Efficient processing method and system for online troubleshooting of information department

Abstract

The invention discloses an efficient processing method and system for online troubleshooting of the information department, and relates to the technical field of automatic operation and maintenance, and the system comprises a multi-modal data acquisition module, a dynamic knowledge graph construction module, a reinforcement learning driven self-healing module, an edge co-processing module and a cross-domain privacy calculation module. According to the method, the limitation of traditional single-dimensional monitoring is broken through, multi-source heterogeneous data such as server performance, container state and network flow are fused, a high-timeliness and high-consistency decision information base is constructed through unified time sequence alignment and semantic standardization, and a panoramic view is provided for dynamic analysis; based on an incremental learning mechanism and a causal inference engine, a service topology dependency relationship is updated in real time, a deep root cause is accurately positioned, and a cross-system and cross-level complex fault combination is solved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of automated operation and maintenance, and realizes fault prediction, root cause analysis and self-healing in combination with artificial intelligence and operation and maintenance processes. BACKGROUND

[0002] With the continuous advancement of enterprise informatization construction of State Grid Corporation and the like, the types and quantities of information systems are continuously increasing, and the safe and reliable operation requirements of information systems are continuously improved. For example, the State Grid Corporation has uniformly constructed an MS system to strengthen the centralized monitoring capability of the operation of information systems, but it is still necessary to further improve the reliable operation and operation and maintenance management level of information application. For many enterprises and institutions, the normal development of business is highly dependent on the stable operation of information systems. For example, online faults of network application products will cause users to be unable to use the products, resulting in user loss and economic loss; the information department of a medical and health institution needs to ensure the normal operation of the hospital information system to support the development of medical business. Online faults usually have a large-scale impact on the availability of online services, causing economic loss and bad reputation for enterprises. Once the online environment is unavailable and cannot serve users, it will not only affect the income of the company, but also cause a negative impact on the reputation of the company.

[0003] The reasons for online faults are complex and diverse, and may involve code bugs, code performance, memory leaks, abnormal traffic / attacks, external system problems and the like. When a fault occurs, it is a challenge to quickly and accurately locate the fault point and analyze the fault reason, which requires technicians to have rich experience and professional knowledge. SUMMARY

[0004] To solve the above technical problems, an efficient processing method and system for online fault elimination of an information department are provided, which solve the problems of complex reasons for the above online faults, difficulty in locating fault points and analyzing fault reasons.

[0005] To achieve the above purpose, the technical scheme adopted by the application is as follows:

[0006] An efficient processing system for online fault elimination of an information department comprises:

[0007] A multi-modal data acquisition module: real-time acquisition of server performance indicators, application logs, network traffic data, container running states and user behavior logs, generation of unified time sequence labels through heterogeneous data normalization processing;

[0008] A dynamic knowledge graph construction module: based on a topology relationship mining engine, combined with a historical fault library and real-time context information, a dynamic knowledge graph containing device dependency relationship, service call chain and resource contention mode is constructed;

[0009] Reinforcement learning-driven self-healing module: Trains the agent in a simulation environment to generate dynamic repair strategies for different fault scenarios, supporting automatic rollback, traffic switching, and dynamic resource scaling.

[0010] Edge Collaborative Processing Module: Deploys a lightweight anomaly detection model on edge nodes to complete initial fault filtering and local repair, with cloud-based linkage only triggered by critical events;

[0011] Cross-domain privacy computing module: Employs multi-party secure computation and homomorphic encryption technology to achieve collaborative analysis of sensitive logs across enterprises and generate global root cause reports of failures.

[0012] Preferably, the multimodal data acquisition module specifically includes:

[0013] Data acquisition unit: Collects server performance metrics including hardware-level monitoring, operating system-level monitoring, and virtualization layer monitoring; application logs including structured logs, unstructured logs, and security audit logs; network traffic data including protocol-level packet capture, application layer analysis, and security threats; container runtime status including resource isolation metrics, orchestration layer data, and runtime security; user behavior logs including front-end tracking, business operation flow, and experience quality.

[0014] Heterogeneous data preprocessing unit: Standardizes data format and unifies units; implements sub-millisecond-level deviation correction between server hardware clock and NTP service based on PTP protocol, performs sliding window compensation, and interpolates and aligns data with inconsistent sampling frequencies; identifies and removes sensor false alarms based on Tukey Fences algorithm; deduplicatizes and merges multiple copy logs with the same TraceID; marks entity relationships, attaching the business line, physical location, and service level to each data point; records the complete transmission path of data from the acquisition end to the storage layer.

[0015] Unified time-series tag generation unit: Multi-dimensional tag system, with basic dimensions including timestamp, data source type, and severity level; business dimensions including tenant ID, experiment group, and compliance tag; dynamic tag injection, context association, and automatic attachment of associated transaction IDs; identification of hidden tags based on historical rule base; tag storage, using Parquet format to store tag key-value pairs, supporting efficient aggregation queries; and the creation of independent indexes for frequently queried tags.

[0016] Preferably, the dynamic knowledge graph construction module specifically includes:

[0017] The multi-source data integration unit includes:

[0018] Real-time data stream access subunit: Device dependency extraction, constructing a physical-virtual resource mapping matrix by parsing Pod-Node binding relationships stored in Kubernetes etcd and VPC network topology configuration files; Service call chain tracing, integrating OpenTelemetry's Trace data to reconstruct RPC / gRPC call paths between microservices; Resource contention pattern identification, quantifying the intensity of resource contention by monitoring CPU Cgroups quota preemption and database connection pool queuing.

[0019] Historical Fault Knowledge Base Subunit: Case feature storage, which encodes historical fault events into five-tuples, including fault type, root cause node, propagation path, repair action, and business impact, and establishes a vectorized index; Time-series decay factor design, which adds time decay weight to historical cases to ensure that recent faults have higher priority than old data;

[0020] Context-aware subunit: Business status awareness, injecting business calendars and system change events to dynamically adjust graph reasoning logic; Environmental variable association, associating weather data and network operator status to expand the dimensions of root cause analysis.

[0021] Preferably, the dynamic knowledge graph construction module specifically includes:

[0022] Topological relationships and dynamic update units include:

[0023] The graph neural network inference subunit uses node embedding technology and the GraphSAGE algorithm to generate vector representations of service nodes, quantifying the strength of influence between services; edge weights are dynamically calculated, and the vulnerability score of service call edges is updated based on real-time traffic and historical failure co-occurrence probability.

