Intelligent early warning method and system for ICT equipment

Abstract

This application relates to an intelligent early warning method and system for ICT equipment, belonging to the field of intelligent operation and maintenance management technology. The intelligent early warning method includes: collecting and processing multi-source heterogeneous data through a sensor network deployed on the ICT equipment to generate structured data; classifying the structured data by importance, outputting critical-level data streams and non-critical-level data packets; performing dynamic threshold calculation and anomaly detection on the critical-level data streams, outputting anomaly markers and equipment feature vectors; fusing the equipment feature vectors and non-critical-level data packets from multiple sources, inputting them into a cloud-based health assessment model to calculate an equipment health score; inputting the equipment health score into a degradation curve function to predict the remaining service life, and outputting an equipment health report; generating graded early warning instructions by combining with an operation and maintenance strategy library; and generating executable maintenance work orders through a cost-benefit decision tree model. This application realizes intelligent perception, analysis, and response to the operating status of ICT equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent operation and maintenance of equipment, in particular to an ICT equipment intelligent early warning method and system. BACKGROUND

[0002] With the rapid development of communication, computing and network infrastructure, modern data centers, base station systems, edge computing nodes and other key ICT facilities are increasingly showing a highly integrated and complex development trend. In actual operation, such equipment is often in a high-load, long-time continuous operation state, and is easily affected by various factors such as internal and external environmental disturbances, component aging, configuration deviation, etc., thereby causing performance degradation and even sudden failure and other problems. If these problems are not discovered and handled in time, they may not only cause service interruption, data loss and other serious consequences, but also cause huge economic losses and social negative effects.

[0003] In order to improve the control ability of the running state of ICT equipment, various sensor monitoring technologies and automatic alarm mechanisms have been widely used in recent years. However, such methods can only discover some explicit problems to a certain extent, but still have obvious shortcomings in terms of early potential problem identification, dynamic working condition adaptability adjustment and cross-dimension correlation analysis. Especially in the face of a large number of concurrent device access scenarios, there is a lack of effective automatic processing procedures and intelligent decision support capabilities, making it difficult to effectively mine and utilize a large amount of unstructured and semi-structured field perception information, and unable to meet the timeliness requirements for fault precursor capture in a rapidly changing environment. SUMMARY

[0004] In order to ensure efficient and reliable operation, and to build a set of ICT equipment lifecycle monitoring and early warning system suitable for complex heterogeneous environments, the present application provides an ICT equipment intelligent early warning method and system.

[0005] In a first aspect, the present application provides an ICT equipment intelligent early warning method, which adopts the following technical solution:

[0006] An ICT equipment intelligent early warning method, the intelligent early warning method comprising:

[0007] Collecting multi-source heterogeneous data through a sensor network deployed in the ICT equipment; wherein the multi-source heterogeneous data includes device running parameters, environmental parameters and device log data;

[0008] Performing real-time cleaning and time synchronization processing on the multi-source heterogeneous data to generate structured data;

[0009] According to a preset entropy value calculation model, the structured data is classified according to importance, and key level data flow and non-key level data packet are outputted;

[0010] performing dynamic threshold calculation on the critical level data stream based on a historical fault database to generate device adaptive real-time threshold parameters;

[0011] performing anomaly detection on the critical level data stream by using a lightweight time series analysis model to output an anomaly label and a device feature vector;

[0012] performing multi-source fusion on the device feature vector and non-critical level data packets to input a cloud health assessment model to calculate a device health score;

[0013] based on pre-stored historical device data and device attribute information, performing cluster analysis on similar devices and constructing a degradation trend model corresponding to each type of device to form a corresponding degradation curve function;

[0014] inputting the device health score into the degradation curve function to predict the remaining useful life and output a device health report;

[0015] generating a hierarchical early warning instruction according to the device health score and the remaining useful life in the device health report in combination with a pre-set operation and maintenance strategy library;

[0016] based on the hierarchical early warning instruction and real-time acquired resource context data, generating an executable maintenance work order by using a cost-benefit decision tree model.

[0017] By using the above technical solution, the present application traverses the whole process control link from bottom perception, intermediate analysis to top scheduling decision, realizes intelligent perception, analysis and response to the running state of ICT devices. The technical solution fully embodies the new generation of intelligent manufacturing concept of soft and hard integration, edge-cloud collaboration under the background of modern industrial internet, not only meets the demand of efficient operation and maintenance management but also takes into account the target achievement of economic benefit. Through layer-by-layer progressive logical evolution, the early warning accuracy and response timeliness are significantly better than those of the existing general fault diagnosis method, which provides strong technical support guarantee for enterprise digital transformation.

[0018] Optionally, the step of classifying the importance of the structured data according to a pre-set entropy value calculation model to output the critical level data stream and the non-critical level data packet includes:

[0019] dividing the structured data into data blocks according to a pre-set time window, and performing probability statistics on the parameter value distribution in each data block;

[0020] calculating the entropy value measurement of each data block according to the probability statistics result of the parameter value distribution;

[0021] The entropy value is compared with a preset classification threshold. Data blocks with an entropy value higher than the preset classification threshold are marked as critical data streams, and the rest are marked as non-critical data packets.

[0022] Output critical-level data streams with hierarchical tags and non-critical-level data packets to the data transmission channel.

[0023] By employing the above technical solution, the original time series is transformed into an analysis object with controllable granularity using sliding time window technology. Furthermore, the internal parameter distribution characteristics are quantified based on information entropy theory, and finally, accurate identification is achieved by setting reasonable evaluation thresholds. Compared to the traditional, extensive full-reporting approach, this solution can significantly reduce the burden of invalid transmission while ensuring the complete capture of core alarm information, thus helping to improve the overall operating efficiency and stability of the distributed system.

[0024] Optionally, the step of dynamically calculating thresholds for the critical-level data stream based on a historical fault database to generate adaptive real-time threshold parameters for the device includes:

[0025] Retrieve equipment type-related fault records and historical parameter statistics stored in the historical fault database;

[0026] Extract current device operating load parameters and environmental parameters from the real-time input critical-level data stream;

[0027] Based on the device type, a corresponding threshold calculation model is matched, and dynamic threshold calculation is performed by combining the historical parameter statistics, current operating load parameters, and environmental parameters.

[0028] Output real-time threshold parameters to the anomaly detection module.

[0029] By adopting the above technical solution and combining the learning and analysis of historical failure cases with close monitoring of current operational status, a comprehensive evaluation framework that takes into account both static statistical characteristics and time-sensitive factors has been successfully established. This effectively overcomes the problems of misjudgment and omission caused by relying solely on manual experience to set a single critical point. Especially when facing the ever-changing and complex maintenance needs of IT infrastructure, the solution's highly automated adjustment capabilities and excellent stability provide strong technical support for enterprise users.

[0030] Optionally, the steps of using a lightweight time-series analysis model to perform anomaly detection on critical-level data streams and output anomaly markers and device feature vectors include:

[0031] Receive critical-level data streams and extract time-series segments containing equipment operating parameters;

[0032] The time series segments are input into a pre-trained lightweight recurrent neural network model;

[0033] Based on the real-time threshold parameter, the anomaly probability value at each time step is calculated using the lightweight recurrent neural network model;

[0034] An abnormal event marker is generated when the probability value of an anomaly exceeds a preset threshold for three consecutive time steps.

[0035] Extract device feature vectors from the hidden layer output of the lightweight recurrent neural network model.

[0036] By adopting the above technical solution and leveraging a lightweight LSTM architecture, low-cost online monitoring targets are achieved. By cleverly integrating the advantages of two complementary perspectives—deep representation and statistical induction—the system's usability and scalability are greatly expanded while ensuring detection accuracy. In particular, the unique dual-channel mechanism of simultaneously outputting discrete labels and continuous feature vectors enables this solution not only to serve immediate alarm response needs but also to lay a solid foundation for future root cause localization, decay trajectory tracking, and even predictive maintenance strategy development.

[0037] Optionally, the step of fusing the device feature vector with non-critical data packets from multiple sources and inputting it into a cloud-based health assessment model to calculate the device health score includes:

[0038] Receive device feature vectors and non-critical data packets; wherein, the device feature vectors include time-series features extracted by real-time anomaly detection, and the non-critical data packets include device logs and environmental parameters;

[0039] The non-critical data packets are structured and parsed to convert device logs into semantic vectors;

[0040] The semantic vector and the device feature vector are dimensionally aligned to generate a fused feature vector;

[0041] The fused feature vectors are input into the cloud-based health assessment model, which outputs a device health score.

[0042] The storage device health score and corresponding device identifier are entered into the health status database.

