Operation and maintenance risk analysis method and device, equipment, storage medium and program product

Abstract

The invention provides an operation and maintenance risk analysis method and device, equipment, a storage medium and a program product.The method comprises the steps that first operation and maintenance data at the current moment and a target knowledge graph are obtained, the target knowledge graph comprises a plurality of nodes and edges, the nodes are target entities determined according to second operation and maintenance data at historical moments, and the edges are connected with the nodes; the edges are used for connecting associated nodes; according to a pre-trained target value function, weight values of the first operation and maintenance data are determined, and the first operation and maintenance data of one mode corresponds to one weight value; performing feature extraction and feature fusion on the first operation and maintenance data according to the weight value of the first operation and maintenance data to generate first feature data; and according to the first feature data, performing fault analysis on nodes in the target knowledge graph to obtain a first risk result of each node. According to the embodiment of the invention, in the data processing stage, the multi-modal data are effectively fused, so that the risk identification efficiency and accuracy are relatively high.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to an operation and maintenance risk analysis method, apparatus, equipment, storage medium, and program product. Background Technology

[0002] In the current wave of digitalization in the communications industry and the rapid development of artificial intelligence, in order to accelerate digital transformation and continuously upgrade the technical architecture, we need to face problems such as increasing system complexity, rapid growth in data volume and network security threats, which pose a huge challenge to ensuring system stability. Therefore, we need an operation and maintenance risk analysis method to identify system failure risks. Existing risk analysis methods mainly build knowledge graphs through large language models and achieve risk identification through semantic mining of knowledge graphs.

[0003] However, most existing operational risk analysis methods rely on only single data sources and do not consider multi-source heterogeneous data in the operational system, or they do not effectively integrate multi-source heterogeneous data (i.e., multimodal data), resulting in poor risk identification efficiency and low risk identification accuracy. Summary of the Invention

[0004] The purpose of this invention is to provide an operation and maintenance risk analysis method, apparatus, equipment, storage medium, and program product to solve the problems of poor risk identification efficiency and low risk identification accuracy caused by the lack of effective fusion of multimodal data in existing operation and maintenance risk analysis methods.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide an operation and maintenance risk analysis method, including:

[0006] Obtain the first operation and maintenance data and the target knowledge graph at the current moment, wherein the target knowledge graph includes multiple nodes and edges, the nodes are target entities determined based on the second operation and maintenance data at historical moments, and the edges are used to connect related nodes;

[0007] Based on the pre-trained target value function, the weight value of the first operation and maintenance data is determined, wherein one weight value corresponds to one modality of the first operation and maintenance data.

[0008] Based on the weight value of the first maintenance data, feature extraction and feature fusion are performed on the first maintenance data to generate the first feature data;

[0009] Based on the first feature data, fault analysis is performed on the nodes in the target knowledge graph to obtain the first risk result for each node.

[0010] Optionally, the method further includes:

[0011] Collect raw operation and maintenance data corresponding to multiple service nodes at the current moment, wherein time synchronization is performed between the service nodes;

[0012] The original operation and maintenance data is cleaned and standardized to generate the first operation and maintenance data.

[0013] Optionally, the method further includes:

[0014] Obtain local business load information for each of the service nodes and quality scores from multiple pre-configured benchmark time sources;

[0015] Calculate the average time drift of each service node relative to the reference time source based on the local clock of the service node and the reference time source;

[0016] For each of the service nodes, a weight value for each of the reference time sources is determined based on the local service load information and the quality score of each reference time source.

[0017] For each of the service nodes, time synchronization is performed based on the average time drift and the weight value of each of the reference time sources.

[0018] Optionally, the step of extracting and fusing features from the first maintenance data based on the weight values ​​of the first maintenance data to generate first feature data includes:

[0019] The first operation and maintenance data is projected onto a vector space through a linear transformation to generate a semantic feature vector. The first operation and maintenance data of one modality corresponds to one semantic feature vector, and the semantic feature vector includes a query vector, a key vector, and a value vector.

[0020] The query vector and the key vector are normalized to obtain the similarity score between the first maintenance data of each of the two modalities;

[0021] Based on the similarity scores, the value vectors are weighted and summed to obtain the feature vector of the first maintenance data for each modality;

[0022] Based on the weight values ​​of the first maintenance data, multiple feature vectors are concatenated and fused to generate the first feature data.

[0023] Optionally, the step of performing fault analysis on the nodes in the target knowledge graph based on the first feature data to obtain a first risk result for each node includes:

[0024] Based on the first feature data and the multilayer perceptron, fault analysis is performed on the nodes in the target knowledge graph to obtain a second risk result for each node.

[0025] Based on the graph attention network, a fault cascade analysis is performed on the nodes in the target knowledge graph to obtain the third risk result for each node;

[0026] A weighted linear calculation is performed on the second risk result and the third risk result to obtain the first risk result for each node.

[0027] Optionally, the method further includes:

[0028] Obtain the second operation and maintenance data and the weight value of the second operation and maintenance data at historical moments, wherein one modality of the second operation and maintenance data corresponds to one weight value;

[0029] Based on the weight values ​​of the second maintenance data, feature extraction and feature fusion are performed on the second maintenance data to generate second feature data;

[0030] The second operation and maintenance data is semantically encoded and entity recognized to construct an initial knowledge graph. The initial knowledge graph includes multiple nodes and edges. The nodes are target entities determined based on the second operation and maintenance data, and the edges are used to connect related nodes.

[0031] Based on the second feature data, the initial knowledge graph is optimized and updated to generate the target knowledge graph and the target value function.