[0024] Dynamic update sub-unit: Event-driven update, triggering local graph reconstruction when a P1 level alarm or service topology change is detected; Incremental learning algorithm, using an online random forest model, continuously absorbs new alarm event features and updates causal inference rules;

[0025] Confidence threshold subunit: Multi-dimensional confidence assessment, comprehensively considering data freshness, data source authority, business criticality, and the confidence of computing nodes and edges; self-healing strategy arbitration, when the graph confidence is lower than the threshold, automatic repair is paused, and manual review is performed and the feedback is recorded and added to the learning loop.

[0026] Preferably, the dynamic knowledge graph construction module specifically includes:

[0027] The causal reasoning and fault propagation analysis unit includes:

[0028] PC Algorithm Subunit: Temporal Constraint Enhancement, introducing Granger causality test into traditional causal discovery to eliminate temporal reverse causality interference; Business Rule Filtering: Pre-defined domain knowledge to constrain the algorithm search space;

[0029] Multi-level propagation path prediction subunit: rate graph model construction, calculating the probability of fault propagation along the service chain based on Bayesian network; critical path identification, using Tarjan algorithm to find strongly connected components and locate critical nodes that are prone to triggering avalanches;

[0030] Simulation verification sandbox unit: Fault injection test, simulating node downtime and network partitioning scenarios in the digital twin environment to verify the accuracy of graph inference; Strategy effect pre-evaluation, comparing the expected impact of different repair actions in the graph, and selecting the solution with the least business loss.

[0031] Preferably, the reinforcement learning-driven self-healing module specifically includes:

[0032] The multimodal simulation environment building blocks include:

[0033] Digital twin modeling subunit: Physical layer simulation, based on real hardware configuration, constructs a virtual server cluster to simulate hardware failure; Network topology cloning, replicates the VPC subnetting, load balancing strategies and firewall rules of the production environment, and injects disturbance factors such as network jitter and DDoS attacks; Business traffic replay, uses historical logs to replay API call sequences to simulate real load fluctuations and business scenario dependencies; Equipped with a fault scenario library with preset fault types, covering multiple fault modes, dynamic scenario generation, and synthesizing rare fault combinations based on adversarial generative networks;

[0034] State-aware interface subunit: Receives topological influence weights and resource contention hotspot labels from the dynamic knowledge graph as input to the agent's observation space; Real-time context injection: Synchronizes business calendars and compliance constraints to guide the generation of boundary conditions for policy;

[0035] The agent training unit includes:

[0036] Hierarchical reinforcement learning sub-units: High-level decision-maker, which uses the PPO algorithm to generate macro policies, and whose action space covers multiple repair paradigms; Low-level executor, which refines operation parameters based on DQN network and supports continuous action space fine-tuning.

[0037] Reward function sub-unit: multi-dimensional reward indicators, including business continuity (service recovery time, transaction failure rate reduction); resource efficiency (CPU utilization variance, excess reserved resource recovery); security and compliance (avoiding SLA violations, reducing sensitive operations); and dynamically adjusting the weight of reward dimensions based on business priority.

[0038] Course Learning and Transfer Sub-units: Progressive training, gradually increasing the difficulty from single-node failures to cross-AZ cascade failures; Cross-environment transfer, adapting models trained in the simulation environment to different cloud platforms through domain randomization.

[0039] Preferably, the reinforcement learning-driven self-healing module specifically includes:

[0040] The dynamic repair strategy unit includes:

[0041] Strategy Tree Inference Subunit: Multi-step look-ahead planning, using Monte Carlo tree search to evaluate the long-term impact of the strategy chain; Real-time game equilibrium, establishing a game model between repair actions and potential fault propagation, and selecting the optimal Nash equilibrium solution;

[0042] The atomic action library subunit includes: automatic rollback via version snapshot management, based on application configuration history versions stored in Etcd, supporting one-click rollback to a stable state; a canary verification mechanism, first verifying the rollback effect in a low-traffic environment, and then pushing it to the full system after confirming there are no anomalies; traffic switching through service mesh linkage, dynamically adjusting traffic weights using Istio VirtualService; DNS-level failover, achieving cross-region traffic switching based on Route53 Health Check; resource scaling, setting elastic scaling strategies, and scaling up in advance based on predicted load; and cost constraint optimization, dynamically balancing Spot instance bidding strategies and reserved instances.

[0043] Strategy Explanation and Audit Subunit: Attention visualization, highlighting key nodes affecting decision-making using Grad-CAM technology; Operation chain tracing, recording all candidate actions and their scores during the strategy generation process;

[0044] The online-offline collaborative unit includes:

[0045] Shadow mode operation subunit: Parallel decision comparison, running agent policies and manual operations in parallel in a real environment, comparing the repair effects and selecting the best one to execute; policy effect feedback, feeding back online verification results to offline training to accelerate model iteration;

[0046] Federated learning enhancement subunit: Cross-enterprise knowledge sharing, training a global model by combining fault repair experience from multiple cloud service providers without exposing the original data; differential privacy protection, adding noise during gradient updates.

[0047] Preferably, the edge collaborative processing module specifically includes:

[0048] Lightweight anomaly detection model unit: It uses TensorFlow Lite Micro and ARM CMSIS-NN libraries to compress the LSTM anomaly detection model trained in the cloud; it transfers the knowledge of the large cloud model to the lightweight student model; it utilizes the INT8 quantization engine of the edge AI chip; it builds a local message queue based on Apache Kafka Edge and NanoMQ, supporting data window sliding and feature extraction; and it ensures low latency through priority scheduling.

[0049] Localized repair strategy library unit: Pre-set repairs include: disk bad sector isolation: triggering remapping of spare sectors via SMART commands to avoid full disk replacement; memory page reclamation: using the Linux Kernel's Page Poisoning mechanism to isolate faulty memory regions; container self-healing: automatically restarting continuously crashing Pods based on Kubernetes livenessProbe; service degradation: shutting down non-core functions to prioritize the availability of the payment link; rule engine: implementing condition-action matching based on the Drools framework; reinforcement learning fine-tuning: deploying a lightweight Q-learning model on the edge to optimize the execution order of contingency plans according to the local environment;

[0050] Cloud-based collaborative linkage unit: event classification and filtering, multi-threshold triggering; metadata summary generation, only uploading fault feature vectors; dynamic selection of MQTT and gRPC based on network quality, enabling streaming compression when RTT is less than or equal to a predetermined threshold; allocation of dedicated VPN tunnels for cross-edge collaborative events;

[0051] Resource and Environment Optimization Unit: Model Slicing Loading, splitting the anomaly detection model into a feature extraction layer and a classification layer; Edge Cache Management, using an LRU strategy to retain the most recently accessed high-frequency data, and periodically synchronizing cold data to cloud object storage; Dynamic Frequency Adjustment, adjusting the CPU main frequency based on load prediction; Solar Power Supply Adaptation, designing charging and discharging strategies for outdoor base stations.

