Method and system for dynamic construction of operation and maintenance knowledge graph based on monitoring and treatment process

Abstract

The application relates to the technical field of knowledge graph construction, in particular to a method and system for dynamically constructing an operation and maintenance knowledge graph based on a monitoring and treatment process. The method comprises the following steps: acquiring coding vectors of various parameters; determining a context semantic vector by fusing the vectors; determining a parameter weight based on the similarity between the coding vectors of the historical event block parameters and the context semantic vector, weighting the coding vectors to acquire the fusion vectors, and then acquiring the entities of the event blocks; presetting a sliding window, determining the entity weight based on the time difference between the event blocks and the sliding window, combining the number of event blocks where the entities are located to determine the correlation between the entities, combining the entity time difference to determine the weight of the candidate edges; and constructing and maintaining the knowledge graph based on the weight of the candidate edges. The application improves the construction accuracy of the knowledge graph.

Description

Technical Field

[0001] This application relates to the field of knowledge graph construction technology, specifically to a method and system for dynamically constructing an operation and maintenance knowledge graph based on monitoring and handling processes. Background Technology

[0002] Operations and maintenance knowledge graphs are graph-structured semantic networks for IT systems. Nodes correspond to unique entities in the operations and maintenance domain (e.g., hardware, containers, microservices, Kubernetes Pods, alert rules, handling scripts, etc.), and edges correspond to unique observable relationships (dependencies, triggers, mitigations, rollbacks, failures, etc.). Edge attributes must also carry at least confidence and time intervals to support deterministic reasoning and online queries, thereby helping operations and maintenance personnel quickly locate problems and improve overall operations and maintenance efficiency.

[0003] Traditional methods for building operational knowledge graphs typically employ a static strategy of offline batch extraction and scheduled updates. This involves periodically extracting entities and relationships from data sources such as CMDBs, Excel topology tables, historical work orders, and log files, and then mapping them to a predefined schema using rules or NLP models. Relying on the maintenance of association rules, this approach fails to consider changes in graph nodes caused by monitoring and handling processes. During operations, when real-time alarms trigger container reconstruction, destroyed container nodes may still exist in the graph. When using root cause algorithms for searching, unreachable paths may be generated. In other words, traditional static graphs, due to the lack of real-time construction, still list destroyed nodes as high-suspicion nodes by root cause algorithms, resulting in low accuracy in knowledge graph construction. Summary of the Invention

[0004] To address the technical issue of low accuracy in knowledge graph construction, this application provides a method and system for dynamically constructing operation and maintenance knowledge graphs based on monitoring and handling processes. The specific technical solution adopted is as follows:

[0005] Firstly, this application proposes a method for dynamically constructing an operation and maintenance knowledge graph based on the monitoring and handling process. This method includes the following steps:

[0006] For the operation and maintenance system, the preset cycle is taken as an event block. The raw event stream of each parameter of the event block is collected and converted into the encoding vector of each parameter.

[0007] The context semantic vector of an event block is determined by the fusion vector of the historical event blocks preceding the event block; for each event block, the parameter weight is determined by the similarity ratio between each parameter and the encoded vectors of all parameters and the context semantic vector; the fusion vector is obtained by weighting the encoded vectors of all parameters and the parameter weights; the fusion vector is used as input to obtain all entities of the event block using an entity extraction method;

[0008] preset different lengths of sliding windows for all event blocks, determine entity weights of the event blocks based on time differences between the event blocks and the rightmost side of the sliding windows for each sliding window, determine weighted frequencies and co-occurrence weighted frequencies based on the number of event blocks in which different numbers of entities are located and the entity weights, obtain correlations between two entities based on the weighted frequencies and the co-occurrence weighted frequencies of the two entities, and determine weights of candidate edges between the two entities based on the correlations between the entities and time differences between the entities;

[0009] determine suitable sliding windows based on entity relationships and the number of event blocks, process the weights of the candidate edges based on the suitable sliding windows to obtain new evidence scores, and update the confidence to complete construction and maintenance of the knowledge graph.