[0032] Optionally, optimizing and updating the initial knowledge graph based on the second feature data to generate the target knowledge graph and the target value function includes:

[0033] Based on the second feature data, the initial knowledge graph is optimized to generate a first knowledge graph;

[0034] Fault analysis is performed on the nodes in the first knowledge graph to obtain the fourth risk result for each node;

[0035] The fourth risk result is evaluated based on the actual risk result of the node to obtain a risk prediction evaluation result, wherein the risk prediction evaluation result is used to measure the accuracy of this fault analysis;

[0036] Based on the risk prediction and assessment results, the value function is trained, and the first knowledge graph is updated based on the trained value function, wherein the value function is used to update the weight values ​​of the second operation and maintenance data.

[0037] If the value function or the risk prediction assessment result meets the preset conditions after training, the current value function is determined as the target value function, and the current first knowledge graph is determined as the target knowledge graph.

[0038] Optionally, the step of semantically encoding and entity recognition of the second operation and maintenance data to construct an initial knowledge graph includes:

[0039] The second maintenance data is semantically encoded using a large language model to generate a first vector representation.

[0040] The first vector representation is processed using a named entity recognition model to identify multiple target entities in the second operation and maintenance data;

[0041] An initial knowledge graph is constructed based on the target entity and the first vector representation.

[0042] Optionally, optimizing the initial knowledge graph based on the second feature data to generate a first knowledge graph includes:

[0043] Based on the graph neural network (GNN) and the second feature data, the nodes in the initial knowledge graph are optimized to obtain the second knowledge graph;

[0044] Based on the retrieval enhancement generated RAG and the second feature data, the nodes and edges in the second knowledge graph are optimized respectively to obtain the first knowledge graph.

[0045] Optionally, before performing fault analysis on the nodes in the target knowledge graph based on the first feature data to obtain a first risk result for each node, the method further includes:

[0046] A risk assessment is performed based on the first feature data to obtain a risk score for the first operation and maintenance data.

[0047] If the risk score of the first operation and maintenance data is greater than the first threshold, the target knowledge graph is updated based on the first operation and maintenance data and the first feature data.

[0048] Optionally, updating the target knowledge graph based on the first operation and maintenance data and the first feature data when the risk score of the first operation and maintenance data is greater than the first threshold includes:

[0049] If the risk score of the first maintenance data is greater than the first threshold, the large language model is updated according to the incremental learning method and the first feature data.

[0050] The updated large language model and named entity recognition model are used to process the first operation and maintenance data to obtain the first target entity corresponding to the first operation and maintenance data and the relationship between the first target entities.

[0051] The target knowledge graph is updated based on the first feature data, the first target entity, and the relationship between the first target entity.

[0052] This invention also provides an operation and maintenance risk analysis device, comprising:

[0053] The first acquisition module is used to acquire the first operation and maintenance data and the target knowledge graph at the current moment. The target knowledge graph includes multiple nodes and edges. The nodes are target entities determined based on the second operation and maintenance data at historical moments. The edges are used to connect nodes with associations.

[0054] The first calculation module is used to determine the weight value of the first operation and maintenance data according to the pre-trained target value function, wherein one modality of the first operation and maintenance data corresponds to one weight value.

[0055] The first processing module is used to perform feature extraction and feature fusion on the first operation and maintenance data according to the weight value of the first operation and maintenance data to generate the first feature data;

[0056] The first analysis module is used to perform fault analysis on the nodes in the target knowledge graph based on the first feature data, and obtain the first risk result for each node.

[0057] This invention also provides a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the operation and maintenance risk analysis method as described in any of the preceding embodiments.

[0058] This invention also provides a readable storage medium, comprising: a program stored on the readable storage medium, wherein when the program is executed by a processor, it implements the steps of the operation and maintenance risk analysis method as described in any of the preceding claims.

[0059] This invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the operation and maintenance risk analysis method as described in any of the preceding embodiments.

[0060] At least one of the above technical solutions of the present invention has the following beneficial effects:

[0061] The above scheme provides a method for operational risk analysis. First, it acquires the current operational data and a target knowledge graph. The target knowledge graph includes multiple nodes and edges. Nodes are target entities determined based on historical operational data, and edges connect related nodes. Then, it determines the weight values ​​of the first operational data based on a pre-trained target value function, where one weight value corresponds to one modality of the first operational data. Next, based on the weight values ​​of the first operational data, it performs feature extraction and feature fusion to generate first feature data. Finally, based on the first feature data, it performs fault analysis on the nodes in the target knowledge graph to obtain a first risk result for each node. This embodiment of the invention has good processing capabilities and generalization performance for multimodal data. During data processing, firstly, different weight values ​​are assigned to the first operational data of different modalities according to the value function. Then, feature extraction and feature fusion are performed on the multimodal operational data based on the weight values ​​to generate first feature data for risk analysis. This allows for better integration of multimodal data, thereby improving the efficiency and accuracy of risk identification for each node. Attached Figure Description

[0062] Figure 1 This is a flowchart illustrating the operation and maintenance risk analysis method according to an embodiment of the present invention;

[0063] Figure 2 This is a schematic diagram of medium- and high-risk nodes in the knowledge graph of an embodiment of the present invention;

[0064] Figure 3 This is a schematic diagram illustrating the process of continuous learning and dynamic updating of the knowledge graph in an embodiment of the present invention.

[0065] Figure 4 This is a flowchart illustrating the knowledge graph optimization and updating method according to an embodiment of the present invention.