[0043] By adopting the above technical solution, physical-level status monitoring data, text-level operation log information, and external environmental conditions are organically combined to form a multi-layered, three-dimensional comprehensive evaluation system. This solution does not rely solely on a specific type of observation signal, nor does it simply depend on expert experience to set rule thresholds. Instead, it relies on advanced feature engineering technology and intelligent modeling methods to achieve a truly integrated "perception-understanding-decision" operation process, enhancing the foresight and initiative of equipment operation and maintenance management.

[0044] Optionally, the step of generating tiered early warning instructions based on the health score and remaining service life in the equipment health report, combined with a pre-set operation and maintenance strategy library, includes:

[0045] Receive equipment health reports and extract the equipment health score and remaining useful life value from the equipment health reports;

[0046] Match the set of early warning rules corresponding to the current device type from the pre-set operation and maintenance strategy library;

[0047] The warning level is determined based on the coupling relationship between the threshold range of the device health score and the remaining service life value.

[0048] Based on the aforementioned warning level and warning rule set, the instruction template library is invoked to generate a warning instruction containing device identifier, warning level, and response time limit requirements;

[0049] By linking the geographical location data of the associated devices with the status data of the maintenance personnel, a list of recipients for the early warning instructions is determined.

[0050] By adopting the above technical solutions, a new intelligent operation and maintenance framework is constructed based on deep fusion processing of multi-dimensional state parameters, highly adaptable modeling for complex operation and maintenance scenarios, and support for full-process automated closed-loop management. Compared with the problems of single indicator-driven and static strategy deployment in existing technologies, this solution demonstrates stronger anomaly identification accuracy, higher resource utilization, and better user experience, and can be widely applied to various critical information infrastructure environments such as data centers, communication base stations, and cloud computing nodes.

[0051] Optionally, the step of generating an executable maintenance work order based on the hierarchical early warning instructions and the real-time acquired resource context data through a cost-benefit decision tree model includes:

[0052] Receive tiered early warning instructions and real-time resource context data; wherein, the tiered early warning instructions include device identifiers, early warning levels and response time limits, and the resource context data includes the location status of maintenance personnel, spare parts inventory, and maintenance tool availability;

[0053] A preset cost-benefit decision tree model is matched according to the warning level. The decision tree model includes a cost calculation branch and a benefit evaluation branch.

[0054] The device identifier and resource context data are input into the decision tree model, and the cost calculation branches are traversed to generate economic cost estimates for multiple candidate maintenance schemes.

[0055] Synchronously traverse the aforementioned benefit evaluation branches and calculate the comprehensive benefit score for each candidate maintenance scheme;

[0056] The candidate solution with the highest ratio of comprehensive benefit score to economic cost estimate is selected as the optimal maintenance solution;

[0057] The optimal maintenance plan is converted into an executable maintenance work order that includes personnel assignment, spare parts scheduling, and time windows.

[0058] By adopting the above technical solutions, the response pace can be flexibly adjusted according to the urgency of different types of faults, minimizing unnecessary expenses while ensuring service quality, and achieving a high degree of collaborative operation throughout the entire process from problem discovery and solution comparison to implementation.

[0059] Optionally, after the step of generating an executable maintenance work order, the following may also be included:

[0060] Obtain the device health score sequence of similar devices in the device cluster, and construct the health status covariance matrix;

[0061] Abnormally associated device groups in the health status covariance matrix are identified using graph convolutional networks;

[0062] Extract common feature vectors from abnormally associated device groups to generate a cross-device fault propagation prediction model;

[0063] When a single device triggers a tiered early warning command, preventative maintenance recommendations for related devices are generated based on the cross-device fault propagation prediction model.

[0064] The resource allocation scheme for the executable maintenance work order is optimized based on the preventive maintenance recommendations.

[0065] By adopting the above technical solutions, we can not only discover the root causes of deep-seated problems hidden in massive amounts of data earlier, but also significantly reduce the probability of major accidents through forward-looking intervention strategies, providing room for sustainable improvement in long-term operation and maintenance, and demonstrating the advanced nature and practicality of the new generation of intelligent operation and maintenance platform.

[0066] Secondly, this application provides an intelligent early warning system for ICT devices, which adopts the following technical solution:

[0067] An intelligent early warning system for ICT devices, the intelligent early warning system comprising:

[0068] The data acquisition module is used to collect multi-source heterogeneous data through a sensor network deployed on ICT devices; wherein, the multi-source heterogeneous data includes device operating parameters, environmental parameters, and device log data;

[0069] The data processing module is used to perform real-time cleaning and time synchronization processing on the multi-source heterogeneous data to generate structured data;

[0070] The data classification module is used to classify the structured data according to the importance based on a preset entropy calculation model, and output key-level data streams and non-key-level data packets.

[0071] The threshold calculation module is used to perform dynamic threshold calculation on the critical-level data stream based on the historical fault database, and generate real-time threshold parameters that are adaptive to the device.

[0072] The anomaly detection module is used to perform anomaly detection on critical data streams using a lightweight time series analysis model, and output anomaly markers and device feature vectors.

[0073] The device health assessment module is used to perform multi-source fusion of the device feature vector and non-critical data packets, and input the data into the cloud health assessment model to calculate the device health score.

[0074] The decay curve construction module is used to perform cluster analysis on similar equipment based on pre-stored historical equipment data and equipment attribute information, and to build a decay trend model for each type of equipment, thereby forming the corresponding decay curve function.

[0075] The equipment health prediction module is used to input the equipment health score into the degradation curve function, predict the remaining service life, and output an equipment health report;

[0076] The graded early warning module is used to generate graded early warning instructions based on the equipment health score and remaining service life in the equipment health report, combined with a pre-set operation and maintenance strategy library.

[0077] The maintenance work order generation module is used to generate executable maintenance work orders based on the hierarchical early warning instructions and real-time acquired resource context data, using a cost-benefit decision tree model.

[0078] In summary, this application achieves at least one of the following beneficial technical effects: By constructing a full-link intelligent early warning system from bottom-level sensor data acquisition to top-level operation and maintenance decision-making, it realizes accurate perception, intelligent analysis, and proactive response to the operating status of ICT equipment. This application uses a distributed sensor network to uniformly access multi-source heterogeneous data, and after real-time cleaning, time synchronization, and entropy value hierarchical processing, effectively improves data quality and key feature recognition capabilities; it achieves high-precision equipment health status assessment through lightweight time-series models for anomaly detection combined with cloud-based health assessment models; furthermore, based on equipment clustering analysis and degradation trend modeling, it predicts the remaining service life, forming a comprehensive health report including health scores and lifespan predictions; finally, combined with a preset operation and maintenance strategy library and cost-effectiveness decision-making model, it automatically generates hierarchical early warning instructions and executable maintenance work orders, significantly improving the timeliness and accuracy of equipment fault early warning, reducing operation and maintenance costs, enhancing the system's adaptability and intelligence level, and providing complete technical support for intelligent operation and maintenance of ICT equipment in the industrial internet environment. Attached Figure Description

[0079] Figure 1 This is a first flowchart illustrating an intelligent early warning method for ICT devices according to one embodiment of this application.

[0080] Figure 2 This is a second flowchart illustrating an intelligent early warning method for ICT devices according to one embodiment of this application.

[0081] Figure 3 This is a third flowchart illustrating an intelligent early warning method for ICT devices according to one embodiment of this application.

[0082] Figure 4 This is a schematic diagram of the fourth process of an ICT device intelligent early warning method according to one embodiment of this application.

[0083] Figure 5 This is a fifth flowchart of an ICT device intelligent early warning method according to one embodiment of this application.

[0084] Figure 6 This is a schematic diagram of the sixth process of an ICT device intelligent early warning method according to one embodiment of this application.

[0085] Figure 7 This is a schematic diagram of the seventh process of an ICT device intelligent early warning method according to one embodiment of this application.

[0086] Figure 8 This is a schematic diagram of the eighth process of an ICT device intelligent early warning method according to one embodiment of this application. Detailed Implementation

[0087] To make the purpose, technical solution, and advantages of this application clearer, the following description is provided in conjunction with the appendix. Figures 1-8 The present application will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application.

[0088] This application discloses an intelligent early warning method for ICT devices.