[0010] In the above scheme, the six types of operation and maintenance data are first encoded and then fused to generate semantic vectors and extract entities and actions; subsequently, correlations between entities are calculated using exponential decay weights within three sliding windows, and old data is penalized using an average time difference to obtain candidate edges with time sequence weights; finally, the candidate edge weights are normalized into new evidence scores, which are fused with historical confidence in the graph to achieve addition and update of the graph; the operation and maintenance data are mapped to the same vector space, eliminating modal differences and making subsequent entity and action extraction and correlation calculation more accurate; through weighted statistics of different time windows, both minute-level causal relationships and hour-level dependency relationships can be highlighted; using average time difference penalty and exponential confidence update to filter old data ensures that the recommended path in root cause analysis is always driven by events that have just occurred and are close, avoiding nodes that have been destroyed being listed as highly suspicious nodes, and improving the construction accuracy of the knowledge graph.

[0011] In one embodiment, the parameters include alarms, indicators, logs, traces, work orders, and change records.

[0012] In one embodiment, the method for determining the context semantic vector of the event block based on the fusion vector of the previous historical event block is:

[0013] For any event block, the preset number of event blocks closest to the event block are recorded as previous event blocks, exponential decay weights are assigned to the previous event blocks, and the context semantic vector of the event block is obtained by weighting the fusion vectors of the previous event blocks and the corresponding exponential decay weights.

[0014] In one embodiment, the expression of the parameter weight is:

[0015] , denotes the encoding vector of the mth parameter in the tth event block, denotes the context semantic vector of the tth event block, denotes a cosine similarity function, This represents an exponential function with the natural constant as its base. Indicates the number of parameters. This represents the parameter weight of the m-th parameter in the t-th event block; where the context semantic vector of the first event block is the zero vector.

[0016] In one embodiment, the expression for the fusion vector is:

[0017] , This represents the encoding vector of the m-th parameter in the t-th event block. This represents the parameter weight of the m-th parameter in the t-th event block. Indicates the number of parameters. This represents the fusion vector of the t-th event block.

[0018] In one embodiment, the expression for the entity weight is:

[0019] , This represents the rightmost time in the sliding window containing the v-th event block. This indicates the start time of the v-th event block. This represents the decay rate of the sliding window. This represents an exponential function with the natural constant as its base. This represents the entity weight of the t-th event block.

[0020] In one embodiment, the weighted frequency is the ratio of the sum of the product of the number of event blocks in which the entity resides and the weights of all entities to the product of the weights of all entities; the co-occurrence weighted frequency is the ratio of the sum of the product of the number of event blocks in which two entities reside and the weights of all entities to the product of the weights of all entities.

[0021] In one embodiment, the weight of the candidate edge is positively correlated with the correlation between the two entities and negatively correlated with the entity time difference; the entity time difference is the average time difference between any two entities in the same event block within the sliding window.

[0022] In one embodiment, the method for obtaining confidence scores by weighting candidate edges using a suitable sliding window and updating the confidence scores to complete the construction and maintenance of the knowledge graph is as follows:

[0023] The weights of the candidate edges obtained from the appropriate window are used as the new evidence scores for each candidate edge. The new evidence scores and the current confidence scores of the same edge in the graph are then combined linearly by an exponentially weighted moving average according to a preset learning rate to obtain the updated confidence scores.

[0024] If the updated confidence is greater than or equal to the third quartile, and there is no same name and same direction edge in the graph, it is written into the knowledge graph; if the same edge already exists, the old confidence is overwritten with the updated confidence; if the updated confidence is less than or equal to the third quartile, the edge is marked as invalid, and the node is retained.

[0025] In a second aspect, the embodiments of the present application further provide a dynamic construction system of an operation and maintenance knowledge graph based on monitoring and treatment processes, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements the steps of the dynamic construction method of the operation and maintenance knowledge graph based on monitoring and treatment processes.

[0026] The beneficial effects of the present application are:

[0027] The present application encodes and fuses six types of operation and maintenance data, generates semantic vectors and extracts entities and actions; then, in a three-level sliding window, the correlation between entities is calculated using an exponential decay weight, and old data is penalized using an average time difference, to obtain candidate edges with time sequence weights; finally, the candidate edge weights are normalized into new evidence scores, and the historical confidence in the graph is weighted and fused to realize the addition and deletion and update of the graph; it maps operation and maintenance data to the same vector space, eliminates modal differences, and makes subsequent entity and action extraction and correlation calculation more accurate; through weighted statistics of different time windows, both minute-level causal relationships and hour-level dependency relationships can be highlighted; using average time difference penalty and exponential confidence update to filter old data, the recommended path in root cause analysis is always driven by events that have just occurred and are adjacent, avoiding nodes that have been destroyed being listed as highly suspicious nodes, and improving the construction accuracy of the knowledge graph. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0029] Figure 1 The dynamic construction method of the operation and maintenance knowledge graph based on monitoring and treatment processes provided by an embodiment of the present application is shown in the flowchart. DETAILED DESCRIPTION

