Enterprise-oriented information technology operation and maintenance intelligent analysis method and system

Abstract

The invention relates to the technical field of machine learning, in particular to an enterprise-oriented information technology operation and maintenance intelligent analysis method and system, and the method comprises the following steps: obtaining asset, network, power supply and service deployment data to construct a knowledge graph, extracting associated entity data to generate a feature matrix when an application response is overtime, searching and screening candidate root cause paths through depth first, and obtaining a candidate root cause path; and selecting the highest reward terminal node according to the voltage fluctuation reward value by using a Q learning algorithm, and generating a root cause positioning identifier. According to the method, the dependency relationship of the IT system is mastered by constructing a multi-source heterogeneous knowledge graph, when the application is abnormal, the state of an associated node is extracted to form a snapshot, entity paths are traversed by utilizing depth-first search, the abnormality is evaluated, a fault propagation chain is screened, and finally, a Q learning algorithm is utilized to carry out data feedback. And the root cause node with the maximum accumulative influence is accurately positioned from the candidate chain, and rapid and accurate fault root positioning is realized.

Description

Technical Field

[0001] This invention relates to the field of machine learning technology, and in particular to intelligent analysis methods and systems for enterprise information technology operations and maintenance. Background Technology

[0002] Machine learning is a core subset of artificial intelligence. Its main task is to guide computers to learn from data, using algorithms to analyze data, discover patterns and correlations, and make decisions or predictions based on the analysis results, without explicit programming. The core elements of this field include data, algorithms, and models, systematically encompassing various learning paradigms. These primarily include supervised learning, which uses labeled training data to train models for classification or regression tasks; unsupervised learning, which searches for structures or patterns in unlabeled data; and reinforcement learning, which learns optimal strategies through trial and error with the environment. Traditional intelligent analysis methods and systems for enterprise IT operations refer to the technical means of processing and analyzing the massive and heterogeneous operational data generated during the operation of enterprise IT systems. Traditional solutions typically rely on manual operation by operations personnel or pre-set simple scripts. Specifically, this involves monitoring performance indicators such as CPU utilization and memory usage by setting fixed static numerical thresholds, generating alarms once the indicators exceed the thresholds, or using keyword matching and regular expressions to search for specific error messages and event codes in log files generated by servers, network devices, and applications to discover system anomalies and potential faults.

[0003] Traditional IT operations and maintenance analysis heavily relies on fixed static numerical thresholds and keyword matching methods. This approach is poorly adaptable to dynamically changing system loads, making it difficult to accurately reflect the true health status of the system. It is prone to causing a large number of false alarms or missing important faults. At the same time, log analysis based on keyword search can only identify predefined known error patterns and is helpless against unknown or complex anomalies. More importantly, such methods treat each operation and maintenance monitoring object as an independent data source, ignoring the intricate topological relationships and dependencies between application services, hardware devices, and network facilities. This leads to a one-sided perspective on fault analysis, making it impossible to effectively trace the fault propagation path and quickly and accurately locate the root cause of the problem, which seriously affects the efficiency and accuracy of operation and maintenance decisions. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing an intelligent analysis method and system for enterprise information technology operation and maintenance.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: an intelligent analysis method for enterprise information technology operation and maintenance, comprising the following steps: S1: Obtain data center asset configuration information, server network cabling table, power connection table, and service deployment list, and construct a multi-source heterogeneous knowledge graph based on the data center asset configuration information, server network cabling table, power connection table, and service deployment list; S2: Determine whether the response time of the application node in the multi-source heterogeneous knowledge graph exceeds the baseline. If so, mark the application node as a faulty application node and extract the associated entity node set. Collect and normalize the associated entity node set data to generate a real-time state feature matrix. S3: Based on the set of associated entity nodes and the real-time state feature matrix, the multi-source heterogeneous knowledge graph is traversed using a depth-first search algorithm, the abnormality of path nodes is accumulated as a score, paths exceeding the threshold are filtered, and a candidate root cause path set is generated. S4: Based on the candidate root cause path set, define nodes as states and transitions as actions, compare the voltage fluctuation extreme value with the stability upper limit to calculate the reward value, update the Q table using the Q learning algorithm, select the terminal node with the highest cumulative reward, and generate a root cause location identifier.

[0006] As a further aspect of the present invention, the multi-source heterogeneous knowledge graph includes entity nodes and relation edges, the real-time state feature matrix includes normalized server performance indicators and normalized hardware sensor data, the candidate root cause path set specifically refers to paths whose propagation influence scores exceed a preset influence threshold, and the root cause location identifier specifically refers to the terminal node of the path with the highest cumulative reward value.

[0007] As a further aspect of the present invention, step S1 specifically comprises: S11: Parse the data center asset configuration information, the server network cabling table, the power connection table and the service deployment list, and extract asset entities containing physical location, hardware specifications, IP address and running status, as well as service entities that define the dependencies between applications, middleware and operating system; S12: Based on the inherent logical association between the asset entity and the service entity, a pre-defined relationship type between entities is set. The relationship type between entities covers four basic connection modes: deployed to, connected to, powered by, and dependent on. A corresponding semantic weight is configured for each mode to characterize the difference in the impact of different relationships during the fault propagation process. S13: Map the asset entity and the service entity to entity nodes, and map the relationship type between entities to relationship edges connecting the entity nodes, wherein the attributes of the relationship edges include the preset semantic weights, thereby structurally expressing the complex topology of the enterprise information technology infrastructure; S14: Integrate all the entity nodes and relation edges, eliminate duplicate entities and redundant relations, and construct a unified, multi-source heterogeneous knowledge graph containing multi-level IT elements and their interactions.

[0008] As a further aspect of the present invention, step S2 specifically comprises: S21: Collect the response time data of the application node within a preset historical period, calculate the mean and standard deviation of the response time using the 3-sigma principle, and set a dynamic response time baseline by combining the mean and the standard deviation. The dynamic response time baseline serves as the basis for judging whether the application performance is normal. S22: When the response time of the application node monitored in real time exceeds the dynamic response time baseline for a predetermined number of consecutive times, the application node is marked as a faulty application node, and a breadth-first traversal is performed along the relation edges in the multi-source heterogeneous knowledge graph to extract all entity nodes within a specified number of hops of the faulty application node, and a set of associated entity nodes is generated. S23: For each entity node in the set of associated entity nodes, the corresponding server CPU utilization, memory usage, disk read / write speed and other performance indicators are collected in real time through the monitoring interface, as well as hardware sensor data such as motherboard temperature, fan speed and power module voltage, to form a multi-dimensional raw state dataset. S24: Normalize the various types of data in the multi-dimensional original state dataset using the minimax method, mapping all values ​​to the interval to eliminate the differences in dimensions between different indicators, and finally integrate all normalized data to generate a real-time state feature matrix that reflects the health status of all entities within the associated range.

