An intelligent auxiliary system and method for network operation and maintenance

Abstract

The application discloses an intelligent auxiliary system and method for network operation and maintenance, and belongs to the technical field of intelligent operation and maintenance management. The system comprises a mapping module, a retrieval module, a data sending module and an operation and maintenance feedback module. The mapping module is used for analyzing a client operation and maintenance instruction, generating operation and maintenance task information, and determining at least one target sub-agent and a function label based on a preset rule. The retrieval module acquires a corresponding operation and maintenance data set in a database according to the function label and the task information. The data sending module sends the operation and maintenance data and the task information to the target sub-agent for processing. The operation and maintenance feedback module receives a processing result of the sub-agent, performs customized processing in combination with the task information and a context, generates an operation and maintenance feedback result and returns the result to the client. The operation and maintenance instruction is parsed into specific tasks, which are independently processed by the sub-agents intelligently distributed by the control end, so that the professional nature and standardization of data processing are ensured, and the network operation and maintenance efficiency and reliability are improved.

Description

Technical Field

[0001] This application belongs to the field of intelligent operation and maintenance management technology, specifically relating to an intelligent auxiliary system and method for network operation and maintenance. Background Technology

[0002] In the field of network operations and maintenance, with the continuous expansion of network scale, the increasing complexity of architecture, and the continuous improvement of business requirements for network stability and performance, the traditional manual operation and maintenance mode can no longer meet the needs of efficient, accurate, and intelligent operation and maintenance.

[0003] After receiving instructions and context information, operations and maintenance personnel will determine whether the target of the operation is a server, network device, or application, analyze the operation type (such as configuration modification or troubleshooting), combine background information such as operations and maintenance records and network status to help understand the purpose, and quickly build an operations and maintenance task framework in their minds to clarify the key directions.

[0004] However, due to the limitations of personal experience and cognition, maintenance personnel may misjudge the target and type of operation when manually interpreting instructions to determine the task direction. Furthermore, it is time-consuming to extract key background information from massive amounts of contextual information, and the constructed task framework may deviate from the actual needs, resulting in deviations in maintenance direction and low efficiency. Summary of the Invention

[0005] To overcome the above-mentioned shortcomings, this invention is proposed to provide solutions or at least partially solve the technical problems of existing technologies, such as the susceptibility of manual interpretation of instructions to the limitations of experience and cognition, the easy misjudgment of the operation object and type, the time-consuming extraction of key information from massive context, and the possibility that the task framework may deviate from actual needs, resulting in low operation and maintenance efficiency.

[0006] In a first aspect, the present invention provides an intelligent auxiliary system for network operation and maintenance, the system comprising: The mapping module is used to perform semantic parsing on the operation and maintenance instructions and context information sent by the client when the control terminal receives them, to obtain operation and maintenance task information, and to determine the target sub-intelligent agent and the target function label based on the operation and maintenance task information and the preset mapping rules; wherein, the number of target sub-intelligent agents is at least one; the number of target function labels is at least one. The retrieval module is used by the control terminal to retrieve the corresponding operation and maintenance data set from the database based on the target function tag and operation and maintenance task information; The data transmission module is used by the control terminal to send the operation and maintenance data set and operation and maintenance task information to the target sub-intelligent agent, so that the target sub-intelligent agent can process the operation and maintenance data set. The operation and maintenance feedback module is used to receive the processing results of the target sub-intelligent agent from the control terminal, perform customized processing on the processing results based on the operation and maintenance task information and context information, obtain the operation and maintenance feedback results, and send the operation and maintenance feedback results to the client.

[0007] In a second aspect, the present invention provides an intelligent auxiliary method for network operation and maintenance, the method comprising: If the control terminal receives the operation and maintenance instructions and context information sent by the client, it performs semantic parsing on the operation and maintenance instructions to obtain operation and maintenance task information, and determines the target sub-intelligent agent and target function label based on the operation and maintenance task information and the preset mapping rules; wherein, the number of target sub-intelligent agents is at least one; the number of target function labels is at least one. The control terminal retrieves the corresponding operation and maintenance data set from the database based on the target function tag and operation and maintenance task information; The control terminal sends the operation and maintenance data set and operation and maintenance task information to the target sub-intelligent agent, so that the target sub-intelligent agent can process the operation and maintenance data set. The control terminal receives the processing result of the target sub-agent, performs customized processing on the processing result based on the operation and maintenance task information and context information, obtains the operation and maintenance feedback result, and sends the operation and maintenance feedback result to the client.

[0008] In a third aspect, an electronic device is provided, comprising a processor, a memory, and a program or instructions stored in the memory and executable on the processor, the program or instructions being loaded and run by the processor to perform the steps of the aforementioned intelligent auxiliary method for network operation and maintenance.

[0009] In a fourth aspect, a computer-readable storage medium is provided, wherein a plurality of program codes are stored therein, the program codes being adapted to be loaded and run by a processor to perform the steps of the aforementioned intelligent auxiliary method for network operation and maintenance.

[0010] The above-described technical solutions of the present invention have at least one or more of the following beneficial effects: In implementing the technical solution of this invention, maintenance instructions are parsed into specific tasks, which are then intelligently distributed by the control terminal to each sub-agent for independent processing, ensuring the professionalism and standardization of data processing. Furthermore, customized analysis is performed by combining task information and context, transforming the standardized results into maintenance feedback that users truly need, thereby improving network maintenance efficiency and reliability. Attached Figure Description

[0011] The disclosure of this invention will become more readily understood with reference to the accompanying drawings. It will be readily understood by those skilled in the art that these drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention. Furthermore, similar numbers in the drawings are used to denote similar components, wherein: Figure 1 This is a schematic diagram of the main structure of an intelligent auxiliary system for network operation and maintenance according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the main structure of an intelligent auxiliary system for network operation and maintenance according to an embodiment of the present invention; Figure 3 This is a flowchart illustrating the main steps of an intelligent auxiliary method for network operation and maintenance according to an embodiment of the present invention. Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0012] Some embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0013] In the description of this invention, "module" and "processor" can include hardware, software, or a combination of both. A module can include hardware circuitry, various suitable sensors, communication ports, memory, and may also include software components, such as program code, or a combination of software and hardware. A processor can be a central processing unit, microprocessor, image processor, digital signal processor, or any other suitable processor. The processor has data and / or signal processing capabilities. The processor can be implemented in software, in hardware, or a combination of both. Non-transitory computer-readable storage media includes any suitable medium capable of storing program code, such as magnetic disks, hard disks, optical disks, flash memory, read-only memory, random access memory, etc. The term "A and / or B" means all possible combinations of A and B, such as only A, only B, or A and B. The terms "at least one A or B" or "at least one of A and B" have a similar meaning to "A and / or B" and can include only A, only B, or A and B. The singular terms "a" or "this" can also include plural forms.

[0014] See appendix Figure 1 , Figure 1 This is a main structural block diagram of an intelligent auxiliary system for network operation and maintenance according to an embodiment of the present invention. Figure 1 As shown, an intelligent auxiliary system for network operation and maintenance in an embodiment of the present invention mainly includes: The mapping module 101 is used to perform semantic parsing on the operation and maintenance instructions and context information sent by the client when the control terminal receives them, to obtain operation and maintenance task information, and to determine the target sub-intelligent agent and the target function label based on the operation and maintenance task information and the preset mapping rules; wherein, the number of target sub-intelligent agents is at least one; the number of target function labels is at least one. The retrieval module 102 is used by the control terminal to retrieve the corresponding operation and maintenance data set from the database based on the target function tag and operation and maintenance task information; The data sending module 103 is used by the control terminal to send the operation and maintenance data set and operation and maintenance task information to the target sub-intelligent agent, so that the target sub-intelligent agent can process the operation and maintenance data set. The operation and maintenance feedback module 104 is used to receive the processing result of the target sub-intelligent agent from the control terminal, perform customized processing on the processing result based on the operation and maintenance task information and context information to obtain the operation and maintenance feedback result, and send the operation and maintenance feedback result to the client.

[0015] In this embodiment, the control unit is the core coordination and decision-making module of the entire system. It is mainly responsible for receiving operation and maintenance instructions and context information from the client, and then performing operations such as semantic parsing, task decomposition, sub-agent scheduling, and result fusion. The client is the user-side interface module that interacts with the control terminal. Users can use the client to input maintenance requests, view the current status of the system, or obtain intelligent assistance suggestions. Operation and maintenance commands are operation requests issued from the client, with the purpose of triggering the system to execute corresponding operation and maintenance tasks.

[0016] Context information is the associated information that the control terminal combines with the client's historical interaction content and the current system running status when receiving operation and maintenance instructions, in order to achieve continuous semantic understanding and task decision-making.

[0017] Operation and maintenance task information is a structured task description generated by the control terminal after semantic parsing of operation and maintenance commands. For example, if the command is "Analyze network latency anomalies in the past hour", the corresponding operation and maintenance task information would include: the task type is performance anomaly analysis; the systems involved are core switches and routing nodes; and the required data are time-series performance indicators, log events, and alarm records. The default mapping rule establishes a correspondence between "task type - sub-agent - function tag" in the control terminal. For example, if the operation and maintenance task type is performance monitoring, the corresponding sub-agent is the monitoring and alarm agent, and the function tag is indicator extraction and anomaly detection. The target sub-agent is an intelligent functional module determined by the control end based on operation and maintenance task information and mapping rules, which is specifically responsible for executing specific task processing. Target function labels are used to identify the specific functions or analysis dimensions that the target sub-agent needs to perform in the current task. They are function instruction labels assigned to the sub-agent after the task is decomposed, such as "performance trend extraction," "alarm pattern recognition," "log anomaly comparison," and "configuration difference detection."