[0066] Figure 5 This is a schematic diagram of the operation and maintenance risk analysis device according to an embodiment of the present invention. Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0069] like Figure 1 As shown, this embodiment of the invention provides a method for operational risk analysis, including:

[0070] Step S101: Obtain the first operation and maintenance data and the target knowledge graph at the current moment, wherein the target knowledge graph includes multiple nodes and edges, the nodes are target entities determined based on the second operation and maintenance data at historical moments, and the edges are used to connect related nodes;

[0071] In step S101, the target knowledge graph is constructed based on the second operation and maintenance data at historical moments. The nodes in the target knowledge graph are target entities determined based on the second operation and maintenance data, such as "database connection timeout" and "API response delay".

[0072] The primary operational data includes, but is not limited to, alarm information, indicator data, configuration information from the Configuration Management Database (CMDB), log data, monitoring indicators, call chain topology changes, change records, and at least one of the following from risk analysis reports. The alarm information consists of historical fault files and storage system fault reports; the indicator data includes, but is not limited to, various levels of indicators such as business, Software as a Service (SaaS), Platform as a Service (PAAS), and Infrastructure as a Service (IAAS); the CMDB configuration information is used to describe the relationships between various components in the system, mainly including the model mapping relationships of business, SaaS / PAAS / IAAS services, middleware, containers, virtual machines, and host machines, to build a complete IT resource dependency model; the log data covers structured or unstructured log information generated by the above-mentioned components and services during operation; the monitoring indicators include, but are not limited to, real-time monitoring data such as Central Processing Unit (CPU) utilization, memory usage, and network traffic; the change log includes historical records of configuration changes, deployment updates, version upgrades, and other operations of various components and services in the system, used to assist in analyzing the correlation between system state changes and potential risks; the risk analysis report is connected to the risk handling report and is used to update the target knowledge graph and support decision analysis.

[0073] Step S102: Determine the weight value of the first operation and maintenance data according to the pre-trained target value function, wherein one weight value corresponds to one modality of the first operation and maintenance data.

[0074] In step S102, the target value function is a Q-value function constructed based on a deep Q-network (DQN) of reinforcement learning. The method for determining the weight values ​​of the first maintenance data based on the target value function is as follows:

[0075] Get the operation and maintenance system at the current time step The environmental state is obtained. At the same time, the objective value function is used to obtain the value in the current state. The target value function outputs the optimal weight combination by selecting the data modes and assigning weights to each data mode.

[0076] Step S103: Based on the weight value of the first maintenance data, perform feature extraction and feature fusion on the first maintenance data to generate first feature data;

[0077] Step S104: Based on the first feature data, perform fault analysis on the nodes in the target knowledge graph to obtain the first risk result for each node.

[0078] This invention provides a method for operational risk analysis. First, it acquires current-time first operational data and a target knowledge graph. The target knowledge graph includes multiple nodes and edges. Nodes are target entities determined based on historical second-time operational data, and edges connect related nodes. Then, it determines the weight values ​​of the first operational data based on a pre-trained target value function, where each modality of the first operational data corresponds to one weight value. Next, based on the weight values ​​of the first operational data, it performs feature extraction and feature fusion to generate first feature data. Finally, based on the first feature data, it performs fault analysis on the nodes in the target knowledge graph to obtain a first risk result for each node. This invention demonstrates good processing capability and generalization performance for multimodal data. During data processing, firstly, different weight values ​​are assigned to first operational data of different modalities according to the value function. Then, feature extraction and feature fusion are performed on operational data of multiple modalities based on the weight values ​​to generate first feature data for risk analysis. This method can better integrate multimodal data, thereby improving the efficiency and accuracy of risk identification for each node.

[0079] In one embodiment, optionally, the method further includes:

[0080] Collect raw operation and maintenance data corresponding to multiple service nodes at the current moment, wherein time synchronization is performed between the service nodes;

[0081] The original operation and maintenance data is cleaned and standardized to generate the first operation and maintenance data.

[0082] In this embodiment of the invention, the service node is the physical or virtual node where each operation and maintenance data source is located (such as a log server, metric collector, application performance management (APM) probe host, etc.). Based on time synchronization between multiple service nodes, the original operation and maintenance data corresponding to multiple service nodes at the current moment are collected. The original operation and maintenance data includes, but is not limited to, alarm information, metric data, CMDB configuration information, log data, monitoring metrics, change records, and at least one of the following from the risk analysis report.

[0083] Then, the raw operation and maintenance data is preprocessed, specifically including:

[0084] The alarm information is initially cleaned and formatted, and the key content is extracted and stored in vector form.

[0085] Standardized cleaning of indicator data includes deduplication, missing value filling, and outlier removal;

[0086] Log data is classified and parsed to form a log feature dataset that can be used for behavioral analysis;

[0087] The risk analysis report is processed using natural language processing and vectorized encoding to extract key risk features and store them as a structured representation.

[0088] By collecting, cleaning, standardizing, and vectorizing the aforementioned multi-dimensional operation and maintenance data, a unified data foundation for operation and maintenance risk analysis has been constructed, thereby enabling comprehensive perception and intelligent judgment of system operating status, performance, historical behavior patterns, and potential risks.

[0089] In one embodiment, optionally, the method further includes:

[0090] Obtain local business load information for each of the service nodes and quality scores from multiple pre-configured benchmark time sources;

[0091] Calculate the average time drift of each service node relative to the reference time source based on the local clock of the service node and the reference time source;

[0092] For each of the service nodes, a weight value for each of the reference time sources is determined based on the local service load information and the quality score of each reference time source.