[0009] As a further aspect of the present invention, the process of generating the candidate root cause path set specifically includes: S31: Based on the differences in the importance of each indicator to fault judgment, set corresponding feature weights for the server performance indicators and hardware sensor data in the real-time state feature matrix, and calculate the node anomaly degree of each entity node in the associated entity node set based on the feature weights and the real-time state feature matrix. S32: Starting from the faulty application node, the multi-source heterogeneous knowledge graph is traversed using a depth-first search algorithm. During the traversal, the algorithm explores all possible fault propagation paths along the relation edges and records the sequence of all entity nodes traversed by each path. S33: During the exploration process of depth-first search, for each path that is being formed, the node anomaly degree of all traversed entity nodes on the path is accumulated in real time, and the accumulated result is defined as the propagation impact score of the path. This score quantifies the severity of the fault propagation along a specific path. S34: Compare the propagation impact score with a preset impact threshold. Only when the propagation impact score of a path exceeds the preset impact threshold is the path considered a potential propagation chain that makes a significant contribution to the fault, and it is completely stored in a set to finally generate a candidate root cause path set.

[0010] As a further aspect of the present invention, step S4 specifically comprises: S41: Initialize the Q table, define all entity nodes in the candidate root cause path set as states, and define the jumps connecting adjacent entity nodes as actions, forming state-action pairs. Assign initial zero values ​​and set hyperparameters for the Q-learning algorithm, such as learning rate and discount factor; S42: Perform multiple rounds of iterative training on each path in the candidate root cause path set. In each iteration, starting from the starting node of the path, the simulated agent selects an action to jump to the next node according to the current Q table, until the terminal node of the path. This process constitutes a complete training round. S43: After each step of each training round, calculate the reward value based on the result of comparing the extreme value of voltage fluctuation with the upper limit of stability, and update the Q value of the current state-action pair using the Bellman equation so that the Q value can reflect the expectation of the long-term cumulative reward that can be obtained by performing the corresponding action. S44: After sufficient rounds of iterative training, once the Q-table converges, starting from the initial state corresponding to the faulty application node, select the action that maximizes the Q-value at each step to perform state transition, thereby obtaining an optimal path from the application to the root cause device, and generating the terminal node of this path as the root cause location identifier.

[0011] As a further aspect of the present invention, the calculation process of the node anomaly degree specifically includes: Extract normalized server performance metrics and normalized hardware sensor data corresponding to specific entity nodes from the real-time state feature matrix to form a feature vector; For each dimension of the feature vector, based on its historical failure contribution analysis results, a fixed indicator importance weight is pre-set, and all indicator importance weights together constitute a weight vector. The feature vector and the weight vector are multiplied by a dot product to obtain a comprehensive score, which is the node anomaly degree of the entity node. The calculation formula is as follows: ; in, Representing the The node anomaly degree of each entity node. An integer index is used to identify different entity nodes in the set of associated entity nodes. The total number of representative features Representing the The importance weights of the indicators corresponding to each feature Representing the The first entity node The real-time state values ​​of each feature after normalization. This is an integer index used to identify features of different dimensions.

[0012] As a further aspect of the present invention, the calculation process of the reward value specifically includes: In each training step of the Q-learning algorithm, after the agent jumps from the current state node to the next state node, it first determines whether the next state node is a power type entity node. If the next state node is a physical node of the power supply type, the output voltage monitoring data of the node is collected in real time, and the extreme value of voltage fluctuation within a unit monitoring cycle is calculated. This extreme value reflects the stability of the power supply output. The extreme value of voltage fluctuation is compared with the preset upper limit threshold of power stability. If the extreme value of voltage fluctuation exceeds the upper limit threshold of power stability, a preset high positive reward value is assigned to the jump action; otherwise, a standard negative step penalty value is assigned. If the next state node is not a power type entity node, then regardless of its state, the standard negative step penalty value is uniformly assigned to this jump action to guide the algorithm to prioritize exploring the root cause path related to power anomalies.

[0013] As a further aspect of the present invention, the entity nodes are divided into infrastructure layer entity nodes, physical layer entity nodes, virtualization layer entity nodes, service layer entity nodes and application layer entity nodes. The physical nodes of the infrastructure layer include server racks and power distribution units; The physical layer entity nodes include servers, switches, and routers; The virtualization layer entity nodes include virtual machines and virtual switches; The service layer entity nodes include the operating system, database, and middleware; The application layer entity nodes include business applications; The specific relational edges include the power supply relation connecting infrastructure layer entity nodes and physical layer entity nodes, the physical connection relation connecting physical layer entity nodes, the bearer relation connecting physical layer entity nodes and virtualization layer entity nodes, the operation relation connecting virtualization layer entity nodes and service layer entity nodes, and the deployment relation connecting service layer entity nodes and application layer entity nodes.

[0014] An intelligent analysis system for enterprise-oriented information technology operations and maintenance, the system being used to implement the aforementioned intelligent analysis method for enterprise-oriented information technology operations and maintenance, the system comprising: The knowledge graph construction module is used to obtain data center asset configuration information, server network cabling tables, power connection tables, and service deployment lists, and to construct a multi-source heterogeneous knowledge graph based on the data center asset configuration information, server network cabling tables, power connection tables, and service deployment lists. The fault feature generation module is used to determine whether the response time of the application node in the multi-source heterogeneous knowledge graph exceeds the baseline. If it does, the application node is marked as a faulty application node and the associated entity node set is extracted. The associated entity node set data is collected and normalized to generate a real-time status feature matrix. The candidate path filtering module is used to traverse the multi-source heterogeneous knowledge graph using a depth-first search algorithm based on the set of associated entity nodes and the real-time state feature matrix, accumulate the path node anomaly scores, filter paths that exceed the threshold, and generate a candidate root cause path set. The root cause localization module is used to define nodes as states and transitions as actions based on the candidate root cause path set, calculate reward values ​​by comparing voltage fluctuation extremes with stability upper limits, update the Q table using the Q-learning algorithm, select the terminal node with the highest cumulative reward, and generate a root cause localization identifier.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, by constructing a multi-source heterogeneous knowledge graph covering asset configuration, network cabling, power connection, and service deployment, the complex dependencies between various components within an information technology system can be fully grasped. When an application malfunctions, instead of analyzing a single monitoring indicator in isolation, the real-time status data of all related entity nodes is automatically extracted to form a multi-dimensional snapshot of the fault scenario. Then, a depth-first search algorithm is used to traverse along the entity association path, comprehensively evaluate the degree of anomaly of each node on the path, and filter out possible fault propagation chains. Finally, the Q-learning algorithm is used to make decisions based on actual data feedback, accurately locating the root cause node with the greatest cumulative impact from multiple candidate chains, thus achieving rapid and accurate fault root cause localization. Attached Figure Description