[0018] Once the control terminal receives the maintenance instructions and context information from the client, it first performs formatted preprocessing on the input. This includes breaking down the instruction sentence into keywords, removing irrelevant words, and extracting metadata such as timestamps and the sending node. Then, the control terminal calls the semantic understanding engine to perform layered semantic analysis on the maintenance instructions. First, the instruction semantics are decomposed using a BERT-based semantic model, converting the input sentence into a sequence of context-dependent word vectors. Next, intent recognition is performed using a multi-class neural network to analyze the encoded results and determine the type of maintenance operation the user intends to perform. For example, is it "troubleshooting," "performance analysis," "configuration modification," or "log checking"? Next comes slot filling. After determining the user's intent, the key information from the command needs to be extracted and filled into the corresponding slots, taking into account the context. This involves using named entity recognition algorithms to identify structured fields such as the name of the device involved, which system it belongs to, the metric to be analyzed, and the time range. Finally, this information is integrated to form a complete task parameter set. The control unit then combines the identified intent with the compiled task parameter set to generate an operation and maintenance task information document. This information is presented in a structured JSON format, clearly stating the task type, the objective, the required data, and whether there are time constraints.

[0019] After obtaining this operation and maintenance task information, it's necessary to find suitable sub-agents to perform the operations and determine the specific functionalities to be performed, using pre-defined mapping rules. These mapping rules are maintained through a combination of expert experience and machine learning models, recording multi-dimensional correspondences such as which type of instruction should be used by which sub-agent and which functions should be employed. The control unit first converts the operation and maintenance task information into feature vectors, then compares their similarity with the function vectors of each sub-agent in the rule base, using methods such as cosine similarity or vector retrieval, and finally selects the one or more most matching sub-agents.

[0020] The control terminal also extracts target function tags that match the current task intent based on the function descriptions in the matching results. For example, if the task is to monitor performance, the tag is "performance monitoring"; if it's to find the cause of a fault, the tag is "root cause analysis". Each tag corresponds to a set of operational procedures for task distribution on the control terminal. What data to retrieve and how to process the data are all guided by these tags. For example, if an operations and maintenance personnel enters the command in the client: "Check the traffic anomaly of the switch on the third floor of the office and analyze the possible bottleneck causes", after receiving this command and the previous context, such as the previous alarm records and performance data of this switch, the control terminal first performs preprocessing, extracting key information such as "third floor", "switch", "check traffic anomaly", and "bottleneck cause". Then, in the semantic parsing stage, it first identifies the intent as "traffic anomaly diagnosis", then fills in the slots: the device location is the third floor, the device type is a switch, the analysis target is to find the bottleneck, and the time is the last hour by default. Finally, it generates task information in JSON format: {"task type":"traffic anomaly diagnosis","target device":["third floor switch"],"analysis target":"bottleneck identification","time range":"last hour"}. Next, the intelligent agents are matched according to the mapping rules. Based on the two key points of "traffic anomaly diagnosis" and "bottleneck finding", the "network inspection intelligent agent" and "fault diagnosis intelligent agent" will be matched after comparison in the rule base. The function tags "traffic anomaly detection" and "performance bottleneck analysis" are also extracted accordingly.

[0021] A database is a structured or semi-structured data warehouse used by the control center to store operation and maintenance-related information.

[0022] The operations and maintenance (O&M) data set is a complete collection of data retrieved from the database by the control terminal that is related to the current O&M task. It contains various types of information needed to complete the task, such as device status data, monitoring metrics, alarm records, log events, and configuration change records. It includes both structured and semi-structured data. Once the control terminal determines the target function tag and maintenance task information, this information needs to be formatted and vectorized. Specifically, various fields in the maintenance task information, such as task type, execution target, device list, and time range, will be mapped to structured query conditions; while the function tag will be mapped to database tables or data category indexes, laying the foundation for subsequent data retrieval. The control terminal will generate corresponding query time ranges and device filtering conditions based on the time range and device list in the task. Simultaneously, it will associate the function tag with tables, fields, and indexes in the database to determine which specific data sources to access. For example, if the function tag is "performance monitoring," the control terminal will point the index to the performance metrics table and related historical device data tables; if the function tag is "alarm analysis," the index will point to the alarm record table and event log table, thus accurately locating the required data.

[0023] Next, the control panel begins constructing query statements or retrieval vectors. For example, for structured data queries, SQL or similar relational query statements are used, combined with previously generated task information filtering conditions, such as time range, device ID, and indicator type, to retrieve data rows that meet the conditions from relational databases or time-series databases. For unstructured or semi-structured data, such as logs, configuration records, or data in JSON, text, or graph formats, full-text index search, keyword matching, regular expression extraction, or vector-based similarity retrieval, such as vector embedding retrieval, are used to find records that match the current maintenance task. If the operation and maintenance task requires data from across tables, databases, or systems, the control end also needs to perform data fusion processing. This involves data merging and association operations, including table joins, time series alignment, node ID mapping, field standardization, and outlier handling, integrating data from different sources. After data retrieval and initial cleaning, the control end will organize the obtained operation and maintenance data set into a structured format according to task requirements, forming an input style that the target sub-agent can directly use. The data structure may include: a device status table, recording the real-time or historical status information of each device; a monitoring indicator table, containing various performance indicators and their corresponding time series data; an alarm record table, detailing the type, level, and occurrence time of alarms, as well as the associated devices; a log event table, a structured presentation of system operation logs; and configuration change records, recording historical configuration modifications to devices or systems, as well as the status information before and after the changes.

[0024] The control terminal can use wireless communication technology to send the operation and maintenance data set and operation and maintenance task information to the target sub-intelligent agent.

[0025] The processing result is that after the target sub-agent receives the received set of operation and maintenance data, it performs tasks such as analysis, prediction, anomaly detection, root cause diagnosis, or repair suggestions, and then outputs intermediate or final information. The operation and maintenance feedback result is the output information that the control terminal integrates, filters, formats, and prioritizes after receiving the processing result of the target sub-agent. Once the control unit receives the processing results returned by the target sub-agent, it first parses and standardizes these results. The processing results may include abnormal states of network nodes, link bottleneck information, a list of abnormal log events, or system performance indicators. The control unit categorizes and organizes these results, performs data cleaning, and standardizes the format. For example, it converts all timestamps to a standard format, either fills in or removes missing values, and extracts and annotates keywords from the log text. Once the data standardization is complete, the control terminal will perform customized analysis by combining operation and maintenance task information and contextual information. The operation and maintenance task information can include task type, such as complex network fault diagnosis, cross-system performance analysis, or root cause localization and remediation recommendations; task priority; the scope of the target system or device to be processed; and specific parameters related to user operation commands. Contextual information is the association information formed by the control terminal when receiving operation and maintenance commands, combining historical client interactions with the current system operating status: historical interactions include previous operation and maintenance records, user responses to system anomalies, and the results of previous tasks; the current system operating status includes performance indicators of each node, link load, and real-time alarms. By analyzing the contextual information, the control terminal can determine whether the current processing result is related to previous anomalies or operations, ensuring continuous semantic understanding of commands and consistency in task decisions. The control panel then aggregates, weights, and sorts the processing results based on the operation and maintenance task information and context information. For example, if the processing results show that three core switches have link bottlenecks, and the context information mentions that these three switches have experienced multiple load anomalies in the past week, the control panel will mark these nodes as high-priority risks and add targeted remediation suggestions to the subsequent operation and maintenance feedback, such as instructing operation and maintenance personnel to check link configurations or adjust routing policies. At the same time, the control panel will also combine historical operation records to filter out duplicate issues that have already been processed, avoiding invalid information in the feedback. Finally, the control panel will organize the analyzed information into operation and maintenance feedback results, which will include key abnormal nodes, risky paths, performance anomaly reports, log anomaly summaries, and targeted operation and maintenance operation suggestions. The presentation format of the feedback results is also flexible, which may be a visual chart, a table, or a text report, and then it will be sent to the client via a network interface.

[0026] In this embodiment, maintenance instructions are parsed into specific tasks, which are then intelligently distributed by the control terminal to each sub-agent for independent processing, ensuring the professionalism and standardization of data processing. Customized analysis is then performed by combining task information and context, transforming the standardized results into maintenance feedback that users truly need, thereby improving network maintenance efficiency and reliability.

[0027] Based on the above technical solution, optionally, the system further includes a single-agent processing module, which is used for: If the target sub-agent is an all-around operation and maintenance agent, the target device and analysis type are extracted from the operation and maintenance task information by the all-around operation and maintenance agent, and the target device is analyzed accordingly based on the operation and maintenance data set and analysis type to obtain the processing result, and the processing result is sent to the control terminal.