[0030] For further elaboration of the technical means and effects taken by the present application to achieve the predetermined object, the specific implementation, structure, features and effects of the monitoring and treatment process-based operation and maintenance knowledge graph dynamic construction method and system according to the present application are described in detail as follows. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0032] Monitoring and treatment process-based operation and maintenance knowledge graph dynamic construction method and system embodiments:

[0033] The specific scheme of the monitoring and treatment process-based operation and maintenance knowledge graph dynamic construction method provided by the present application is described in detail below with reference to the accompanying drawings.

[0034] Please refer to Figure 1 , which shows the monitoring and treatment process-based operation and maintenance knowledge graph dynamic construction method flowchart provided by one embodiment of the present application, which includes the following steps:

[0035] Step S001, collect the original event stream of each parameter of the event block and convert it into an encoded vector of each parameter.

[0036] For the operation and maintenance system, the present application takes the preset time as the period, collects each parameter in the period, records the timestamp of the parameter data, and takes each period as an event block. In this embodiment, the parameters are the original event streams of alarms, indicators, logs, traces, work orders and change records, and the preset time is 30s.

[0037] For each type of parameter data, a dedicated encoder is called for encoding, and a fixed 256-dimensional encoded vector is output through one-hot encoding and dictionary hashing.

[0038] At this point, the encoded vector of each parameter is obtained.

[0039] Step S002, determine the context semantic vector by fusing the vector; determine the parameter weight based on the similarity of the encoded vector and the context semantic vector of the historical event block parameter, weight the encoded vector to obtain the fusion vector, and then obtain the entity of the event block.

[0040] For any event block, the nearest preset number of event blocks to the event block are recorded as pre-event blocks. In this embodiment, the number of pre-event blocks is 10.

[0041] An exponential decay weight is assigned to each pre-event block, and in this embodiment, the half-life is set to 5. The weighted sum of the context semantic vector of each pre-event block after normalization of the exponential decay weight of each pre-event block can obtain the context semantic vector of the event block.

[0042] The context semantic vector can serve as the instantaneous semantic reference of the current operation and maintenance scene event. Since the operation and maintenance event usually lasts for a period of time, the context semantic vector accumulates the semantic vectors of the nearby neighbors, and can objectively reflect the current running context. Based on the dynamic weight allocation of the similarity of each parameter encoding vector and the context semantic vector, the most similar modal extracted entities and actions occupy the dominant position, and the matching degree with the current real situation is improved.

[0043] For any event block, the parameter weight is determined by the ratio of the similarity of each parameter encoding vector and the context semantic vector to the similarity of all parameter encoding vectors and the context semantic vector.

[0044] Preferably, in this embodiment, the expression of the parameter weight is:

[0045] , represents the encoding vector of the mth parameter in the tth event block, represents the context semantic vector of the tth event block, represents the cosine similarity function, represents the exponential function with a natural constant as the base, represents the number of parameters, represents the parameter weight of the mth parameter in the tth event block.

[0046] If the event block is the first event block, the context semantic vector of the event block is a zero vector, the parameter weights of the parameters are the same, and the sum is 1.

[0047] The parameter weight and the encoding vector of each parameter are weighted and fused to obtain the fusion vector of the event block.

[0048] Preferably, in this embodiment, the expression of the fusion vector is:

[0049] , represents the encoding vector of the mth parameter in the tth event block, represents the parameter weight of the mth parameter in the tth event block, represents the number of parameters, represents the fusion vector of the tth event block.

[0050] The fusion vector of each event block is input The entity set and the treatment action set are extracted from the fusion vector by an entity extraction method. The fusion vector is equivalent to the result of adding the three vectors of the text, the keyword and the entity type in the prior art.