[0089] Reference Figure 1 An intelligent early warning method for ICT devices, the intelligent early warning method comprising:

[0090] Step S101: Collect multi-source heterogeneous data through a sensor network deployed on ICT equipment; wherein, the multi-source heterogeneous data includes equipment operating parameters, environmental parameters and equipment log data;

[0091] In this context, multi-source heterogeneity refers to data sets from different types of sensors (such as temperature, humidity, voltage, current, fan speed, etc.) with multiple formats and transmission protocols. The essence of heterogeneity lies in the fact that these data not only originate from different physical dimensions (such as operating parameters, environmental parameters), but may also be difficult to integrate directly due to differences in sampling frequency, unit system, encoding methods, etc. Therefore, a distributed sensor network architecture is necessary to uniformly access and collect this raw information. This distributed acquisition mechanism not only ensures the system's flexibility and scalability but also improves fault tolerance, preventing local failures from affecting overall monitoring performance.

[0092] Step S102: Perform real-time cleaning and time synchronization processing on multi-source heterogeneous data to generate structured data;

[0093] Since noise interference, packet loss, and even erroneous readings are unavoidable during on-site data acquisition, preprocessing, or cleaning, is necessary. This step typically includes modules such as deduplication, missing value filling, and outlier removal.

[0094] Meanwhile, since multiple sensors may have inconsistent sampling times, this can affect the consistency and accuracy of subsequent data analysis if not corrected. Therefore, a time synchronization mechanism is introduced to align all data according to a unified time base. For example, the NTP protocol or hardware-level timestamps can be used to achieve millisecond-level or even microsecond-level time coordination, thereby ensuring the effectiveness of time series modeling.

[0095] Step S103: Based on the preset entropy calculation model, the structured data is classified according to importance, and key-level data streams and non-key-level data packets are output.

[0096] To optimize resource allocation and highlight the role of key signals, Shannon entropy can be used as one of the metrics. A higher entropy value indicates that the information carried by the variable is more uncertain or volatile, often implying greater potential risk, and should be classified as "critical data stream"; conversely, a lower entropy value is classified as "non-critical data stream". This process is essentially a feature selection strategy that helps reduce the computational burden caused by redundant information and guides attention to the core indicators that truly reflect the health of the equipment.

[0097] Step S104: Based on the historical fault database, perform dynamic threshold calculation on the critical data stream to generate real-time threshold parameters that are adaptive to the device.

[0098] Specifically, typical failure cases that have occurred in the past are used as reference samples to extract the corresponding normal operating range boundary values, and mathematical expressions are constructed based on these values ​​to update the current safety limits online.

[0099] Step S105: Use a lightweight time series analysis model to perform anomaly detection on the critical data stream and output anomaly markers and device feature vectors.

[0100] In this application, a small LSTM (Long Short-Term Memory) network suitable for embedded platforms is selected as the basic model framework. This model can effectively remember the evolution trend of a sequence over a period of time and infer the possible future state. By using a sliding window, key observations for ten consecutive seconds are extracted as input vectors and fed into the network to complete a full inference operation. The output includes both a probability estimate of whether the trajectory deviates from the normal path and an abstract feature representation that can be used in the downstream health assessment subsystem.

[0101] Step S106: Perform multi-source fusion of device feature vectors and non-critical data packets, and input them into the cloud-based health assessment model to calculate the device health score;

[0102] While the most representative high-entropy data segments have been selected and their condensed latent features extracted using deep networks, relying solely on this limited perspective for a comprehensive diagnosis still has limitations. Therefore, previously stored low-priority data items can be reintroduced into the consideration framework, transformed into semantic-level embedding vectors, and concatenated with the high-level representations produced by the aforementioned main path to form a new composite input space, which is then fed into a higher-level classifier. This classifier typically consists of ensemble learning algorithms like XGBoost, which, thanks to their powerful generalization ability and robustness, can accurately estimate the overall operational quality level of the target entity in a relatively short time.

[0103] Step S107: Based on the pre-stored historical equipment data and equipment attribute information, perform cluster analysis on similar equipment and construct a decline trend model for each type of equipment to form a corresponding decline curve function.

[0104] Historical operating data includes, but is not limited to, time-series data of key performance indicators such as temperature, voltage, current, vibration frequency, and power consumption. It also covers basic equipment attribute information such as equipment model, manufacturer, service life, and working environment parameters.

[0105] By employing the K-means clustering algorithm, the system can automatically identify groups of devices with similar operating characteristics and performance degradation patterns. During the clustering process, the system calculates the similarity distance between each device sample. Commonly used similarity metrics include Euclidean distance, cosine similarity, and Mahalanobis distance. Euclidean distance is suitable for comparing continuous numerical features, while cosine similarity is more suitable for handling vector space models of high-dimensional sparse data.

[0106] Through an iterative optimization process, the algorithm groups devices with similar degradation patterns into the same category, with each category exhibiting similar performance degradation trajectories and fault evolution patterns. Based on this, for each group of devices, the system employs time series analysis to construct a corresponding degradation trend model. These models typically use mathematical functions such as Weibull distribution, exponential decay function, or multinomial regression to describe the systematic decline in device performance over time.

[0107] For example, for a certain type of network switching equipment, its port transmission rate exhibits a typical exponential decay characteristic over time. The system will fit a decay curve function of the form R(t) = A × e^(-λt) + B, where R(t) represents the equipment performance level at time t, A is the initial performance decay magnitude, λ is the decay rate parameter, and B is the performance baseline value. This decay curve function, established based on statistical principles, can not only accurately depict the average degradation trend of similar equipment, but also adapt to the specific degradation characteristics of individual equipment through parameter adjustment, thus laying a solid mathematical foundation for subsequent accurate prediction.

[0108] Step S108: Input the equipment health score into the degradation curve function to predict the remaining service life and output the equipment health report;

[0109] The process involves using the current device health score as input, substituting it into the previously constructed degradation curve function for inverse calculation, thereby determining the time period required for the device to progress from its current health state to a preset failure threshold. The device health score, as a comprehensive quantitative indicator, is typically calculated by weighting and fusing multiple dimensions of operating parameters. Its numerical range is generally standardized between 0 and 100, where 100 indicates the device is in a brand-new state, and 0 indicates the device has reached the failure threshold.

[0110] In actual prediction, the system needs to solve an inverse optimization problem: given the current health score H_current, the goal is to find a time variable t such that the decay curve function R(t) equals the preset maintenance threshold H_maintenance. This solution process may involve Newton's iteration method, binary search method, or other optimization algorithms in numerical analysis to ensure the accuracy and convergence speed of the calculation results. For example, when a server's current health score is 75 and the preset maintenance threshold is 30, the system determines that the device will need to run for approximately 24 more months before reaching a state requiring maintenance by solving the equation R(t) = 30.

[0111] It's important to note that the prediction results include not only specific remaining useful life values ​​but also relevant confidence intervals and uncertainty assessments. This information collectively constitutes a complete equipment health report. The health report generation process also incorporates Bayesian inference mechanisms, continuously updating the prior probability distribution to improve prediction accuracy. Particularly when facing new types of equipment or abnormal operating conditions, the system can dynamically adjust the prediction model's parameter settings to ensure the reliability of the prediction results. Furthermore, the health report integrates historical maintenance records, fault statistics, and environmental impact analysis, providing maintenance personnel with a comprehensive understanding of the equipment's status.

[0112] Step S109: Based on the equipment health score and remaining service life in the equipment health report, and combined with the pre-set operation and maintenance strategy library, generate graded early warning instructions.

[0113] Once the specific numerical ranges of each core indicator are determined, the corresponding alarm rule engine can be triggered to execute the contingency plan. These operational strategy rules are pre-written and stored in the form of IF-THEN statements for easy recall and matching. For example, when a server's health score falls below 50 or its expected availability period is less than seven days, it will automatically escalate to a Level 2 emergency, notifying relevant personnel to intervene; while in cases between 50 and 70, only a general reminder will be sent. Furthermore, geographical location factors will be considered to accurately pinpoint affected areas and rationally allocate maintenance human resources for shift scheduling.

[0114] Step S110: Based on the hierarchical early warning instructions and the real-time acquired resource context data, generate an executable maintenance work order through a cost-benefit decision tree model.

[0115] One option is to add a dedicated decision support component focused on maximizing operational efficiency. This component is designed around balancing input and output, comprehensively considering multiple cost factors such as component procurement prices, replacement difficulty, and business losses during downtime. It uses the probability of failure as the root node, branching down through various feasible options until the optimal solution is found. Simultaneously, it considers the equipment's own operational rhythm to identify the most suitable intervention window to minimize impact on its daily operations.

[0116] In the above embodiments, this application integrates the entire control chain from bottom-level perception and intermediate analysis to top-level scheduling decision-making, realizing intelligent perception, analysis, and response to the operating status of ICT equipment. This technical solution fully embodies the new generation of intelligent manufacturing concept of integrated hardware and software and edge-cloud collaboration in the context of the modern industrial internet, meeting both the needs of efficient operation and maintenance management and the goal of achieving economic benefits. Through a progressive logical evolution, it achieves significantly better early warning accuracy and response time than existing general-purpose fault diagnosis methods, providing strong technical support for enterprise digital transformation.