[0028] In this solution, the omnipotent operation and maintenance intelligent agent is a comprehensive operation and maintenance sub-intelligent agent. Its core capabilities include equipment information query, interface status check, basic performance analysis, and simple fault diagnosis. Target devices are the specific system components or network devices that need to be analyzed or monitored in the operation and maintenance tasks. For example, servers, switches, routers, and storage nodes are common target devices. Analysis type refers to the specific category of analysis that the all-around operations and maintenance agent is required to perform in the operation and maintenance task. Examples include device status query, interface connectivity check, performance indicator evaluation, and simple fault diagnosis. Once the control terminal determines that the target sub-agent is an all-around operations and maintenance (O&M) agent, it sends the O&M task information and related O&M data sets to this agent. After receiving the task information, the all-around O&M agent first parses the task content, identifying the target devices involved and the corresponding analysis types. Common target devices might be servers, switches, routers, or storage nodes; the analysis type specifies the type of O&M operation the agent needs to perform, such as device information query, interface status check, basic performance analysis, or simple fault diagnosis. Having identified the target devices and analysis types, the all-around O&M agent performs processing based on the various information in the O&M data sets: For device information queries, the AI ​​system reads basic information such as the device's model, configuration, operating system version, and runtime parameters, then organizes it into a unified device attribute table. For interface status checks, the AI ​​system analyzes network topology data, interface connection logs, and link status records to determine whether the interface is active, blocked, or in error mode. It also calculates the interface's throughput and packet loss rate, finally generating an interface status report. For basic performance analysis, the AI ​​system combines real-time monitoring metrics and historical performance data to perform statistical and trend analysis on indicators such as CPU utilization, memory usage, disk I / O, and link load, highlighting any abnormal fluctuations. For simple fault diagnosis, the AI ​​system integrates alarm information, log events, and performance anomaly indicators, using a rule engine or lightweight fault reasoning algorithm to determine the possible fault type, such as link congestion, device overload, or service unavailability, and identifies potential root cause nodes to provide direction for subsequent processing. During processing, the all-around intelligent operations and maintenance agent also standardizes different types of data. For example, it standardizes timestamp formats, units, and indicator ranges, extracts keywords from log text, and categorizes events. This ensures that the output can be directly used by the control end without additional format adjustments. Once all processing is complete, the agent encapsulates the organized results into standardized data packets and sends them back to the control end via a network interface. In this solution, the use of an all-around operation and maintenance intelligent agent can uniformly parse tasks, extract key indicators and perform basic diagnosis, and generate standardized results, making operation and maintenance work more efficient and accurate.

[0029] Based on the above technical solution, optionally, the system further includes a correlation analysis module, which is used for: If the target sub-agent is a log analysis agent, a monitoring and alarm agent, a configuration change analysis agent, a network inspection agent, or a fusion agent, and the analysis type of the operation and maintenance task information is multi-system data correlation analysis, the log analysis agent selects cross-system log event data from the operation and maintenance data set based on the operation and maintenance task information, performs event marking, abnormal pattern extraction, and level classification on the cross-system log event data, obtains a cross-system log event feature set, and sends the cross-system log event feature set to the fusion agent; The monitoring and alarm intelligent agent selects real-time monitoring indicators and real-time alarm information of each system in the cross-system combination of the operation and maintenance data set based on the operation and maintenance task information. Based on the real-time monitoring indicators and real-time alarm information, it performs time-series anomaly analysis and key indicator extraction to obtain a performance indicator feature set and an alarm feature set. The performance indicator feature set and alarm feature set are then sent to the fusion intelligent agent. The configuration change analysis agent selects cross-system configuration history information from the cross-system combination in the operation and maintenance data set based on the operation and maintenance task information, updates the edge weights of the corresponding knowledge graph nodes in the preset knowledge graph based on the cross-system configuration history information, obtains the cross-system change perception graph, and sends the cross-system change perception graph to the fusion agent. The network inspection agent selects system topology information and node status data of each system in the cross-system combination of the operation and maintenance data set based on the operation and maintenance task information. Based on the system topology information and node status data, it extracts local topology features and node status features, constructs topological relationships between nodes based on local topology features, and performs structural encoding based on the topological relationships between nodes using a graph embedding method to obtain a set of local topology features. It then performs normalization and feature encoding processing on the node status features to obtain a set of node status features. Finally, it sends the set of local topology features and the set of node status features to the fusion agent. The fusion agent performs joint modeling and differentiable fusion based on log event feature set, performance indicator feature set, alarm feature set, local topology feature set, node status feature set, and cross-system change perception map to obtain cross-system related feature set. Based on the cross-system related feature set, it generates cross-system related report and risk transmission path results, and sends the cross-system related report and risk transmission path results to the control terminal.

[0030] In this approach, multi-system data correlation analysis is a type of analysis that examines the relationships between data from multiple systems.

[0031] Cross-system combination refers to the collection of multiple target systems involved in the analysis process. Cross-system log event data is extracted from the operations and maintenance data set and belongs to the log event data collection of various systems within the cross-system combination. It includes the event timestamp, event level, source component, and keyword information. The cross-system log event feature set is a set of feature vectors formed after processing cross-system log event data. Real-time monitoring metrics are numerical sequences of key performance indicators for each system, generated during real-time data collection. These include CPU utilization, memory usage, disk I / O, network I / O, and response time. Real-time alarm information consists of alarm records triggered by various systems during real-time monitoring. For example, alarms can be triggered when metrics exceed thresholds, connections fail, or responses time out. The performance metric feature set is a set of feature vectors extracted from real-time monitoring metrics and historical performance data. The alarm feature set is a set of feature vectors obtained after processing real-time alarm information.

[0032] Cross-system configuration history information comprises the historical configuration records of each system within a cross-system combination. Specifically, it includes network policies, access control rules, software version updates, and configuration change logs.

[0033] A cross-system change awareness graph is a graph structure formed by mapping cross-system configuration history information to a pre-defined knowledge graph. Nodes in the graph represent system components or configuration items, while edge weights represent the strength of dependencies or the degree of influence between components. System topology information refers to the physical or logical connections between various system devices. It includes link information between nodes, routing information, and network structure information. Node status data refers to the operational status information of individual nodes in various systems. These nodes include servers, routers, and switches, and the status information covers metrics such as CPU load, memory usage, bandwidth utilization, latency, and packet loss rate. Local topology features are representations of the local network structure extracted based on system topology information. Examples include neighbor relationships of nodes, subnet connection patterns, and the importance of links.

[0034] Node state features are feature vectors obtained by normalizing and encoding node state data.

[0035] The topological relationships between nodes are the connections between nodes in a network, along with their corresponding weights.

[0036] Graph embedding methods are algorithms that map network topology and relationships between nodes to a low-dimensional vector space. Methods like DeepWalk, Node2Vec, and graph neural network coding belong to this category.

[0037] The local topological feature set is a set of local topological feature vectors for all nodes, extracted based on the topological relationships between nodes and graph embedding methods. It integrates the local topological features of each node together.

[0038] The node state feature set is a vector set formed by normalizing and encoding the node state features of all nodes. It can describe the operating state of all nodes in the entire system. The cross-system correlation feature set is a comprehensive feature set. It integrates log event features, performance indicator features, alarm features, local topology features, node status features, and cross-system change perception maps, which can characterize the correlation and risk propagation relationships between cross-systems.

[0039] The cross-system correlation report is an analysis report generated based on a set of cross-system correlation features. It describes in detail the correlation between systems, the anomaly patterns that occur, and the potential risks.

[0040] The risk propagation path results are calculated based on cross-system correlation analysis. This includes the specific path and score along which a potential anomaly or fault propagates from one system node to other nodes.

[0041] When the target sub-agent is identified as a log analysis agent, monitoring and alarm agent, configuration change analysis agent, network inspection agent, or fusion agent, and the analysis type of the operation and maintenance task information is multi-system data correlation analysis, the log analysis agent will first determine the cross-system combination to be analyzed based on the operation and maintenance task information. After determining the combination, it will extract the corresponding cross-system log event data from the operation and maintenance data set, which includes key information such as event timestamps, event levels, source components, and keywords for each system. Then, these log events will undergo three processing steps: first, event tagging to extract key behavioral patterns; second, abnormal pattern identification, such as identifying abnormal patterns like repeated failures, timeouts, or connection rejections; and third, severity level classification, dividing them into high, medium, and low levels. After processing, a vector set will be generated, which represents the event type, pattern, and risk level—that is, the cross-system log event feature set—and finally sent to the fusion agent.