[0016] Figure 1This is a flowchart of the intelligent analysis method for information technology operation and maintenance of the present invention; Figure 2 A flowchart for constructing a multi-source heterogeneous knowledge graph for this invention; Figure 3 Flowchart for generating the real-time state feature matrix for this invention; Figure 4 Flowchart for generating a set of candidate root cause paths for this invention; Figure 5 A flowchart for generating root cause localization identifiers for this invention is provided. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the software-based technical solution is described in detail below with reference to system architecture diagrams and embodiments. It should be understood that the specific embodiments described herein are only for explaining the technical solutions of this invention and do not constitute a limitation on the scope of protection.

[0018] In the description of this invention, the system architecture relationships or data processing flows indicated by terms such as "layer," "module," "interface," "data flow," "client," and "server" are all defined based on the architecture diagram or flowchart corresponding to the embodiments. This way of describing is only used to clearly illustrate the logical relationships between the elements in the technical solution, and not to limit the physical deployment form. The term "multiple" includes two or more technical units, including but not limited to multiple data nodes, processing threads, service instances, or functional components and other scalable elements. The specific number is determined according to the actual business scenario and needs to be specifically specified.

[0019] The specific operation of this embodiment begins with the structuring of the operation and maintenance data of an enterprise data center.

[0020] Please see Figure 1 and Figure 2 This invention provides a technical solution: an intelligent analysis method for enterprise information technology operation and maintenance, comprising the following steps: S1: Obtain data center asset configuration information, server network cabling tables, power connection tables, and service deployment lists, and construct a multi-source heterogeneous knowledge graph based on the data center asset configuration information, server network cabling tables, power connection tables, and service deployment lists; Multi-source heterogeneous knowledge graphs include entity nodes and relation edges; The specific steps of S1 are as follows: S11: Parse data center asset configuration information, server network cabling tables, power connection tables and service deployment lists, and extract asset entities containing physical location, hardware specifications, IP address and operating status, as well as service entities that define the dependencies between applications, middleware and operating systems. S12: Based on the inherent logical relationship between asset entities and service entities, preset the relationship types between entities. The relationship types between entities cover four basic connection modes: deployed on, connected to, powered on, and dependent on. A corresponding semantic weight is configured for each mode to characterize the difference in the impact of different relationships in the fault propagation process. S13: Map asset entities and service entities to entity nodes, and map the relationship types between entities to relationship edges connecting entity nodes. The attributes of the relationship edges include preset semantic weights, thereby structurally expressing the complex topology of the enterprise's information technology infrastructure. S14: Integrate all entity nodes and relationship edges, eliminate duplicate entities and redundant relationships, and construct a unified, multi-source heterogeneous knowledge graph containing multi-level IT elements and their interactions. Entity nodes are divided into infrastructure layer entity nodes, physical layer entity nodes, virtualization layer entity nodes, service layer entity nodes, and application layer entity nodes; Infrastructure layer physical nodes include server racks and power distribution units; Physical layer physical nodes include servers, switches, and routers; Virtualization layer entity nodes include virtual machines and virtual switches; Service layer entity nodes include operating system, database, and middleware; Application layer entity nodes include business applications; The specific relationships between the infrastructure layer entity nodes and the physical layer entity nodes include the power supply relationship, the physical connection relationship between the physical layer entity nodes, the bearer relationship between the physical layer entity nodes and the virtualization layer entity nodes, the operation relationship between the virtualization layer entity nodes and the service layer entity nodes, and the deployment relationship between the service layer entity nodes and the application layer entity nodes.

[0021] First, export the data center asset configuration information from the Configuration Management Database (CMDB). This information is stored in CSV format and includes details such as: Asset Number (SRV001), Asset Type (Server), Brand and Model (Dell PowerEdge R740), Physical Location (Rack A01, U-slots 25-27), CPU Specification (Intel Xeon Gold 6248R), Memory Capacity (128GB), and Disk Configuration (4 x 1.2TB SAS). Simultaneously, obtain the server network cabling table generated from the network management system. This table is in JSON format and records the connection relationships between ports, for example: {"source_device":"SRV001","source_port":"eth0","target_device":"SW-CORE-01","target_port":"Gi0 / 1"}. Additionally, obtain the power connection table from the power monitoring unit. This table is in XML format, as shown in the example below. <connection> <source> PDU-A01-05 <target> SRV001-PSU1< / target> < / connection> This indicates that the 5th socket of power distribution unit A in rack A01 supplies power to power module 1 of server SRV001. Finally, the service deployment manifest is exported through the Application Performance Monitoring (APM) system. This manifest is in YAML format and describes the relationship between application software and the runtime environment, for example: app:"OnlineTrading"depends_on:["middleware:Tomcat-01","db:MySQL-01"].

[0022] Next, we proceed to the data parsing and entity extraction stage (S11). For the four types of data sources obtained above, parsing operations are performed. From the asset configuration information CSV file, the physical location "Rack A01, U-slot 25-27", hardware specifications "Intel Xeon Gold 6248R, 128GB RAM", and server asset entity "SRV001" are extracted. From the network cabling table JSON, the switch asset entity "SW-CORE-01" and the IP address "192.168.1.10" of server "SRV001" are extracted. From the service deployment manifest YAML, the application entity "OnlineTrading", middleware entity "Tomcat-01", and database entity "MySQL-01" are parsed, and their dependencies are determined.

[0023] Subsequently, the relationship types between entities are preset and weighted (S12). Based on the extracted entities and their logical associations, four relationship types are preset. For example, server "SRV001" deploys virtual machine "VM-WEB-01", and this relationship is defined as "deployed on". The "eth0" port of server "SRV001" is connected to the "Gi0 / 1" port of switch "SW-CORE-01", and this relationship is defined as "connected to". Power distribution unit "PDU-A01-05" supplies power to server "SRV001", and this relationship is defined as "supplying power to". The application "OnlineTrading" depends on database "MySQL-01", and this relationship is defined as "depending on". Semantic weights are configured for these relationships to characterize their differences in impact during fault propagation. The weight settings are based on statistical analysis of root cause analysis reports of 1000 historical data center fault events, and the Fault Tree Analysis (FTA) method is used to quantify the contribution of different types of relationships to top-level fault events. The analysis results show that power outages accounted for the highest proportion of faults, reaching 45%, followed by physical network connectivity issues at 30%, service dependency issues at 15%, and the rest at 10%. Based on the statistical proportions of each type of fault, normalization was performed, setting the semantic weight of the "powered on" relationship to 0.45, the "connected to" relationship to 0.30, the "depends on" relationship to 0.15, and the "deployed on" relationship to 0.10.

