Machine room safety management platform

Abstract

The invention discloses a machine room safety management platform, which comprises a cloud side-end collaborative architecture consisting of an edge layer, a platform layer and an application layer, and is operated based on the cloud side-end collaborative architecture by the following steps: uniformly accessing heterogeneous equipment by the platform, and carrying out real-time data acquisition and preprocessing; carrying out real-time fusion, alignment, deduplication and aggregation on heterogeneous data from different edge gateways, and storing the data into a time sequence database and a relational database; fault prediction, root cause analysis and automatic operation and maintenance are realized by using a large language model, a knowledge graph and reinforcement learning; when a fault or early warning occurs, cross-system collaborative response is carried out based on the digital twinning and the knowledge graph, and operation and maintenance operation is automatically executed; and through a multi-dimensional visual interface, the full-link state of the machine room is displayed in real time, and historical data query and analysis functions are synchronously provided. According to the invention, in the safety operation and maintenance management of the machine room, the operation and maintenance management efficiency from equipment access to intelligent decision and from collaborative response to visual monitoring is improved.

Description

Technical Field

[0001] This invention relates to the field of data center infrastructure and security management technology, specifically to a data center security management platform. Background Technology

[0002] Existing enterprise data center management platforms primarily monitor, manage, and maintain equipment related to power, environment, video surveillance, fire protection, and security. Monitored objects include infrastructure within the data center such as power distribution, air conditioning, UPS, water leak detectors, smoke detectors, access control, video surveillance, and infrared sensors. By providing detailed information, the platform displays the real-time status and operating parameters of the monitored equipment. In the event of an alarm, it promptly generates alert information and automatically triggers a work order system to urge relevant personnel to handle the situation quickly.

[0003] In the current domestic IT infrastructure development environment, compatibility issues among various hardware and software components (such as CPUs, operating systems, middleware, and databases) are prominent. Inconsistent interface standards and protocol incompatibility between products from different vendors lead to high system integration difficulty and costs. Furthermore, data silos result from a lack of interoperability, leading to low efficiency in security operations and maintenance. Existing data center security management platforms require the integration of numerous widely distributed subsystems that process large amounts of real-time data, including video streams, sensor data, and log data. This results in slow processing speeds due to the large number of data sources. The complex and highly coupled business logic between modules in each subsystem also leads to low efficiency in the aggregation and correlation analysis of events from different devices. A problem in one module can affect the data processing progress of other modules. Additionally, existing data center security management platforms primarily manage loosely coupled devices, relying mainly on statistical analysis of log information from a few devices for collaboration. They lack integrated security situation awareness and collaborative response mechanisms, resulting in insufficient integration and response capabilities in complex scenarios and low operational efficiency. Summary of the Invention

[0004] The purpose of this invention is to provide a data center security management platform to solve the problems mentioned in the background art.

[0005] The specific technical solution provided by this invention is as follows: A data center security management platform, comprising a cloud-edge-device collaborative architecture consisting of an edge layer, a platform layer, and an application layer.

[0006] Edge layer: Edge intelligent gateways deployed in the data center are used for device access, protocol conversion, data preprocessing, and edge intelligent analysis.

[0007] Preferably, the edge layer operation process includes: using a dual-mode protocol recognition engine for matching based on rule templates; performing fuzzy recognition based on a lightweight neural network; automatically synchronizing new protocol feature vectors from the cloud through a dynamic update mechanism of the protocol feature library; then using the gateway to actively detect devices for intelligent protocol selection to achieve adaptive protocol negotiation; using a time-series data stream window algorithm to define a dynamic window size and adjust the aggregation window in real time; simultaneously deploying a hybrid detection algorithm based on the edge anomaly detection model using isolated forest and local anomaly factors, with the local model synchronized with the cloud model through federated learning to enhance edge computing; finally, integrating SM2 / SM3 / SM4 algorithms to achieve end-to-end data encryption, with the key rotating every hour, and using two-factor trusted device identity authentication using device fingerprints and dynamic tokens to generate a unique digital identity certificate when a device connects, enabling zero-trust device access control and automatically isolating abnormal devices.

[0008] Platform layer: A cluster of microservices deployed on a cloud platform for data processing, intelligent decision-making, digital twins, and operation and maintenance management.

[0009] Preferably, the platform layer operation process includes: data augmentation through an intelligent data processing engine; optimization of adaptive load balancing algorithms; construction of a knowledge graph of device associations and a multi-level causal discovery model; construction of a physical-virtual precise mapping model based on digital twin intelligent agents; prediction of device degradation based on neural differential equations; and using reinforcement learning methods to model the data center energy efficiency optimization problem as a Markov decision process, perform fault propagation simulation, and adjust control strategies.

[0010] Application layer: Provides web management terminal, large screen decision center and mobile operation and maintenance APP for 3D digital twin visualization, operation and maintenance operation and decision support.

[0011] Preferably, the application layer operation process includes: performing comprehensive data statistics; visualizing the layout of the data center to achieve location search and configuration management; and using visualization technology to establish a three-dimensional virtual environment that is completely consistent with the actual data center environment, providing multi-dimensional visualization.

[0012] On the other hand, the data center security management platform operates based on a cloud-edge-device collaborative architecture, and follows these steps:

[0013] Step S1: The platform uniformly connects to heterogeneous devices to perform real-time data acquisition and preprocessing.

[0014] Preferably, the specific implementation includes: using an edge gateway to collect data from multiple heterogeneous devices in real time, constructing a protocol semantic knowledge graph in the edge smart gateway, automatically learning protocol features through the Node2Vec graph embedding algorithm, and generating protocol conversion rules; an adaptive protocol conversion engine converting data from different protocols into a unified semantic model according to the rules generated by the knowledge graph; the edge gateway dynamically loading new protocol adapters through a pluggable protocol library to identify, parse, and convert the data; performing preprocessing on the collected and converted data, including preliminary cleaning and aggregation, compressing the preprocessed data, and uploading it to the platform layer.

[0015] Step S2: Real-time fusion, alignment, deduplication, and aggregation of heterogeneous data from different edge gateways, and storage in time-series databases and relational databases.