[0093] For each of the service nodes, time synchronization is performed based on the average time drift and the weight value of each of the reference time sources.

[0094] In this embodiment of the invention, to achieve more accurate time synchronization between data in high-concurrency scenarios, this proposal suggests an improved time synchronization algorithm. This algorithm introduces a dynamic weight adjustment mechanism based on service load and time drift prediction, building upon the traditional Network Time Protocol (NTP). The specific method is as follows:

[0095] For each of the service nodes, assume the local node's uncalibrated time is... The number of reference time sources is N, and the th The reference time returned by each reference time source is Its corresponding dynamic weight is Then the calibrated timestamp It can be represented as:

[0096]

[0097] in, It is the average drift of the local clock relative to the reference time source, which is predicted based on historical data. It is used to compensate for additional time offsets that may occur in the short term. The specific calculation method includes: continuously recording the time difference sequence between the local clock and each reference time source. Based on this time sequence, a Long Short Term Memory (LSTM) network is used to estimate the clock drift trend in the future short period. This is an existing technology. The calculation is based on the quality of the reference time source (such as stability, response speed, etc.) and the degree of impact of the current business load on the time synchronization accuracy.

[0098] Assume the first The quality score of each benchmark time source is: The service load level of the local node is , It can be represented as:

[0099]

[0100] Here, α is an adjustment parameter used to avoid weight distribution imbalance when the business load is extremely low. Generally, its value is 0.2-0.8.

[0101] In practical applications, the system improves synchronization accuracy by dynamically adjusting the weights of the reference time sources participating in time synchronization, based on real-time monitoring of the business load of each node and prediction of clock drift over a future period. The proposed time synchronization algorithm significantly improves the accuracy and response speed of cross-node time synchronization. In practical applications, the algorithm controls the time error within ±20ms, and in over 95% of scenarios, the single synchronization time does not exceed 12ms, improving response speed by approximately 50%-70%. Furthermore, its adaptability ensures stable synchronization performance under different load conditions, providing strong support for efficient operation and maintenance in complex information technology (IT) environments.

[0102] In one implementation, optionally, the step of extracting and fusing features from the first maintenance data based on the weight value of the first maintenance data to generate first feature data includes:

[0103] The first operation and maintenance data is projected onto a vector space through a linear transformation to generate a semantic feature vector. The first operation and maintenance data of one modality corresponds to one semantic feature vector, and the semantic feature vector includes a query vector, a key vector, and a value vector.

[0104] The query vector and the key vector are normalized to obtain the similarity score between the first maintenance data of each of the two modalities;

[0105] Based on the similarity scores, the value vectors are weighted and summed to obtain the feature vector of the first maintenance data for each modality;

[0106] Based on the weight values ​​of the first maintenance data, multiple feature vectors are concatenated and fused to generate the first feature data.

[0107] In this embodiment of the invention, to achieve efficient cross-modal information fusion, a Cross-Modal Attention Network (CMAN) is used to extract and fuse features from the first maintenance data. Based on configuring weight values ​​using the target value function, the CMAN network can automatically focus on the correlation between different modal data and further refine the feature representation. The specific operation is as follows:

[0108] The first step is to input the first operation and maintenance data of different modalities into the CMAN network through the embedding layer, where each modal data has a corresponding embedding layer;

[0109] The second step involves the CMAN network projecting the input first operational data into a vector space through linear transformation, converting it into high-dimensional semantic feature vectors, namely query (Q) vectors, key (K) vectors, and value (V) vectors, specifically represented as follows:

[0110]

[0111]

[0112]

[0113] in, Indicates the first The weight matrix of the Q-vector for each mode. Indicates the first The weight matrix of the K vectors for each modality. Indicates the first The weight matrix of the V vector for each modality.

[0114] The third step involves normalizing the query vector and the key vector to obtain the similarity score between the first maintenance data for each of the two modalities. Specifically, the first step... The query vector of the first modality and the first Similarity between key vectors of different modalities It can be calculated as:

[0115]

[0116] in, This is the dimension of the key vector, which is typically set to 512.

[0117] By using the normalized exponential function (Softmax) to... Normalized to a probability distribution, the similarity score between each pair of modes is obtained. for:

[0118]

[0119] Where M represents the total number of modalities of the first operation and maintenance data.

[0120] The fourth step involves using these similarity scores to perform a weighted summation of the value vectors, which yields a weighted feature representation for each modality:

[0121]

[0122] in, Let be the feature vector representation of the first operational data of the i-th modality. The first maintenance data of the j-th mode is processed by the encoder to obtain the feature vector, which is the value vector of the j-th mode.

[0123] Fifth, based on the weight values ​​of the first maintenance data, the weighted feature representations of all modalities are concatenated to obtain the final comprehensive feature representation, i.e., the first feature data. The formula is as follows:

[0124]

[0125] By employing a cross-modal attention network, more accurate feature extraction is achieved. Experiments show that in complex operational environments, this method can significantly improve the accuracy of fault detection and reduce the false alarm rate by more than 30%.

[0126] In one implementation, optionally, the step of performing fault analysis on the nodes in the target knowledge graph based on the first feature data to obtain a first risk result for each node includes:

[0127] Based on the first feature data and the multilayer perceptron, fault analysis is performed on the nodes in the target knowledge graph to obtain a second risk result for each node.

[0128] Based on the graph attention network, a fault cascade analysis is performed on the nodes in the target knowledge graph to obtain the third risk result for each node;

[0129] A weighted linear calculation is performed on the second risk result and the third risk result to obtain the first risk result for each node.