[0024] Next, a graph mapping of entities and relationships is performed (S13). The asset entities “SRV001”, “SW-CORE-01”, and “PDU-A01-05” extracted in the previous steps, and the service entities “OnlineTrading”, “VM-WEB-01”, and “Tomcat-01”, are all mapped to entity nodes in the knowledge graph. Predefined relationship types are mapped to relationship edges connecting these nodes. For example, a relationship edge is created from “PDU-A01-05” to “SRV001”, with the type “Powered By” and the attribute “Weight: 0.45”. Similarly, a relationship edge is created from “SRV001” to “SW-CORE-01”, with the type “Connected To” and the attribute “Weight: 0.30”. In this way, all entities and their relationships are expressed in a structured manner.

[0025] Finally, graph integration and disambiguation are performed (S14). All mapped entity nodes and relation edges are integrated into a unified graph database. During this process, entity alignment is performed. For example, if both the asset configuration information and the power connection table mention "SRV001", the system uses the asset number as a unique identifier to merge the entity information from these two sources into a unified "SRV001" entity node, avoiding duplication. Simultaneously, redundant relationships are checked and eliminated. For instance, if the data source contains both a connection record from "SRV001" to "SW-CORE-01" and a record from "SW-CORE-01" to "SRV001", the former is retained and the latter is deleted according to network cabling specifications. After integration, a hierarchical and non-redundant multi-source heterogeneous knowledge graph was finally constructed. This graph includes infrastructure layer entity nodes (rack A01, PDU-A01-05), physical layer entity nodes (SRV001, SW-CORE-01), virtualization layer entity nodes (VM-WEB-01), service layer entity nodes (Tomcat-01, MySQL-01), and application layer entity nodes (OnlineTrading). The complex topology between them is accurately described by relational edges with semantic weights.

[0026] The aforementioned multi-source heterogeneous knowledge graph refers to a knowledge base that integrates information from different data sources (multi-source) and with different data structures (heterogeneous), and expresses entities and their relationships in a unified manner in the form of a graph structure.

[0027] Please see Figure 1 and Figure 3 S2: Determine whether the response time of the application node in the multi-source heterogeneous knowledge graph exceeds the baseline. If so, mark the application node as a faulty application node and extract the associated entity node set. Collect and normalize the associated entity node set data to generate a real-time state feature matrix. The real-time status feature matrix includes normalized server performance metrics and normalized hardware sensor data. The specific steps of S2 are as follows: S21: Collect response time data of application nodes within a preset historical period, calculate the mean and standard deviation of response time using the 3-sigma principle, and set a dynamic response time baseline based on the mean and standard deviation. The dynamic response time baseline serves as the basis for judging whether the application performance is normal. S22: When the response time of the application node monitored in real time exceeds the dynamic response time baseline for a predetermined number of consecutive times, the application node is marked as a faulty application node, and a breadth-first traversal is performed along the relation edges in the multi-source heterogeneous knowledge graph to extract all entity nodes within a specified number of hops related to the faulty application node and generate a set of associated entity nodes. S23: For each entity node in the set of associated entity nodes, the corresponding server CPU utilization, memory usage, disk read and write speed and other performance indicators are collected in real time through the monitoring interface, as well as hardware sensor data such as motherboard temperature, fan speed and power module voltage, to form a multi-dimensional raw state dataset. S24: The various types of data in the multi-dimensional original state dataset are normalized using the minimax method, mapping all values ​​to the interval to eliminate the differences in the units of measurement between different indicators. Finally, all normalized data are integrated to generate a real-time state feature matrix that reflects the health status of all entities within the associated range.

[0028] After constructing the multi-source heterogeneous knowledge graph, the real-time monitoring and fault diagnosis of application performance begins. First, a dynamic baseline for the response time of the application layer entity node "OnlineTrading" in the graph is established (S21). To this end, the average response time data per minute of "OnlineTrading" over the past 7 consecutive days is collected, resulting in 10080 data points. The arithmetic mean (mean μ) of these 10080 data points is calculated to be 120 milliseconds (ms), and the standard deviation (σ) is 8 ms. Based on the 3-sigma principle, the upper limit of the dynamic response time baseline is set to μ + 3σ, i.e., 120 + 3 * 8 = 144 ms. This baseline value of 144 ms is used as the criterion for judging whether the performance of the "OnlineTrading" application is normal.

[0029] The 3-sigma principle mentioned above means that in a normal distribution, the probability of a value falling within the interval (μ-3σ, μ+3σ) is 99.73%. Therefore, data points outside this range can be considered outliers.

[0030] Subsequently, the system continuously monitors the real-time response time of "OnlineTrading" and performs fault diagnosis (S22). At a certain moment, the monitoring system collects three consecutive response time data points of 152ms, 155ms, and 158ms. Since these three response times all exceed the dynamic response time baseline of 144ms, and the number of consecutive exceedances reaches the predetermined number "3", the system determines that the application node "OnlineTrading" has failed and marks it as a "faulty application node". Once the marking is completed, it immediately starts from the faulty application node and performs a breadth-first traversal along the relation edges in the multi-source heterogeneous knowledge graph. The traversal jump count is set to 4, that is, all entity nodes within the 4-level relation with the "OnlineTrading" node are extracted. The traversal process is as follows: The first hop finds "Tomcat-01" and "MySQL-01"; the second hop finds the virtual machine "VM-WEB-01" running within "Tomcat-01"; the third hop finds the physical server "SRV001" hosting it within "VM-WEB-01"; the fourth hop finds the power supply "PDU-A01-05" and the connected switch "SW-CORE-01" within "SRV001". All the traversed entity nodes {OnlineTrading,Tomcat-01,MySQL-01,VM-WEB-01,SRV001,PDU-A01-05,SW-CORE-01} constitute the associated entity node set.