[0042] Next, the monitoring and alarm intelligence agent retrieves real-time monitoring metrics and alarm information from each system within the cross-system portfolio from the operations and maintenance data set. Real-time monitoring metrics include performance data sequences such as CPU utilization, memory usage, disk I / O, and network latency; real-time alarm information includes alarm records such as threshold exceeding, connection failures, and service unavailability. Multivariate time-series analysis is performed on this data, such as using LSTM or Transformer for time-series anomaly detection, while extracting key metrics like average load, peak fluctuations, and persistent abnormal periods, thus forming performance metric feature sets and alarm feature sets. These two sets reflect the operational status and abnormal behavior of each system within the cross-system portfolio and are subsequently sent to the fused intelligence agent. The configuration change analysis agent retrieves cross-system configuration history information from the operations and maintenance data set, including network policies, access control rules, and version update records. It then maps these configuration changes to nodes and edges in a pre-defined knowledge graph and updates the corresponding edge weights. This forms a cross-system change awareness graph that reflects cross-system dependencies and their impact strength. Finally, this graph is sent to the fusion agent. Then, the network inspection agent extracts system topology information and node status data from the cross-system combination of the operation and maintenance data set. System topology information represents the physical or logical connections between devices, while node status data represents the operational metrics of each device. The process involves two parts: first, extracting local topology features based on the topology information, such as node neighbor relationships, subnet structure, and link capacity distribution; simultaneously constructing topology relationships between nodes; and then using graph embedding methods, such as Node2Vec or graph convolutional coding, to vectorize these topology relationships, generating a set of local topology features; second, performing feature selection and metric combination on the node status data, such as calculating statistics, fluctuations, and anomaly counts of CPU, memory, and IO utilization, extracting key features reflecting the node's operational status to form node status features. These features are then normalized and encoded to obtain a set of node status features. Finally, the set of local topology features and the set of node status features are sent together to the fusion agent.

[0043] Finally, the fusion agent receives multi-source information from the previous four agents, including cross-system log event feature sets, performance indicator feature sets, alarm feature sets, local topology feature sets, node status feature sets, and cross-system change perception maps. Then, based on graph neural networks and differentiable fusion methods, these multi-source features are jointly modeled. First, all features are mapped into node vectors and edge vectors to form a graph structure input. Then, for each node, an inter-node message passing mechanism is executed, comprehensively encoding neighbor node information, link status, and features such as anomalies, events, and changes, updating the node representation, and finally generating a cross-system correlation feature set. This set can comprehensively characterize the structural dependencies, performance status, anomaly patterns, and the impact of configuration changes of each system in the cross-system combination. Afterwards, predictive calculations are performed based on the cross-system correlation feature set to generate a cross-system correlation report and risk propagation path results. The cross-system correlation report describes the anomaly correlations and potential risk points between systems; the risk propagation path results indicate the possible paths for anomalies or faults to propagate from a node to other nodes, along with corresponding risk scores. Finally, this report and path results are sent to the control terminal via a network interface. This solution can not only perceive the performance and link status of a single node, but also capture potential dependencies and abnormal associations between nodes, enabling joint analysis across systems.

[0044] Based on the above technical solution, optionally, the system further includes a configuration change impact assessment module, which is used for: If the target sub-agent is a configuration change analysis agent, a network inspection agent, a monitoring and alarm agent, or a fusion agent, and the analysis type of the operation and maintenance task information is configuration change impact assessment, the configuration change analysis agent selects configuration change records in the operation and maintenance data set based on the operation and maintenance task information, determines change records and risk indicators based on the configuration change records, and sends the change records and risk indicators to the fusion agent. The network inspection agent selects the device status information before and after the change from the operation and maintenance data set based on the operation and maintenance task information, determines the change impact assessment result based on the device status information before and after the change, and sends the change impact assessment result to the fusion agent. The monitoring and alarm intelligent agent selects the baseline performance indicators and monitoring data before and after the change from the operation and maintenance data set based on the operation and maintenance task information, determines the performance impact feature set and alarm impact feature set based on the baseline performance indicators and monitoring data before and after the change, and sends the performance impact feature set and alarm impact feature set to the fusion intelligent agent. The integrated intelligent agent performs comprehensive analysis and integration of change records, risk indicators, change impact assessment results, performance impact feature sets, and alarm impact feature sets to generate a change impact assessment report, which is then sent to the control terminal.

[0045] In this solution, the configuration change impact assessment evaluates the risks, performance impact, and potential failure types that may arise after a configuration change is made to the system or network. Configuration change logs are raw data that records specific configuration modifications made to a system or network. They clearly state the change type, time of change, who performed the change, and which devices will be affected.

[0046] A change log is a record of one or more specific configuration change events. It includes the content of the change, as well as execution information, such as execution time and execution result. Risk metrics are indicators that quantify the risks that configuration changes may cause. For example, the probability of a failure after a change, or how many devices or systems will be affected by the risk. The device status information before and after the change is collected by the network inspection intelligent agent, representing the device's operational status data before and after the configuration change. This includes CPU utilization, memory usage, disk I / O, etc.

[0047] The impact assessment results are calculated based on the equipment status information before and after the change. It clearly reflects the specific impact of the configuration change on system performance, stability, and reliability.

[0048] Baseline performance metrics are reference performance standards provided by the monitoring and alarm agent. Their purpose is to measure the system's performance under normal conditions, such as the average CPU utilization under normal circumstances. The monitoring data before and after the change is the actual monitoring data collected by the monitoring and alarm intelligent agent. It is mainly used to compare the system status before and after the configuration change, including CPU utilization, memory usage, etc.

[0049] The performance impact feature set is a set of features that represent the impact of configuration changes on various performance metrics. For example, how much the performance metrics deviate from the baseline after the change, and the magnitude of the anomalies. The alarm impact feature set represents the set of features that indicate that configuration changes have triggered alarms. This includes the types of alarms triggered, the frequency of alarm triggering, and the severity level of the alarms.

[0050] The Change Impact Assessment Report is generated by the integrated intelligent agent after comprehensively analyzing information such as configuration changes, risk indicators, device status, and monitoring data. It clearly describes the specific details of the change event, the risk analysis results, the impact assessment on performance and alarms, and which key nodes are most affected.

[0051] When the target sub-agent is identified as a configuration change analysis agent, network inspection agent, monitoring and alarm agent, or fusion agent, and the analysis type of the operation and maintenance task information is configuration change impact assessment, the configuration change analysis agent will select configuration change records related to the current operation and maintenance task from the operation and maintenance data set. These records contain key details of each configuration modification, such as the modification time, the type of change, who performed the operation, the target device to be modified, and the specific change parameters. Based on these configuration change records, the agent will use a rule engine or risk scoring algorithm to analyze the potential risks of each change, and finally generate risk indicators corresponding to each change record. These risk indicators may include failure probability scores, the scope of services affected, and the sensitivity scores of key nodes to the change, which can quantify the risk. After the analysis is completed, each change record and its corresponding risk indicators will be organized into structured data and sent to the fusion agent. Next, the network inspection AI agent, based on the operation and maintenance task information, retrieves the device status information of the devices involved in this change from the operation and maintenance data set before and after the change. This device status information includes monitoring indicators such as CPU utilization, memory usage, disk I / O, network port load, latency, and throughput. Then, the AI ​​agent uses data difference analysis methods, such as differential analysis, trend comparison, or anomaly detection algorithms, to compare the device status information before and after the change and calculate the impact assessment results. This result will clearly state the extent of performance degradation, the scope of impact on critical devices, and which potential risk nodes exist. These results are then sent to the fusion AI agent. The monitoring and alarm agent retrieves the system's baseline performance metrics and corresponding device monitoring data before and after configuration changes from the operations and maintenance data set. The baseline performance metrics are reference indicators under normal system operation, reflecting the system's usual performance level; while the monitoring data are the actual performance metrics and alarm information collected before and after the change—real operational data. The agent compares these two types of data, using statistical analysis or machine learning methods, such as anomaly detection models, threshold comparisons, and rate of change calculations, to generate performance impact feature sets and alarm impact feature sets. The performance impact feature set reflects the extent of deviation in performance metrics caused by the configuration change, while the alarm impact feature set reflects the impact of the change on alarm triggering. After processing, both sets are sent to the fusion agent.

[0052] Finally, the fusion agent receives all data from the previous three agents, including change records, risk indicators, change impact assessment results, performance impact feature sets, and alarm impact feature sets, and then integrates this data. First, a structured correlation analysis is performed on the change records and risk indicators, matching each risk indicator with its corresponding change event, the affected devices, and the potential scope of impact to ensure accurate correspondence. Next, the change impact assessment results, performance impact feature sets, and alarm impact feature sets are fused in a multi-dimensional manner using non-linear mapping methods, such as MLP or weighted aggregation, along with a weighted scoring mechanism, to comprehensively quantify the impact of each change on the overall system performance and alarm risk. The final change impact assessment report includes a detailed description of each change event, a potential risk score, the affected devices and service scope, performance deviation analysis, the impact of alarm triggering, and key risk propagation paths. This report provides a practical reference for operational decisions and risk management and is ultimately sent to the control center.

[0053] This solution can accurately quantify the impact of each change on system performance and risk, and can also identify potential faults and risk propagation paths in advance, thereby helping operations and maintenance personnel make more scientific and efficient decisions.

[0054] Based on the above technical solution, optionally, the system further includes a diagnostic and repair module, which is used for: If the target sub-agent is a log analysis agent, a monitoring and alarm agent, a fault diagnosis agent, or a network problem agent, and the analysis type of the operation and maintenance task information is root cause diagnosis and repair suggestion, the log analysis agent selects diagnostic log data from the operation and maintenance data set based on the operation and maintenance task information, determines the log abnormal feature set based on the diagnostic log data, and sends the log abnormal feature set to the fault diagnosis agent. The monitoring and alarm intelligent agent selects real-time performance indicators and real-time alarm information of the system involved in abnormal events in the operation and maintenance data set based on the operation and maintenance task information, determines the performance abnormal feature set and alarm feature set based on the real-time performance indicators and real-time alarm information, and sends the performance abnormal feature set and alarm feature set to the fault diagnosis intelligent agent. The fault diagnosis agent determines potential root causes and associated anomaly information based on the log anomaly feature set, performance anomaly feature set, and alarm feature set, and sends the potential root causes and associated anomaly information to the network problem agent. The network problem agent determines a root cause analysis report and corresponding solutions based on the potential root causes and associated anomaly information, and sends the root cause analysis report and corresponding solutions to the control terminal.