[0051] In the extraction of the entity set and the treatment action set, a parallel treatment action classification head is added, the activation function adopts Sigmoid, the hyperparameter adopts the default hyperparameter, the corresponding label file is obtained by adding the action label to the BIO entity label, the loss function is changed to the weighted sum of the entity cross-entropy and the action binary cross-entropy, the weight is 1:1, and the entity set and the treatment action set of each event block are output.

[0052] In the present application, the treatment is also regarded as an entity, and therefore the number of entities of the event block is the sum of the entity set and the treatment action set.

[0053] Thus, all the entities of each event block are obtained.

[0054] In step S003, a sliding window is preset, the entity weight is determined based on the time difference between the event block and the sliding window, the correlation between the entities is determined in combination with the number of the event blocks where the entities are located, and the weight of the candidate edge is determined in combination with the entity time difference.

[0055] In the operation and maintenance scene, containers, scripts and configuration items and the like are quickly born and die with elastic expansion and contraction and gray release, so it is necessary to assign higher weights to the latest events and consider the average time difference to avoid recommending old or destroyed nodes as root causes by the graph, resulting in failure of automatic treatment. The present application adopts exponential decay frequency estimation and average time difference penalty, so that entities and treatment actions that have just occurred and have a short interval accumulate high weights, thereby ensuring that the candidate edge always reflects the latest causal chain.

[0056] For all event blocks, a plurality of sliding windows of different lengths are set, in the present application, 1-hour, 6-hour and 24-hour sliding windows are set. The 1-hour sliding window is the average duration of cloud-native environment faults, which is used to obtain the minute-level causal chain of alarm-automatic restart-recovery, and ensure that short-time high-confidence edges are preferentially stored. The 6-hour sliding window is the influence time of a gray release or configuration change, which is used to obtain the medium-period association of change-performance degradation-batch alarms, and avoid missing progressive failure modes due to insufficient samples in the short-time window. The 24-hour sliding window is the cycle of business peaks and valleys and batch processing, which is used to obtain the long-period dependence of batch tasks-resources-faults, and prevent low-frequency but high-impact causal edges from being removed due to degradation.

[0057] The weighted frequency and the co-occurrence weighted frequency of each entity are calculated for each sliding window respectively. For each event block, the entity weight of each event block is determined based on the time difference between the start time of the event block and the rightmost time of the sliding window in which the event block is located and the decay rate.

[0058] The expression of the entity weight is:

[0059] , represents the rightmost time of the sliding window in which the vth event block is located, represents the start time of the vth event block, represents the decay rate of the sliding window, represents the exponential function with the natural constant as the base, represents the entity weight of the tth event block.

[0060] In the present application, different sizes of sliding windows have different decay rates; in the present embodiment, the decay rate of the 1h sliding window is 1 / 3600, the decay rate of the 6h sliding window is 1 / 21600, and the decay rate of the 24h sliding window is 1 / 86400.

[0061] For all event blocks in each sliding window, any one entity is recorded as a target entity, and the event block containing the target entity is recorded as a target event block. The weighted frequency of the target entity is determined based on the number of target event blocks and the entity weight of the event block.

[0062] Preferably, the expression of the weighted frequency is:

[0063] , represents the number of event blocks corresponding to the ith entity, represents the entity weight of the tth event block, represents the number of event blocks in the sliding window, represents the normalization function, represents the weighted frequency of the ith entity.

[0064] For any two entities in the sliding window, the event block in which the two entities co-occur is recorded as a co-occurrence event block. The co-occurrence weighted frequency of any two entities is determined based on the number of co-occurrence event blocks and the entity weight of the event block.

[0065] Preferably, the expression of the co-occurrence weighted frequency is:

[0066] , represents the number of event blocks in which the ith entity and the jth entity co-occur, represents the entity weight of the tth event block, denotes the number of event blocks in the sliding window, denotes a normalization function, denotes the co-occurrence weighted frequency of the ith entity and the jth entity.

[0067] The co-occurrence relationship between entities and treatment actions is a direct intervention relationship, while the co-occurrence relationship between entities is a dependent relationship. By counting the co-occurrence times between them and setting different time decay constants, short-term causal edges and long-term dependent edges can be distinguished, thereby dynamically constructing a knowledge graph.