[0052] Preferably, the cross-domain privacy computing module specifically includes:

[0053] Multimodal data security unit: Heterogeneous data alignment, establishing a standardized dictionary of log fields between enterprises to resolve data pattern conflicts; aligning the log time bases of all parties based on blockchain timestamp services to ensure the consistency of event sequence across systems; k-anonymizing sensitive fields for each participant before data leaves their local machine; encrypting numerical indicators using the Paillier homomorphic encryption algorithm, supporting aggregation operations in ciphertext state;

[0054] Multi-party secure computation unit: Identifies common fault characteristics without exposing the original logs of all parties; fuzzy matching algorithm supports fault tolerance setting and locates cross-system associated anomaly patterns; based on secret sharing technology, it statistically analyzes the global fault frequency distribution; Laplace noise is added to the aggregation results to prevent the inference of individual enterprise data from statistical results; the improved PC algorithm runs under the MPC framework to identify cross-enterprise fault propagation paths; and a secure multi-party regression model is used to calculate the root cause influence coefficient.

[0055] Homomorphic encryption driver unit: Based on the TFHE library, it implements complex operations in encrypted state, using Paillier encryption for numerical data and AES-GCM encryption for text data, balancing security and computational efficiency; Horizontal federated learning: Each enterprise uses local logs to train sub-models, exchanging only model parameter updates, and protecting the transmission process through homomorphic encryption; Vertical federated learning: For data from overlapping users but with different characteristics, it jointly trains user behavior prediction models; Encrypted log data from enterprise A can be used for inference in enterprise B's model, with the output in ciphertext form, decrypted only by authorized parties; Threshold signature technology enables multi-party joint decryption of prediction results;

[0056] Multi-dimensional report synthesis unit: Constructs a three-dimensional fault propagation map of time, space, and business, highlighting critical paths across enterprises; quantifies the responsibility ratio of each participant based on a causal contribution algorithm; dynamically controls data visibility granularity according to report sensitivity level and enterprise role; supports clicking to view some fields in plaintext, while other fields remain encrypted and require secondary authorization for full decryption; all joint analysis steps are recorded to the Hyperledger Fabric consortium blockchain to meet GDPR / CCPA compliance audit requirements; sets a global report automatic destruction policy, and independently controls the local data retention policies of each participant.

[0057] Furthermore, an efficient online troubleshooting method for information technology departments, used to implement the efficient online troubleshooting system for information technology departments as described above, includes:

[0058] The distributed probes collect server performance metrics, application logs, network traffic data, and container running status in real time. The heterogeneous data normalization engine is used to clean, align, and generate unified time-series labels for the multimodal data.

[0059] Based on the topology relationship mining algorithm, combined with the historical fault case library and real-time context information, a knowledge graph containing device dependencies, service call chains and resource contention patterns is constructed, and the graph node weights and edge association strength are dynamically updated through an incremental learning mechanism.

[0060] We use a causal reasoning engine to analyze the failure propagation path in the knowledge graph, quantify the contribution of root cause nodes, and predict the potential impact of failures on business continuity indicators through Monte Carlo simulation.

[0061] Train a reinforcement learning agent in a digital twin environment to generate dynamic repair strategies based on the current system state and the scope of fault impact, including at least one of the following operations: automatic rollback, traffic switching, and elastic scaling of resources.

[0062] Lightweight repair operations are performed on edge nodes, while critical events are synchronized to the cloud for global strategy optimization. After verifying the repair effect through shadow mode, the system is fully deployed.

[0063] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0064] This invention proposes integrating heterogeneous data from multiple sources, such as server performance, container status, and network traffic, and achieving cross-system data correlation analysis through unified temporal alignment and semantic standardization. Based on distributed probes and lightweight acquisition technology, it ensures millisecond-level data synchronization accuracy, providing a highly timely and consistent information foundation for dynamic decision-making. Combining real-time topology mining and historical fault mode learning, it constructs a dynamically evolving knowledge graph. Through an incremental learning mechanism, it continuously absorbs service architecture changes and fault events, automatically updating node dependency strength and edge weights to accurately characterize the spatiotemporal correlation of system states. The introduction of a causal reasoning engine penetrates superficial alarms to locate deep-seated root causes, significantly improving the accuracy of fault attribution in complex scenarios.

[0065] The reinforcement learning model is trained in a digital twin environment to simulate fault propagation paths and predict the long-term impact of remediation strategies. A hierarchical decision-making architecture is used to generate dynamic remediation solutions that take into account business continuity, resource efficiency, and security compliance, and supports atomic operation combinations. The shadow mode verification and feedback mechanism ensures continuous strategy iteration, forming an autonomous cycle of "decision-execution-verification". Attached Figure Description

[0066] Figure 1 This is an internal framework diagram of an efficient online troubleshooting system for information technology.

[0067] Figure 2 Internal framework diagram of the module for building dynamic knowledge graphs;

[0068] Figure 3 Internal framework diagram of the reinforcement learning-driven self-healing module;

[0069] Figure 4 This is a flowchart of an efficient online troubleshooting method for information technology. Detailed Implementation

[0070] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0071] Reference Figure 1 As shown, an efficient online troubleshooting system for information technology includes:

[0072] Multimodal data acquisition module: Real-time acquisition of server performance metrics, application logs, network traffic data, container running status and user behavior logs, and generation of unified time-series labels through heterogeneous data normalization processing;

[0073] Dynamic knowledge graph construction module: Based on the topology relationship mining engine, combined with the historical fault database and real-time context information, a dynamic knowledge graph containing device dependencies, service call chains, and resource contention patterns is constructed.

[0074] Reinforcement learning-driven self-healing module: Trains the agent in a simulation environment to generate dynamic repair strategies for different fault scenarios, supporting automatic rollback, traffic switching, and dynamic resource scaling.

[0075] Edge Collaborative Processing Module: Deploys a lightweight anomaly detection model on edge nodes to complete initial fault filtering and local repair, with cloud-based linkage only triggered by critical events;

[0076] Cross-domain privacy computing module: Employs multi-party secure computation and homomorphic encryption technology to achieve collaborative analysis of sensitive logs across enterprises and generate global root cause reports of failures.