[0055] In this solution, root cause diagnosis and remediation recommendations are a type of operational analysis. Its core objectives are twofold: first, to pinpoint the root cause of system anomalies or failures, finding the source of the problem; and second, to provide targeted solutions to help restore normal system operation or optimize system performance.

[0056] Diagnostic log data is extracted from the operations and maintenance data set and is specifically used for analyzing system anomalies. It includes error logs, event logs, and operation records.

[0057] Log anomaly feature set is anomaly patterns and features extracted from diagnostic log data. Examples include frequently occurring error codes and unusual operation sequences. An abnormal event involves the various subsystems or components that are affected or related when an abnormal event occurs in the system. Real-time performance metrics are quantitative indicators that reflect the current operating status of a system. Common metrics include CPU utilization, memory usage, service response time, and data throughput. Real-time alarm information consists of alarm records triggered during system operation. It is primarily used to alert users to abnormal situations or performance metrics deviating from preset thresholds. The performance anomaly feature set is based on anomalies obtained from real-time performance metric analysis. Examples include resource usage exceeding thresholds, performance showing a downward trend, and the emergence of obvious bottleneck indicators. The alarm feature set is a set of features obtained based on the analysis of real-time alarm information. It includes the type of alarm, the frequency of alarm triggering, and the severity level of the alarm.

[0058] Potential root causes are the underlying reasons that the troubleshooting agent identifies after analysis, which may lead to system abnormalities or failures.

[0059] Related anomaly information consists of anomalous event data associated with potential root causes. This includes anomaly records in logs, anomalous performance metrics, and triggered alert information. A root cause analysis report is a document generated by a network problem agent. Its core function is to summarize potential root causes and their impact, and to provide a detailed description of the specific circumstances of system anomalies. The corresponding solution provides actionable measures for the problems identified in the root cause analysis report. These include remedial steps, performance optimization operations, or configuration adjustment methods.

[0060] When the target sub-agent is identified as a log analysis agent, a monitoring and alarm agent, a fault diagnosis agent, or a network problem agent, and the analysis type of the operation and maintenance task information is root cause diagnosis and remediation suggestions, the log analysis agent will filter out diagnostic log data related to the current operation and maintenance task from the operation and maintenance data set. This log data includes key content such as operation records, error events, and exception stack information generated by various applications, services, and systems. Then, the log analysis agent will use techniques such as text parsing, regular expression matching, and event pattern mining to structure the diagnostic logs, decomposing each log event into clear fields such as event type, timestamp, and affected components. Next, based on anomaly detection algorithms, such as statistical anomaly detection, rule-based anomaly recognition, or machine learning classification models, it will extract significant anomaly patterns from the logs and label these anomaly patterns according to their severity, ultimately forming a log anomaly feature set. This set contains the key attributes, anomaly type, and level information of each anomaly event, and is then sent to the fault diagnosis agent. The monitoring and alerting agent retrieves real-time operational metrics and alert information related to abnormal events from the operational data set. Real-time performance metrics include CPU utilization, memory usage, disk I / O, and network traffic; real-time alert information includes alert type, trigger threshold, trigger time, and alert level. The agent first performs time-series analysis on the performance metrics, using anomaly detection algorithms such as sliding window statistics, Z-score, or EWMA, as well as deep learning sequence models like LSTM, to identify anomalies and extract key anomaly features. For alert information, the agent performs alert aggregation, deduplication, and level evaluation, ultimately forming a performance anomaly feature set and an alert feature set. These two sets reflect deviations from normal system performance and the core characteristics of alert events, and are then sent to the fault diagnosis agent. After receiving the sets of log anomaly features, performance anomaly features, and alarm features, the first step for the troubleshooting agent is to perform correlation analysis and causal reasoning on these features. The system may construct an event dependency graph or use methods such as Bayesian networks, graph neural networks, and knowledge graphs to perform multi-source feature fusion. Through these methods, it identifies system components that may cause anomalies or chains of anomalous events, thereby determining potential fault points or causes of anomalies, i.e., potential root causes. Simultaneously, the agent compiles information on anomalous events related to each potential root cause, including affected nodes, anomalous indicators, and detailed log event information, forming correlated anomaly information. This information is crucial for subsequent remediation decisions and is then sent to the network problem agent. After receiving potential root causes and related anomaly information, the network problem agent performs a comprehensive analysis of each potential root cause, combining historical failure experience, system topology relationships, and best practice strategies to generate a root cause analysis report. This report details the source, scope of impact, associated anomalies, and potential risks of each potential root cause. Based on this analysis report, the agent generates corresponding solutions, including actionable remedial operations such as restarting services, adjusting configurations, and upgrading patches; optimization suggestions such as resource expansion and load balancing adjustments; and risk mitigation measures. Finally, the root cause analysis report and corresponding solutions are sent to the control terminal.

[0061] This solution uses multi-source data analysis to quickly identify the root cause of anomalies and generate an executable repair plan, which can solve problems more accurately and efficiently and reduce system downtime.

[0062] See appendix Figure 2 , Figure 2 This is a main structural block diagram of an intelligent auxiliary system for network operation and maintenance according to an embodiment of the present invention. Figure 2As shown, an intelligent auxiliary system for network operation and maintenance in an embodiment of the present invention mainly includes: Complex network problem diagnosis module 105, the complex network problem diagnosis module 105 is used for: If the target sub-agent is a network inspection agent, a monitoring and alarm agent, a log analysis agent, a fault diagnosis agent, a configuration change analysis agent, a network problem agent, or a fusion agent, and the analysis type of the operation and maintenance task information is complex network problem diagnosis, the network inspection agent selects network topology information and multi-time-series device status information from the operation and maintenance data set based on the operation and maintenance task information. Based on the network topology information and multi-time-series device status information, it performs joint modeling of topology dependency and historical status for network nodes and network links to obtain network node feature set, network link feature set, and network topology dependency feature. The network node feature set and network link feature set are sent to the fusion agent, and the network topology dependency feature is sent to the network problem agent. The monitoring and alarm intelligent agent selects the real-time monitoring indicators and real-time alarm information of the target single system in the operation and maintenance data set based on the operation and maintenance task information, performs global time-series anomaly detection based on the real-time monitoring indicators and real-time alarm information, obtains an anomaly feature set, and sends the anomaly feature set to the fusion intelligent agent; wherein, the target single system corresponds to the relevant nodes or links in the network, which are included in the operation and maintenance task information. The log analysis agent selects single-system log event information of the target single system from the operation and maintenance data set based on the operation and maintenance task information, performs event marking and level classification based on the single-system log event information, obtains a single-system event feature set, and sends the single-system event feature set to the fusion agent. The configuration change analysis agent selects the single-system configuration history information of the target single system in the operation and maintenance data set based on the operation and maintenance task information, updates the edge weights of the corresponding knowledge graph nodes in the preset knowledge graph based on the single-system configuration history information, obtains the single-system change perception graph, and sends the single-system change perception graph to the fusion agent. The fusion agent performs differentiable joint optimization on the received network node feature set, network link feature set, anomaly feature set, single system event feature set, and single system change perception map. During one backpropagation, it updates the preset graph neural network parameters and the preset knowledge graph edge weights of the current network layer to obtain the fusion feature set, and sends the fusion feature set to the fault diagnosis agent. The fault diagnosis agent simultaneously performs abnormal link prediction and device bottleneck prediction based on the intermediate latent space of the fused feature set, obtains the prediction results, and sends the prediction results to the network problem agent. The network problem agent generates network risk paths and key risk node reports based on the network topology dependency features and prediction results, and sends the network risk paths and key risk node reports to the control terminal.

[0063] In this embodiment, the network inspection agent is an intelligent analysis unit that is specifically designed to periodically detect and extract features from the network topology and device operating status.

[0064] A monitoring and alarm intelligent agent is an intelligent analysis unit used to monitor the operating status of a single system or device.

[0065] Log analysis agents are intelligent analysis units that parse the runtime logs of a target system.

[0066] The fault diagnosis agent is an intelligent analysis unit that operates based on the fused feature set.

[0067] The configuration change analysis agent is an intelligent analysis unit specifically designed to analyze the history of system configuration changes.

[0068] A network problem intelligent agent is an intelligent analysis unit that integrates the dependency characteristics of network topology and fault prediction results. The fusion agent is the core computing entity responsible for receiving multi-source feature information from multiple sub-agents and performing unified analysis and joint optimization.

[0069] Complex network problem diagnosis is a type of operational analysis task that addresses network issues that span multiple levels. Examples include network performance anomalies, link bottlenecks, and device coordination failures. Network topology information is a structured collection of data that reflects the physical or logical connections between network devices. It includes the connection relationships between nodes, link attributes, bandwidth, latency, etc.

[0070] Multi-time sequence device status information is a sequence of device operating parameters collected at different time periods. Common parameters such as CPU utilization, memory usage, interface traffic, and error rate are all included.

