quantifiable severity of the potential impact of the fault by aggregating the business criticality weight and fault intensity. The effect is that it can accurately answer the question of "which of the many risk nodes will have the most severe consequences from failure", thereby transforming the abstract "potential risk" into specific quantitative indicators that can be ranked and compared, and accurately locating the "fault propagation vulnerability" that truly needs to be addressed first.
[0021] S5. In response to the completion of marking potential risk nodes, starting from the potential risk node, and combining the weights and types of edges in the dynamic fault association graph, execute the reverse tracing algorithm to output the fault propagation path and the identifier of the source fault node. When executing the reverse tracing algorithm, its search strategy will prioritize exploring paths pointing to marked fault propagation vulnerability points in the dynamic fault association graph; specifically including:
[0022] Using the unique identifier of a potential risk node as input, query the set of all its incoming edges;
[0023] Initialize a priority queue to manage the path nodes to be explored, and calculate a path priority score for each incoming edge; the path priority score is a function of edge weight, edge type, and destination node attributes; if the destination node attributes contain a vulnerability marker for fault propagation, the path priority score will receive the maximum boost factor.
[0024] The process iterates through the queue to extract the node with the highest path priority score and calculates the probability that it will become the source failure node until a source failure node with a probability exceeding the threshold is found or the queue is empty.
[0025] The final output is a sequence of fault propagation path nodes ordered by time, along with the identifier of the source fault node.
[0026] In addition, when a visible fault event that has actually occurred is detected, the reverse tracing algorithm is immediately triggered, starting from the event entity node corresponding to the visible fault event, to locate the source fault node that caused the visible fault.
[0027] Step S5 effectively traces the most likely root cause of high-impact risk points (vulnerabilities) by prioritizing the exploration of paths leading to marked vulnerabilities. This significantly improves the efficiency and accuracy of tracing, enabling rapid identification of the source fault node that triggered the entire fault propagation chain. This not only solves the root cause problem after a fault occurs but, more importantly, provides a clear roadmap for understanding the complete fault propagation chain and developing defense strategies from the source. Furthermore, when an actual fault (i.e., a "manifest fault event") has occurred, efficient automated root cause localization can be initiated immediately. Starting from the node corresponding to the alarm event, it utilizes a pre-constructed dynamic fault association graph and an optimized reverse tracing algorithm to quickly trace the fault propagation path. Its core effect is a significant reduction in average fault location time. By prioritizing the exploration of paths leading to known "fault propagation vulnerabilities," it intelligently skips numerous irrelevant branches, directly pointing to the fault source most likely to cause this large-scale impact, thus gaining valuable time for subsequent emergency recovery and solving the problems of time-consuming and misjudgment-prone traditional fault investigation.
[0028] S6. Based on the fault propagation path and the source fault node identifier, generate and execute the corresponding fault handling strategy, specifically including:
[0029] The fault propagation path and source fault node identifier are matched with a pre-defined strategy knowledge base for pattern matching.
[0030] Once a match is successful, an executable fault handling strategy is generated based on the specific fault scenario and parameterized parameters.
[0031] Policy commands are directly issued and executed by calling the application interface of the operation and maintenance automation platform, and the execution status is fed back to the monitoring system in real time.
[0032] Step S6 ultimately transforms the aforementioned analysis results into automated operation and maintenance actions. By matching the knowledge base and parameterizing the generated strategies, it can automatically and quickly execute predefined handling plans for specific fault propagation paths and root causes, thereby proactively suppressing fault spread or quickly repairing problems, directly transforming technical analysis capabilities into practical benefits that enhance system resilience.
[0033] Compared with the prior art, the beneficial effects of the present invention are:
[0034] This invention constructs a dynamic fault association map, enabling deep fusion and real-time evolution of multi-source heterogeneous operation and maintenance data. It can proactively identify risk topologies that characterize system anomalies. Its core benefit lies in accurately quantifying the fault propagation potential of each potential risk node through dynamic impact diffusion simulation, thereby locating the most vulnerable points of fault propagation that have the most severe impact on business. This solves the key problem that traditional operation and maintenance cannot prioritize handling from numerous risks. Furthermore, combined with a reverse tracing algorithm, it can predict the highest risk path and source in advance, and quickly locate the root cause after a fault occurs. Finally, through policy automation, it realizes an intelligent closed loop from perception, assessment, tracing to handling, significantly improving system resilience and reducing business risks. Attached Figure Description
[0035] Figure 1 This is a schematic diagram of the overall method steps of the present invention;
[0036] Figure 2 This is the core flowchart of step S4 of the present invention;
[0037] Figure 3 This is the core flowchart of step S5 of the present invention. Detailed Implementation
[0038] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0039] Next, please refer to Figure 1 The purpose of this embodiment is to provide an intelligent operation and maintenance management method based on big data algorithms, which includes the following steps:
[0040] S1. Through a pre-defined data interface, multi-source heterogeneous operation and maintenance data is continuously and concurrently received from multiple different monitoring data sources. This multi-source heterogeneous operation and maintenance data includes performance indicator data collected from servers, network devices, and storage devices; text log data collected from operating systems, databases, middleware, and applications; call chain data collected from a distributed tracing system; and configuration item change data collected from a configuration management database. Simultaneously, the multi-source heterogeneous operation and maintenance data is immediately standardized, cleaned, and formatted. Performance indicator data is converted into a time-series data format with timestamps; text log data is normalized and parsed to extract log events with a unified structure; call chain data is reconstructed into a call span sequence with parent-child relationships; and configuration item change data is converted into structured change event records. This step ensures that subsequent processing flows can operate based on a complete, standardized, and unified set of data, laying a solid data foundation for building a high-quality dynamic fault correlation graph.