[0130] In this embodiment of the invention, fault analysis is performed on each node in the target knowledge graph. The specific steps are as follows:

[0131] First, for each node in the target knowledge graph Using a multilayer perceptron (MLP) and combining it with the first feature data compute nodes The second risk outcome in the current context is formulated as follows:

[0132]

[0133] in, Represents a node The second risk outcome (i.e., risk score); , It is the set of nodes in the target knowledge graph; This indicates a splicing operation; MLP is a trainable multilayer perceptron that outputs a single-value risk score. Represents a node Semantic embedding, in general, It is generated through a large language model.

[0134] Secondly, a Graph Attention Network (GAT) is used to model risk propagation on the knowledge graph, capturing the cascading effect of failures between nodes, as shown in the following formula:

[0135]

[0136] in, Indicates the ( ) layer nodes The expression, It is a node The set of neighboring nodes, Indicates the ( ) layer nodes The representation of nodes belong , To correct the linear unit (RELU) function, For nodes and nodes Attention weights between them Indicates the first Learnable parameters of the layer.

[0137] The calculation formula is as follows:

[0138]

[0139] in, , All are learnable parameters. It is a node The expression, node The representation of nodes belong , It is the non-linear activation function ReLU. It is a normalized exponential function.

[0140] After the cascading effect of failures between nodes, a max-pooling operation is performed on the nodes to obtain the third risk result for each node, as shown in the following formula:

[0141]

[0142] in, Represents a node The third risk outcome (i.e., risk score). Indicates the first Layer nodes The expression, This represents the total number of layers in a Graph Neural Network (GNN), for example, 5. This represents the max pooling function.

[0143] Finally, the second and third risk results are fused using a weighted linear fusion method to achieve rapid perception and deep reasoning of risk components, obtaining the final first risk result for each node. The calculation formula is as follows:

[0144]

[0145] Where λ is a hyperparameter, set according to actual conditions; in this embodiment, it is set to 0.3, but this is not a limitation. All entities are sorted in descending order of their final risk scores to form a risk entity ranking list. :

[0146]

[0147] Based on a pre-set threshold and a list of risky entities. The system filters out medium- and high-risk component entities and issues risk warnings. An example result is shown below. Figure 2 As shown.

[0148] In one embodiment, optionally, the method further includes:

[0149] Obtain the second operation and maintenance data and the weight value of the second operation and maintenance data at historical moments, wherein one modality of the second operation and maintenance data corresponds to one weight value;

[0150] Based on the weight values ​​of the second maintenance data, feature extraction and feature fusion are performed on the second maintenance data to generate second feature data;

[0151] The second operation and maintenance data is semantically encoded and entity recognized to construct an initial knowledge graph. The initial knowledge graph includes multiple nodes and edges. The nodes are target entities determined based on the second operation and maintenance data, and the edges are used to connect related nodes.

[0152] Based on the second feature data, the initial knowledge graph is optimized and updated to generate the target knowledge graph and the target value function.

[0153] In this embodiment of the invention, a method for constructing a knowledge graph based on historical operation and maintenance data is provided. First, the second operation and maintenance data is semantically encoded and entity recognized to construct an initial knowledge graph.

[0154] Then, based on the weight values ​​of the second maintenance data, feature extraction and feature fusion are performed on the second maintenance data to generate second feature data. Furthermore, the initial knowledge graph is optimized and updated based on the second feature data to generate the target knowledge graph and the target value function. Specifically:

[0155] Initially, an initial weight value is configured for each modality of data in the second operation and maintenance data. This initial weight value is set based on prior knowledge (e.g., if log text is considered more important in the early stages of a fault, then combinations such as [text 0.7, time series 0.2, graph 0.1] are included) to cover as many diverse modality preferences as possible. Then, feature extraction and feature fusion are performed based on the initial weight values ​​to generate second feature data. The initial knowledge graph is then optimized and updated based on the second feature data. During the optimization and updating of the initial knowledge graph, the weight values ​​of each modality in the second operation and maintenance data are continuously optimized through iterative optimization of the value function, thereby continuously optimizing and updating the initial knowledge graph and the value function until the target knowledge graph and the target value function are generated.

[0156] In one implementation, optionally, the step of optimizing and updating the initial knowledge graph based on the second feature data to generate the target knowledge graph and the target value function includes:

[0157] Based on the second feature data, the initial knowledge graph is optimized to generate a first knowledge graph;

[0158] Fault analysis is performed on the nodes in the first knowledge graph to obtain the fourth risk result for each node;

[0159] The fourth risk result is evaluated based on the actual risk result of the node to obtain a risk prediction evaluation result, wherein the risk prediction evaluation result is used to measure the accuracy of this fault analysis;

[0160] Based on the risk prediction and assessment results, the value function is trained, and the first knowledge graph is updated based on the trained value function, wherein the value function is used to update the weight values ​​of the second operation and maintenance data.

[0161] If the value function or the risk prediction assessment result meets the preset conditions after training, the current value function is determined as the target value function, and the current first knowledge graph is determined as the target knowledge graph.