[0071] A network node is a physical unit within a network that can operate and communicate independently. Common examples include servers, switches, routers, and other terminal devices. A network link is a connection channel that enables data transmission between network nodes.

[0072] The network node feature set is a multi-dimensional vector set used to characterize the state, performance, and anomaly features of each network node after feature extraction and modeling. A network link feature set is a multi-dimensional set of features used to characterize the quality, load, and temporal variation characteristics of network links. It provides a clear understanding of the quality of each link and the amount of traffic it carries.

[0073] Network topology dependency features are the inter-node dependency features calculated based on the network topology. A target single system is a system or subsystem unit corresponding to a specific network node or link in an operation and maintenance task. For example, a host, an application server, or a business module. Real-time monitoring metrics are performance metrics collected in real time from the target system. Common real-time monitoring metrics include CPU utilization, memory usage, network I / O, latency, and throughput. Real-time alerts are abnormal notifications triggered by monitoring policies during system operation. For example, performance exceeding thresholds, link interruptions, service delays, and error responses will all trigger alerts.

[0074] The abnormal feature set is the set of abnormal pattern features extracted by the monitoring and alarm intelligent agent after performing global time-series abnormality detection.

[0075] Single-system log event information comprises various log records generated by the target single system. These include operation logs, error logs, and system event records. The single-system event feature set is a set of features extracted by the log analysis agent. It includes the event level, event type, and the event's temporal distribution. The single-system configuration history information is a record of historical changes to the system configuration files and various parameters. The pre-defined knowledge graph is an operations and maintenance knowledge network stored using a graph structure. It mainly describes the relationships between entities such as devices, systems, alarms, and events, as well as their dependency logic. Knowledge graph nodes are entity objects within a knowledge graph. For example, devices, alarm types, event categories, and configuration items can all serve as knowledge graph nodes and are the basic elements that constitute a knowledge graph.

[0076] Edge weights are weight values ​​used in knowledge graphs to represent the strength or correlation of the relationship between two nodes. They reflect the probability of a fault propagating from one node to another. A single-system change perception graph is a knowledge graph structure formed within a configuration change analysis agent.

[0077] The preset graph neural network parameters are the initial parameter set used to learn the graph structure of the graph neural network from the fused features. They include initial weights, node embedding data, and propagation parameters. The preset knowledge graph edge weights are the initial knowledge graph edge weights set before the fusion and optimization work begins.

[0078] The fusion feature set is a high-dimensional unified feature representation formed by the fusion agent after jointly optimizing features from multiple sources. The intermediate latent space is a potential feature space formed in a fault-finding agent after fusion features have undergone dimensionality reduction or embedding processing. It is mainly used to predict abnormal links and analyze equipment bottlenecks. The prediction results are based on the output of intermediate latent space modeling. They mainly include predictions for abnormal links and equipment bottlenecks. Network risk paths are sequences of paths generated by a network problem agent based on topological dependency characteristics and prediction results. These paths are routes where risks may propagate. The critical risk node report is an analysis report of high-risk nodes identified in the network risk path. It clearly states the failure probability of each high-risk node, the potential scope of impact, and the priority of handling it.

[0079] The current network hierarchy is the network structure hierarchy that is the focus of analysis and modeling in the task of diagnosing complex network problems.

[0080] When the control end determines that the target sub-agents include network inspection agents, monitoring and alarm agents, log analysis agents, fault diagnosis agents, configuration change analysis agents, network problem agents, and fusion agents, and the analysis type of the operation and maintenance task information is complex network problem diagnosis, the network inspection agent will extract network topology information and multi-time-series device status information from the operation and maintenance data set according to the network scope and diagnostic objectives specified in the operation and maintenance task information. The network topology information includes the physical or logical connection relationships between network nodes, such as the link configuration table between routers, switches, and servers; the multi-time-series device status information includes time-series indicators such as historical CPU load, port bandwidth utilization, packet loss rate, and latency. Then, a graph structure modeling method is used to abstract each device into a network node and the communication relationships between devices into network links. Finally, a graph time-series modeling algorithm, such as T-GCN or DCRNN, is used to construct a joint model of topology dependencies and historical states. The model training will yield three types of outputs: first, a set of network node features reflecting the performance trends and stability of each node; second, a set of network link features reflecting changes in link bandwidth and connectivity reliability; and third, network topology dependency features reflecting the structural dependency weight matrix between nodes and links.

[0081] Then, the log analysis agent selects single-system log events from the same target single system based on the operation and maintenance task information, and parses the event timestamp, keywords, level, and component source from the log stream. Next, it uses semantic embedding methods based on BERT or LogBERT models to perform event content understanding and similarity clustering, semantically labeling and classifying the severity of events. Finally, a single-system event feature set is formed and sent to the fusion agent, including event vector representations, risk levels, and associated time windows to characterize system behavior patterns. For example, if high-risk keywords such as "connection refused" or "pooltimeout" appear in the logs, they will be aggregated into the same abnormal event cluster. The configuration change analysis agent selects historical configuration information for the target single system from the operation and maintenance data set, such as network policy tables, access control rules, and version change records. Then, based on a knowledge graph update algorithm, it maps these configuration changes to nodes and edges in a pre-defined knowledge graph. Knowledge graph nodes represent system components or configuration items, such as "interface eth0" or "firewall policy #23," while edge weights represent the strength of their dependencies or the degree of their impact. When a configuration modification is detected, the corresponding edge weights are adjusted according to the scope of the change's impact, forming a single-system change awareness graph, which is then sent to the fusion agent. For example, if a routing policy was recently modified and affected multiple switch nodes, the edge weight from the policy node to the switch node will be increased, indicating an enhanced dependency relationship.

[0082] The fusion agent first receives multi-source features from various sub-agents, including sets of network node features, network link features, anomaly features, single-system event features, and a single-system change-aware graph. The fusion agent then maps these features from different sources into node and edge input vectors that a graph neural network (Graph Neural Network) can recognize, preparing for subsequent model computation. Next, the Graph Neural Network begins working, encoding information such as network topology dependencies, node performance, and link states through multi-layer message passing and graph convolution operations. Simultaneously, the model calculates loss functions for the fused features on several key tasks, such as anomaly prediction, performance evaluation, and configuration change matching. These loss functions reflect the degree of bias in the current model's handling of these tasks. These loss functions are differentiable with respect to the pre-defined Graph Neural Network parameters and the pre-defined knowledge graph edge weights. Therefore, during backpropagation, the model not only updates the Graph Neural Network parameters to optimize the vector representations of nodes and edges but also synchronously adjusts the knowledge graph edge weights at the current network layer. This allows the knowledge graph to dynamically reflect the real dependencies between nodes, achieving global optimization within layers and avoiding biases caused by local parameter adjustments. Once the optimization is complete, a fused feature set will be output and sent to the fault diagnosis agent. This set of node and link vectors incorporates multi-dimensional information such as topology, performance data, anomaly signals, and configuration changes, providing a more comprehensive reflection of the network status. Furthermore, the updated knowledge graph edge weights enhance the model's ability to perceive potential dependencies between nodes. For example, after the edge weights between database nodes and application server nodes are strengthened, the model can automatically capture the performance correlation between these two nodes in the next round of prediction, thereby improving the accuracy of anomaly prediction and risk analysis. Finally, there's the anomaly prediction and risk generation stage. The fault diagnosis agent utilizes the intermediate latent space representation of the fused feature set—that is, the high-dimensional latent feature distribution in the fused model—to perform anomaly link prediction and device bottleneck prediction tasks. It employs a prediction model based on graph convolution and attention mechanisms, such as GAT or GNN-based forecasting, to generate prediction results, including high-risk links and device nodes that may experience performance bottlenecks. These prediction results are sent to the network problem agent. The network problem agent combines the prediction results with the previously mentioned network topology dependency features to calculate the risk propagation paths in the network. Then, based on path analysis algorithms, such as the shortest risk path Dijkstra's algorithm or a probabilistic propagation model, it generates reports on network risk paths and key risk nodes.

[0083] This solution can simultaneously detect anomalies at the node, link, and system levels, and can also capture potential risks brought about by configuration changes and historical dependencies.

[0084] Based on the above technical solution, optionally, the complex network problem diagnosis module is specifically used for: The fusion agent models the feature sets of network nodes and network links using graph neural networks, and updates the node representations through inter-node message passing mechanisms and link relationships to form a joint representation of nodes and links. The joint representation of node links maps the abnormal feature set and the single system event feature set to the corresponding node representation by node. Then, through the differentiable fusion layer, the mapped node representation and the single system change perception map are nonlinearly mapped and weighted to form a comprehensive node representation. Based on the comprehensive node representation, the predicted output of network nodes and network links is calculated through forward propagation. Based on the predicted output and the preset task objective, the loss value is calculated. Based on the loss value, the preset graph neural network parameters and the preset knowledge graph edge weights of the current network layer are updated simultaneously through a backpropagation to obtain a fused feature set.

[0085] In this approach, graph neural networks are a specialized deep learning model. They can simultaneously consider the properties of nodes themselves, as well as the connections between nodes, and perform feature learning based on these factors. The inter-node message passing mechanism is a core concept in graph neural networks, used to describe how nodes collect information from neighboring nodes and update their own representations.

[0086] Link relationships are the connections between nodes in a network, which correspond to the edges of a graph.