[0016] Preferably, the specific implementation includes: deploying an Apache Flink cluster in the platform layer; using a time window alignment algorithm to perform time-series alignment of multi-source data; utilizing Flink's state management and event time processing mechanisms to further deduplicate, correlate, and aggregate the data; writing the processed data into the time-series database TDengine, with each device or metric corresponding to a sub-table, and labels recording the device's location and type information; and synchronously writing the processed data into a relational database and a knowledge graph database for business queries and correlation analysis.

[0017] Step S3: Utilize large language models, knowledge graphs, and reinforcement learning to achieve fault prediction, root cause analysis, and automated operation and maintenance.

[0018] Preferably, the specific implementation includes: employing a fault prediction engine based on the GLM-130B large language model; fine-tuning the data center operation and maintenance corpus using the LoRA method; constructing question-answer pairs or sequence prediction tasks from the fine-tuned corpus text; training the model to understand the context of data center operation and maintenance; performing root cause analysis using a graph neural network (GCN) in conjunction with a knowledge graph; training automated operation and maintenance strategies using the reinforcement learning PPO algorithm; the fault prediction engine analyzes data obtained from Flink and TDengine in real time, combines historical fault cases, predicts possible faults, and generates early warnings; and sending intelligent decision results, including fault prediction, root cause analysis results, and automated operation and maintenance strategy suggestions, to the collaborative orchestration layer and operation and maintenance management terminal via a message queue. The collaborative orchestration layer executes specific operations based on the decision results, and the operation and maintenance management terminal generates operation and maintenance work orders and notifies operation and maintenance personnel.

[0019] Step S4: When a fault or warning occurs, conduct cross-system collaborative response based on digital twins and knowledge graphs, and automatically execute operation and maintenance operations.

[0020] Preferably, the specific implementation includes: constructing a device association model based on digital twins and knowledge graphs; when a fault or warning occurs, the collaborative orchestration layer automatically generates a collaborative control strategy based on the device association model; the collaborative control command is sent to the corresponding terminal through the edge gateway; the corresponding terminal automatically dispatches the collaborative control command to the executing device, and tracks the operation and maintenance of the executing device throughout the process, updating the device status and maintenance records; and pushes work orders and processing instructions through the mobile terminal for on-site inspection and maintenance.

[0021] Step S5: Through a multi-dimensional visualization interface, the real-time status of the entire data center is displayed, and historical data query and analysis functions are provided simultaneously.

[0022] Preferably, the specific implementation includes: constructing a 3D digital twin scene for visualization; integrating 2D charts and 3D scenes to display the overall status of the data center; conducting full-link monitoring; querying historical data based on the digital twin scene to obtain statistical analysis results; and performing mobile operation and maintenance for multiple tasks via mobile terminals.

[0023] Compared with the prior art, the beneficial effects achieved by the present invention are: (1) The digital twin intelligent agent used in this invention accurately maps the physical computer room through multi-scale modeling, maintains the accuracy of the model by real-time calibration, and realizes equipment degradation prediction, fault propagation simulation and energy efficiency optimization simulation based on neural differential equations, graph diffusion models and reinforcement learning, providing strong support for predictive maintenance and optimized operation of the computer room.

[0024] (2) This invention achieves proactive operation and maintenance of “prediction-prevention” through large models and machine learning, and deeply integrates the semantic understanding of large language models, the structured reasoning of knowledge graphs, and the decision optimization of reinforcement learning to form a complete intelligent chain of cognition, reasoning and decision-making, and deeply optimizes it for the characteristics of domestic hardware and software.

[0025] (3) This invention constructs a collaborative operation and maintenance model based on the complementary advantages of historical experience and AI computing power through interpretable decision output, multi-level confirmation mechanism and human feedback closed loop. It reduces the amount of uploaded data through edge computing, reduces inference cost through model compression, and uses adaptive algorithm to adapt to different sizes of computer rooms. It can be deployed economically from small and medium-sized computer rooms to ultra-large-scale data centers. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the operation steps of the data center security management platform provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the components, terminals, and modules of the data center security management platform provided in this embodiment of the invention; Figure 3This is a schematic diagram of the terminal operation structure of the data center security management platform provided in this embodiment of the invention; Figure 4 This is a schematic diagram of the architecture of the data center security management platform provided in this embodiment of the invention, covering data collection, monitoring, and user operations. Figure 5 This is a schematic diagram of the complete architecture of the data center security management platform provided in this embodiment of the invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention are within the scope of protection of the present invention.

[0028] Example 1: Combination Figures 1-5 As shown in the figure, the data center security management platform described in this embodiment includes a layered, microservice-based cloud-edge-device collaborative architecture, which is as follows: Edge layer: The edge intelligent gateway deployed in the data center is responsible for device access, protocol conversion, data preprocessing, and edge intelligent analysis.

[0029] Platform layer: Microservice clusters deployed on the domestic IT cloud platform, including services such as data processing, intelligent decision-making, digital twins, and operation and maintenance management.

[0030] Application layer: Provides a variety of applications such as web management terminal, large screen decision center, and mobile operation and maintenance APP to realize 3D digital twin visualization, operation and maintenance operation, decision support, etc.

[0031] In this embodiment, the edge layer specifically includes: Hardware: This invention uses domestically produced hardware (Phytium / Kunpeng CPU) and is equipped with a domestically produced operating system (Kylin OS).

[0032] Edge intelligent gateway: This invention integrates an adaptive protocol conversion engine, which supports plug-in access of multiple protocols (SNMP / Modbus / OPC / private protocol) to achieve a protocol conversion latency of <50ms.

[0033] Edge computing: Data cleaning, format standardization, and preliminary aggregation are performed at the edge, with a processing capacity of >100,000 points / second, reducing the amount of data uploaded by 70%.

[0034] Edge AI: This invention deploys a lightweight large model based on the domestic Phytium AI chip in the cloud, integrates edge-side feature data through a federated learning mechanism, achieves a fault prediction accuracy of >90%, an alarm false alarm rate of <10%, and performs real-time anomaly detection and preliminary fault judgment.