[0077] It should be noted that this invention achieves a closed-loop data flow across the entire chain, integrating data acquisition, analysis, and execution. This includes: multimodal data fusion, which normalizes heterogeneous data to unify server performance, container status, and other data into an analyzable spatiotemporal event stream; a dynamic knowledge graph hub serving as a data center, integrating historical failure modes with real-time context to generate a semantic representation of the system state; and a reinforcement learning module that feeds back the knowledge graph weights based on the repair effect, such as reducing the confidence of relevant nodes if the success rate of a certain strategy is low.

[0078] Dynamic adaptability includes the knowledge graph automatically reconstructing dependencies when the microservice architecture is adjusted, without manual intervention; and reinforcement learning agents quickly adapting to new scenarios through course learning.

[0079] Hardware-software joint fault handling identifies container drift and service degradation caused by physical server downtime, triggering hybrid repair, hardware replacement + service migration; rare faults based on GAN synthesis, such as cloud vendor API rate limiting + database deadlock concurrency, train agents to generate combined strategies.

[0080] Reference Figure 2As shown, the dynamic knowledge graph construction module specifically includes:

[0081] Topological relationships and dynamic update units include:

[0082] The graph neural network inference subunit uses node embedding technology and the GraphSAGE algorithm to generate vector representations of service nodes, quantifying the strength of influence between services; edge weights are dynamically calculated, and the vulnerability score of service call edges is updated based on real-time traffic and historical failure co-occurrence probability.

[0083] Dynamic update sub-unit: Event-driven update, triggering local graph reconstruction when a P1 level alarm or service topology change is detected; Incremental learning algorithm, using an online random forest model, continuously absorbs new alarm event features and updates causal inference rules;

[0084] Confidence threshold subunit: Multi-dimensional confidence assessment, comprehensively considering data freshness, data source authority, business criticality, and the confidence of computing nodes and edges; self-healing strategy arbitration, when the graph confidence is lower than the threshold, automatic repair is paused, and manual review is performed and the feedback is recorded and added to the learning loop.

[0085] The dynamic knowledge graph construction module specifically includes:

[0086] The causal reasoning and fault propagation analysis unit includes:

[0087] PC Algorithm Subunit: Temporal Constraint Enhancement, introducing Granger causality test into traditional causal discovery to eliminate temporal reverse causality interference; Business Rule Filtering: Pre-defined domain knowledge to constrain the algorithm search space;

[0088] Multi-level propagation path prediction subunit: rate graph model construction, calculating the probability of fault propagation along the service chain based on Bayesian network; critical path identification, using Tarjan algorithm to find strongly connected components and locate critical nodes that are prone to triggering avalanches;

[0089] Simulation verification sandbox unit: Fault injection test, simulating node downtime and network partitioning scenarios in the digital twin environment to verify the accuracy of graph inference; Strategy effect pre-evaluation: comparing the expected impact of different repair actions in the graph, and selecting the solution with the least business loss.

[0090] It should be noted that graph neural network drivers include:

[0091] Node semantic embedding uses the GraphSAGE algorithm to generate vector representations of service nodes and quantifies the intensity of influence between services; edge vulnerability dynamic scoring is based on real-time traffic and historical failure co-occurrence probability. For example, if services X and Y have both failed 12 times in the past 30 days, the vulnerability of the service call edge is calculated, with a score range of 0-100.

[0092] Dynamic calculation of edge weights:

[0093]

[0094] In the formula, Let be the edge weight from service node i to j at time t; i to j are the harmonic hyperparameters of real-time and historical impacts; P is the conditional probability based on historical failures. Let be the flow from node i to node j at time t; This is the maximum value of the flow across all edges, used to normalize the real-time flow. This represents the probability that node i and node j will fail simultaneously, calculated based on historical data.

[0095] By combining real-time traffic and historical fault data, the weights of edges are dynamically adjusted to reflect the importance or reliability of different edges in the network.

[0096] Event-driven incremental updates include:

[0097] Local refactoring is triggered when a P1-level alarm is detected, including a database master node failure; or when a service topology change occurs, including when a new microservice instance is added. Only the affected subgraph is updated.

[0098] The system uses online random forest learning to continuously absorb new alarm event characteristics, such as changes in the distribution of container OOM error codes, and dynamically adjusts the causal rule base, updating approximately 300 rules daily.

[0099] Granger causality constraints add time window verification to the traditional PC algorithm, with a lag order of 3, to eliminate spurious causality; hard constraints based on business rules pre-set domain knowledge, such as "load balancer failure will inevitably lead to backend service unavailability", to limit the algorithm's search space and reduce invalid path analysis;

[0100] Granger causality test:

[0101]

[0102] In the formula, F is a statistic used to determine the causal relationship between variables; and is the sum of squared residuals for both the restricted and unrestricted models; T is the time series length; p is the lag order.

[0103] Multi-stage propagation path prediction, Bayesian network probability calculation, construction of a service dependency chain failure propagation model, such as the probability that a failure of node A will cause a problem in node B = 72%, predicting the potential impact range; key node location, using the Tarjan algorithm to identify strongly connected components, such as an API gateway that is depended on by 10+ services, marked as an avalanche risk point.

[0104] Digital twin sandbox verification, fault injection scenario library, built-in 50+ standard fault modes, such as network packet loss rate >30%, disk IO latency >500ms, simulating cascading faults in real environment; policy pre-evaluation matrix, comparing the business impact of different repair actions, such as "restart service" expected recovery time 2 minutes vs "traffic switching" expected recovery time 45 seconds;

[0105] Confidence-driven decision arbitration, multi-dimensional evaluation model, data freshness (60% weight of data from the last hour), data source authority (30% weight of monitoring system data vs. 20% weight of log data), business criticality (2 times weight of payment link nodes).

[0106] Human-machine collaboration mechanism: When the confidence level of the map is less than 85%, the automatic repair is paused and the manual review process is triggered. The average intervention time is less than 3 minutes, and the feedback data is fed back into the training model.

[0107] Reference Figure 3 As shown, the reinforcement learning-driven self-healing module specifically includes:

[0108] The multimodal simulation environment building blocks include:

[0109] Digital twin modeling subunit: Physical layer simulation, based on real hardware configuration, constructs a virtual server cluster to simulate hardware failure; Network topology cloning, replicates the VPC subnetting, load balancing strategies and firewall rules of the production environment, and injects disturbance factors such as network jitter and DDoS attacks; Business traffic replay, uses historical logs to replay API call sequences to simulate real load fluctuations and business scenario dependencies; Equipped with a fault scenario library with preset fault types, covering multiple fault modes, dynamic scenario generation, and synthesizing rare fault combinations based on adversarial generative networks;

[0110] State-aware interface subunit: Receives topological influence weights and resource contention hotspot labels from the dynamic knowledge graph as input to the agent's observation space; Real-time context injection: Synchronizes business calendars and compliance constraints to guide the generation of boundary conditions for policy;

[0111] The agent training unit includes:

[0112] Hierarchical reinforcement learning sub-units: High-level decision-maker, which uses the PPO algorithm to generate macro policies, and whose action space covers multiple repair paradigms; Low-level executor, which refines operation parameters based on DQN network and supports continuous action space fine-tuning.