[0162] In this embodiment of the invention, after constructing the initial knowledge graph, the initial knowledge graph is first optimized to generate a first knowledge graph. Then, a value function based on reinforcement learning (i.e., the Q-value function) is used to dynamically adjust the relative importance (i.e., weight values) of different modalities (such as text, time series, and graph structures) in the second operational data until the optimal weight combination is found. During this process, the weight values ​​of the second operational data are continuously adjusted, thereby continuously updating the second feature data and the knowledge graph. The following describes the update and training process of the value function:

[0163] At time step The environmental state is obtained Simultaneously, obtain the data modalities and their weight combinations that can be selected in the current state. The optimal solution is learned through the DQN algorithm, where the value function... Indicates the state Take action below The expected cumulative rewards will be updated according to the following rules:

[0164]

[0165] in, The learning rate is used to control the balance between new and old information; it is typically set to 0.01. It is a discount factor used to balance the relationship between immediate rewards and long-term returns; it is typically set to 0.95. To ensure timely rewards, the fourth risk outcome of the node corresponding to the current knowledge graph is assessed based on the actual risk outcome of the node. If the risk prediction assessment result meets the first preset condition, it is considered that the problem has been successfully located by adjusting the weights, and a positive reward is given. This process is continuously iterated and updated. It can find the optimal weight combination .

[0166] Generally, when the number of iterations of the value function meets a preset number, the value function converges, or the risk prediction and assessment result meets a second preset condition, the current value function is determined as the target value function, and the first knowledge graph corresponding to the current target value function is determined as the target knowledge graph.

[0167] In one implementation, optionally, the step of semantically encoding and entity recognition of the second maintenance data to construct an initial knowledge graph includes:

[0168] The second maintenance data is semantically encoded using a large language model to generate a first vector representation.

[0169] The first vector representation is processed using a named entity recognition model to identify multiple target entities in the second operation and maintenance data;

[0170] An initial knowledge graph is constructed based on the target entity and the first vector representation.

[0171] In this embodiment of the invention, the method for constructing the initial knowledge graph is described as follows:

[0172] First, a large language model (such as DeepSeek R1) is used to semantically encode the preprocessed second operational data (such as "database connection timeout, causing increased application programming interface (API) response time" in log text, and monitoring metric alarms "CPU utilization surge") to generate a context-aware first vector representation. The preprocessing method for the second maintenance data is the same as that for the first maintenance data, and will not be described in detail here.

[0173] First vector representation The formula for generating it is as follows:

[0174]

[0175] Here, X is the text sequence of input second-level operational data, and BERT is a pre-trained language model. BERT is used to encode X to obtain the contextual semantic representation matrix of each token. , where n is the sequence length and d is the hidden layer dimension.

[0176] Then, based on The Named Entity Recognition (NER) module is used to identify key operational entities in the text, such as "database connection timeout" and "API response delay". Let there be m target entity types (e.g., service, fault, component, etc.). Then, for each token i, the probability distribution of its belonging to each target entity type is... It can be represented as:

[0177]

[0178] in, The weight matrix of the NER classification head. For bias vectors, Let i be the context representation of the i-th token.

[0179] The identified target entities, after deduplication and boundary merging, are used as nodes in the knowledge graph, and the relationships between target entities are used as edges in the knowledge graph. An initial knowledge graph is constructed based on the nodes, edges, and the first vector representation. ,in, It is the set of nodes in the initial knowledge graph. It is the set of edges in the initial knowledge graph.

[0180] In one implementation, optionally, optimizing the initial knowledge graph based on the second feature data to generate a first knowledge graph includes:

[0181] Based on the graph neural network (GNN) and the second feature data, the nodes in the initial knowledge graph are optimized to obtain the second knowledge graph;

[0182] Based on the retrieval enhancement generated RAG and the second feature data, the nodes and edges in the second knowledge graph are optimized respectively to obtain the first knowledge graph.

[0183] In this embodiment of the invention, firstly, to capture the semantic relationships between entities, a Generative Neural Network (GNN) is introduced for relation modeling, optimizing the initial knowledge graph to generate a first knowledge graph. In the GNN's... Layers, nodes The state update formula is as follows:

[0184]

[0185] Wherein, the initial node represents It is obtained by aggregating the context vectors of the corresponding entities using average pooling. This indicates a splicing operation. For nodes In the The hidden state of the layer These are global features output by a cross-modal attention network. For the first The learnable weight matrix of the layer, It is the normalization coefficient. For nodes The set of neighboring nodes, The activation function is ReLU. By leveraging deep semantic understanding and graph neural networks, the ability to understand unstructured text is improved, resulting in an approximately 25% increase in the accuracy of key event identification.

[0186] Then, a graph-based retrieval augmented generation (GraphRAG) method is introduced to iteratively optimize the initial graph, incorporating general operation and maintenance rules from an external knowledge base and adjusting the graph structure by combining the first feature data Y output by a cross-modal attention network. The definition is as follows:

[0187]

[0188] in, For nodes The set of neighbors; For relation r in the th case The learnable embedding vectors of the layer are used to encode the semantic type of the edge, supporting structured knowledge reasoning under the GraphRAG framework. The relation type r is the relationship between entities, such as "call", "cause", "dependency" etc. Indicates a splicing operation; and These are trainable parameters; The activation function is ReLU; It is a relation-aware aggregation function, in the following form:

[0189]

[0190] After each layer update, the first feature data Introducing a graph structure, the importance of graph nodes and edges is dynamically adjusted through a gating mechanism:

[0191]

[0192]

[0193] in, Indicates the first The gating vector of the layer node. For relation r in the th case Learnable embedding vectors of layers and These are the parameters of the gating network, which ultimately output a semantically rich and context-sensitive first knowledge graph.