[0035] For example, the operational flow in the edge layer includes: employing a dual-mode protocol recognition engine for fast matching based on rule templates (µs level) + fuzzy recognition based on lightweight neural networks (<20ms); automatically synchronizing new protocol feature vectors from the cloud weekly based on a dynamic update mechanism of the protocol feature library, supporting incremental learning; actively probing devices through the gateway to support intelligent selection of the optimal communication method for the protocol, achieving adaptive protocol negotiation; and using a time-series data stream window algorithm to define a dynamic window size. + (Data Change Rate) - (Network latency), where: (Empirical coefficient) Real-time adjustment of the aggregation window balances real-time performance and data integrity. A hybrid detection algorithm combining isolated forest and local anomaly factors is used in conjunction with the edge anomaly detection model. The model is deployed quantitatively on the Phytium D2000 chip, with inference latency <15ms. The local model is synchronized with the cloud model every 24 hours via federated learning, enhancing edge computing. Finally, end-to-end encryption of data is achieved by integrating SM2 / SM3 / SM4 national cryptographic algorithm chips. The key is rotated hourly, supporting quantum-safe encryption pre-algorithms (based on lattice cryptography). Two-factor authentication of device identity using device fingerprints and dynamic tokens is employed, generating a unique digital identity certificate (valid for 7 days) upon device access, enabling zero-trust device access control and automatic isolation of abnormal devices.

[0036] In this implementation, the platform layer includes: Microservice architecture: Based on domestic microservice frameworks such as Spring Cloud Alibaba, it achieves service decoupling and supports elastic scaling.

[0037] Data processing terminal: The platform adopts the Flink streaming computing engine and time series database (TDengine) to achieve real-time fusion of multi-source data (throughput > 1 million records / second). Through sliding window aggregation (window size 200ms), the end-to-end latency is compressed to < 800ms, eliminating data silos and reducing duplicate collection by 60%.

[0038] Intelligent Decision Terminal: The platform builds a fault prediction engine based on a domain-fine-tuned large language model (LoRA fine-tuned on the data center operation and maintenance corpus based on GLM-130B), and combines it with knowledge graph reasoning (Graph Neural Network GCN) to achieve root cause analysis, achieving an alarm accuracy of 92% and a false alarm rate of 8%. Automated operation and maintenance strategies are trained through reinforcement learning (PPO algorithm), achieving a coverage rate of 75%. The system adopts a microservice architecture deployed on a domestic cloud platform (Kylin OS + DM database), with modules communicating via gRPC (latency <10ms), supporting elastic scaling, and achieving availability >99.95%.

[0039] Digital twin terminal: Construct 3D visualized digital twin scene, combine knowledge graph to realize device association modeling, and support collaborative control response time <500ms.

[0040] Protocol Abstraction Layer: Constructs a protocol semantic knowledge graph and automatically generates protocol conversion rules through graph embedding algorithms such as Node2Vec to achieve unified semantic model mapping for heterogeneous devices.

[0041] For example, the platform layer's operational flow includes: Enhanced Intelligent Data Processing Engine: Data augmentation is performed through the intelligent data processing engine. A multimodal data fusion pipeline is used to feed {time-series data stream, video frames, log text, knowledge graph} into the input layer, and STFT transformation and feature engineering are used to extract time-series data. For video data, a lightweight CNN is used to extract spatial features. A BERT fine-tuning model is used to extract semantic features from text logs. After multimodal alignment using a multi-head attention mechanism, a unified feature vector (512 dimensions) is output.

[0042] Adaptive load balancing algorithm optimization: Calculate the current load L = (CPU utilization) for each Flink TaskManager. 0.4+ memory usage 0.3+ network I / O 0.3), when the current load L is greater than the set threshold (0.85), the data partitioning strategy is dynamically adjusted to migrate 20% of the data flow to low-load nodes, and the data flow rate is adjusted based on the PID controller. Data quality is controlled by calculating data integrity, accuracy and timeliness scores in real time.

[0043] Dynamic Knowledge Graph Construction Engine: By inputting device logs, configuration data, and topology information, it uses a BiLSTM+CRF model to identify entities such as devices, ports, and services. A Transformer model based on an attention mechanism is used for relationship extraction, and GCN is used for multi-source knowledge fusion to obtain a device-related knowledge graph. The graph is incrementally updated hourly based on a predefined incremental update mechanism. Simultaneously, a multi-layered causal discovery model is constructed, comprising layers one through four: layer one implements statistical causal discovery based on the PC algorithm; layer two implements temporal causal inference based on Granger causality testing; layer three implements structural causal modeling based on Do-calculus; and layer four implements causal verification under domain knowledge constraints.

[0044] A physical-virtual precise mapping model based on digital twin agents: In this embodiment, a graph-based thermodynamic model is used to divide the data center into multiple hot zones. Each hot zone contains several server racks and air conditioners. Heat transfer between hot zones is represented by edges between graph nodes. The edge weights are determined by factors such as the distance between adjacent hot zones and airflow organization. By setting hot zones... The temperature is Its thermal dynamics can be approximated by the following differential equation:

[0045] in, For the heat capacity of the hot zone, Hot Zone temperature, The thermal conductivity coefficient, For the heat generated by equipment in the hot zone, The coefficient of performance (COP) of an air conditioner. This refers to the air conditioning supply temperature.

[0046] Furthermore, a heat transfer network model is adopted, treating the server rack as a heat source and considering front and rear air ducts, hot and cold aisles, etc. Therefore, for a server rack, an internal temperature distribution model is established, defining uniform heat generation of the equipment inside the rack, and the impact of the opening ratio of the front and rear doors on airflow, thus determining the rack outlet temperature. It can be represented as:

[0047] in, This refers to the rack inlet temperature. This represents the total heat generated by the server rack. air density, The specific heat capacity of air, This refers to air volume.

[0048] Further, device models based on electrical characteristics are employed, such as the relationship between server power consumption and load, and UPS efficiency curves. For a single server, its power consumption... With CPU utilization The relationship can be represented as:

[0049] in, This is the idle power consumption. For maximum power consumption, It is an empirical coefficient (usually close to 1).