[0113] Reward function sub-unit: multi-dimensional reward indicators, including business continuity (service recovery time, transaction failure rate reduction); resource efficiency (CPU utilization variance, excess reserved resource recovery); security and compliance (avoiding SLA violations, reducing sensitive operations); and dynamically adjusting the weight of reward dimensions based on business priority.

[0114] Course Learning and Transfer Sub-units: Progressive training, gradually increasing the difficulty from single-node failures to cross-AZ cascade failures; Cross-environment transfer, adapting models trained in the simulation environment to different cloud platforms through domain randomization.

[0115] The reinforcement learning-driven self-healing module specifically includes:

[0116] The dynamic repair strategy unit includes:

[0117] Strategy Tree Inference Subunit: Multi-step look-ahead planning, using Monte Carlo tree search to evaluate the long-term impact of the strategy chain; Real-time game equilibrium, establishing a game model between repair actions and potential fault propagation, and selecting the optimal Nash equilibrium solution;

[0118] The atomic action library subunit includes: automatic rollback via version snapshot management, based on application configuration history versions stored in Etcd, supporting one-click rollback to a stable state; a canary verification mechanism, first verifying the rollback effect in a low-traffic environment, and then pushing it to the full system after confirming there are no anomalies; traffic switching through service mesh linkage, dynamically adjusting traffic weights using Istio VirtualService; DNS-level failover, achieving cross-region traffic switching based on Route53 Health Check; resource scaling, setting elastic scaling strategies, and scaling up in advance based on predicted load; and cost constraint optimization, dynamically balancing Spot instance bidding strategies and reserved instances.

[0119] Strategy Explanation and Audit Subunit: Attention visualization, highlighting key nodes affecting decision-making using Grad-CAM technology; Operation chain tracing, recording all candidate actions and their scores during the strategy generation process;

[0120] The online-offline collaborative unit includes:

[0121] Shadow mode operation subunit: Parallel decision comparison, running agent policies and manual operations in parallel in a real environment, comparing the repair effects and selecting the best one to execute; policy effect feedback, feeding back online verification results to offline training to accelerate model iteration;

[0122] Federated learning enhancement subunit: Cross-enterprise knowledge sharing, training a global model by combining fault repair experience from multiple cloud service providers without exposing the original data; differential privacy protection, adding noise during gradient updates.

[0123] It should be noted that the multimodal simulation environment building blocks include:

[0124] The digital twin modeling uses physical-logical double precision, based on BMC data modeling of real server models, to simulate hardware failures, including CPU overheating and frequency reduction, and RAID card failure; network topology cloning, accurately replicating the subnet partitioning rules of AWS VPC, and injecting dynamic perturbations, such as the inter-region network latency suddenly increasing from 5ms to 300ms.

[0125] Business traffic replay, reconstructing the API call chain based on historical logs, e-commerce order creation → payment → inventory deduction, supports proportional scaling of load pressure by business time period, such as "Double 11 traffic peak";

[0126] To overcome rare faults in adversarial generative networks, the generator network combines low-frequency fault patterns, such as disk bad sectors, memory leaks, and API gateway rate limiting concurrency. Dynamic scene evolution is also addressed by the discriminator network, which evaluates the authenticity of the generated scene in real time, achieving an FID score ≤15, thus ensuring the robustness of agent training.

[0127] State-aware interface, context awareness and policy constraints, semantic input of dynamic knowledge graph, topological influence weight, mapping the importance score of service nodes to priority labels in the agent's observation space; resource contention hotspot labeling, real-time marking of container groups with CPU contention rate >80%, guiding agents to prioritize resource scheduling;

[0128] Dynamic injection of business context and time-sensitive rules include prohibiting ALTER operations on large database tables during the "month-end settlement period" to avoid business interruption; compliance boundary settings, enforcing the "patient data does not leave the hospital area" policy in medical scenarios, and restricting cross-AZ migration operations.

[0129] The agent training unit includes:

[0130] A hierarchical reinforcement learning architecture, co-optimization of decision-making and execution, a high-level decision-maker, and macro-level policy generation include an action space covering the selection of repair paradigms, such as "automatic rollback," "service degradation," and "cross-region switching," with a decision cycle of 5-10 seconds; enhanced policy interpretability, visualizing the decision basis through an attention mechanism, such as selecting "traffic switching" because the database connection pool utilization rate reaches 98%;

[0131] The underlying executor features fine-grained parameter control, including continuous adjustment of CPU quota (step ±5%) and thread pool size (±20%) during the "resource scaling up / down" action; real-time feedback calibration, dynamically adjusting the JVM heap memory expansion range based on monitoring data;

[0132] The system features a dynamic weighted reward function with business continuity weighting: a 1% decrease in transaction failure rate earns +15 points, while service recovery timeouts are penalized with -20 points per minute; resource efficiency balancing: a penalty of -10 points per unit of variance is triggered when CPU utilization variance exceeds 30%, and excess resource recovery is rewarded with +5 points per core; and an adaptive adjustment mechanism that increases the weight of "sensitive operation count" from 10% to 35% during periods of frequent security incidents.

[0133] The course learning phases are designed as follows: Basic training, single-node failure, 100,000 iterations, success rate >95%; Advanced training, cross-AZ cascaded failures, introducing random network partitions (20% probability), success rate threshold >85%; Domain randomized migration, randomly perturbing differences in API latency and resource quotas for AWS / Azure / GCP, model cross-platform generalization error <8%.

[0134] The dynamic repair strategy unit includes:

[0135] Strategy tree reasoning and Monte Carlo tree search are used to simulate the failure propagation path in the next 30 minutes of an e-commerce promotion scenario, such as cache breakdown → database overload → payment failure. The long-term impact of different repair strategies is evaluated, such as "expanding the database" may cause resource contention.

[0136] The game theory model is constructed, which treats fault propagation as a malicious participant, establishes a payoff matrix between repair actions and fault propagation, calculates the Nash equilibrium solution, and prioritizes isolating faulty nodes rather than global flow limiting.