[0194] This invention combines a large language model with a graph neural network to extract high-precision entities and their semantic relationships from unstructured text, overcoming the limitations of traditional static rule-matching entity linking methods. It is the first to introduce GraphRAG into the field of operations and maintenance, using global features to guide the optimization of the graph structure, enabling the knowledge graph to have dynamic context awareness capabilities and enhancing the accuracy of fault association analysis.

[0195] In one embodiment, optionally, before performing fault analysis on the nodes in the target knowledge graph based on the first feature data to obtain a first risk result for each node, the method further includes:

[0196] A risk assessment is performed based on the first feature data to obtain a risk score for the first operation and maintenance data.

[0197] If the risk score of the first operation and maintenance data is greater than the first threshold, the target knowledge graph is updated based on the first operation and maintenance data and the first feature data.

[0198] In this embodiment of the invention, to further enhance the system's adaptability and generalization ability in complex and dynamic environments, this embodiment also provides a continuous learning and optimization mechanism for intelligent operation and maintenance scenarios. This mechanism aims to continuously absorb new operation and maintenance data and abnormal events through online incremental training and knowledge distillation, dynamically updating model parameters and the knowledge graph structure. The specific steps are as follows:

[0199] First, for the first operational data collected in real time, steps S102 and S103 are executed to recalculate the first feature data Y at the current moment using a cross-modal attention network;

[0200] Then, a risk assessment is performed based on the first feature data to obtain the risk score of the first operation and maintenance data, as shown in the following formula:

[0201]

[0202] in, and For learnable parameters, The sigmoid activation function outputs the value... This indicates the probability that the current sample belongs to the high-risk category.

[0203] Finally, based on the first threshold Assess the risk level of the primary maintenance data. If the first maintenance data is a high-risk sample, it enters the continuous learning process, which means updating the target knowledge graph based on the first maintenance data and the first feature data.

[0204] In one implementation, optionally, updating the target knowledge graph based on the first operation and maintenance data and the first feature data when the risk score of the first operation and maintenance data is greater than a first threshold includes:

[0205] If the risk score of the first maintenance data is greater than the first threshold, the large language model is updated according to the incremental learning method and the first feature data.

[0206] The updated large language model and named entity recognition model are used to process the first operation and maintenance data to obtain the first target entity corresponding to the first operation and maintenance data and the relationship between the first target entities.

[0207] The target knowledge graph is updated based on the first feature data, the first target entity, and the relationship between the first target entity.

[0208] In this embodiment of the invention, the continuous learning process is described. When the risk score of the first maintenance data is greater than a first threshold, firstly, an online incremental learning strategy is used to locally fine-tune a large language model, such as DeepSeekR1. The specific operation is as follows:

[0209] The loss function is defined as follows:

[0210]

[0211] in, It is a classification task loss, used to perform binary classification to determine whether a new sample is a "high-risk sample". and It is the balance coefficient. For user feedback or expert annotations, These are the parameters of the model at time t.

[0212] Update model parameters using gradient descent:

[0213]

[0214] in, The learning rate is typically set to 0.001.

[0215] Then, the updated large language model and named entity recognition model are used to process the first operation and maintenance data to obtain the first target entity corresponding to the first operation and maintenance data and the relationship between the first target entity. The identification method of the target entity and the relationship is the same as that used when constructing the knowledge graph above, and will not be repeated here.

[0216] If a new entity is identified in the first target entity And / or identify new relationships in the relationships between the first target entities If so, it will be added to the existing target knowledge graph, and the target knowledge graph will be updated. The specific operations are as follows:

[0217] If new entities are discovered Perform the insertion operation:

[0218]

[0219] in, This represents the set of nodes in the updated target knowledge graph. This represents the set of nodes in the target knowledge graph before the update.

[0220] If a new relationship is identified Perform the edge-adding operation:

[0221]

[0222] in, This represents the set of edges in the updated target knowledge graph. This represents the set of edges in the target knowledge graph before the update.

[0223] Finally, the updated target knowledge graph is augmented using the GraphRAG method, and a lightweight propagation update is performed on the entire graph, as shown in the following formula:

[0224]

[0225] in, This represents the update function of a graph neural network. The graph structure representing the current moment. For nodes In the previous moment, he expressed himself as follows: For nodes In the previous moment, he expressed himself as follows: To pass through relationships and A set of connected neighbors. belong , For the set of all relation types, For relationship Dynamic embedding, The gating weights are calculated based on the global first feature data Y. ReLU is a non-linear activation function that enables context-aware fusion of new knowledge. These are learnable parameters.

[0226] Through the aforementioned continuous learning and optimization mechanisms, the system can quickly adapt to new failure modes and business changes, significantly improving the model's generalization ability and robustness. By continuously introducing new samples and user feedback, the model's accuracy in identifying new failures has increased by 15.4%; the performance degradation rate across cycles and business scenarios has decreased by 40%, effectively extending the model's lifespan.

[0227] like Figure 3 As shown in the diagram, this embodiment of the invention provides a flowchart for continuous learning and dynamic updating of a knowledge graph, with the following steps:

[0228] Step S301: Real-time collection of primary maintenance data

[0229] Step S302: Re-extract and fuse features based on the first maintenance data to update the first feature data.

[0230] Step S303: Perform a risk assessment on the first feature data to obtain a risk score.

[0231] Step S304: Determine if the risk score is greater than the first threshold. If yes, proceed to step S305; otherwise, end.

[0232] Step S305: Update the large language model through incremental learning.

[0233] Step S306: Identify the entities and relationships of the first maintenance data based on the large language model and entity naming model, then proceed to steps S307 and S308.