[0050] To maintain consistency between the digital twin model and the actual system, model parameters need to be calibrated periodically. This is achieved by collecting actual sensor data (such as temperature, power consumption, and airflow) every 5 minutes and updating the model parameters using Bayesian inference. Assuming the model parameters follow a prior distribution, the posterior distribution is obtained according to Bayes' theorem. However, due to the complexity of the model, the posterior distribution is difficult to solve analytically; therefore, Markov Chain Monte Carlo (MCMC) sampling is further employed. Finally, the estimated parameters are updated in the digital twin model. For example, in a thermal zone model, parameters requiring calibration include the thermal conductivity coefficient. and air conditioning cooling coefficient Every 5 minutes, data such as the average temperature of each hot zone, the air conditioning supply temperature, and the total power consumption (heat generation) of the equipment are collected. The data are then sampled from the prior distribution of parameters using the MCMC method (such as the Metropolis-Hastings algorithm) to minimize the error between the model's predicted temperature and the actual temperature.

[0051] Equipment degradation prediction based on neural differential equations: Neural differential equations (Neural ODEs) combine neural networks with differential equations, making them suitable for modeling continuous-time dynamic systems. This invention uses neural differential equations to predict equipment degradation, representing the equipment degradation state as a continuous variable. Its evolution is described by differential equations:

[0052] in, For neural networks, The parameter is determined by the given initial state. It predicts future states through numerical integration. For example, it predicts the capacity degradation of UPS batteries by collecting historical battery data, including charge / discharge cycles, ambient temperature, voltage, internal resistance, etc., and using the battery state of health (SOH) as a latent variable. A neural differential equation model is constructed. During training, the SOH variation in historical data (obtainable through capacity testing) is used to learn the model. During prediction, given the current state, the trajectory of SOH over a future period is obtained by solving the ODE. When SOH is below a threshold (e.g., 80%), a prompt is made to replace the battery.

[0053] Fault Propagation Simulation: The goal of this energy efficiency optimization simulation is to reduce energy consumption by adjusting control strategies (such as air conditioning set temperature and fan speed) while ensuring that equipment temperature remains within a safe range. By employing reinforcement learning (RL), the data center energy efficiency optimization problem is modeled as a Markov decision process (MDP). The state space is defined, including temperatures in each hot zone, equipment power consumption, and outdoor temperature; the action space includes control variables such as air conditioning set temperature and fan speed; and a reward function is defined that considers energy consumption and temperature exceedance penalties. :

[0054] in, For equipment power consumption, For the region temperature, The maximum permissible temperature. This represents the penalty coefficient. Using the PPO algorithm to train the policy network, in a digital twin environment, the agent takes an action based on the current state, the environment (digital twin model) transitions to the next state, and a reward is returned. Extensive simulation training is used to obtain the energy-optimal policy. For example, in a computer room, there are 5 precision air conditioners. The states are the temperatures of 10 hot zones, the total power consumption of the computer room, and the outdoor temperature. The actions are the set temperatures of the 5 air conditioners (discreteized, such as integers between 18-26℃). A decision is made every 5 minutes, and the simulation runs for one week (2016 decision steps). After training, the policy can save 15% more energy than a fixed-temperature policy while ensuring that the temperature does not exceed the limit.

[0055] In this embodiment, the application layer includes providing multiple applications such as a web management terminal, large-screen display, and mobile terminal (integrated with Zhejiang Government DingTalk). It enables functions such as 2D / 3D visualization, asset operation and maintenance management, intelligent alarms, automated work orders, and a knowledge base.

[0056] For example, the application layer's operation flow includes: Comprehensive data statistics: The application layer provides a comprehensive overview of the platform's main statistical functions through comprehensive analysis, including: asset type statistics, real-time temperature and humidity, weekly trends in energy conservation and emission reduction, environmental alarm statistics, work order statistics, data center operation dynamics information, capacity utilization (USB flash drive, cooling capacity, network port, fiber optic port, rated power, actual power consumption), PUE index, energy consumption ratio, alarm analysis, etc. (content can be customized).

[0057] Visualized Data Center Display: The layout of equipment within the data center is based on blueprints: racks, air conditioners, power distribution cabinets, rack cabinets, temperature and humidity sensors, cameras, etc., are arranged according to their actual locations; including a visualized temperature and humidity cloud map and visualized rack capacity. Switching between data center and full-screen displays is possible. Clicking displays detailed information for a single item. For example, racks display IT equipment, storage locations, maintenance information, racking information, IT equipment asset information, and port connection information. Air conditioners, power distribution cabinets, rack cabinets, and humidity sensors display information for specific measurement points. Clicking on a camera allows for real-time preview. Users can move, remove, and relocate IT equipment within racks, as well as configure network ports and fiber optic ports. Location search and configuration management are supported. In any data center layout interface, the fuzzy search function can find any asset object on the current page, including site infrastructure, IT infrastructure, and environmental monitoring equipment. Entering keywords will bring up corresponding asset tags; clicking on them will display their information. The shielded server room, infrastructure, and structural facilities can be managed in a more easily understood way, such as through graphical representations. Virtual scenarios for various application scenarios can be established, allowing the front-end to present the objects and location attributes of information in an intuitive way.

[0058] Multi-dimensional visualization: Using visualization technology to create a three-dimensional virtual environment that is completely consistent with the actual data center environment, the campus environment, data center buildings, computer room layout, and equipment placement can be presented in a three-dimensional scene. Any information can be expressed using visualization technology.

[0059] Example 2 In this embodiment, a data center security management platform operates the following method steps based on the above architecture, including: Step S1: The platform uniformly connects to heterogeneous devices to perform real-time data acquisition and preprocessing.

[0060] In this embodiment, the specific implementation process includes: a) Real-time data collection from multiple heterogeneous devices is performed using edge gateways, and a protocol semantic knowledge graph is constructed in the edge smart gateway, covering 15 protocols such as SNMP, Modbus, and OPC. Protocol features are automatically learned through the Node2Vec graph embedding algorithm to generate protocol conversion rules.