[0137] Atomic Actions Library, Automatic Rollback: Based on application configuration snapshots stored in Etcd, it supports second-level rollback, such as Kubernetes Deployment version rollback, and has passed canary release verification and 5% traffic testing to ensure no side effects;

[0138] Intelligent traffic scheduling, in conjunction with Istio, enables dynamic weight adjustment, such as gradually reducing the traffic weight of a faulty service from 100% to 0, simultaneously triggering Route53 health checks, and completing cross-regional switching;

[0139] Elastic scaling optimization employs reinforcement learning to predict peak loads and dynamically mixes Spot instances and reserved instances to achieve Pareto optimality in cost and stability.

[0140] Strategy explanation and auditing, attention visualization, and the use of Grad-CAM technology to mark key decision factors, such as "selecting to expand due to database connection pool utilization > 95%", generate audit reports that comply with ITIL standards;

[0141] Operation chain tracing records all candidate actions during the strategy generation process, such as "Option A: Expand DB → Score 82; Option B: Service Degradation → Score 75", supporting post-event root cause reproduction and strategy optimization;

[0142] The online-offline collaborative unit includes:

[0143] Shadow mode, security policy evolution, parallel decision comparison, synchronously runs agent policies and human operations in a real environment, selects the optimal solution through A / B testing, such as agent policy recovery is 12% faster, but resource consumption is 15% higher;

[0144] The feedback mechanism feeds back online validation results, such as "a configuration conflict caused by an automatic rollback", to offline training, accelerating model iteration by prioritizing experience replay.

[0145] Federated learning enhances cross-domain knowledge fusion and privacy-preserving collaborative training. Multiple cloud service providers jointly train the global model, such as AWS, Azure, and GCP, sharing fault repair experience. Homomorphic encryption is used to exchange gradient updates. Differential privacy noise injection adds Laplace noise (ε=0.5) to the gradient update to ensure that fault data of a single enterprise cannot be reversed and meets GDPR compliance requirements.

[0146] Reference Figure 4 As shown, an efficient online troubleshooting method for information technology includes:

[0147] The distributed probes collect server performance metrics, application logs, network traffic data, and container running status in real time. The heterogeneous data normalization engine is used to clean, align, and generate unified time-series labels for the multimodal data.

[0148] Based on the topology relationship mining algorithm, combined with the historical fault case library and real-time context information, a knowledge graph containing device dependencies, service call chains and resource contention patterns is constructed, and the graph node weights and edge association strength are dynamically updated through an incremental learning mechanism.

[0149] We use a causal reasoning engine to analyze the failure propagation path in the knowledge graph, quantify the contribution of root cause nodes, and predict the potential impact of failures on business continuity indicators through Monte Carlo simulation.

[0150] Train a reinforcement learning agent in a digital twin environment to generate dynamic repair strategies based on the current system state and the scope of fault impact, including at least one of the following operations: automatic rollback, traffic switching, and elastic scaling of resources.

[0151] Lightweight repair operations are performed on edge nodes, while critical events are synchronized to the cloud for global strategy optimization. After verifying the repair effect through shadow mode, the system is fully deployed.

[0152] It should be noted that the distributed probe design includes lightweight deployment, with probes consuming less than 1% of CPU / memory resources, and supports automatic scaling in Kubernetes DaemonSet mode; data source coverage includes servers (CPU / memory / disk), containers (cAdvisor metrics), networks (eBPF traffic sniffing), and logs (Fluentd aggregation).

[0153] Heterogeneous data alignment technologies include: timeline synchronization, using NTP+ hardware clock calibration, with cross-node time error ≤5ms; semantic standardization, defining a unified entity model, such as mapping "k8s_pod_cpu_usage" to "service instance resource load".

[0154] The incremental update mechanism includes: event-driven updates, which partially reconstruct the subgraph when a P1-level alarm is detected, such as when the database master node crashes; and an online learning model, which uses an online random forest algorithm to dynamically absorb new failure modes.

[0155] Root cause localization algorithms include: improved causal discovery by introducing Granger causality test into the PC algorithm to eliminate more than 30% of temporal pseudo-correlation interference; and contribution quantification by calculating the influence weight of root cause nodes based on SHAP values, such as a service node contributing 78%.

[0156] The digital twin environment includes: high-fidelity simulation, cloning the production environment topology, and injecting 50+ standard fault scenarios, such as network partitioning and resource exhaustion; adversarial training uses GANs to generate rare fault combinations, such as disk bad sectors + memory leak concurrency, to improve model robustness.

[0157] The strategy generation optimization includes: a hierarchical decision architecture, a high-level PPO algorithm to select a repair paradigm, such as "automatic rollback", and a low-level DQN network to fine-tune parameters, such as expansion step size ±5%; a dynamic reward function, and real-time weight adjustments for business continuity (weight 40%), resource efficiency (weight 35%), and security compliance (weight 25%).

[0158] In summary, the advantages of this invention are as follows:

[0159] Breaking through the limitations of traditional single-dimensional monitoring, this system integrates multi-source heterogeneous data such as server performance, container status, and network traffic. Through unified time-series alignment and semantic standardization, it constructs a highly timely and consistent decision-making information foundation, providing a panoramic view for dynamic analysis. Based on an incremental learning mechanism and a causal inference engine, it updates service topology dependencies in real time, accurately pinpoints deep-seated root causes, and resolves complex fault combinations across systems and levels. It trains reinforcement learning models in a digital twin environment to generate dynamic remediation strategies that balance business continuity, resource efficiency, and compliance. It supports atomic operation combinations, enabling a self-evolving cycle of "decision-execution-verification."

[0160] A lightweight edge model enables second-level local fault interception, while a global optimization strategy is synchronized in the cloud, forming a layered architecture of "fast edge response + deep cloud analysis." This ensures low-latency repair while avoiding the limitations of local decision-making. Federated learning and homomorphic encryption technologies are used to build a fault knowledge sharing network among enterprises. Under the premise that data does not leave the domain, the global model is jointly optimized, significantly improving the ability to solve common industry problems.