[0041] S2. Based on standardized multi-source heterogeneous operation and maintenance data, an entity and relation extraction algorithm is used to automatically construct and dynamically update a knowledge graph called Dynamic Fault Association Graph, which specifically includes:
[0042] First, identify and create two types of nodes: operation and maintenance entity nodes and event entity nodes. Operation and maintenance entity nodes correspond to physical and software resources, such as hosts and database instances. Event entity nodes correspond to state changes, such as an error log event.
[0043] Subsequently, edges are created between nodes based on the inherent relationships between multi-source heterogeneous operation and maintenance data. The types of edges include static dependencies and dynamic associations. Static dependencies are directly obtained from deployment relationships in configuration item change data; dynamic associations are calculated in real time by analyzing co-occurrence information in text log data, call sequence relationships in call chain data, and the correlation of performance metrics data. The process of obtaining static dependencies is as follows:
[0044] Read and identify the explicitly recorded, pre-defined deployment relationship information in the configuration item change data, such as "application A is deployed on virtual machine B" or "database instance C runs on server D"; these relationships are inherent and relatively stable physical or logical dependencies and connections in the system architecture; the acquisition process is to directly extract the configuration item pairs with explicit relationships from these structured change event records and map them one-to-one as static dependencies between two operation and maintenance entity nodes in the dynamic fault association graph;
[0045] The calculation process for dynamic associations is as follows:
[0046] First, text log data is analyzed to infer potential correlations by statistically analyzing the co-occurrence frequency of log events generated by different components or services within the same time window. Second, call chain data is processed to construct the real-time call sequence and dependency path between services by parsing the parent-child span relationship of cross-service calls. Finally, performance indicator data is analyzed to discover their linkage change patterns by calculating the statistical correlation (such as the CPU utilization of different hosts) of different indicator sequences (such as the Pearson correlation coefficient). The above analysis results (co-occurrence frequency, call chain, and statistical correlation) are integrated in real time to create or update dynamic association edges representing the real-time dynamic interaction strength between corresponding nodes in the graph, and their weights are determined by the calculated association strength values.
[0047] After the dynamic fault association graph is constructed, new operation and maintenance data streams are continuously monitored. Once a new event occurs or a new relationship is identified by the algorithm, the nodes and edges in the dynamic fault association graph are updated incrementally in real time, and the weights of the edges are adjusted to ensure that the graph is always an accurate mapping of the real-time state of the entire system.
[0048] S3 has a built-in timer scheduler that periodically triggers full-map scan tasks according to predefined time intervals. Once the task starts, it loads the latest dynamic fault association map and calls a graph pattern recognition algorithm to traverse and analyze the global topology of the dynamic fault association map, specifically including:
[0049] The graph pattern recognition algorithm predefines a series of risk conditions and pattern templates to represent anomalies, such as star-shaped radial pattern, abnormal call chain pattern, and dense connection cluster pattern. It matches the topology of the dynamic fault association graph with the predefined pattern templates. When the topology of a local subgraph is detected to meet any of the risk conditions, it is determined that there is an abnormal topology at that location.
[0050] Subsequently, based on the pattern rules corresponding to the matched pattern template, multiple nodes that play a core role are identified from the multiple nodes constituting the abnormal topology, and the status of the nodes is updated and marked as potential risk nodes. This marked status will be stored as a persistent attribute in the dynamic fault association graph, providing a clear input object for subsequent analysis processes.
[0051] S4, please refer to Figure 2 For each marked potential risk node, a dynamic impact diffusion simulation process will be initiated, which specifically includes:
[0052] The dynamic impact diffusion simulation takes potential risk nodes as the starting point of the simulated fault, takes the abnormal topology of the nodes in the dynamic fault association graph as the network, and takes the weight of the edge in the graph as the probability of the fault propagating along the edge.