[0117] Reference Figure 2 As one implementation of step S103, the step of classifying the structured data by importance according to a preset entropy calculation model and outputting critical-level data streams and non-critical-level data packets includes:

[0118] Step S201: Divide the structured data into data blocks according to a preset time window, and perform probability statistics on the distribution of parameter values ​​within each data block;

[0119] This process employs a fixed-length time window (e.g., 10 seconds) to slice the continuously flowing data stream, breaking down the originally infinitely extending signal into a finite number of local segments, thus facilitating further quantification and modeling. Each data block represents a snapshot of the system's behavior over a specific time period, encompassing the joint performance of multiple variables within the same observation interval. Subsequent probabilistic statistics focus on revealing the relative frequency of each parameter within its value range, i.e., establishing a mapping table between parameters and their corresponding frequencies. This process is essentially a manifestation of empirical distribution function estimation, which does not rely on any prior assumptions or models but infers underlying patterns entirely based on actual observations.

[0120] For example, in a typical server monitoring case, if the number of samplings where the CPU utilization rate is in the 90%-100% range within a certain time window is much higher than in other ranges, it can be preliminarily judged that there is significant workload pressure during that period; conversely, if the various indicators fluctuate little and are evenly distributed, it indicates that the system is running relatively smoothly.

[0121] Step S202: Calculate the entropy value measure of each data block based on the probability statistics of the parameter value distribution;

[0122] Among them, the entropy measure is a scalar index built on the Shannon entropy formula, the specific formula of which is: ;p(x i ) represents the frequency proportion of the i-th type of parameter value.

[0123] Intuitively, when all observations of a parameter are concentrated around a few numerical points, the corresponding entropy is low, indicating that the behavior of the parameter is highly predictable; conversely, if all values ​​are almost equally likely to occur, the entropy reaches its maximum value, reflecting extremely high unpredictability.

[0124] In this embodiment, all parameters can be combined to form a multidimensional joint space, on which the information complexity of the entire data set can be comprehensively evaluated. For example, suppose there are two data blocks A and B. The former only covers three CPU usage states (70%, 80%, and 90%, respectively), while the latter covers all ten levels (each level increasing by 10%). Obviously, the latter has higher entropy, meaning that it contains more diverse information and is more likely to contain clues to the occurrence of abnormal events or emergencies.

[0125] Step S203: Compare the entropy value measurement with a preset classification threshold, mark the data blocks with the entropy value measurement higher than the preset classification threshold as critical data streams, and mark the rest as non-critical data packets;

[0126] The process of setting the preset grading threshold requires a trade-off between false alarm rate and false negative risk based on the actual needs of the application scenario. Optimal empirical values ​​can usually be derived through historical data analysis. Once the result obtained from the aforementioned entropy calculation for a data block exceeds the predetermined limit, it is considered that the phenomenon it reflects deviates significantly from normal expectations, potentially indicating a precursor to a fault or a peak business period. Therefore, it should be given higher attention and appropriate measures should be taken to retain or quickly forward it.

[0127] Conversely, blocks with low entropy values ​​are considered redundant information under normal operation. Their scheduling weight in the network link can be appropriately reduced without affecting the overall monitoring quality, or even some copies can be discarded to save bandwidth.

[0128] Step S204: Output the critical-level data stream with hierarchical tags and the non-critical-level data packets to the data transmission channel.

[0129] Among them, data transmission channel refers to any communication medium that supports asynchronous message passing mechanism, which can be a message queue service within a local area network or a dedicated channel across a wide area network.

[0130] In this embodiment, by applying explicit identifiers (such as Tag fields) to different types of data, downstream nodes can quickly identify which items are urgent and which can be delayed, thereby achieving differentiated control over service quality. This solution not only effectively alleviates traffic congestion during peak periods but also enhances the entire monitoring system's ability to respond to emergencies and improves operational response speed.

[0131] In the above implementation, the original time series is transformed into an analysis object with controllable granularity using sliding time window technology, and its internal parameter distribution characteristics are quantified based on information entropy theory. Finally, accurate identification is achieved by setting reasonable evaluation thresholds. Compared with the traditional extensive full-reporting approach, this scheme can significantly reduce the burden of invalid transmission while ensuring the complete capture of core alarm information, which helps to improve the overall operating efficiency and stability of the distributed system.

[0132] Reference Figure 3 As one implementation of step S104, the step of dynamically calculating the threshold of the critical-level data stream based on the historical fault database to generate adaptive real-time threshold parameters for the device includes:

[0133] Step S301: Obtain the equipment type-related fault records and historical parameter statistics stored in the historical fault database;

[0134] Historical fault records refer to failure events and corresponding operational or environmental conditions of a certain type of equipment during its life cycle over a period of time (e.g., 180 days). These records often include contextual data under abnormal conditions of key indicators, such as overheating causing shutdowns or voltage fluctuations triggering restarts.

[0135] Historical parameter statistics are a series of characteristic values ​​derived through statistical methods based on a large number of sensor readings collected under normal and abnormal conditions. Typical examples include the mean μ_hist, standard deviation σ_hist, and the third and fourth quartiles Q3. These statistical data reflect the basic distribution patterns of various performance parameters over time for a specific equipment category, helping to identify which numerical ranges may indicate potential risks. Therefore, this stage is not only a fundamental supporting link in the entire process but also one of the prerequisites for achieving intelligent early warning.

[0136] Step S302: Extract the current device operating load parameters and environmental parameters from the real-time input critical-level data stream;

[0137] Among them, critical data flow refers to important signal sources that have a decisive impact on system stability, such as load parameters that reflect the degree of computing resource consumption, such as CPU utilization, memory usage ratio, and network throughput rate; it also covers external physical environmental factors such as room temperature, humidity, air pressure, and even dust concentration.

[0138] Step S303: Match the corresponding threshold calculation model according to the device type, and perform dynamic threshold calculation by combining historical parameter statistics, current operating load parameters and environmental parameters;

[0139] Among them, matching the corresponding threshold calculation model means that different types of ICT devices have large differences in hardware architecture, application scenarios and even deployment regions, and need to customize the mathematical expression that best suits their characteristics to complete the final judgment task.

[0140] In terms of specific function construction, a weighted linear combination can be adopted, that is, all relevant information obtained in the previous two stages is combined in a certain proportion to participate in the calculation. Specifically, Threshold = α·Load + β·EnvParam + γ·σ_hist. In the above formula, the weight coefficients α, β, and γ represent the importance ranking of the three dimensions of load level, environmental disturbance intensity, and long-term fluctuation characteristics, respectively. They are not constant but are affected by factors such as the continuous operating time of the equipment and the rate of environmental change, and are therefore adjusted accordingly.

[0141] Step S304: Output the real-time threshold parameters to the anomaly detection module.

[0142] In this embodiment, the anomaly detection module is a lightweight recurrent neural network model embedded within the entire operation and maintenance platform. It is specifically designed to receive status reports from various terminal nodes and compare them with preset security boundaries to trigger alarms or other intervention measures. After the real-time threshold parameter (Threshold) obtained here is fed into this component, the alarm logic judgment process can be initiated.

[0143] It should be noted that, in order to further enhance the learning ability and self-evolution potential of the overall architecture, it is also possible to consider writing the latest threshold generated in each iteration, along with the context at that time, back into the original historical database to form a closed-loop feedback chain, making future predictions more accurate and reliable.

[0144] In the above implementation method, by combining the learning and analysis of historical failure cases with close monitoring of the current operational status, a comprehensive evaluation framework that takes into account both static statistical characteristics and time-sensitive factors has been successfully established. This effectively overcomes the problems of misjudgment and omission caused by relying solely on manual experience to set a single critical point. Especially when facing the ever-changing and complex IT infrastructure maintenance needs, the highly automated adjustment capabilities and excellent stability performance demonstrated by this solution provide strong technical support for enterprise users.

[0145] Reference Figure 4 As one implementation of step S105, the step of using a lightweight time series analysis model to perform anomaly detection on the critical-level data stream and outputting anomaly markers and device feature vectors includes:

[0146] Step S401: Receive the critical-level data stream and extract the time-series segments containing equipment operating parameters;

[0147] Critical-level data streams refer to key performance indicators or status monitoring signals from the target ICT equipment, such as CPU utilization, memory usage, temperature readings, and power consumption changes—core sensor data that reflects the current operating status of the system. These data typically feature high sampling frequencies and strong real-time characteristics, forming a continuous time-series signal.