[0031] Next, real-time status data is collected for each entity in the set of associated entity nodes (S23). Multi-dimensional raw status data is collected through the monitoring interfaces of each node. For server "SRV001", the SNMP protocol shows that its CPU utilization is 98%, memory utilization is 95%, and disk read / write speed is 800MB / s. Simultaneously, hardware sensor data is collected through the IPMI interface, showing a motherboard temperature of 85℃, fan speed of 9500RPM, and power module 1 (PSU1) input voltage of 218V. For switch "SW-CORE-01", the traffic on port "Gi0 / 1" is collected as 900Mbps, with a packet loss rate of 0.5%. For power distribution unit "PDU-A01-05", the voltage at output port 5 is collected as 217V, and the current is 2.5A. These collected raw data collectively constitute a multi-dimensional raw status dataset.

[0032] Finally, the collected multi-dimensional raw state dataset is normalized (S24), and the original data of different dimensions are mapped to intervals using the minimax method. The calculation process is as follows: ;in, This represents the normalized value. Represents the raw monitoring values ​​to be processed. and These represent the maximum and minimum values ​​of the normal operating range, respectively, set according to the equipment's technical specifications or statistical analysis of historical operating data; for example, for server CPU utilization, its... 0%, If the CPU utilization is 100%, then the normalized value of "SRV001" is... For motherboard temperature, the normal range is set to 20℃ to 90℃, then its normalized value is... After processing, all normalized data are integrated into a matrix, namely the real-time status feature matrix. Each row of this matrix represents an entity node, and each column represents a performance or status feature. The values ​​in the matrix are the normalized status values ​​of the entity on that feature. This matrix quantitatively reflects the real-time health status of all entities within the fault association range.

[0033] Please see Figure 1 and Figure 4 S3: Based on the set of associated entity nodes and the real-time state feature matrix, a depth-first search algorithm is used to traverse the multi-source heterogeneous knowledge graph, accumulate the path node anomaly scores, filter out paths that exceed the threshold, and generate a candidate root cause path set. The candidate root cause path set is specifically defined as paths whose propagation impact score exceeds a preset impact threshold; The process of generating the candidate root cause path set specifically includes: S31: Based on the differences in the importance of each indicator to fault judgment, set corresponding feature weights for the server performance indicators and hardware sensor data in the real-time state feature matrix, and calculate the node anomaly degree of each entity node in the associated entity node set based on the feature weights and the real-time state feature matrix. S32: Starting from the faulty application node, the depth-first search algorithm is used to traverse the multi-source heterogeneous knowledge graph. During the traversal, the algorithm explores all possible fault propagation paths along the relation edges and records the sequence of all entity nodes passed through each path. S33: During the exploration process of depth-first search, for each path that is being formed, the node anomaly degree of all traversed entity nodes on the path is accumulated in real time, and the accumulated result is defined as the propagation impact score of the path. This score quantifies the severity of the fault propagation along a specific path. S34: Compare the propagation impact score with the preset impact threshold. Only when the propagation impact score of a path exceeds the preset impact threshold is the path considered a potential propagation chain that makes a significant contribution to the fault, and it is completely stored in a set to generate a set of candidate root cause paths. The calculation process for node anomaly degree specifically includes: Extract normalized server performance metrics and normalized hardware sensor data corresponding to specific entity nodes from the real-time state feature matrix to form a feature vector; For each dimension of the feature vector, based on its historical failure contribution analysis results, a fixed indicator importance weight is pre-set, and all indicator importance weights together constitute a weight vector. The feature vector and weight vector are multiplied by a dot product to obtain a comprehensive score, which is the node anomaly degree of the entity node. The calculation formula is as follows: ; in, Representing the The node anomaly degree of each entity node. An integer index used to identify different entity nodes in the set of associated entity nodes. The total number of representative features Representing the The importance weights of the indicators corresponding to each feature Representing the The first entity node The real-time state values ​​of each feature after normalization. This is an integer index used to identify features of different dimensions.

[0034] After generating the real-time state feature matrix, the candidate root cause path generation stage begins. First, feature weights are assigned to each indicator in the real-time state feature matrix, and the node anomaly degree (S31) of each associated entity node is calculated. The weights are determined based on an analysis of 500 resolved fault tickets from the data center over the past two years, statistically analyzing the contribution of each performance indicator to the root cause analysis. The analysis revealed that hardware-related indicators such as power supply voltage and motherboard temperature have the strongest correlation with the final root cause, contributing 35%; followed by core performance indicators such as CPU utilization and memory utilization, contributing 30%; then network indicators such as packet loss rate and port traffic, contributing 20%; and finally, other indicators such as disk I / O, contributing 15%. Weights are allocated based on this contribution; for example, a total weight of 0.35 is assigned to hardware sensor data, and a total weight of 0.30 is assigned to server performance indicators. Specifically, for individual indicators, such as the weight of power module voltage within the hardware sensor data category... Set the weight of motherboard temperature to 0.20. Set to 0.15. This is the weight of CPU utilization within the server performance metric category. Set the weight of memory usage to 0.18. Let's set it to 0.12. These weights together form the weight vector.

[0035] Next, calculate the node anomaly degree. The formula for calculating this value is: ; in, Representing the Node anomaly degree of each entity node, integer index Used to identify different entity nodes in a set of associated entity nodes; Representing the The total number of features possessed by each entity node; Representing the The importance weight of the indicator corresponding to the feature, and the object of this weight is the feature. One feature; Representing the The first entity node The real-time state values ​​of each feature after normalization, with integer indices. Used to identify features of different dimensions; summation symbol Indicates the first All of the entity nodes The weighted values ​​of each feature are accumulated.

[0036] Taking server "SRV001" as an example, its associated features include CPU utilization, memory usage, motherboard temperature, and power module voltage. Assuming the total number of its features... The value is 4. Its normalized eigenvector is... The corresponding weight vector is Then the node anomaly degree of "SRV001" is... The calculation process is as follows: ; ; Using the same calculation method, the anomaly degree of all other nodes in the associated entity node set is calculated, for example, the node anomaly degree of distribution unit "PDU-A01-05". The node anomaly score for switch "SW-CORE-01" is 0.75. It is 0.21.

[0037] Subsequently, starting from the "faulty application node" and "OnlineTrading", a depth-first search algorithm is used to traverse the multi-source heterogeneous knowledge graph (S32). The algorithm explores downstream along the relationship edges until there are no deeper nodes or the preset search depth is reached, recording all paths from the starting point to the ending point. For example, the search finds path P1: OnlineTrading->Tomcat-01->VM-WEB-01->SRV001->PDU-A01-05, and path P2: OnlineTrading->Tomcat-01->VM-WEB-01->SRV001->SW-CORE-01.

[0038] During the search process, the node anomaly degree of all traversed nodes on each path is accumulated in real time to obtain the propagation impact score of the path (S33). For path P1, its propagation impact score is... Assuming the calculated outliers for each node are 0.1, 0.15, 0.2, 0.59849, and 0.75, then... For path P2, its propagation impact score is... Assuming the calculated outliers for each node are 0.1, 0.15, 0.2, 0.59849, and 0.21, then... .