[0087] Node representations are vectorized features learned by nodes in a graph neural network.

[0088] The joint node-link representation is a comprehensive vector obtained by combining node representations and link information.

[0089] A node is the basic unit in a network. It can be a physical device, such as a switch, router, or server; or a logical entity, such as a database service or application service.

[0090] A differentiable fusion layer is a type of neural network layer or operation. It is mainly used to integrate features from multiple sources, such as anomaly features, event features, and change maps.

[0091] The composite node representation is the final vector feature obtained after each node has been processed by a differentiable fusion layer. It includes the node's own state, link information, as well as anomaly features, event features, etc.

[0092] The predicted output is the result obtained after forward propagation of the model based on the comprehensive node representation.

[0093] Pre-defined task objectives are objective functions that are predefined during model training or inference. Examples include anomaly identification criteria for anomaly detection and reference ranges for performance prediction metrics. The loss value is a numerical value used to measure the difference, specifically the difference between the model's predicted output and the preset task objective. It is mainly used in the backpropagation process. The initial step for a fusion agent is to model the feature sets of network nodes and network links. Specifically, this involves mapping these features into node vectors and edge vectors that a graph neural network can recognize, and then constructing a graph structure as input. Here, node vectors represent the states of various devices in the network, while link relationships represent the connectivity or performance correlations between nodes, laying the foundation for subsequent model processing. The graph neural network then processes this graph structure, primarily updating node representations through inter-node message passing mechanisms. This process involves each node encoding its own features into messages, then sending these messages to neighboring nodes based on the weights of the link relationships, while also receiving messages from neighboring nodes. Upon receiving messages, these messages are first aggregated, for example using weighted summation or attention-weighted methods, and then fused with the node's own features. Finally, a non-linear mapping function, such as an MLP with an activation function, is used to update the node representation. After multiple iterations, the node representation integrates its own features, the states of neighboring nodes, and link information, forming a joint node-link representation. This joint statement represents the core modeling results of network topology, device status, and link performance, comprehensively reflecting key information about nodes and connections. Next, the abnormal feature set and the single-system event feature set are mapped to the node link joint representation according to the node correspondence. This adds a new dimension to each node vector to represent the abnormal behavior or event pattern of that node, making the node information more complete. Then, a differentiable fusion layer operation is performed on the mapped node representation and the single-system change perception graph: first, the node representation is transformed through a non-linear mapping function, and then weighted and integrated with the edge weights in the graph to finally obtain the comprehensive node representation for each node. This comprehensive representation integrates multi-dimensional information such as structural dependencies, performance data, abnormal signals, log events, and configuration changes, and can comprehensively reflect the actual situation of the node. For example, the comprehensive node representation of database node DB-01 may include its high CPU load, IO bottleneck, surge in upstream application requests, and recent routing policy changes. Next, forward propagation computation is performed based on the comprehensive node representation to generate prediction outputs. These prediction outputs may include the anomaly probability of a link, the performance bottleneck score of a node, or the potential failure risk value, representing the model's judgment of the network state. Then, the prediction outputs are compared with preset task objectives, such as anomaly detection standards, performance optimization requirements, or risk score thresholds, and the loss value is calculated. There are many ways to calculate the loss value, such as mean squared error, cross-entropy, or weighted combined loss, which reflects the degree of model deviation on the current prediction task. After obtaining the loss value, a backpropagation is performed. During this process, the preset graph neural network parameters and the preset knowledge graph edge weights for the current network layer are updated simultaneously. After the update, the node representations and edge vectors can more accurately reflect the true network state, and the knowledge graph edge weights can also capture changes in potential dependencies between nodes. For example, when the performance of database node DB-01 and application server APP-01 is highly correlated, their edge weights will increase. In this way, the model can automatically identify this relationship in the next round of inference, improving the accuracy of the analysis. Finally, the updated node vectors, edge vectors, and fused feature vectors will together form a fused feature set. This solution enables node vectors and edge vectors to accurately capture inter-node dependencies and link performance, and also integrates historical anomaly and configuration change information to make the prediction output more accurate.

[0094] It should be noted that although the steps in the above embodiments are described in a specific order, those skilled in the art will understand that in order to achieve the effects of the present invention, different steps do not necessarily have to be executed in such an order. They can be executed simultaneously (in parallel) or in other orders, and these variations are all within the scope of protection of the present invention.

[0095] Furthermore, the present invention also provides an intelligent auxiliary method for network operation and maintenance.

[0096] See appendix Figure 3 , Figure 3 This is a schematic flowchart illustrating the main steps of an intelligent auxiliary method for network operation and maintenance according to an embodiment of the present invention. Figure 1 As shown, an intelligent auxiliary method for network operation and maintenance in this embodiment of the invention mainly includes the following steps S301-S304.

[0097] S301, if the control terminal receives the operation and maintenance instructions and context information sent by the client, it performs semantic parsing on the operation and maintenance instructions to obtain operation and maintenance task information, and determines the target sub-intelligent agent and target function label based on the operation and maintenance task information and the preset mapping rules; wherein, the number of target sub-intelligent agents is at least one; the number of target function labels is at least one. S302, the control terminal retrieves the corresponding operation and maintenance data set from the database based on the target function tag and operation and maintenance task information; S303, the control terminal sends the operation and maintenance data set and operation and maintenance task information to the target sub-intelligent agent, so that the target sub-intelligent agent can process the operation and maintenance data set. S304, the control terminal receives the processing result of the target sub-intelligent agent, performs customized processing on the processing result based on the operation and maintenance task information and context information, obtains the operation and maintenance feedback result, and sends the operation and maintenance feedback result to the client.

[0098] Those skilled in the art will understand that all or part of the processes in the method of the above embodiment of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable storage medium can include any entity or system capable of carrying the computer program code, a medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory, a random access memory, an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc. It should be noted that the content included in the computer-readable storage medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable storage medium does not include electrical carrier signals and telecommunication signals.

[0099] Furthermore, the present invention also provides an electronic device 400, including a processor 401, a memory 402, and a program or instructions stored in the memory 402 and executable on the processor 401. When the program or instructions are executed by the processor 401, they implement the various processes of the above-described intelligent auxiliary system embodiment for network operation and maintenance, and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0100] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0101] Furthermore, the present invention also provides a computer-readable storage medium. In one embodiment of the computer-readable storage medium according to the present invention, the computer-readable storage medium can be configured to store a program for executing an intelligent auxiliary system for network operation and maintenance according to the above-described method embodiments. This program can be loaded and run by a processor to implement the aforementioned intelligent auxiliary system for network operation and maintenance. For ease of explanation, only the parts related to the embodiments of the present invention are shown; for specific technical details not disclosed, please refer to the method section of the embodiments of the present invention. The computer-readable storage medium can be a storage system device comprising various electronic devices. Optionally, in the embodiments of the present invention, the computer-readable storage medium is a non-transitory computer-readable storage medium.

[0102] Furthermore, it should be understood that since the various modules are only provided to illustrate the functional units of the system of the present invention, the physical devices corresponding to these modules may be the processor itself, or a part of the processor's software, hardware, or a combination of software and hardware. Therefore, the number of modules shown in the figures is merely illustrative.

[0103] Those skilled in the art will understand that the various modules in the system can be adaptively split or merged. Such splitting or merging of specific modules will not cause the technical solution to deviate from the principles of the present invention; therefore, the technical solutions after splitting or merging will fall within the protection scope of the present invention.