[0148] Specifically, to facilitate processing and control computational overhead, the data needs to be divided into multiple sub-segments with a fixed window length. The 10-second segmentation period is a trade-off between typical fault response time and human perception delay, ensuring it is neither too long to mask abnormal events nor too short to exacerbate noise interference. The subsequent standard normalization operation uses historical statistical data to uniformly adjust the numerical range of each time series segment, thus mapping the original observations to a zero-mean unit variance space.

[0149] Step S402: Input the time series segments into the pre-trained lightweight recurrent neural network model;

[0150] The lightweight recurrent neural network model specifically refers to a shallow recurrent neural network composed of a single-layer LSTM (Long Short-Term Memory) structure, with the number of hidden layer nodes strictly limited to 8 or less, and the total number of parameters of the entire model not exceeding the thousand level.

[0151] Specifically, LSTM, as a classic RNN variant, is widely used in long-term dependency modeling tasks due to its gating mechanism, which effectively alleviates the gradient vanishing problem. However, traditional deep LSTMs or multi-head attention structures often have complex parameters, making them difficult to deploy in resource-constrained edge environments. Therefore, this solution achieves extremely low computational requirements while retaining basic memory functions by significantly compressing the network size. Pre-training refers to the parameter initialization process using a large amount of historical data under normal operating conditions before the network is officially put into online inference, enabling the model to initially distinguish normal patterns. This stage of training is usually completed in the form of unsupervised reconstruction error minimization, that is, allowing the model to try to reconstruct the input sequence itself, thereby learning to capture typical dynamic evolution patterns.

[0152] Step S403: Based on the real-time threshold parameter, calculate the anomaly probability value for each time step using a lightweight recurrent neural network model;

[0153] The normalized time series is fed into the pre-trained LSTM module for point-by-point expansion and computation, generating a corresponding hidden state vector h at each time step. t Next, the output layer uses the Sigmoid activation function to transform the hidden state corresponding to the last time step into a real value between 0 and 1, representing a probability estimate of whether the current frame deviates from the expected behavior relative to the overall distribution. This probability is not an absolute classification label, but rather expresses the model's judgment on the likelihood of an anomaly occurring at that time point.

[0154] It is worth noting that, unlike the traditional binary classification method, no hard decision boundary is set here. Instead, the continuous probability output characteristic is retained, which is conducive to further fine-tuning of the sensitivity threshold and supporting the quantitative assessment of uncertainty in the downstream.

[0155] Step S404: When the anomaly probability value of three consecutive time steps exceeds a preset threshold, an anomaly event marker is generated;

[0156] This mechanism introduces a sliding window judgment rule to filter out occasional false alarms. If triggering is based solely on prediction results at a single time point, unnecessary alarm storms may arise due to isolated spikes. Conversely, only when three consecutive frames exhibit a consistent offset trend above a certain critical level (e.g., 0.8) is a potential fault identified. This improves alarm confidence while avoiding misjudgments caused by frequent fluctuations. This principle, based on continuity rather than transient changes, aligns better with practical operation and maintenance management experience, and is particularly suitable for early warning scenarios involving gradual degradation. Furthermore, the threshold can be flexibly adjusted according to different service types to balance the false alarm rate and the missed detection rate.

[0157] Step S405: Extract device feature vectors from the hidden layer output of the lightweight recurrent neural network model.

[0158] Specifically, the device feature vector consists of two parts: one is the hidden state h at the last time step of the LSTM. t This part carries the memory information accumulated by the model throughout the time window, reflecting complex nonlinear spatiotemporal correlations; the second part consists of some classic statistical properties constructed by humans, including the standard deviation σ of all observations within the window, the slope of the trend term obtained by least squares fitting, and the peakFreq, the main energy concentration frequency band obtained by performing a fast Fourier transform on the original sequence.

[0159] The above implementation utilizes a lightweight LSTM architecture to achieve low-cost online monitoring. By cleverly integrating the advantages of two complementary perspectives—deep representation and statistical induction—the system's usability and scalability are greatly expanded while ensuring detection accuracy. In particular, the unique dual-channel mechanism of simultaneously outputting discrete labels and continuous feature vectors enables this solution not only to serve the needs of immediate alarm response but also to lay a solid foundation for future root cause localization, decay trajectory tracking, and even predictive maintenance strategy development.

[0160] Reference Figure 5 As one implementation of step S106, the step of multi-source fusion of device feature vectors and non-critical data packets, and inputting them into the cloud-based health assessment model to calculate the device health score, includes:

[0161] Step S501: Receive device feature vector and non-critical data packet; wherein, the device feature vector contains time-series features extracted by real-time anomaly detection, and the non-critical data packet contains device logs and environmental parameters.

[0162] Non-critical data packets encompass information sets that do not directly affect the system's immediate response capabilities, such as automatically generated log records (including error codes and warning messages) and environmental monitoring data (temperature, humidity, dust concentration, etc.). The term "non-critical" does not imply low importance, but rather emphasizes that their transmission priority is lower than control commands or alarm signals, allowing for appropriate delays in processing under conditions of limited network bandwidth. This classification mechanism helps optimize network resource scheduling and avoids backbone communication congestion caused by the analysis of large amounts of auxiliary data.

[0163] Step S502: Perform structured parsing on non-critical data packets and convert device logs into semantic vectors;

[0164] Since raw logs are mostly in free-format strings and lack a standardized way of expression, NLP tools are needed to standardize, clean, and parse them. On this basis, pre-trained word embedding models (such as Word2Vec, BERT, etc.) are introduced to map keywords or sentences in the logs into vector representations in a dense real space of fixed dimensions (such as 128 dimensions), which are called "semantic vectors".

[0165] This process not only preserves the grammatical properties of the words themselves, but more importantly, it can depict the potential relationships between different terms, transforming the originally discrete and disordered textual descriptions into continuous mathematical objects that can be processed by algorithms. At the same time, to address the issue of dimensional differences in environmental variables, a minimum-maximum normalization formula is used to scale them to the [0,1] interval, thereby ensuring that no dominant bias occurs when they are used in subsequent calculations in conjunction with other types of features.

[0166] Step S503: Align the semantic vector with the device feature vector in terms of dimensions to generate a fused feature vector;

[0167] In particular, considering that features from two different sources may be in completely different dimensional spaces (for example, the former may be 128-dimensional while the latter may be dozens or even hundreds of dimensions), directly splicing them together would lead to an explosive increase in the input dimension of the subsequent model, affecting efficiency and increasing the risk of overfitting.

[0168] To address this, a fully connected neural network layer can be used as a dimensionality reduction unit to compress the target features to be fused, bringing them to the same dimensionality as the semantic vector. Then, the three vector components (compressed original features + log semantic encoding + normalized environmental factors) are concatenated along the channel direction in a predetermined order, ultimately constructing a high-dimensional composite feature vector. This fusion strategy takes into account the unique contributions of various types of information and achieves effective integration of cross-domain features, providing a solid foundation for the next step of intelligent discrimination.

[0169] Step S504: Input the fused feature vector into the cloud-based health assessment model and output the device health score;

[0170] In this embodiment of the application, the cloud health assessment model in this step adopts a supervised learning model based on the gradient boosting decision tree (GBDT) framework to perform the prediction task. The reason for choosing this architecture is mainly due to its good generalization ability and strong noise resistance, which is particularly suitable for facing the challenge of complex failure mode recognition caused by the combined effect of multiple uncertain factors.

[0171] The number of input nodes in the model is set to strictly match the size of the aforementioned fusion feature dimensions to ensure that all relevant information can be fully absorbed and utilized. At the output end, a Sigmoid activation function is applied to constrain the scoring range to be limited to [0,100], which facilitates intuitive understanding and business integration.

[0172] It should be noted that, in order to further improve the accuracy of the scoring, a result correction mechanism based on historical maintenance records has been added before the final score. This means that the severity of the problems reported in the three most recent maintenance activities is weighted and summed with the time decay coefficient, and then the corresponding score is deducted from the full score of one hundred. This is to compensate for the influence of historical trend evolution that the static model may ignore.

[0173] Step S505: Store the device health score and corresponding device identifier in the health status database.

[0174] The device identifier can be a unique hardware number, IP address, or other identifying marker used to distinguish individual entities. By persistently storing each assessment result, not only can long-term trend tracking analysis be supported, but also functional expansion needs such as threshold-triggered alerts and automated work order dispatching can be addressed. Furthermore, as the accumulated sample size continues to expand, it also helps to drive continuous model iteration and upgrades, thereby continuously improving overall diagnostic accuracy and service quality.