[0061] For example, real-time data collection from multiple heterogeneous devices is performed via an edge gateway, and for each protocol, key features are extracted by collecting its protocol specification documents: Data model (such as object identifier OID, register address, variable name); Communication modes (request / response, publish / subscribe); Data format (data type, encoding method); Security mechanisms (authentication, encryption); These features are further transformed into structured representations, such as using RDF triples (subject, predicate, object). A graph database (such as Neo4j) is used to store protocol knowledge, where each node represents a protocol concept (e.g., protocol, data point, command), and edges represent relations (e.g., "contains," "equivalent to," "conversion rule"). A knowledge graph is constructed, that is, a subgraph is built for each protocol, describing the structure of its data points and commands. The Node2Vec algorithm is then used to learn node embeddings, mapping nodes to low-dimensional vectors. Node2Vec is a graph embedding method based on random walks that can capture the structural similarity of nodes. Specifically, it involves performing random walks on the knowledge graph to generate node sequences, using a Skip-gram model (similar to Word2Vec) to learn node embeddings, and calculating the similarity between nodes using the embedding vectors, thereby discovering similar data points in different protocols. Clustering algorithms (such as K-means) based on embedded vectors are used to group similar nodes together to form equivalence classes. For each equivalence class, transformation rules are generated manually or automatically (through templates). For example, the node with Modbus register address 40001 and the node with SNMP OID 1.3.6.1.4.1.2021.10.1.3.1 are mapped to a unified semantic model (such as "temperature sensor 1").

[0062] b) The adaptive protocol conversion engine converts data from different protocols into a unified semantic model (JSON format) based on the rules generated by the knowledge graph, with a conversion latency of <50ms.

[0063] For example, when the edge gateway starts, it loads transformation rules from the knowledge graph service into memory for fast lookup. The gateway listens to network data, parses data packets according to the configured protocol type (such as Modbus TCP, SNMP UDP), extracts data point identifiers (such as Modbus register address, SNMP OID) and values, and looks up the corresponding semantic model key value in the rule table according to the data point identifier. The rule table structure is similar to: the key is the protocol type + identifier (such as "modbus:40001"), and the value is the key in the semantic model (such as "temperature_sensor_1"). Finally, the values ​​are converted according to the data type (such as float, int) defined in the semantic model, encapsulated into JSON format, and stored in a hash table to ensure O(1) lookup time. At the same time, zero-copy technology is used to reduce memory copying, and JSON objects are pre-allocated using a memory pool.

[0064] c) The edge gateway supports a hybrid ARM / x86 architecture, enabling plug-and-play functionality. Furthermore, new protocol adapters can be dynamically loaded via a pluggable protocol library.

[0065] For example, when a device using the BACnet protocol is connected, the operations and maintenance team uploads the BACnet protocol plugin (bacnet.so) to the gateway's plugin directory. The gateway then rescans for plugins and loads bacnet.so. When a BACnet data packet is received, the BACnet plugin identifies and parses the data, and then converts it into a unified semantic model through the protocol conversion engine.

[0066] d) The collected data undergoes preliminary cleaning and aggregation at the edge gateway (e.g., removing invalid and duplicate data, and performing simple statistics), with a processing capacity of >100,000 points / second, and is then compressed before being uploaded to the platform layer.

[0067] For example, invalid data can be removed through data purification, such as checking whether values ​​are within a reasonable range (e.g., temperature between -50 and 100 degrees Celsius). Continuous data points are compared; if values ​​remain unchanged and the time interval is short, duplicate data is discarded. Simultaneously, statistical methods (such as Z-score) or machine learning models are used to detect outliers, which are then marked or discarded. High-frequency data is downsampled. For example, the average of every 10 data points is taken, and one point is uploaded per minute. Sliding window aggregation is used, with the window size adjustable according to data characteristics. Lossless compression algorithms (such as LZ4) are used to compress the data overall, reducing transmission bandwidth. Finally, multi-threaded or asynchronous I / O is used to process the data stream. Lock-free queues are designed to reduce thread contention.

[0068] e) Data is uploaded to the platform-level message queue (Kafka) using the MQTT protocol (based on a domestically developed encryption algorithm) to ensure the security and reliability of data transmission. When the edge gateway publishes JSON-formatted data to the topic "data / device001" via MQTT, the MQTT broker receives the message and writes it to the "raw-data" topic in Kafka. The platform-level stream processing program (such as Flink) then consumes the data from Kafka for real-time processing.

[0069] Step S2: Real-time fusion, alignment, deduplication, and aggregation of heterogeneous data from different edge gateways, and storage in time-series databases and relational databases.

[0070] In this embodiment, the specific implementation process includes: a) Deploy an Apache Flink cluster at the platform layer as a streaming computing engine. Flink consumes data from Kafka's "raw-data" topics, which are JSON-formatted data uploaded by the edge gateway that has undergone preliminary cleaning and transformation.

[0071] b) A time window alignment algorithm (based on a sliding window with a window size of 200ms) is used to align the time series of multi-source data to solve the problem of time series inconsistency caused by different acquisition frequencies.

[0072] For example, since different devices have different data acquisition frequencies, this invention needs to align data within the same time window for correlation analysis. This is achieved by using a sliding window based on event time, with a window size of 200ms and a sliding step size that can be set to 100ms (overlapping window) or 200ms (non-overlapping window) as needed. Each data stream is assigned an event timestamp (using the timestamp field in the data) and a watermark to handle out-of-order events. In this embodiment, a certain degree of out-of-order is allowed, with a maximum out-of-order time set to 50ms. Data is grouped by device ID and metric type using KeyBy, and then a window (sliding window) is opened. Within the window, the data is sorted (by timestamp), and then a linear interpolation method is used to fill in missing data at each time point. If a device has no data at a certain moment within the window, but other devices do, the value of that device at that moment is estimated through interpolation.

[0073] c) Utilize Flink's state management and event-driven processing mechanisms to achieve data deduplication, association, and aggregation.