[0104] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. An intelligent auxiliary system for network operation and maintenance, characterized in that, The system includes: The mapping module is used by the control terminal to perform semantic parsing on the operation and maintenance instructions and context information sent by the client, obtain operation and maintenance task information, and determine the target sub-intelligent agent and target function label based on the operation and maintenance task information and preset mapping rules; wherein, the number of target sub-intelligent agents is at least one; the number of target function labels is at least one; the context information is the association information that the control terminal integrates the client's historical interaction content and the current system running status when receiving operation and maintenance instructions, and is used to realize continuous semantic understanding and task decision-making. The retrieval module is used by the control terminal to retrieve the corresponding operation and maintenance data set from the database based on the target function tag and operation and maintenance task information; The data transmission module is used by the control terminal to send the operation and maintenance data set and operation and maintenance task information to the target sub-intelligent agent, so that the target sub-intelligent agent can process the operation and maintenance data set. The operation and maintenance feedback module is used by the control terminal to receive the processing results of the target sub-agent. Based on the operation and maintenance task information and context information, the control terminal performs customized processing on the processing results. By analyzing the context information, the control terminal can determine whether the current processing result is related to previous anomalies or operations, ensuring continuous semantic understanding of instructions and the coherence of task decisions. Then, the control terminal aggregates, weights, and sorts the processing results based on the operation and maintenance task information and context information. At the same time, the control terminal also combines historical operation records to filter out duplicate problems that have already been processed, obtains the operation and maintenance feedback result, and sends the operation and maintenance feedback result to the client. The system further includes a single-agent processing module, which is used for: If the target sub-agent is an all-around operation and maintenance agent, the target device and analysis type in the operation and maintenance task information are extracted by the all-around operation and maintenance agent, and the target device is analyzed accordingly based on the operation and maintenance data set and analysis type to obtain the processing result, and the processing result is sent to the control terminal. The system also includes a complex network problem diagnosis module, which is used to: if the target sub-agent is a network inspection agent, a monitoring and alarm agent, a log analysis agent, a fault diagnosis agent, a configuration change analysis agent, a network problem agent, or a fusion agent, and the analysis type of the operation and maintenance task information is complex network problem diagnosis, the network inspection agent selects network topology information and multi-time-series device status information from the operation and maintenance data set based on the operation and maintenance task information, performs joint modeling of topology dependency and historical status for network nodes and network links based on the network topology information and multi-time-series device status information, obtains a network node feature set, a network link feature set, and a network topology dependency feature, sends the network node feature set and the network link feature set to the fusion agent, and sends the network topology dependency feature to the network problem agent; The monitoring and alarm intelligent agent selects the real-time monitoring indicators and real-time alarm information of the target single system in the operation and maintenance data set based on the operation and maintenance task information, performs global time-series anomaly detection based on the real-time monitoring indicators and real-time alarm information, obtains an anomaly feature set, and sends the anomaly feature set to the fusion intelligent agent; wherein, the target single system corresponds to the relevant nodes or links in the network, which are included in the operation and maintenance task information. The log analysis agent selects single-system log event information of the target single system from the operation and maintenance data set based on the operation and maintenance task information, performs event marking and level classification based on the single-system log event information, obtains a single-system event feature set, and sends the single-system event feature set to the fusion agent. The configuration change analysis agent selects the single-system configuration history information of the target single system in the operation and maintenance data set based on the operation and maintenance task information, updates the edge weights of the corresponding knowledge graph nodes in the preset knowledge graph based on the single-system configuration history information, obtains the single-system change perception graph, and sends the single-system change perception graph to the fusion agent. The fusion agent performs differentiable joint optimization on the received network node feature set, network link feature set, anomaly feature set, single system event feature set, and single system change perception map. During one backpropagation, it updates the preset graph neural network parameters and the preset knowledge graph edge weights of the current network layer to obtain the fusion feature set, and sends the fusion feature set to the fault diagnosis agent. The fault diagnosis agent simultaneously performs abnormal link prediction and device bottleneck prediction based on the intermediate latent space of the fused feature set, obtains the prediction results, and sends the prediction results to the network problem agent. The network problem agent generates network risk paths and key risk node reports based on the network topology dependency characteristics and prediction results, and sends the network risk paths and key risk node reports to the control terminal. The complex network problem diagnosis module is specifically used for: the fusion agent to model the feature set of network nodes and the feature set of network links through graph neural networks, and to update the node representation through the message passing mechanism between nodes and the link relationship to form a joint representation of nodes and links; The joint representation of node links maps the abnormal feature set and the single system event feature set to the corresponding node representation by node. Then, through the differentiable fusion layer, the mapped node representation and the single system change perception map are nonlinearly mapped and weighted to form a comprehensive node representation. Based on the comprehensive node representation, the predicted output of network nodes and network links is calculated through forward propagation. Based on the predicted output and the preset task objective, the loss value is calculated. Based on the loss value, the preset graph neural network parameters and the preset knowledge graph edge weights of the current network layer are updated simultaneously through a backpropagation to obtain a fused feature set.

2. The intelligent auxiliary system for network operation and maintenance according to claim 1, characterized in that, in, The system also includes a correlation analysis module, which is used for: If the target sub-agent is a log analysis agent, a monitoring and alarm agent, a configuration change analysis agent, a network inspection agent, or a fusion agent, and the analysis type of the operation and maintenance task information is multi-system data correlation analysis, the log analysis agent selects cross-system log event data from the operation and maintenance data set based on the operation and maintenance task information, performs event marking, abnormal pattern extraction, and level classification on the cross-system log event data, obtains a cross-system log event feature set, and sends the cross-system log event feature set to the fusion agent; The monitoring and alarm intelligent agent selects real-time monitoring indicators and real-time alarm information of each system in the cross-system combination of the operation and maintenance data set based on the operation and maintenance task information. Based on the real-time monitoring indicators and real-time alarm information, it performs time-series anomaly analysis and key indicator extraction to obtain a performance indicator feature set and an alarm feature set. The performance indicator feature set and alarm feature set are then sent to the fusion intelligent agent. The configuration change analysis agent selects cross-system configuration history information from the cross-system combination in the operation and maintenance data set based on the operation and maintenance task information, updates the edge weights of the corresponding knowledge graph nodes in the preset knowledge graph based on the cross-system configuration history information, obtains the cross-system change perception graph, and sends the cross-system change perception graph to the fusion agent. The network inspection agent selects system topology information and node status data of each system in the cross-system combination of the operation and maintenance data set based on the operation and maintenance task information. Based on the system topology information and node status data, it extracts local topology features and node status features, constructs topological relationships between nodes based on local topology features, and performs structural encoding based on the topological relationships between nodes using a graph embedding method to obtain a set of local topology features. It then performs normalization and feature encoding processing on the node status features to obtain a set of node status features. Finally, it sends the set of local topology features and the set of node status features to the fusion agent. The fusion agent performs joint modeling and differentiable fusion based on log event feature set, performance indicator feature set, alarm feature set, local topology feature set, node status feature set, and cross-system change perception map to obtain cross-system related feature set. Based on the cross-system related feature set, it generates cross-system related report and risk transmission path results, and sends the cross-system related report and risk transmission path results to the control terminal.

3. The intelligent auxiliary system for network operation and maintenance according to claim 1, characterized in that, in, The system also includes a configuration change impact assessment module, which is used for: If the target sub-agent is a configuration change analysis agent, a network inspection agent, a monitoring and alarm agent, or a fusion agent, and the analysis type of the operation and maintenance task information is configuration change impact assessment, the configuration change analysis agent selects configuration change records in the operation and maintenance data set based on the operation and maintenance task information, determines change records and risk indicators based on the configuration change records, and sends the change records and risk indicators to the fusion agent. The network inspection agent selects the device status information before and after the change from the operation and maintenance data set based on the operation and maintenance task information, determines the change impact assessment result based on the device status information before and after the change, and sends the change impact assessment result to the fusion agent. The monitoring and alarm intelligent agent selects the baseline performance indicators and monitoring data before and after the change from the operation and maintenance data set based on the operation and maintenance task information, determines the performance impact feature set and alarm impact feature set based on the baseline performance indicators and monitoring data before and after the change, and sends the performance impact feature set and alarm impact feature set to the fusion intelligent agent. The integrated intelligent agent performs comprehensive analysis and integration of change records, risk indicators, change impact assessment results, performance impact feature sets, and alarm impact feature sets to generate a change impact assessment report, which is then sent to the control terminal.

4. The intelligent auxiliary system for network operation and maintenance according to claim 1, characterized in that, in, The system also includes a diagnostic and repair module, which is used for: If the target sub-agent is a log analysis agent, a monitoring and alarm agent, a fault diagnosis agent, or a network problem agent, and the analysis type of the operation and maintenance task information is root cause diagnosis and repair suggestion, the log analysis agent selects diagnostic log data from the operation and maintenance data set based on the operation and maintenance task information, determines the log abnormal feature set based on the diagnostic log data, and sends the log abnormal feature set to the fault diagnosis agent. The monitoring and alarm intelligent agent selects real-time performance indicators and real-time alarm information of the system involved in abnormal events in the operation and maintenance data set based on the operation and maintenance task information, determines the performance abnormal feature set and alarm feature set based on the real-time performance indicators and real-time alarm information, and sends the performance abnormal feature set and alarm feature set to the fault diagnosis intelligent agent. The fault diagnosis agent determines potential root causes and associated anomaly information based on the log anomaly feature set, performance anomaly feature set, and alarm feature set, and sends the potential root causes and associated anomaly information to the network problem agent. The network problem agent determines a root cause analysis report and corresponding solutions based on the potential root causes and associated anomaly information, and sends the root cause analysis report and corresponding solutions to the control terminal.

5. An intelligent auxiliary method for network operation and maintenance, based on the system described in any one of claims 1-4, characterized in that, The method includes: If the control terminal receives the operation and maintenance instructions and context information sent by the client, it performs semantic parsing on the operation and maintenance instructions to obtain operation and maintenance task information, and determines the target sub-intelligent agent and target function label based on the operation and maintenance task information and the preset mapping rules; wherein, the number of target sub-intelligent agents is at least one; the number of target function labels is at least one. The control terminal retrieves the corresponding operation and maintenance data set from the database based on the target function tag and operation and maintenance task information; The control terminal sends the operation and maintenance data set and operation and maintenance task information to the target sub-intelligent agent, so that the target sub-intelligent agent can process the operation and maintenance data set. The control terminal receives the processing result of the target sub-agent, performs customized processing on the processing result based on the operation and maintenance task information and context information, obtains the operation and maintenance feedback result, and sends the operation and maintenance feedback result to the client.

6. An electronic device comprising a processor, a memory, and a program or instructions stored in the memory and executable on the processor, characterized in that, The program or instructions are adapted to be loaded and run by the processor to perform the intelligent auxiliary method for network operation and maintenance as described in claim 5.

7. A computer-readable storage medium storing a plurality of program codes, characterized in that, The program code is adapted to be loaded and run by a processor to perform the intelligent auxiliary method for network operation and maintenance as described in claim 5.

Images