[0175] The above implementation organically combines physical-level status monitoring data, text-level operation log information, and external environmental conditions to form a multi-layered, three-dimensional comprehensive evaluation system. This solution does not rely solely on a specific type of observation signal, nor does it simply depend on expert experience to set rule thresholds. Instead, it leverages advanced feature engineering technology and intelligent modeling methods to achieve a truly integrated "perception-understanding-decision" operation process, enhancing the foresight and proactiveness of equipment operation and maintenance management.

[0176] Reference Figure 6 As one implementation of step S109, the step of generating graded early warning instructions based on the health score and remaining service life in the equipment health report, combined with a pre-set operation and maintenance strategy library, includes:

[0177] Step S601: Receive the equipment health report and extract the equipment health score and remaining useful life value from the equipment health report;

[0178] The equipment health score is a standardized quantitative assessment result, typically derived from a weighted fusion of multiple underlying performance parameters (such as CPU load rate, memory usage, and network latency fluctuations). The remaining service life value is an estimated failure probability over time, typically expressed in hours, output by a predictive model trained on historical fault data. These two values ​​together form the basic input variables for subsequent early warning judgments.

[0179] Step S602: Match the set of early warning rules corresponding to the current device type from the preset operation and maintenance strategy library;

[0180] The operation and maintenance strategy library is essentially a set of differentiated management specifications set according to different equipment categories (such as switches, routers, servers, storage arrays, etc.) and their business importance. The set of early warning rules not only includes what level of early warning response measures should be taken for different health conditions, but also covers factors such as priority weight allocation and human resource scheduling constraints.

[0181] Therefore, at this stage, the system uses the device ID of the reported device to look up its type and locate the pre-configured set of rules. For example, for a mission-critical server, even if its global limit (RU) is still several days old, abnormal fluctuations may trigger a high-level alert; while for small switches at the edge access layer, a more lenient state threshold may be tolerated. This behavior policy adjustment mechanism based on device attributes is key to improving the intelligence level of the entire IT infrastructure.

[0182] Step S603: Determine the warning level based on the coupling relationship between the threshold range of the equipment health score and the remaining service life value;

[0183] This step employs a two-factor coupled decision-making mechanism, combining the specific threshold range into which the equipment health score falls with its corresponding Recovery Limit (RUL) range to form a composite criterion for ultimately determining the warning level. This design fully considers the interaction of multiple factors affecting equipment stability in real-world environments. Specifically, if the health score is extremely low but the RUL is still relatively long, there may be a risk of false alarms; conversely, even if the current performance is good, intervention is necessary if the equipment is nearing the end of its expected lifespan.

[0184] In this application embodiment, the following judgment criteria can be set as a typical example: when the health score is less than or equal to 50 points or the remaining usage time is less than 72 hours, it is judged as a Level 1 warning (emergency); if the health score is between 50 and 70 and the RUL is within 72 to 168 hours, a Level 2 warning (important) is issued; in other cases (health score is higher than 70 and RUL is more than one week), it is classified as a Level 3 warning (routine). The above classification principle can prevent both missed detections and overreactions, thereby achieving truly precise preventive maintenance.

[0185] Step S604: Based on the warning level and warning rule set, call the instruction template library to generate a warning instruction containing the device identifier, warning level and response time limit requirements;

[0186] In this stage, the system no longer simply issues vague alarm signals. Instead, based on the warning level number obtained from previous judgments, it automatically selects an appropriate operation guidance template and assembles it into a standard format message body with clearly defined fields (such as device ID, warning level code, and response time limit requirements). Taking a level one warning as an example, the warning instruction it is bound to may be a forced offline detection with a time limit not exceeding two hours. This approach significantly improves emergency response efficiency and reduces execution errors caused by human interpretation bias.

[0187] Step S605: Associate the device's geographical location data with the maintenance personnel's status data to determine the list of recipients of the early warning instruction.

[0188] Specifically, the system first locates the device's physical location using the GPS coordinates recorded during device registration, then searches for the nearest service station or technical support center. It then further filters the list of qualified technicians still on duty in the area that day, and can expand the search radius as needed until the minimum manpower requirements are met. This not only effectively shortens the fault repair cycle but also maximizes the efficiency of existing operations and maintenance team resources.

[0189] In the above implementation, a novel intelligent operation and maintenance framework is constructed based on deep fusion processing of multi-dimensional state parameters, highly adaptable modeling for complex operation and maintenance scenarios, and support for full-process automated closed-loop management. Compared with the problems of single indicator-driven and static strategy deployment in existing technologies, this solution exhibits stronger anomaly identification accuracy, higher resource utilization, and better user experience, and can be widely applied to various critical information infrastructure environments such as data centers, communication base stations, and cloud computing nodes.

[0190] Reference Figure 7As one implementation of step S110, the step of generating an executable maintenance work order based on hierarchical early warning instructions and real-time acquired resource context data through a cost-benefit decision tree model includes:

[0191] Step S701: Receive tiered early warning instructions and real-time resource context data; wherein, the tiered early warning instructions include device identifiers, early warning levels and response time limits, and the resource context data includes the location status of maintenance personnel, spare parts inventory and maintenance tool availability.

[0192] Specifically, the device identifier is used to uniquely identify the target device; the warning level reflects the severity of the fault (such as Level 1 Emergency, Level 2 Important, etc.) and determines the priority of subsequent responses; while the response time limit clarifies the time boundary conditions for task completion.

[0193] At the same time, the real-time resource context covers multiple dimensions of state variables, including but not limited to the location coordinates (latitude and longitude) of the operations engineer, whether they are currently idle and their skill tags, the actual inventory level of various spare parts in the warehouse, and the functional integrity of the available maintenance tools on site.

[0194] This contextual data forms the basic input set that supports the next step of rational decision-making, ensuring that the entire maintenance process not only considers the characteristics of the fault itself, but also takes into account the practical constraints of manpower allocation, material reserves and operational convenience.

[0195] Step S702: Match a preset cost-benefit decision tree model according to the warning level. The decision tree model includes a cost calculation branch and a benefit evaluation branch.

[0196] The cost-benefit decision tree is a data processing model with two nested but independent yet interconnected branches: a "cost calculation branch" that focuses on expenditures and a "benefit evaluation branch" that measures returns. These correspond to the two most important aspects of business operations: input control and output maximization.

[0197] Understandably, once the system identifies a certain warning level, it will automatically load the pre-trained decision tree template that matches it. For example, for a high-risk warning event (Level 1), it may be inclined to sacrifice some efficiency in exchange for a higher safety guarantee coefficient. In this case, the corresponding decision tree node will be given a higher weight to the risk aversion factor. For low-risk events, however, more emphasis is placed on economic performance, thereby activating the relevant subtree paths that focus on minimizing total expenditure.

[0198] Step S703: Input the device identifier and resource context data into the decision tree model, and traverse the cost calculation branches to generate economic cost estimates for multiple candidate maintenance schemes;

[0199] Specifically, this step uses all the static and dynamic attribute parameters collected in the preceding step as input feature vectors and injects them into the selected decision tree. It then deduces the various cost components required for each potential solution by reasoning downwards along the cost branches. This cost calculation integrates a composite quantitative modeling of multiple explicit and implicit overhead factors, including technical personnel service compensation (Cp), replacement parts procurement expenditure (Cs), and the discounted value of capacity loss due to equipment downtime (Cd).

[0200] It's important to note that the cost factor (Cd) is often overlooked but is extremely crucial because it indirectly relates to maintaining a company's core competitiveness. For example, the business interruption caused by a data center server going down for several hours far exceeds the direct cost of replacing a few hard drives. Therefore, incorporating this factor into the overall cost estimation framework helps improve the scientific and forward-looking nature of resource allocation.

[0201] Step S704: Synchronously traverse the benefit evaluation branches and calculate the comprehensive benefit score of each candidate maintenance scheme;

[0202] Unlike cost assessment, which relies more on financial figures, performance assessment uses a series of engineering and technical indicators to characterize potential value growth. For example, reliability gain (Br) reflects the extent to which the expected lifespan of equipment is extended after maintenance; risk reduction (Bs) expresses the increased probability of safe and stable operation resulting from effective intervention in potential failures; and resource utilization (Bu) is a metric designed to reveal whether an execution plan can efficiently integrate existing personnel and resources, avoiding unnecessary waiting and waste. These three scores together form a comprehensive performance evaluation system, enabling managers to make more comprehensive and balanced choices among numerous options.