[0074] For example, Flink's keyed state is used to record the unique identifier of recently processed data (e.g., gateway ID + device ID + timestamp), and duplicates are discarded. Data from different metrics within the same time window are then correlated to form a complete record. For instance, temperature, humidity, and power consumption data for the same server rack are correlated to form a server rack environment record. Finally, the data within the window is aggregated and calculated, for example, to calculate the average, highest, and lowest temperatures for each server rack over a 5-minute period.

[0075] d) The processed data is written to the time-series database TDengine, which uses columnar storage and adaptive compression algorithms, improving data storage efficiency by 60% and supporting real-time concurrent queries for 150,000+ monitoring points.

[0076] For example, TDengine is a high-performance time-series database that uses columnar storage and adaptive compression algorithms. By writing the data processed by Flink into TDengine, each device or metric corresponds to a sub-table, and tags record information such as the device's location and type.

[0077] e) Synchronize the processed data to a relational database and a knowledge graph database (Neo4j) for business queries and correlation analysis. The relational database stores business-related data, such as device information, alarm records, and maintenance work orders. Key information from the processed data (such as aggregated metrics) is written to the DM database for business queries and report generation. The knowledge graph database (Neo4j) stores the relationships between devices, fault propagation paths, etc. Data processed by Flink is used to update the real-time status of devices in the knowledge graph, and when a fault occurs, the fault event and its impact scope are recorded.

[0078] Step S3: Utilize large language models, knowledge graphs, and reinforcement learning to achieve fault prediction, root cause analysis, and automated operation and maintenance.

[0079] In this embodiment, the specific implementation process includes: a) Deploy a fault prediction engine based on the GLM-130B large language model at the platform layer. This engine is fine-tuned using the LoRA method on the data center operation and maintenance corpus, enabling it to understand the professional terminology and context of the data center operation and maintenance field.

[0080] For example, the GLM-130B is used as the base model, fine-tuned on a corpus of data center operations and maintenance (A&M) data. The fine-tuning employs the LoRA (Low-Rank Adaptation) method, which inserts a low-rank matrix into the original model and trains only these newly added parameters, significantly reducing training costs. The fine-tuning corpus includes data center A&M manuals, historical fault records, equipment logs, expert experience, etc. These text data are used to construct question-answer pairs or sequence prediction tasks to train the model to understand the context of data center A&M. For instance, given a natural language input describing the current equipment status and recent events, the base model outputs the types of faults that may occur in the future and their probabilities.

[0081] b) Combine knowledge graphs (using graph neural networks GCN) for root cause analysis.

[0082] For example, the knowledge graph contains entities (devices, ports, services, etc.) and relationships (connections, dependencies, memberships, etc.) extracted from device configuration libraries, network topology diagrams, and historical failure cases. When an alarm occurs, the alarming device is used as the starting point to extract a subgraph within its k hops in the knowledge graph. Then, a Graph Convolutional Network (GCN) is used to classify the nodes in the subgraph to identify the root cause node leading to the alarm. For instance, when server node A alarms (overheating), in the knowledge graph, node A is connected to air conditioner node B and rack node C. Through GCN analysis, it is found that air conditioner B has the highest failure probability, therefore the root cause may be air conditioner node B.

[0083] c) Use reinforcement learning PPO algorithm to train automated operation and maintenance strategies.

[0084] For example, operational decisions can be modeled as Markov Decision Processes (MDPs): State: The current status of all devices, alarm information, resource usage, etc.

[0085] Action: Executes a specific maintenance operation, such as restarting equipment, adjusting air conditioning temperature, or switching power supplies.

[0086] Reward: Calculated based on factors such as fault recovery time, resource consumption, and operating costs.

[0087] A policy network is trained using the reinforcement learning PPO algorithm. This network outputs a probability distribution of actions based on the current state. Historical maintenance records are used as initial training data, and the policy is continuously optimized through reinforcement learning training in a simulated environment. When the trained policy detects that the temperature of a certain cabinet is consistently too high, it will automatically adjust the air conditioning set temperature and notify the inspection robot to conduct an inspection.

[0088] d) The fault prediction engine analyzes data obtained from Flink and TDengine in real time, combines it with historical fault cases, predicts possible faults, and generates early warnings.

[0089] For example, the fault prediction engine consumes data processed by Flink in real time (or queries recent data directly from TDengine), combines it with historical fault cases, and performs fault prediction. The prediction results include: the possible fault, the time range of the fault occurrence, and the confidence level. By continuously collecting actual fault and false alarm data, the model parameters are adjusted to improve alarm accuracy and reduce the false alarm rate. For instance, if the fault prediction engine analyzes that the internal resistance of a UPS battery has increased by 10% in the past 24 hours, and combines it with historical data, it predicts that the probability of the battery failing within the next week is 85%, thus generating a warning to replace the battery.

[0090] e) Intelligent decision-making results are sent to the collaborative orchestration layer and the operations and maintenance management system via message queues. Intelligent decision-making results (including fault prediction, root cause analysis results, and automated operations and maintenance strategy suggestions) are sent to the collaborative orchestration layer and the operations and maintenance management system via message queues (such as Kafka). The collaborative orchestration layer executes specific operations based on the decision results, while the operations and maintenance management system generates work orders and notifies operations and maintenance personnel.

[0091] Step S4: When a fault or warning occurs, based on digital twins and knowledge graphs, a collaborative response is achieved across multiple subsystems (such as air conditioning, power supply, network, security, etc.), and maintenance operations are automatically executed.

[0092] In this embodiment, the specific implementation process includes: a) Construct device association models based on digital twins and knowledge graphs.

[0093] For example, in a digital twin scenario, a geometric model of the data center is constructed using 3D scanning and BIM data, and a 3D model is created for each device. Physical attributes (such as size, weight, power, heat dissipation, etc.) and logical attributes (such as IP address, system affiliation, function, etc.) are defined for each device. In the digital twin environment, the device's status (such as temperature, power consumption, operating status) is synchronized with the actual device in real time. In the knowledge graph, devices are treated as nodes, and relationships between nodes are represented by edges. Relationship types include: Physical connections: such as power cord connections, network cable connections, and refrigerant pipe connections.

[0094] Logical dependencies: such as servers depending on the power supply and cooling of the rack they are in, and applications depending on servers and networks.