[0068] For any two entities, the time difference between the two entities in the corresponding co-occurrence event block is counted, and the mean value of the time difference in all co-occurrence event blocks corresponding to any two entities in the sliding window is calculated and denoted as entity time difference; the greater the value, the weaker the relationship between the two entities, and the greater the penalty, so that edges with stronger causal relationships obtain greater weights.

[0069] For any two entities in the sliding window, the weight of the candidate edge between the two entities is determined based on the correlation between the entities and the entity time difference.

[0070] The weight of the candidate edge is positively correlated with the correlation between the two entities and negatively correlated with the entity time difference.

[0071] It should be noted that positive correlation means that when one variable increases, the other variable also increases, and the two variables change in the same direction. When one variable changes from large to small or from small to large, the other variable also changes from large to small or from small to large. The specific relationship is determined by actual application, and the present application does not make special limitations.

[0072] It should be noted that negative correlation means that when one variable increases, the other variable decreases, and the two variables change in opposite directions. When one variable changes from large to small or from small to large, the other variable also changes from small to large or from large to small. The specific relationship is determined by actual application, and the present application does not make special limitations.

[0073] Preferably, in the present embodiment, the expression of the weight of the candidate edge is:

[0074] , denotes the weighted frequency of the ith entity, denotes the weighted frequency of the jth entity, denotes the weighted frequency of the ith entity, denotes the co-occurrence weighted frequency of the ith entity and the jth entity, denotes a maximum function, denotes the entity time difference between the ith entity and the jth entity, denotes a time decay constant, denotes an exponential function with a natural constant as base, denotes the weight of the candidate edge between the ith entity and the jth entity. The correlation between the two entities is obtained by the weighted frequency and the co-occurrence weighted frequency, and the time decay constant varies according to the value of the sliding window. The larger the value of the sliding window, the larger the time decay constant. In this embodiment, the time decay constant is respectively 300s, 600s and 3600s.

[0075] On the basis of the traditional point mutual information, the application introduces a statistical quantity of time decay weight to measure the correlation strength of two events within a specific time window. The more recent events contribute more to the correlation. The log ratio is multiplied by the average time difference penalty after truncating the negative value, so as to filter historical noise and highlight two entities with strong causal or dependent relationship.

[0076] Thus, the weight of the candidate edge between the two entities is obtained.

[0077] Step S004, constructing and maintaining the knowledge graph based on the weight of the candidate edge.

[0078] According to the operation and maintenance event, a suitable window is selected. If it is an entity-action type edge, the candidate edge weight calculated by the 1h window is adopted, so as to retain the causal relationship of fast response. If it is an entity-entity type edge, the candidate edge weight calculated by the 6h window is preferred. If the event block in the window is less than 5, the 24h window is switched, so as to retain the long-period evidence of the dependent relationship.

[0079] The weight of the candidate edge obtained from the suitable window is taken as the new evidence score of each candidate edge. The new evidence score and the current confidence of the same edge in the graph are linearly combined according to the exponential weighted moving average of the learning rate of 0.2 to obtain the updated confidence, so that the old knowledge naturally decays by 0.8, and the new evidence is immediately integrated, so that the confidence of the graph neither suddenly changes nor continuously evolves with the latest operation and maintenance event. If there is no same edge, the current confidence is regarded as zero.

[0080] If the updated confidence is greater than or equal to the third quartile, and there is no same edge in the graph, it is written into the knowledge graph. If there is the same edge, the updated confidence is used to replace the old confidence. If the updated confidence is less than or equal to the third quartile, the edge is marked as invalid, and the node is retained, so as to realize the dynamic construction and maintenance of the operation and maintenance knowledge graph.

[0081] Based on the same inventive concept as the above method, the embodiments of the present application also provide a monitoring and treatment process-based operation and maintenance knowledge graph dynamic construction system, which comprises a memory, a processor and a computer program stored in the memory and running on the processor, and the processor implements the steps of any one of the methods in the above monitoring and treatment process-based operation and maintenance knowledge graph dynamic construction method when executing the computer program.

[0082] It should be noted that the above-described embodiments are only used to illustrate the technical solutions of the present application, but not limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

[0083] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment mainly describes the difference from other embodiments.