[0039] Finally, the calculated propagation impact score is compared with a preset impact threshold to filter paths (S34). This impact threshold is set by back-analyzing 100 known fault scenarios with clear root causes, calculating the propagation impact score of the true root cause path, sorting these scores from smallest to largest, and taking the 10th percentile as the threshold. This ensures that the threshold can filter out most noise paths while retaining the true fault paths. Assume the impact threshold calculated using this method is 1.5. Comparison path P1: Comparison path P2: Therefore, path P1 is identified as a candidate root cause path and added to the candidate root cause path set. Path P2 is discarded. Ultimately, the generated candidate root cause path set includes path P1, and this set is passed to the next step for precise localization.

[0040] Please see Figure 1 and Figure 5 S4: Based on the candidate root cause path set, define nodes as states and transitions as actions, compare the extreme values ​​of voltage fluctuations with the upper limit of stability to calculate the reward value, update the Q table using the Q learning algorithm, select the terminal node with the highest cumulative reward, and generate a root cause location identifier; Root cause identification specifically refers to the terminal node of the path with the highest cumulative reward value; The specific steps for S4 are as follows: S41: Initialize the Q table, define all entity nodes in the candidate root cause path set as states, and define the jumps connecting adjacent entity nodes as actions, forming state-action pairs. Assign initial zero values ​​and set hyperparameters for the Q-learning algorithm, such as learning rate and discount factor; S42: Perform multiple rounds of iterative training for each path in the candidate root cause path set. In each iteration, starting from the starting node of the path, the simulated agent selects an action based on the current Q-table to jump to the next node until the terminal node of the path. This process constitutes a complete training round. S43: After each step in each training round, calculate the reward value based on the comparison between the extreme value of voltage fluctuation and the upper limit of stability, and update the Q value of the current state-action pair using the Bellman equation so that the Q value can reflect the expected long-term cumulative reward that can be obtained by performing the corresponding action. S44: After sufficient rounds of iterative training, once the Q-table converges, starting from the initial state corresponding to the faulty application node, select the action that maximizes the Q value at each step to perform state transition, thereby obtaining an optimal path from the application to the root cause device, and generating the terminal node of this path as the root cause location identifier. The calculation process for the reward value specifically includes: In each training step of the Q-learning algorithm, after the agent jumps from the current state node to the next state node, it first determines whether the next state node is a power type entity node. If the next state node is a power supply type physical node, the output voltage monitoring data of that node is collected in real time, and the extreme value of voltage fluctuation within a unit monitoring cycle is calculated. This extreme value reflects the stability of the power supply output. The extreme voltage fluctuation is compared with the preset upper limit threshold of power stability. If the extreme voltage fluctuation exceeds the upper limit threshold of power stability, a preset high positive reward value is assigned to the jump action; otherwise, a standard negative step penalty value is assigned. If the next state node is not a power type entity node, then regardless of its state, a standard negative step penalty value will be uniformly assigned to this jump action, thereby guiding the algorithm to prioritize exploring the root cause path related to power anomalies.

[0041] After obtaining the candidate root cause path set, the Q-learning algorithm is used to analyze the paths to generate the final root cause localization identifier. First, the Q-learning environment is initialized (S41). All entity nodes in the candidate root cause path set (containing path P1: OnlineTrading->Tomcat-01->VM-WEB-01->SRV001->PDU-A01-05) are defined as states, and the behavior of jumping from one node to an adjacent node is defined as an action. A Q table is created, with rows representing states and columns representing actions, to store the values ​​of state-action pairs. The Q table is initially filled with all values ​​of 0.

[0042] Table 1 shows an example of Q. ; Table 1 shows the initial structure of the Q-table. The hyperparameters of the Q-learning algorithm are also set. The learning rate α is set to 0.1, and the discount factor γ is set to 0.9. The learning rate α of 0.1 is the optimal value selected from [0.01, 0.1, 0.5, 0.9] through grid search in 100 offline training experiments, achieving the best balance between convergence speed and stability. The discount factor γ of 0.9 indicates that the algorithm highly values ​​future long-term rewards when making decisions, which is crucial for finding the root causes at the end of multi-step paths.

[0043] Next, iterative training (S42) is performed on each path in the candidate root cause path set. Taking path P1 as an example, an agent is simulated to start from the initial state "OnlineTrading", select actions according to the ε-greedy policy and based on the current Q-table, and jump step by step to the terminal node "PDU-A01-05" of the path. The ε-greedy policy randomly selects actions for exploration with a probability of 0.1 and selects the action with the largest Q value in the current state for utilization with a probability of 0.9. Each complete traversal from the starting point to the ending point constitutes a training round. A total of 2000 training rounds are executed to ensure that the Q-table converges fully.

[0044] After each step in each training round, the reward value is calculated and the Q table is updated (S43). The calculation logic for the reward value is as follows: When the agent jumps from the current state node to the next state node, it first determines the type of the next state node. If the next state node is a power supply type entity node, such as "PDU-A01-05" here, the voltage monitoring data of the output port 5 of the node is immediately collected in real time through the monitoring interface, collecting 10 voltage readings within one unit monitoring cycle (1 second): [217.1,216.9,217.2,216.5,217.3,217.0,216.8,216.6,217.1,216.7] (unit: V). The extreme value of voltage fluctuation within this cycle is calculated, i.e., maximum value - minimum value = 217.3 - 216.5 = 0.8V. This extreme value of fluctuation is compared with the preset power supply stability upper limit threshold. This threshold is set based on the voltage stability (±5%) specified in the equipment manual and the voltage fluctuation data of 100 identical PDUs in the data center under normal operating conditions for 24 consecutive hours (99.9% of the fluctuations are less than 0.5V). Its value is 0.5V. Because... This indicates abnormal voltage fluctuations, so a high positive reward value of +100 is assigned to the action of jumping from "SRV001" to "PDU-A01-05". If the next state node is not a power supply type, such as jumping from "VM-WEB-01" to "SRV001", a standard negative step penalty value of -1 is uniformly assigned. The Q value of the current state-action pair is updated using the Bellman equation, and the update formula is: ; in, Represents the state Next action The current Q value, Represents the next state Execute all possible actions The corresponding Q value, This represents the learning rate, which controls the step size for each update. Represents the execution of actions The instant reward value obtained afterwards This represents a discount factor, which adjusts the perceived importance of future rewards. Represents the execution of actions The next state to enter Represents the next state Select the Q value corresponding to the action that produces the maximum Q value.