[0095] Spatial relationship: such as the equipment being located in a cabinet, and the cabinet being located in a room.

[0096] The device status nodes are updated through real-time data streams, and the fault propagation relationships between devices are learned through historical fault data, and the association model is updated. When the data center layout or device connection changes, the digital graph and knowledge graph are updated manually or automatically (such as through network topology discovery).

[0097] b) When a fault or warning occurs, the collaborative orchestration layer automatically generates a collaborative control strategy based on the device association model.

[0098] For example, fault prediction or real-time alarm events are received from the intelligent decision-making layer, including event type, affected device, severity, and confidence level. Starting from the alarm device, the knowledge graph is traversed along relational edges to analyze potentially affected devices. For instance, a faulty air conditioner might cause the temperature of multiple server racks to rise. Finally, based on the device association model and predefined strategy templates, a collaborative control strategy is generated. The strategy templates include: Redundant equipment switching: If the main air conditioner fails, start the backup air conditioner.

[0099] Load balancing: such as migrating the load from a faulty server to other servers.

[0100] Environmental adjustments: such as adjusting the airflow direction and temperature of adjacent air conditioners to alleviate local overheating.

[0101] Resource reservation: Reserve resources for potentially affected business operations.

[0102] The strategy generation takes into account multi-objective optimization, including minimizing impact, minimizing energy consumption, and minimizing operating costs. The strategy execution is simulated in a digital twin environment to predict the effect after execution and verify the effectiveness and security of the strategy. If the simulation results do not meet the requirements, the strategy is adjusted.

[0103] c) Send collaborative control commands to devices through the edge gateway.

[0104] For example, the policy is decomposed into a specific sequence of control commands, and the order and timing of command issuance are determined. These commands are then sent to the corresponding devices via an edge gateway. The edge gateway is responsible for protocol conversion, transforming the unified commands into a protocol recognizable by the devices, and monitoring the command execution status to ensure the devices act according to the commands. If a device does not respond or execution fails, a retry or backup plan is triggered. Through real-time communication links (such as MQTT) and rapid protocol conversion by the edge gateway, the total time from policy generation to device response is ensured to be less than 500ms.

[0105] d) The operation and maintenance management system receives work orders generated by the intelligent decision-making layer, automatically dispatches them to relevant personnel or robots, tracks the entire work order processing process, and links with the asset management system to update equipment status.

[0106] For example, for maintenance operations requiring manual intervention, work orders are automatically generated, including fault descriptions, handling steps, required tools, and spare parts. Based on the work order type, urgency, and maintenance personnel's skills, the work order is automatically dispatched to appropriate personnel or robots. Maintenance personnel receive work orders via mobile devices and update the work order status in real time (e.g., accepted, processing, completed), tracking the work order processing progress and recording the timestamps of each step. Upon completion of the work order, the equipment status and maintenance records in the asset management system are automatically updated.

[0107] e) Push work orders and processing instructions via mobile devices to support on-site inspections and maintenance.

[0108] For example, alarms and work order notifications can be pushed to maintenance personnel via mobile devices. Maintenance personnel can then view device details, historical maintenance records, and handling steps on their mobile devices, and remotely control the device (e.g., restart it). Furthermore, by incorporating AR technology, maintenance personnel can see overlaid information about the device (e.g., temperature, alarms) through their mobile phones or AR glasses, and perform maintenance operations according to AR guidance.

[0109] Step S5: Through a multi-dimensional visualization interface, the real-time status of the entire data center link is displayed, from device access to intelligent decision-making, and historical data query and analysis functions are provided.

[0110] In this embodiment, the specific implementation process includes: a) Construct a 3D digital twin scene and achieve high-fidelity visualization using UE4 / WebGL technology.

[0111] For example, a 3D scene is built using UE4 or WebGL, with the model replicating the real data center 1:1, including the data center layout, racks, equipment, and cabling. Device status data is retrieved in real time from databases such as TDengine, driving updates to the device status in the 3D scene (such as color changes and animations).

[0112] The visualization effects include: Temperature cloud map: In the 3D model of the computer room, the temperature distribution is displayed using color gradients.

[0113] Capacity visualization: Different colors are used to display the rack's U-slot usage and power consumption.

[0114] Airflow simulation: Displays the airflow of the air conditioner's supply and return air, helping to analyze thermal management.

[0115] b) The large-screen display system integrates 2D charts and 3D scenes to show the overall status of the data center, including PUE, energy consumption, alarm statistics, work order statistics, capacity utilization, etc.

[0116] c) End-to-end monitoring: From device access, data transmission, processing to decision-making and control, each link has monitoring indicators, which are displayed visually. For example, data stream latency, processing throughput, and model prediction accuracy can be displayed.

[0117] d) Provides historical data query and analysis functions. Users can click on the device in the digital twin scenario to view historical curves, or use natural language queries (through a large language model) to obtain statistical analysis results.

[0118] e) The mobile app supports functions such as receiving inspection tasks, viewing equipment information, querying the knowledge base, and processing work orders, enabling mobile operation and maintenance.

[0119] For example, maintenance personnel access the large-screen display system and see a 3D model of the entire data center, with colors showing the current temperature distribution. They notice a localized area that appears reddish (indicating higher temperatures). Clicking on a cabinet in that area brings up a pop-up window displaying the cabinet's real-time temperature, power consumption, and historical temperature curves. Switching to the end-to-end monitoring view reveals high latency in data acquisition from the edge gateway in the area where the cabinet is located. Further investigation reveals an anomaly in the protocol conversion of the air conditioning equipment connected to that gateway. A natural language query for "Air conditioning failure status in data center A over the past day" returns air conditioning failure statistics and a list. A work order for inspecting the air conditioner is received on a mobile device. Maintenance personnel arrive on-site, use AR glasses to view the internal parameters of the air conditioner, find a clogged filter, and clean it. After cleaning, the air conditioner returns to normal, the color of that area on the large screen gradually turns green, and the edge gateway metrics in the end-to-end monitoring also return to normal.