[0203] Step S705: Select the candidate scheme with the highest ratio of comprehensive benefit score to economic cost estimate as the optimal maintenance scheme;

[0204] Understandably, this step didn't simply rely on the lowest cost or highest return, but rather adopted a more strategic optimization principle: maximizing cost-effectiveness. Even if a maintenance measure seems expensive, if the long-term stability improvement it brings is significant enough, then the investment is still worthwhile. Conversely, even if a cheap solution appears to save a lot of money, it may sow the seeds for a larger-scale accident.

[0205] Therefore, the system compares the benefit / cost ratio of each candidate strategy and selects the result with the most comprehensive advantages for adoption. This technical solution fully reflects the application practice of the flexible management concept in the context of modern intelligent manufacturing.

[0206] Step S706: Convert the optimal maintenance plan into an executable maintenance work order that includes personnel assignment, spare parts scheduling, and time window.

[0207] During this conversion process, the originally complex mathematical model output was reformatted into an operational guide document that is easy for frontline employees to understand and execute. This includes clearly specifying the names and IDs of the specific technicians responsible for this emergency repair task, listing all replacement components that must be prepared, and setting reasonable timeframes for on-site construction.

[0208] More importantly, all these arrangements strictly adhered to a series of rigid restrictions, such as requiring dispatched personnel to be within five kilometers of the incident location for rapid on-site arrival, ensuring the number of parts involved did not exceed the local warehouse's inventory limit (otherwise, an inter-warehouse transfer request had to be initiated in advance), and scheduling work start and end times to avoid the client's normal working hours as much as possible to prevent additional disruptions. This meticulous task breakdown ensured both effective execution and improved user experience satisfaction.

[0209] In the above implementation method, the response pace is flexibly adjusted according to the urgency of different types of faults, and unnecessary expenses are minimized to the greatest extent while ensuring service quality. This achieves a high degree of collaborative operation throughout the entire process from problem discovery and solution comparison to implementation.

[0210] Reference Figure 8 As a further implementation of the intelligent early warning method, after the step of generating an executable maintenance work order, the method further includes:

[0211] Step S801: Obtain the device health score sequence of similar devices in the device cluster and construct the health status covariance matrix;

[0212] In this context, a device cluster refers to a collection of multiple devices with the same functional attributes or deployed in the same business scenario, such as a group of servers of the same model in a data center or a network node group composed of core switches. Based on this, the device health score sequence refers to the time-series data of the health scores of each device continuously collected within a certain period, reflecting the health evolution trend of each device throughout its lifecycle.

[0213] Furthermore, by conducting statistical analysis on the relationships between these time series, a two-dimensional matrix describing the correlation of health status among devices can be constructed, namely the covariance matrix. The covariance matrix not only reflects the degree of linear dependence between the health status of any two devices but also reveals whether they exhibit synchronous fluctuations. If two devices show a highly consistent trend of change most of the time, it indicates that they may share some common influencing factors, or even have a physical or logical coupling connection.

[0214] Step S802: Identify abnormally associated device groups in the health status covariance matrix using a graph convolutional network;

[0215] Graph Convolutional Networks (GCNs) are a neural network architecture specifically designed for processing graph-structured data, suitable for datasets where node features and edge relationships both possess semantic meaning. Each device is treated as a node in the graph, and the health correlations between devices are input as edge weights into the GCN for training. Since the covariance matrix itself provides rich information about inter-node relationships, it can be embedded into the graph structure by transforming it into an adjacency matrix.

[0216] After several layers of graph convolution operations, the network automatically learns the representation vectors of each node in the local neighborhood environment, which helps to discover subgraph regions that deviate from the normal pattern in the overall distribution. If a small group of devices exhibits a health evolution pattern that is significantly different from other parts of the cluster, this difference will be amplified during the GCN learning process and eventually identified, forming the so-called "abnormally associated device group".

[0217] Step S803: Extract the common feature vector of the abnormally associated equipment group and generate a cross-equipment fault propagation prediction model;

[0218] Common feature vectors refer to the unified encoding of various types of information, such as historical operation records, alarm events, and maintenance logs of a set of devices, into a fixed-length numerical vector representation, so that machine learning algorithms can directly process them. These features typically include, but are not limited to, measurable key performance indicators such as average load level, failure frequency, response latency growth rate, and number of configuration changes.

[0219] In this embodiment, by comparing the similarity of feature vectors of different devices within the same time period, common causes behind such anomalies can be identified, such as defects in specific software versions, unstable power supply, or poor heat dissipation. Once the mechanisms of these key driving factors are understood, supervised learning methods (such as support vector machines, random forests, and LSTMs) can be used to fit one or more function mapping relationships, thereby establishing a cross-device fault propagation prediction model. This model can react quickly when similar problems emerge, predicting which other devices are likely to encounter similar fault risks in the future.

[0220] Step S804: When a single device triggers a graded early warning command, preventive maintenance recommendations for related devices are generated based on a cross-device fault propagation prediction model.

[0221] Traditional early warning mechanisms often focus only on changes in the status of individual devices, taking remedial measures only after a problem is detected. This approach can easily miss the optimal time for handling the issue, leading to wider service disruptions. In this solution, whenever any device triggers an early warning signal due to its health score dropping to a certain threshold, the system does not immediately initiate emergency repair procedures. Instead, it first calls upon the aforementioned fault propagation prediction model to perform a rapid simulation.

[0222] Specifically, the model infers a list of other target devices most likely to be affected based on the specific characteristics of the current device and the historical behavior of its cluster. It also generates a "preventive maintenance recommendation" in advance, which includes a checklist of inspection items, recommended replacement parts, and estimated manpower and material resources. This solution can not only prevent the situation from escalating, but also help maintenance personnel prepare in advance and improve their ability to respond to emergencies.

[0223] Step S805: Optimize the resource allocation scheme for executable maintenance work orders based on preventive maintenance recommendations.

[0224] Among them, executable maintenance work orders are sets of task instructions initiated manually or by automated tools, covering multiple dimensions of information such as task type, priority settings, responsible person assignment, and deadline. How to rationally allocate limited human and material resources in the face of maintenance requests of different levels submitted concurrently from multiple sources becomes a major challenge.

[0225] In this embodiment, by integrating preventative maintenance recommendations from the fault propagation prediction module, the tasks in the original work order pool can be reordered and their resource allocation strategies dynamically adjusted. For example, if the system detects a risk area where a cascading failure is about to occur, experienced engineers should be prioritized for on-site investigation; or, if a batch of hardware is confirmed to have batch quality issues, the reserve of spare parts should be appropriately increased to prevent unforeseen circumstances. In this way, the originally scattered and isolated operating units form an organically linked work loop, making the entire IT infrastructure management system more efficient and orderly.

[0226] The above implementation not only enables the early detection of deep-seated problems hidden in massive amounts of data, but also significantly reduces the probability of major accidents through proactive intervention strategies, providing room for sustainable improvement in long-term operation and maintenance, and demonstrating the advanced nature and practicality of the new generation of intelligent operation and maintenance platform.

[0227] This application also discloses an intelligent early warning system for ICT devices.

[0228] An intelligent early warning system for ICT devices includes:

[0229] The data acquisition module is used to collect multi-source heterogeneous data through a sensor network deployed on ICT devices; the multi-source heterogeneous data includes device operating parameters, environmental parameters, and device log data.

[0230] The data processing module is used to perform real-time cleaning and time synchronization processing on multi-source heterogeneous data to generate structured data;

[0231] The data classification module is used to classify the importance of structured data according to a preset entropy value calculation model, and output critical data streams and non-critical data packets.

[0232] The threshold calculation module is used to perform dynamic threshold calculation on critical data streams based on a historical fault database, and generate real-time threshold parameters that are adaptive to the device.

[0233] The anomaly detection module is used to perform anomaly detection on critical data streams using a lightweight time series analysis model, and output anomaly markers and device feature vectors.

[0234] The equipment health assessment module is used to perform multi-source fusion of equipment feature vectors and non-critical data packets, and input them into the cloud-based health assessment model to calculate the equipment health score;

[0235] The decay curve construction module is used to perform cluster analysis on similar equipment based on pre-stored historical equipment data and equipment attribute information, and to build a decay trend model for each type of equipment, thereby forming the corresponding decay curve function.

[0236] The equipment health prediction module is used to input the equipment health score into the degradation curve function, predict the remaining service life, and output an equipment health report.

[0237] The graded early warning module is used to generate graded early warning instructions based on the equipment health score and remaining service life in the equipment health report, combined with a pre-set operation and maintenance strategy library.

[0238] The maintenance work order generation module is used to generate executable maintenance work orders based on hierarchical early warning instructions and real-time acquired resource context data, using a cost-benefit decision tree model.