[0053] The dynamic impact diffusion simulation process employs an iterative algorithm to simulate the recursive propagation of a fault state along outgoing edges to neighboring nodes. Each iteration calculates the state changes of the affected nodes. The specific process of the iterative algorithm is as follows:
[0054] First, the simulated fault state of the initial potential risk node is initialized to an initial strength value, and then an iterative process is initiated. In each iteration, all currently affected nodes are traversed, each outgoing edge is examined, and the strength of the fault successfully propagated to its neighboring nodes is calculated based on the fault propagation probability represented by the weight of the outgoing edge. This strength value serves as the input for the neighboring node in the next iteration cycle, while also aggregating the fault impact from multiple upstream nodes. The final state of each node is determined by the simulated fault input strength it bears and its own business criticality weight. The iterative process continues until the simulated fault strength decays below a preset threshold as the propagation path extends, making it impossible to activate new nodes or affecting any new nodes, at which point the algorithm automatically terminates.
[0055] After the simulation ends, the final results are summarized, and two core quantitative indicators are calculated: the diffusion range and the severity quantification value. The diffusion range represents the total number of nodes affected by the simulated fault. The severity quantification value is calculated by aggregating the preset business criticality weights on all affected nodes and the intensity of the simulated fault they endure. Specifically, it is calculated by aggregating all nodes marked as affected in the dynamic impact diffusion simulation, where the value contributed by each affected node is the product of its preset business criticality weight and the intensity of the simulated fault it endures. The final sum of the contribution values of all affected nodes is the severity quantification value of this simulation.
[0056] After the calculation is completed, all potential risk nodes are sorted according to their severity quantification values, and nodes ranked above a certain threshold are further marked as vulnerability points for fault propagation. This marking is a higher level of risk identification than potential risk nodes, and it directly indicates the weak link in the system that may cause the most serious business impact once a failure occurs.
[0057] S5, please refer to Figure 3 In response to the completion of marking potential risk nodes, starting from these potential risk nodes, and combining the weights and types of edges in the dynamic fault association graph, a reverse source tracing algorithm is executed, specifically including:
[0058] Using the unique identifier of the potential risk node as input parameter, the dynamic fault association graph is first accessed to query and obtain the set of all incoming edges of the node; a priority queue is initialized to manage the path nodes to be explored; for each incoming edge, its path priority score is calculated, which is a function of edge weight, edge type and destination node attribute; if the destination node attribute contains a fault propagation vulnerability marker, its path priority score will receive the maximum boost factor.
[0059] The process iteratively extracts the node with the highest path priority score from the priority queue and processes it. The probability of its failure propagation is calculated. If the calculation result shows that the probability of the node being the source failure node is lower than the threshold, all its incoming edges are added to the queue and the priority is recalculated. This loop continues until a source failure node with a probability exceeding the threshold is found, or the queue is empty. Finally, a sequence of failure propagation path nodes sorted by time and the identifier of the source failure node are output. Throughout the process, the path pointing to the failure propagation vulnerability always has the highest exploration priority.
[0060] Furthermore, when a visible failure event that has actually occurred is detected (e.g., an error log alarm that reaches a critical level, a key performance indicator that exceeds the failure threshold, or a service unavailability event), the regular periodic processing flow is immediately interrupted or paralleled. The event entity node corresponding to the visible failure event in the dynamic failure association graph is used as the starting point to trigger a reverse tracing algorithm to locate the source failure node that caused the visible failure, thereby achieving rapid root cause localization of the failure.
[0061] S6. Receive the fault propagation path and source fault node identifier output by the reverse tracing algorithm in step S5 as input, and start the policy generation and execution engine, specifically including:
[0062] First, the fault propagation path and source fault node identifier are matched against a pre-built policy knowledge base. This knowledge base stores processing instruction templates corresponding to various fault modes. After a successful match, the engine generates an executable fault handling policy based on the specific fault scenario. Policy types include resource restart, traffic switching, service expansion, or query optimization. After the policy is generated, the policy instructions are directly issued and executed by calling the application programming interface of the operations and maintenance automation platform. The execution process includes permission verification, command encapsulation, and result callback confirmation. The entire policy execution process is logged, and the execution status is fed back to the monitoring system in real time, completing closed-loop management from fault analysis to handling.
[0063] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.