[0120] It should be noted that, in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0121] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A machine room security management platform, characterized in that: Comprise a cloud edge end collaborative architecture composed of edge layer, platform layer, application layer, the platform based on cloud edge end collaborative architecture runs the following steps: Step S1: The platform uniformly accesses heterogeneous devices, and performs real-time data collection and preprocessing; Step S2: Real-time fusion, alignment, deduplication, aggregation of heterogeneous data from different edge gateways, and storage into time series database and relational database; Step S3: Use large language model, knowledge graph and reinforcement learning to realize fault prediction, root cause analysis and automatic operation and maintenance; Step S4: When a fault or warning occurs, based on digital twinning and knowledge graph, cross-system collaborative response is carried out, and automatic operation and maintenance is performed; Step S5: Through multi-dimensional visual interface, real-time display of machine room full link state, synchronous provision of historical data query and analysis function.

2. The machine room security management platform of claim 1, wherein: In the cloud edge end collaborative architecture: Edge layer: edge intelligent gateway deployed in the machine room site, used for device access, protocol conversion, data preprocessing and edge intelligent analysis; Platform layer: micro-service cluster deployed on the cloud platform, used for data processing, intelligent decision-making, digital twinning, operation and maintenance; Application layer: provides Web management terminal, large screen decision center, mobile terminal operation and maintenance APP application, used for 3D digital twinning visualization, operation and maintenance, decision support.

3. The machine room security management platform of claim 2, wherein: The running process of the edge layer includes: Adopting a dual-mode protocol recognition engine to match based on rule templates; Based on a lightweight neural network for fuzzy recognition; Through the protocol feature library dynamic update mechanism, automatically synchronize new protocol feature vectors from the cloud; Then use the gateway to actively detect the device to select the protocol intelligently, realize protocol adaptive negotiation; Adopting time series data flow window algorithm, define dynamic window size, real-time adjust aggregation window; Synchronize the mixed detection algorithm of isolation forest and local anomaly factor based on edge anomaly detection model, conduct model quantization deployment, the local model synchronizes with the cloud model through federated learning, realize the enhancement of edge computing; Finally, integrate SM2 / SM3 / SM4 algorithm to realize end-to-end encryption of data, the key is replaced every hour, adopt device fingerprint and dynamic token double-factor device identity trusted authentication, generate unique digital identity certificate when the device accesses, carry out zero trust device access control, automatically isolate abnormal devices.

4. The machine room security management platform of claim 3, wherein: The running process of the platform layer includes: Through the intelligent data processing engine to enhance the data; Adaptive load balancing algorithm optimization; Construct the associated knowledge graph and multi-level causal discovery model of the device; Build a physical-virtual precise mapping model based on digital twinning agent; Based on neural differential equation for device degradation prediction; Adopting reinforcement learning method, model the machine room energy efficiency optimization problem as a Markov decision process, carry out fault propagation simulation, adjust control strategy.

5. The machine room security management platform of claim 4, wherein: The running process of the application layer includes: Carry out comprehensive data statistics; Visualize the machine room layout to realize positioning search and configuration management; Use visualization technology to establish a three-dimensional virtual environment completely consistent with the actual data center environment, multi-dimensional visualization.

6. The machine room security management platform of claim 5, wherein: The implementation of step S1 includes: Real-time collection of multi-heterogeneous device data is performed by using an edge gateway, and a protocol semantic knowledge graph is constructed in the edge intelligent gateway. Protocol features are automatically learned by using a Node2Vec graph embedding algorithm, and protocol conversion rules are generated. An adaptive protocol conversion engine converts data of different protocols into a unified semantic model according to the rules generated by the knowledge graph. The edge gateway dynamically loads new protocol adapters through a plug-in protocol library to identify, analyze and convert data. The collected and converted data is preprocessed, including preliminary cleaning and aggregation, and the preprocessed data is compressed and uploaded to the platform layer.

7. The machine room security management platform of claim 6, wherein: The implementation of step S2 includes: An Apache Flink cluster is deployed in the platform layer. A time window alignment algorithm is used to align multi-source data in time sequence. The state management and event time processing mechanism of Flink are used to further de-duplicate, correlate and aggregate data. The processed data is written into a time series database TDengine, and each device or index corresponds to a sub-table, and the label records the location and type information of the device. The processed data is synchronized and written into a relational database and a knowledge graph database for business query and correlation analysis.

8. The machine room security management platform of claim 7, wherein: The implementation of step S3 includes: A fault prediction engine based on a GLM-130B large language model is used, and a LoRA method is used to fine-tune the machine room operation corpus. The fine-tuned corpus text is constructed into a question and answer pair or a sequence prediction task, and the model is trained to understand the context of the machine room operation. Root cause analysis is performed using a graph neural network GCN in combination with the knowledge graph. An automated operation strategy is trained using a reinforcement learning PPO algorithm. The fault prediction engine analyzes the data obtained from Flink and TDengine in real time, combines historical fault cases, predicts possible faults, and generates an early warning. Intelligent decision results including fault prediction, root cause analysis results, and automated operation strategy suggestions are sent to the collaborative scheduling layer and the operation management terminal through a message queue. The collaborative scheduling layer performs specific operations according to the decision results, and the operation management terminal generates an operation work order and notifies the operation personnel.

9. The machine room security management platform of claim 8, wherein: The implementation of step S4 includes: A device correlation model is constructed based on digital twinning and knowledge graph. When a fault or warning occurs, the collaborative scheduling layer automatically generates a collaborative control strategy based on the device correlation model. The collaborative control instructions are sent to the corresponding terminal through the edge gateway. The corresponding terminal automatically distributes the collaborative control instructions to the execution device, and tracks the operation of the execution device throughout the process, updates the device state and maintenance record. Work orders and processing instructions are pushed through the mobile terminal for on-site inspection and maintenance.

10. The machine room security management platform of claim 9, wherein: The implementation of step S5 includes: A 3D digital twinning scene is constructed for visualization. 2D charts and 3D scenes are integrated to show the overall situation of the machine room. Full-link monitoring is performed. Historical data query is implemented based on the digital twinning scene to obtain statistical analysis results. Mobile operation and maintenance of multiple tasks are performed through the mobile terminal.

Images