Claims

1. A method for dynamically constructing an operation and maintenance knowledge graph based on monitoring and treatment processes, characterized in that, The method includes the following steps: For the operation and maintenance system, the preset cycle is taken as an event block. The raw event stream of each parameter of the event block is collected and converted into the encoding vector of each parameter. The context semantic vector of an event block is determined by the fusion vector of the historical event blocks preceding the event block; for each event block, the parameter weight is determined by the similarity ratio between each parameter and the encoded vectors of all parameters and the context semantic vector; the fusion vector is obtained by weighting the encoded vectors of all parameters and the parameter weights; the fusion vector is used as input to obtain all entities of the event block using an entity extraction method; For all event blocks, a sliding window of different length is preset. For each sliding window, the entity weight of the event block is determined based on the time difference between the event block and the rightmost side of the sliding window. The weighted frequency and co-occurrence weighted frequency are determined based on the number of event blocks containing different numbers of entities and the entity weights. The correlation between two entities is obtained based on the weighted frequency and co-occurrence weighted frequency of the two entities. The weight of the candidate edge between the two entities is determined based on the correlation between the entities and the time difference between the entities. The appropriate sliding window is selected based on entity relationships and the number of event blocks; the weights of candidate edges are processed based on the appropriate sliding window to obtain new evidence scores, and the confidence level is updated to complete the construction and maintenance of the knowledge graph; The weighted frequency is the ratio of the sum of the product of the number of event blocks in which an entity is located and the weights of all entities to the product of the weights of all entities; the co-occurrence weighted frequency is the ratio of the sum of the product of the number of event blocks in which two entities are located and the weights of all entities to the product of the weights of all entities. 2.The method of claim 1, wherein, The parameters include alarms, metrics, logs, tracking, work orders, and change records. 3.The method of claim 1, wherein, The method for determining the context semantic vector of an event block from the fusion vector of historical event blocks preceding the event block is as follows: For any event block, the number of event blocks closest to it are designated as the preceding event blocks. The preceding event blocks are assigned exponentially decaying weights, and the context semantic vector of the event block is obtained by weighting the fusion vector of the preceding event blocks with the corresponding exponentially decaying weights. 4.The method of claim 1, wherein, The expression for the parameter weights is: denotes the encoding vector of the mth parameter in the tth event block, denotes the context semantic vector of the tth event block, denotes the cosine similarity function, denotes the exponential function with base of natural constant, denotes the number of parameters, denotes the parameter weight of the mth parameter in the tth event block; wherein the context semantic vector of the first event block is a zero vector.​ 5.The method of claim 1, wherein, The expression for the fusion vector is: , denotes the encoding vector of the mth parameter in the tth event block, denotes the parameter weight of the mth parameter in the tth event block, denotes the number of parameters, denotes the fusion vector of the tth event block. 6.The method of claim 1, wherein, The expression for the entity weight is: , denotes the rightmost time of the sliding window in which the v-th event block is located, denotes the start time of the v-th event block, denotes the decay rate of the sliding window, denotes the exponential function with base of the natural constant, denotes the entity weight of the t-th event block.

7. The method of claim 1, wherein the method further comprises: The weight of the candidate edge is positively correlated with the correlation between the two entities and negatively correlated with the entity time difference; the entity time difference is the average time difference between any two entities in the same event block within the sliding window. 8.The method of claim 1, wherein, The method for obtaining confidence scores by weighting candidate edges using a suitable sliding window and then updating those confidence scores to complete the construction and maintenance of the knowledge graph is as follows: The weights of the candidate edges obtained from the appropriate window are used as the new evidence scores for each candidate edge. The new evidence scores and the current confidence scores of the same edge in the graph are then combined linearly by an exponentially weighted moving average according to a preset learning rate to obtain the updated confidence scores. If the updated confidence level is greater than or equal to the third quartile and there are no edges with the same name and direction in the graph, then write it into the knowledge graph; If the same edge already exists, the old confidence is overwritten with the updated confidence; if the updated confidence is less than or equal to the third quartile, the edge is marked as invalid, and the node is retained. 9.A system for dynamically constructing an operation and maintenance knowledge graph based on monitoring and treatment processes, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, The processor implements the computer program to realize the method for dynamically constructing an operation and maintenance knowledge graph based on a monitoring and treatment process according to any one of claims 1-8. The processor implements the computer program to realize the method for dynamically constructing an operation and maintenance knowledge graph based on a monitoring and treatment process according to any one of claims 1-8.

Images