[0161] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. An efficient processing system for online troubleshooting in information department, characterized in that, include: Multimodal data acquisition module: Real-time acquisition of server performance metrics, application logs, network traffic data, container running status and user behavior logs, and generation of unified time-series labels through heterogeneous data normalization processing; Dynamic knowledge graph construction module: Based on the topology relationship mining engine, combined with the historical fault database and real-time context information, a dynamic knowledge graph containing device dependencies, service call chains, and resource contention patterns is constructed. Reinforcement learning-driven self-healing module: Trains the agent in a simulation environment to generate dynamic repair strategies for different fault scenarios, supporting automatic rollback, traffic switching, and dynamic resource scaling. Edge Collaborative Processing Module: Deploys a lightweight anomaly detection model on edge nodes to complete initial fault filtering and local repair, with cloud-based linkage only triggered by critical events; Cross-domain computing module: Employing multi-party secure computation and homomorphic encryption technology, it enables collaborative analysis of sensitive logs across enterprises and generates global root cause reports of failures.

2. The efficient processing system for online troubleshooting of information center of claim 1, wherein, The multimodal data acquisition module specifically includes: Data acquisition unit: Collects server performance metrics including hardware-level monitoring, operating system-level monitoring, and virtualization layer monitoring; application logs including structured logs, unstructured logs, and security audit logs; network traffic data including protocol-level packet capture, application layer analysis, and security threats; container runtime status including resource isolation metrics, orchestration layer data, and runtime security; user behavior logs including front-end tracking, business operation flow, and experience quality. Heterogeneous data preprocessing unit: Standardizes data format and unifies units; implements sub-millisecond-level deviation correction between server hardware clock and NTP service based on PTP protocol, performs sliding window compensation, and interpolates and aligns data with inconsistent sampling frequencies; identifies and removes sensor false alarms based on Tukey Fences algorithm; deduplicatizes and merges multiple copy logs with the same TraceID; marks entity relationships, attaching the business line, physical location, and service level to each data point; records the complete transmission path of data from the acquisition end to the storage layer. Unified time-series tag generation unit: Multi-dimensional tag system, with basic dimensions including timestamp, data source type, and severity level; business dimensions including tenant ID, experiment group, and compliance tag; dynamic tag injection, context association, and automatic attachment of associated transaction IDs; identification of hidden tags based on historical rule base; tag storage, using Parquet format to store tag key-value pairs, supporting efficient aggregation queries; and the creation of independent indexes for frequently queried tags.

3. The efficient processing system for online troubleshooting of information center of claim 2, wherein, The dynamic knowledge graph construction module specifically includes: The multi-source data integration unit includes: Real-time data stream access subunit: Device dependency extraction, constructing a physical-virtual resource mapping matrix by parsing Pod-Node binding relationships stored in Kubernetes etcd and VPC network topology configuration files; Service call chain tracing, integrating OpenTelemetry's Trace data to reconstruct RPC / gRPC call paths between microservices; Resource contention pattern identification, quantifying the intensity of resource contention by monitoring CPU Cgroups quota preemption and database connection pool queuing. Historical failure knowledge base subunit: case feature storage, encode historical failure events into five-tuples including failure type, root cause node, propagation path, repair action, and business impact, and establish vectorized index; time decay factor design, add time decay weight to historical cases to ensure that recent failures have higher priority than old data; Context awareness subunit: business status awareness, inject business calendar and system change events to dynamically adjust graph reasoning logic; environment variable association, associate weather data and network operator status to expand root cause analysis dimensions.

4. The efficient processing system for online troubleshooting of information center of claim 3, wherein, The dynamic knowledge graph construction module specifically includes: Topology relationship and dynamic updating unit includes: Graph neural network reasoning subunit: use node embedding technology to generate vector representation of service nodes using GraphSAGE algorithm to quantify the influence strength between services; edge weight dynamic calculation, based on real-time traffic and historical failure co-occurrence probability, update the vulnerability score of service call edge; Dynamic updating subunit: event-driven updating, trigger local graph reconstruction when P1 level alarms and service topology changes are detected; incremental learning algorithm, use online random forest model to continuously absorb new alarm event features and update causal reasoning rules; Confidence threshold subunit: multi-dimensional confidence evaluation, calculate node and edge confidence by combining data freshness, data source authority, and business criticality; self-healing strategy arbitration, suspend automated repair when graph confidence is below the threshold, and transfer to manual review and record feedback to the learning cycle.

5. The efficient processing system for online troubleshooting of information center of claim 4, wherein, The dynamic knowledge graph construction module specifically includes: Causal reasoning and failure propagation analysis unit includes: PC algorithm subunit: time constraint enhancement, introduce Granger causality test in traditional causal discovery to exclude time reverse causal interference; business rule filtering: pre-set domain knowledge to constrain algorithm search space; Multi-stage propagation path prediction subunit: rate graph model construction, calculate the probability of failure spreading along the service chain based on Bayesian network; key path identification, use Tarjan algorithm to find strongly connected components to locate key nodes that are prone to trigger avalanches; Simulation verification sandbox subunit: fault injection test, simulate node downtime and network partition scenarios in the digital twin environment to verify the accuracy of graph reasoning; strategy effect pre-evaluation, compare the expected impact of different repair actions in the graph to select the solution with the least business loss.

6. The efficient processing system for online troubleshooting of information center of claim 5, wherein, The reinforcement learning driven self-healing module specifically includes: Multi-modal simulation environment construction unit includes: Digital twin modeling subunit: physical layer simulation, based on real hardware configuration, build a virtual server cluster to simulate hardware failures; network topology cloning, replicate production environment VPC subnet division, load balancing strategy and firewall rules, and inject network jitter and DDoS attack disturbance factors; business traffic replay, use historical log playback API call sequences to simulate real load fluctuations and business scenario dependencies; equipped with a fault scenario library to preset failure types, covering multiple failure modes, dynamic scenario generation based on generative adversarial networks to synthesize rare fault combinations; State-aware interface subunit: receive topology influence weight from state knowledge graph, resource contention hotspot area label as agent observation space input; real-time context injection: synchronize business calendar, compliance constraints to guide policy generation boundary conditions; Agent training unit includes: Hierarchical reinforcement learning subunit: high-level decision maker, use PPO algorithm to generate macro strategy, action space covers multiple repair paradigms; bottom layer executor, based on DQN network to refine operation parameters, support continuous action space fine tuning; Reward function subunit: multi-dimensional reward index, business continuity includes service recovery time, transaction failure rate decline amplitude; resource efficiency includes CPU utilization fluctuation variance, excess reserved resource recovery amount; security compliance includes avoiding violating SLA, reducing sensitive operation; dynamically adjust reward dimension weight according to business priority; Course learning and migration subunit: progressive training, gradually increase difficulty from single node failure to cross AZ cascade failure; cross environment migration, adapt the model trained in the simulation environment to different cloud platforms through domain randomization.