[0239] An intelligent early warning system for ICT devices according to an embodiment of this application can implement any of the above-mentioned early warning methods, and the specific working process of each module in the early warning system can refer to the corresponding process in the above-mentioned method embodiments.

[0240] In the several embodiments provided in this application, it should be understood that the provided methods and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for example, the division of a certain module is merely a logical functional division, and in actual implementation there may be other division methods, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0241] In this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0242] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce a good effect.

[0243] The above are all preferred embodiments of this application and are not intended to limit the scope of protection of this application. Any feature disclosed in this specification (including the abstract and drawings) may be replaced by other equivalent or similar features unless specifically stated otherwise. That is, unless specifically stated otherwise, each feature is only one example of a series of equivalent or similar features.

Claims

1. A method for intelligent early warning of ICT devices, characterized in that, The intelligent early warning method includes: Multi-source heterogeneous data is collected through a sensor network deployed on ICT devices; wherein, the multi-source heterogeneous data includes device operating parameters, environmental parameters, and device log data; The multi-source heterogeneous data is cleaned and synchronized in real time to generate structured data; The structured data is classified according to importance based on a preset entropy calculation model, and key-level data streams and non-key-level data packets are output. Based on the historical fault database, dynamic threshold calculation is performed on the critical-level data stream to generate real-time threshold parameters that are adaptive to the device. A lightweight time-series analysis model is used to detect anomalies in critical-level data streams, and anomaly markers and device feature vectors are output. The device feature vector is fused with non-critical data packets from multiple sources and then input into a cloud-based health assessment model to calculate the device health score. Based on pre-stored historical equipment data and equipment attribute information, cluster analysis is performed on similar equipment and a corresponding decline trend model is constructed for each type of equipment to form a corresponding decline curve function. The equipment health score is input into the degradation curve function to predict the remaining service life and output an equipment health report; Based on the equipment health score and remaining service life in the equipment health report, and combined with the pre-set operation and maintenance strategy library, a graded early warning instruction is generated. Based on the tiered early warning instructions and the real-time acquired resource context data, an executable maintenance work order is generated through a cost-benefit decision tree model.

2. The intelligent early warning method for ICT equipment according to claim 1, characterized in that, The steps of classifying the structured data according to the importance of a preset entropy calculation model and outputting critical-level data streams and non-critical-level data packets include: The structured data is divided into data blocks according to a preset time window, and the probability distribution of parameter values ​​within each data block is statistically analyzed. The entropy measure of each data block is calculated based on the probability statistics of the parameter value distribution. The entropy value is compared with a preset classification threshold. Data blocks with an entropy value higher than the preset classification threshold are marked as critical data streams, and the rest are marked as non-critical data packets. Output critical-level data streams with hierarchical tags and non-critical-level data packets to the data transmission channel.

3. The intelligent early warning method for ICT devices according to claim 2, characterized in that, The steps of dynamically calculating the threshold of the critical-level data stream based on the historical fault database to generate adaptive real-time threshold parameters for the device include: Retrieve equipment type-related fault records and historical parameter statistics stored in the historical fault database; Extract current device operating load parameters and environmental parameters from the real-time input critical-level data stream; Based on the device type, a corresponding threshold calculation model is matched, and dynamic threshold calculation is performed by combining the historical parameter statistics, current operating load parameters, and environmental parameters. Output real-time threshold parameters to the anomaly detection module.

4. The intelligent early warning method for ICT equipment according to claim 3, characterized in that, The steps for using a lightweight time-series analysis model to detect anomalies in critical-level data streams and output anomaly markers and device feature vectors include: Receive critical-level data streams and extract time-series segments containing equipment operating parameters; The time series segments are input into a pre-trained lightweight recurrent neural network model; Based on the real-time threshold parameter, the anomaly probability value at each time step is calculated using the lightweight recurrent neural network model; An abnormal event marker is generated when the probability value of an anomaly exceeds a preset threshold for three consecutive time steps. Extract device feature vectors from the hidden layer output of the lightweight recurrent neural network model.

5. The intelligent early warning method for ICT equipment according to claim 4, characterized in that, The steps of fusing the device feature vector with non-critical data packets from multiple sources and inputting the result into a cloud-based health assessment model to calculate the device health score include: Receive device feature vectors and non-critical data packets; wherein, the device feature vectors include time-series features extracted by real-time anomaly detection, and the non-critical data packets include device logs and environmental parameters; The non-critical data packets are structured and parsed to convert device logs into semantic vectors; The semantic vector and the device feature vector are dimensionally aligned to generate a fused feature vector; The fused feature vectors are input into the cloud-based health assessment model, which outputs a device health score. The storage device health score and corresponding device identifier are entered into the health status database.

6. The intelligent early warning method for ICT equipment according to claim 1, characterized in that, The steps for generating tiered early warning instructions based on the health score and remaining service life in the equipment health report, combined with a pre-set maintenance strategy library, include: Receive equipment health reports and extract the equipment health score and remaining useful life value from the equipment health reports; Match the set of early warning rules corresponding to the current device type from the pre-set operation and maintenance strategy library; The warning level is determined based on the coupling relationship between the threshold range of the device health score and the remaining service life value. Based on the aforementioned warning level and warning rule set, the instruction template library is invoked to generate a warning instruction containing device identifier, warning level, and response time limit requirements; By linking the geographical location data of the associated devices with the status data of the maintenance personnel, a list of recipients for the early warning instructions is determined.

7. The intelligent early warning method for ICT equipment according to claim 6, characterized in that, Based on the tiered early warning instructions and the real-time acquired resource context data, the steps for generating an executable maintenance work order using a cost-benefit decision tree model include: Receive tiered early warning instructions and real-time resource context data; wherein, the tiered early warning instructions include device identifiers, early warning levels and response time limits, and the resource context data includes the location status of maintenance personnel, spare parts inventory, and maintenance tool availability; A preset cost-benefit decision tree model is matched according to the warning level. The decision tree model includes a cost calculation branch and a benefit evaluation branch. The device identifier and resource context data are input into the decision tree model, and the cost calculation branches are traversed to generate economic cost estimates for multiple candidate maintenance schemes. Synchronously traverse the aforementioned benefit evaluation branches and calculate the comprehensive benefit score for each candidate maintenance scheme; The candidate solution with the highest ratio of comprehensive benefit score to economic cost estimate is selected as the optimal maintenance solution; The optimal maintenance plan is converted into an executable maintenance work order that includes personnel assignment, spare parts scheduling, and time windows.

8. The intelligent early warning method for ICT devices according to any one of claims 1 to 7, characterized in that, After the step of generating an executable maintenance work order, the following steps are also included: Obtain the device health score sequence of similar devices in the device cluster, and construct the health status covariance matrix; Abnormally associated device groups in the health status covariance matrix are identified using graph convolutional networks; Extract common feature vectors from abnormally associated device groups to generate a cross-device fault propagation prediction model; When a single device triggers a tiered early warning command, preventative maintenance recommendations for related devices are generated based on the cross-device fault propagation prediction model. The resource allocation scheme for the executable maintenance work order is optimized based on the preventive maintenance recommendations.

9. An intelligent early warning system for ICT devices, characterized in that, The intelligent early warning system includes: The data acquisition module is used to collect multi-source heterogeneous data through a sensor network deployed on ICT devices; wherein, the multi-source heterogeneous data includes device operating parameters, environmental parameters, and device log data; The data processing module is used to perform real-time cleaning and time synchronization processing on the multi-source heterogeneous data to generate structured data; The data classification module is used to classify the structured data according to the importance based on a preset entropy calculation model, and output key-level data streams and non-key-level data packets. The threshold calculation module is used to perform dynamic threshold calculation on the critical-level data stream based on the historical fault database, and generate real-time threshold parameters that are adaptive to the device. The anomaly detection module is used to perform anomaly detection on critical data streams using a lightweight time series analysis model, and output anomaly markers and device feature vectors. The device health assessment module is used to perform multi-source fusion of the device feature vector and non-critical data packets, and input the data into the cloud health assessment model to calculate the device health score. The decay curve construction module is used to perform cluster analysis on similar equipment based on pre-stored historical equipment data and equipment attribute information, and to build a decay trend model for each type of equipment, thereby forming the corresponding decay curve function. The equipment health prediction module is used to input the equipment health score into the degradation curve function, predict the remaining service life, and output an equipment health report; The graded early warning module is used to generate graded early warning instructions based on the equipment health score and remaining service life in the equipment health report, combined with a pre-set operation and maintenance strategy library. The maintenance work order generation module is used to generate executable maintenance work orders based on the hierarchical early warning instructions and real-time acquired resource context data, using a cost-benefit decision tree model.

Images