[0045] Taking a particular update as an example, the current state For "SRV001", the action is... (Jump to "PDU-A01-05"), Reward +100, next state The value is "PDU-A01-05". Let's assume this is the case. The value is 0, currently. If the value is 50.0, then the new Q value is: .

[0046] After 2000 rounds of iterative training, the values ​​in the Q-table stabilize, and training is complete (S44). At this point, starting from the initial state corresponding to the faulty application node "OnlineTrading," the action that maximizes the Q-value is selected for state transition at each step. Since the jump action from "SRV001" to "PDU-A01-05" consistently receives high positive rewards during training, its corresponding Q-value... The Q value will be significantly higher than that of other actions. Therefore, when the agent is in the "SRV001" state, it will deterministically choose to jump to "PDU-A01-05". This yields an optimal path from the application to the root cause device: OnlineTrading->Tomcat-01->VM-WEB-01->SRV001->PDU-A01-05. The terminal node "PDU-A01-05" of this optimal path is finally determined. This result indicates that the power distribution unit PDU-A01-05 is the most likely root cause of this application performance problem. Finally, the identification information (device ID, physical location, etc.) of the terminal node "PDU-A01-05" is generated as the root cause localization identifier for this fault event and output to the operation and maintenance platform.

[0047] An enterprise-oriented intelligent analysis system for IT operations and maintenance, used to execute the aforementioned enterprise-oriented intelligent analysis method for IT operations and maintenance, the system comprising: The knowledge graph construction module is used to obtain data center asset configuration information, server network cabling tables, power connection tables, and service deployment lists, and to construct a multi-source heterogeneous knowledge graph based on these information. The fault feature generation module is used to determine whether the response time of the application node in the multi-source heterogeneous knowledge graph exceeds the baseline. If it does, the application node is marked as a faulty application node and the associated entity node set is extracted. The associated entity node set data is collected and normalized to generate a real-time status feature matrix. The candidate path filtering module is used to traverse the multi-source heterogeneous knowledge graph based on the set of associated entity nodes and the real-time state feature matrix using a depth-first search algorithm, accumulate the path node anomaly scores, filter paths that exceed the threshold, and generate a set of candidate root cause paths. The root cause localization module is used to define nodes as states and transitions as actions based on the candidate root cause path set, calculate reward values ​​by comparing voltage fluctuation extremes with stability upper limits, update the Q table using the Q-learning algorithm, select the terminal node with the highest cumulative reward, and generate a root cause localization identifier.

[0048] The above embodiments illustrate preferred embodiments of the present invention. Any equivalent adjustments to the technical solution based on software engineering methods are within the scope of protection, including but not limited to: implementing algorithm logic using different programming languages, refactoring functional modules into services, adjusting data interaction protocols, and optimizing resource scheduling strategies. Any implementation scheme derived from reasonable modifications to the data processing flow, service call chain, or system architecture layer without departing from the core technology of the present invention should be considered within the scope of protection defined by the claims of the present invention.