7. The efficient processing system for online troubleshooting of information center of claim 6, wherein, The reinforcement learning driven self-healing module specifically includes: Dynamic repair strategy unit includes: Policy tree reasoning subunit: multi-step forward planning, use Monte Carlo tree search to evaluate the long-term impact of policy chain; real-time game equilibrium, establish a game model between repair action and potential fault propagation, select the Nash equilibrium optimal solution; Operation atomic action library subunit: automatic rollback through version snapshot management, based on Etcd stored application configuration history version, support one-key rollback to stable state; gray verification mechanism, first verify rollback effect in small traffic environment, confirm no exception before full push; traffic switching through service mesh linkage, use Istio VirtualService to dynamically adjust traffic weight; DNS level failover, based on Route53 Health Check to realize cross-region traffic switching; resource expansion, set elastic scaling policy, according to predicted load, expand in advance; cost constraint optimization, dynamically balance between spot instance bidding strategy and reserved instance; Policy explanation and audit subunit: attention visualization, highlight key nodes affecting decision-making through Grad-CAM technology; operation chain traceability, record all candidate actions and their scores in the policy generation process; Online-offline collaborative unit includes: Shadow mode running subunit: parallel decision comparison, run agent strategy and manual operation in real environment in parallel, compare repair effects and execute the better one; strategy effect feedback, feed back online verification results to offline training to accelerate model iteration; Federated learning enhancement subunit: cross-enterprise knowledge sharing, train global model jointly with multiple cloud service providers' fault repair experience without exposing raw data; differential protection, add noise in gradient update.

8. The efficient processing system for online troubleshooting of information center of claim 7, wherein, The edge collaborative processing module specifically includes: Lightweight anomaly detection model unit: TensorFlow Lite Micro, ARM CMSIS-NN library, compress the cloud-trained LSTM anomaly detection model; migrate the knowledge of the cloud large model to the lightweight child model; use the INT8 quantization engine of the edge AI chip; based on Apache Kafka Edge, NanoMQ to build a local message queue, support data window sliding and feature extraction; low latency guarantee, through priority scheduling; Local repair strategy library unit: preset repair includes disk bad track isolation: trigger remapping spare sectors through SMART instructions to avoid full disk replacement; memory page recycling: isolate faulty memory areas using the Page Poisoning mechanism of Linux Kernel; container self-healing: based on Kubernetes livenessProbe automatically restart continuously crashing Pods; service degradation: turn off non-core functions to prioritize payment link availability; rule engine, condition-action matching based on Drools framework; reinforcement learning fine-tuning, deploy lightweight Q-learning model on the edge side to optimize the execution order of the plan according to the local environment; Cloud collaborative linkage unit: event classification and filtering, multi-threshold triggering; metadata summary generation, upload only fault feature vectors; dynamically select MQTT, gRPC according to network quality, enable stream compression when RTT is less than or equal to the specified threshold; allocate a dedicated VPN tunnel for cross-edge collaborative events; Resource environment optimization unit: model sharding loading, split the anomaly detection model into feature extraction layer and classification layer; edge cache management, use LRU strategy to retain the most recently accessed data, and periodically synchronize cold data to cloud object storage; dynamic frequency adjustment, adjust CPU frequency based on load prediction; solar power supply adaptation, design charging and discharging strategies for field stations.

9. The efficient processing system for online troubleshooting of information center of claim 8, wherein, The cross-domain computing module specifically includes: Multi-modal data security unit: heterogeneous data alignment, establish a standardized dictionary of log fields between enterprises to solve data mode conflicts; align the log time base of each party based on the blockchain timestamp service to ensure the consistency of the order of cross-system events; each party performs k-anonymization on sensitive fields before the data leaves the local; use Paillier homomorphic encryption algorithm to encrypt numerical indicators, support aggregate operations in ciphertext state; Multi-party secure computing unit: identify common fault features without exposing the original logs of each party; fuzzy matching algorithm, support fault tolerance rate setting, locate cross-system associated abnormal patterns; based on secret sharing technology, statistics global fault frequency distribution; add Laplace noise to the aggregation result to prevent individual enterprise data from being inferred from the statistical result; improved PC algorithm runs in the MPC framework to identify cross-enterprise fault propagation paths; use a secure multi-party regression model to calculate the root cause influence coefficient; Homomorphic encryption driving unit: based on the TFHE library to realize complex operations in the encrypted state, Paillier encryption is used for numerical data, and AES-GCM encryption is used for text data, balancing security and computing efficiency; horizontal federated learning, each enterprise trains a sub-model using local logs, only exchanges model parameter updates, and protects the transmission process through homomorphic encryption; vertical federated learning, for data of overlapping users but different features, jointly train user behavior prediction models; the encrypted log data of enterprise A can be inferred in the model of enterprise B, and the output result is in ciphertext form, only authorized parties can decrypt; through threshold signature technology, multi-party joint decryption of prediction results is realized; Multi-dimensional report synthesis unit: construct a three-dimensional fault propagation graph of time-space-business, highlight the cross-enterprise key path; based on the causality contribution algorithm, quantify the responsibility proportion of each participant; dynamically control the data visibility granularity according to the report sensitivity level and enterprise role; support clicking to view part of the field plaintext, other fields remain encrypted, and complete decryption requires secondary authorization; all joint analysis steps are recorded to the Hyperledger Fabric consortium chain, meeting the GDPR / CCPA compliance audit requirements; set global report automatic destruction strategy, and the local data retention strategy of each participant is independently controlled.

10. An efficient processing method of information department online troubleshooting, according to the efficient processing system of information department online troubleshooting of claims 1-9, characterized in that, Including: Real-time collection of server performance indicators, application logs, network traffic data and container running status through distributed probes, using heterogeneous data normalization engine to clean, align and generate uniform time sequence labels for multi-modal data; Based on the topological relationship mining algorithm, combined with the historical fault case library and real-time context information, a knowledge graph containing device dependency relationship, service call chain and resource contention mode is constructed, and the graph node weight and edge association strength are dynamically updated through incremental learning mechanism; Use causal reasoning engine to analyze the fault propagation path in the knowledge graph, quantify the contribution degree of the root cause node, and predict the potential impact of the fault on the business continuity index through Monte Carlo simulation; Train reinforcement learning agents in the digital twin environment, generate dynamic repair strategies according to the current system state and fault impact range, including at least one of automatic rollback, traffic switching, resource elastic expansion and contraction; Perform lightweight repair operations on edge nodes, synchronize key events to the cloud for global strategy optimization, and verify the repair effect through shadow mode before full deployment.

Images