Claims
1. An intelligent operation and maintenance management method based on big data algorithms, characterized in that, The methods and steps include the following: S1. Input multi-source heterogeneous operation and maintenance data; S2. Construct and continuously update a dynamic fault association map based on the multi-source heterogeneous operation and maintenance data; S3. Based on a predefined time period, initiate a full-map scan of the dynamic fault association map, detect abnormal topological structures that meet the risk conditions through a graph pattern recognition algorithm, and mark the core nodes constituting the abnormal topological structure as potential risk nodes. The process of detecting abnormal topological structures by the graph pattern recognition algorithm specifically includes: The topology of the dynamic fault association map is matched with a predefined pattern template, which represents the risk conditions of the anomaly. When the topology of a local subgraph is detected to meet any of the risk conditions, it is determined that there is an abnormal topology at that location. Based on the pattern rules corresponding to the matched pattern template, multiple core nodes are identified and determined from the multiple nodes constituting the abnormal topology, and they are marked as potential risk nodes. S4. For the potential risk nodes, based on their abnormal topology and edge weights in the dynamic fault association graph, perform dynamic impact diffusion simulation, calculate the diffusion range and severity quantification value of the impact of each potential risk node on related services after a fault occurs, and mark them as fault propagation vulnerability points according to the severity quantification value. S5. In response to completing the marking of potential risk nodes, starting from the potential risk node, and combining the weight and type of the edges in the dynamic fault association graph, execute the reverse tracing algorithm to output the fault propagation path and the source fault node identifier; wherein when executing the reverse tracing algorithm, its search strategy will prioritize exploring the path pointing to the marked fault propagation vulnerability point in the dynamic fault association graph. S6. Based on the fault propagation path and the source fault node identifier, generate and execute the corresponding fault handling strategy.
2. The intelligent operation and maintenance management method based on big data algorithms according to claim 1, characterized in that, The multi-source heterogeneous operation and maintenance data includes performance indicator data, text log data, call chain data, and configuration item change data.
3. The intelligent operation and maintenance management method based on big data algorithms according to claim 1, characterized in that, The process of constructing and continuously updating the dynamic fault association map specifically includes: Identify and create operation and maintenance entity nodes and event entity nodes; Based on the inherent relationships between multi-source heterogeneous operation and maintenance data, edges are created between nodes, and the types of edges include static dependencies and dynamic associations. Continuously monitor new multi-source heterogeneous operation and maintenance data, update the nodes and edges in the dynamic fault association graph in real time and incrementally, and adjust the weight of the edges.
4. The intelligent operation and maintenance management method based on big data algorithms according to claim 3, characterized in that, The static dependency relationship is obtained directly from the deployment relationship in the configuration item change data; the dynamic relationship is calculated in real time by analyzing the co-occurrence information in the text log data, the call sequence relationship in the call chain data, and the correlation of the performance indicator data.
5. The intelligent operation and maintenance management method based on big data algorithms according to claim 1, characterized in that, The execution process of the dynamic influence diffusion simulation specifically includes: Potential risk nodes are used as the starting points for simulating faults, and their abnormal topology is used as the network. The weights of the edges in the graph are used as the probability of fault propagation along the edges. An iterative algorithm is used to simulate the recursive propagation of the fault state along the outgoing edge to neighboring nodes, and the state changes of the affected nodes are calculated. After the simulation is terminated, the results are summarized and the quantitative values of the spread range and severity are calculated; All potential risk nodes are sorted according to their severity quantification values, and nodes with a ranking higher than a certain threshold are further marked as vulnerability points for fault propagation.
6. The intelligent operation and maintenance management method based on big data algorithms according to claim 5, characterized in that, The calculation process for the severity quantification value specifically includes: Aggregate all nodes marked as affected in the dynamic impact diffusion simulation, where the contribution value of each affected node is the product of its preset business criticality weight and the intensity of the simulated failure it suffers; sum the contribution values of all affected nodes as the quantification value of the severity of the simulation.
7. The intelligent operation and maintenance management method based on big data algorithms according to claim 1, characterized in that, The execution process of the reverse tracing algorithm specifically includes: Using the unique identifier of a potential risk node as input, query the set of all its incoming edges; Initialize a priority queue to manage the path nodes to be explored, and calculate the path priority score for each incoming edge; The process iterates through the queue to extract the node with the highest path priority score and calculates the probability that it will become the source failure node until a source failure node with a probability exceeding the threshold is found or the queue is empty. The final output is a sequence of fault propagation path nodes ordered by time, along with the identifier of the source fault node.
8. The intelligent operation and maintenance management method based on big data algorithms according to claim 7, characterized in that, The path priority score is a function of edge weight, edge type, and destination node attributes; if the destination node attributes contain a vulnerability marker for fault propagation, the path priority score will receive the maximum boost factor.
9. The intelligent operation and maintenance management method based on big data algorithms according to claim 1, characterized in that, In step S5, when a visible fault event that has actually occurred is detected, the reverse tracing algorithm is immediately triggered, with the event entity node corresponding to the visible fault event as the starting point, to locate the source fault node that caused the visible fault.