Claims

1. An intelligent analysis method for enterprise-oriented information technology operation, characterized in that, The method comprises the following steps: S1: obtaining data center asset configuration information, server network wiring table, power connection table, service deployment list, and constructing a multi-source heterogeneous knowledge graph based on the data center asset configuration information, the server network wiring table, the power connection table, and the service deployment list; S2: determining whether the response time of an application program node in the multi-source heterogeneous knowledge graph exceeds a baseline, marking the application program node as a faulty application program node if the response time exceeds the baseline, extracting a set of associated entity nodes, collecting and normalizing data of the set of associated entity nodes, and generating a real-time state feature matrix; S3: based on the set of associated entity nodes and the real-time state feature matrix, traversing the multi-source heterogeneous knowledge graph using a depth-first search algorithm, accumulating path node anomaly degrees as scores, filtering paths exceeding a threshold, and generating a candidate root cause path set; S4: based on the candidate root cause path set, defining nodes as states and jumps as actions, comparing voltage fluctuation extrema and stable upper limits to calculate reward values, updating a Q table using a Q learning algorithm, selecting a terminal node with the highest cumulative reward, and generating a root cause positioning identifier. 2.The enterprise-oriented information technology operation intelligent analysis method according to claim 1, characterized in that, The multi-source heterogeneous knowledge graph comprises entity nodes and relationship edges, the real-time state feature matrix comprises normalized server performance indicators and normalized hardware sensor data, and the candidate root cause path set specifically refers to paths with a propagation impact score exceeding a preset impact threshold, and the root cause positioning identifier specifically refers to a terminal node of a path with the highest cumulative reward value. 3.The enterprise-oriented information technology operation intelligent analysis method according to claim 1, characterized in that, The step S1 specifically comprises: S11: analyzing the data center asset configuration information, the server network wiring table, the power connection table, and the service deployment list, extracting asset entities including physical locations, hardware specifications, IP addresses, and running states, and service entities defining dependency relationships among applications, middleware, and operating systems; S12: based on the internal logical association between the asset entities and the service entities, presetting relationship types between entities, the relationship types between entities covering four basic connection modes of being deployed on, connected to, powered by, and dependent on, and configuring corresponding semantic weights for each mode to represent the impact difference of different relationships in the fault propagation process; S13: mapping the asset entities and the service entities into entity nodes, and mapping the relationship types between entities into relationship edges connecting the entity nodes, wherein the properties of the relationship edges include the preset semantic weights, thereby structurally expressing the complex topology of enterprise information technology infrastructure; S14: integrating all the entity nodes and the relationship edges, eliminating duplicate entities and redundant relationships, and constructing a unified multi-source heterogeneous knowledge graph containing multi-level IT elements and their interactions. 4.The enterprise-oriented information technology operation intelligent analysis method according to claim 1, characterized in that, The step S2 specifically comprises: S21: collecting response time data of the application program node within a preset historical period, calculating the mean and standard deviation of the response time using the 3-sigma principle, setting a dynamic response time baseline based on the mean and the standard deviation, and using the dynamic response time baseline as a basis for judging whether the application performance is normal; S22: When the response time of the application node monitored in real time continuously exceeds the dynamic response time baseline for a predetermined number of times, mark the application node as a faulty application node, and perform breadth-first traversal along the relationship edges in the multi-source heterogeneous knowledge graph to extract all entity nodes within a specified hop number from the faulty application node, and generate an associated entity node set; S23: For each entity node in the associated entity node set, real-time collection of its corresponding server central processor utilization, memory usage, disk read / write rate and other performance indicators, as well as mainboard temperature, fan speed, power module voltage and other hardware sensor data through a monitoring interface to form a multi-dimensional original state data set; S24: Normalize the various types of data in the multi-dimensional original state data set using the maximum minimization method, map all numerical values to the interval to eliminate the dimensional difference between different indicators, and finally integrate all normalized data to generate a real-time state feature matrix reflecting the health status of all entities within the associated range. 5.The enterprise-oriented information technology operation intelligent analysis method according to claim 2, characterized in that, The generation process of the candidate root cause path set specifically includes: S31: According to the importance difference of each indicator to fault judgment, set corresponding feature weights for server performance indicators and hardware sensor data in the real-time state feature matrix, and calculate the node abnormality degree of each entity node in the associated entity node set based on the feature weights and the real-time state feature matrix; S32: Starting from the faulty application node, a depth-first search algorithm is used to traverse the multi-source heterogeneous knowledge graph, and in the traversal process, the algorithm explores all possible fault propagation paths along the relationship edges and records the entire entity node sequence passed by each path; S33: During the exploration process of the depth-first search, for each path being formed, the node abnormality degrees of all traversed entity nodes on the path are accumulated in real time, and the accumulation result is defined as the propagation impact score of the path, which quantifies the severity of fault propagation along a specific path; S34: Compare the propagation impact score with the preset impact threshold, and only when the propagation impact score of a path exceeds the preset impact threshold, the path is considered as a potential propagation chain that significantly contributes to the fault, and is stored in a set in its entirety, and finally a candidate root cause path set is generated. 6.The enterprise-oriented information technology operation intelligent analysis method according to claim 1, characterized in that, The step of S4 is specifically: S41: initialize the Q table, define all entity nodes in the candidate root cause path set as states, define the jumps connecting adjacent entity nodes as actions, and define the state-action pairs as tuples initial zero value is assigned, and the learning rate and discount factor and other Q-learning algorithm hyperparameters are set; S42: Perform multiple rounds of iterative training on each path in the candidate root cause path set, and in each iteration, starting from the starting node of the path, simulate an agent jumping to the next node according to the current Q table, until the terminal node of the path, which constitutes a complete training round; S43: After each jump in each training round, calculate the reward value based on the comparison result of the voltage fluctuation extreme value and the stable upper limit, and update the Q value of the current state-action pair using the Bellman equation, so that the Q value can reflect the expected long-term cumulative reward brought by the corresponding action. S44: After the Q table converges through iterative training for a sufficient number of rounds, starting from the initial state corresponding to the fault application node, the action that maximizes the Q value is selected at each step to perform state transition, thereby obtaining an optimal path from the application to the root cause device, and generating the terminal node of the path as the root cause positioning identifier. 7.The enterprise-oriented information technology operation intelligent analysis method according to claim 5, characterized in that, The calculation process of the node anomaly degree specifically includes: extracting the normalized server performance indicators and normalized hardware sensor data corresponding to a specific entity node from the real-time state feature matrix to form a feature vector; for each dimension feature in the feature vector, a fixed indicator importance weight is pre-set according to the historical fault contribution degree analysis result, and all indicator importance weights collectively form a weight vector; performing dot product operation on the feature vector and the weight vector to obtain a comprehensive score, which is the node anomaly degree of the entity node, and the calculation formula is: ； wherein, a node anomaly degree representing a th entity node, is an integer index used to identify different entity nodes in the set of associated entity nodes, represents a total number of features, a feature importance weight corresponding to a th feature, a normalized real-time status value of a th feature of a th entity node, is an integer index used to identify different dimension features. 8.The enterprise-oriented information technology operation intelligent analysis method according to claim 6, characterized in that, The calculation process of the reward value specifically includes: In each training step of the Q learning algorithm, when the agent jumps from the current state node to the next state node, first determine whether the next state node is a power type entity node; if the next state node is a power type entity node, real-time collect the output voltage monitoring data of the node, and calculate the voltage fluctuation extreme value in a unit monitoring period, which reflects the stability of the power output; compare the voltage fluctuation extreme value with the pre-set upper limit threshold of power stability, if the voltage fluctuation extreme value exceeds the upper limit threshold of power stability, assign a pre-set high positive reward value to this jump action, otherwise assign a standard negative step penalty value; if the next state node is not a power type entity node, regardless of its state, uniformly assign the standard negative step penalty value to this jump action to guide the algorithm to preferentially explore the root cause path related to power anomalies. 9.The enterprise-oriented information technology operation intelligent analysis method according to claim 3, characterized in that, The entity nodes are divided into infrastructure layer entity nodes, physical layer entity nodes, virtualization layer entity nodes, service layer entity nodes and application layer entity nodes; The infrastructure layer entity nodes include cabinets and power distribution units; The physical layer entity nodes include servers, switches and routers; The virtualization layer entity nodes include virtual machines and virtual switches; The service layer entity nodes include operating systems, databases and middleware; The application layer entity nodes include business application programs; The relationship edges specifically include "power supply to" relationship connecting the infrastructure layer entity nodes and the physical layer entity nodes, "physical connection to" relationship connecting the physical layer entity nodes, "carrying on" relationship connecting the physical layer entity nodes and the virtualization layer entity nodes, "running on" relationship connecting the virtualization layer entity nodes and the service layer entity nodes, and "deployed on" relationship connecting the service layer entity nodes and the application layer entity nodes.

10. An enterprise-oriented information technology operation intelligent analysis system, characterized in that, The system is used to implement the enterprise-oriented information technology operation and maintenance intelligent analysis method of any one of claims 1-9, and the system includes: The knowledge graph construction module is configured to acquire data center asset configuration information, a server network cabling table, a power connection table, and a service deployment list, and construct a multi-source heterogeneous knowledge graph based on the data center asset configuration information, the server network cabling table, the power connection table, and the service deployment list. The fault feature generation module is configured to determine whether the response time of an application program node in the multi-source heterogeneous knowledge graph exceeds a baseline, mark the application program node as a fault application program node if the response time exceeds the baseline, extract a set of associated entity nodes, collect and normalize data of the set of associated entity nodes, and generate a real-time state feature matrix. The candidate path screening module is configured to use a depth-first search algorithm to traverse the multi-source heterogeneous knowledge graph based on the set of associated entity nodes and the real-time state feature matrix, accumulate path node abnormality degrees as scores, screen paths exceeding a threshold value, and generate a candidate root cause path set. The root cause positioning module is configured to define nodes as states and jumps as actions based on the candidate root cause path set, compare voltage fluctuation extrema and a stable upper limit to calculate a reward value, update a Q table using a Q learning algorithm, select a terminal node with the highest cumulative reward, and generate a root cause positioning identifier.

Images