[0234] Step S307: If a new entity is identified, insert the new entity into the knowledge graph, and proceed to step S309.

[0235] Step S308: If a new relationship is identified, insert a new edge into the knowledge graph, and proceed to step S309.

[0236] Step S309: Update the current knowledge graph.

[0237] like Figure 4As shown, this embodiment of the invention provides a method for optimizing and updating a knowledge graph. After generating an initial knowledge graph, the graph is first optimized by GNN semantic enhancement, then optimized by GraphRAG retrieval enhancement, and finally, the newly added samples are analyzed by a large language model. When new entities and new relationships are identified in the graph, the knowledge graph is updated according to the new entities and new relationships.

[0238] like Figure 5 As shown, this embodiment of the invention also provides an operation and maintenance risk analysis device, including:

[0239] The first acquisition module 501 is used to acquire the first operation and maintenance data and the target knowledge graph at the current moment. The target knowledge graph includes multiple nodes and edges. The nodes are target entities determined based on the second operation and maintenance data at historical moments. The edges are used to connect nodes with associations.

[0240] The first calculation module 502 is used to determine the weight value of the first operation and maintenance data according to the pre-trained target value function, wherein one modality of the first operation and maintenance data corresponds to one weight value.

[0241] The first processing module 503 is used to perform feature extraction and feature fusion on the first maintenance data according to the weight value of the first maintenance data to generate first feature data;

[0242] The first analysis module 504 is used to perform fault analysis on the nodes in the target knowledge graph based on the first feature data, and obtain the first risk result for each node.

[0243] Optionally, the device further includes:

[0244] The first acquisition module is used to acquire the original operation and maintenance data corresponding to multiple service nodes at the current time, wherein the time synchronization between the service nodes is performed.

[0245] The second processing module is used to clean and standardize the original operation and maintenance data to generate the first operation and maintenance data.

[0246] Optionally, the device further includes:

[0247] The second acquisition module is used to acquire the local business load information of each of the service nodes and the quality scores of multiple pre-configured benchmark time sources;

[0248] The second calculation module is used to calculate the average time drift of each service node relative to the reference time source based on the local clock of the service node and the reference time source.

[0249] The third calculation module is used to determine the weight value of each of the reference time sources for each of the service nodes, based on the local business load information and the quality score of each reference time source.

[0250] The third processing module is used to perform time synchronization processing for each of the service nodes based on the average time drift and the weight value of each reference time source.

[0251] Optionally, the first processing module 503 includes:

[0252] The first processing submodule is used to project the first operation and maintenance data onto a vector space through linear transformation to generate a semantic feature vector, wherein one modality of the first operation and maintenance data corresponds to one semantic feature vector, and the semantic feature vector includes a query vector, a key vector, and a value vector.

[0253] The first calculation submodule is used to perform normalization calculation on the query vector and the key vector to obtain the similarity score between the first operation and maintenance data of each of the two modalities;

[0254] The second calculation submodule is used to perform a weighted summation of the value vector based on the similarity score to obtain the feature vector of the first operation and maintenance data for each modality.

[0255] The first fusion submodule is used to concatenate and fuse multiple feature vectors according to the weight values ​​of the first operation and maintenance data to generate first feature data.

[0256] Optionally, the first analysis module 504 includes:

[0257] The first analysis submodule is used to perform fault analysis on the nodes in the target knowledge graph based on the first feature data and the multilayer perceptron, and obtain a second risk result for each node;

[0258] The second analysis submodule is used to perform fault cascade analysis on the nodes in the target knowledge graph based on the graph attention network, and obtain the third risk result for each node;

[0259] The third calculation submodule is used to perform a weighted linear calculation on the second risk result and the third risk result to obtain the first risk result for each node.

[0260] Optionally, the device further includes:

[0261] The third acquisition module is used to acquire the second operation and maintenance data and the weight value of the second operation and maintenance data at historical moments, wherein one modality of the second operation and maintenance data corresponds to one weight value;

[0262] The fourth processing module is used to extract and fuse features from the second maintenance data based on the weight values ​​of the second maintenance data to generate second feature data.

[0263] The first construction module is used to perform semantic encoding and entity recognition on the second operation and maintenance data to construct an initial knowledge graph. The initial knowledge graph includes multiple nodes and edges. The nodes are target entities determined based on the second operation and maintenance data, and the edges are used to connect nodes with associations.

[0264] The first optimization module is used to optimize and update the initial knowledge graph based on the second feature data, and generate the target knowledge graph and the target value function.

[0265] Optionally, the first optimization module includes:

[0266] The first optimization submodule is used to optimize the initial knowledge graph based on the second feature data to generate a first knowledge graph;

[0267] The third analysis submodule is used to perform fault analysis on the nodes in the first knowledge graph and obtain a fourth risk result for each node.

[0268] The first assessment submodule is used to assess the fourth risk result based on the actual risk result of the node, and obtain a risk prediction assessment result, wherein the risk prediction assessment result is used to measure the accuracy of this fault analysis.

[0269] The first training submodule is used to train the value function based on the risk prediction and assessment results, and update the first knowledge graph based on the trained value function, wherein the value function is used to update the weight value of the second operation and maintenance data.

[0270] The first determining submodule is used to determine the current value function as the target value function and the current first knowledge graph as the target knowledge graph when the value function or the risk prediction assessment result meets preset conditions after training.

[0271] Optionally, the first building module includes:

[0272] The first encoding submodule is used to perform semantic encoding on the second operation and maintenance data using a large language model to generate a first vector representation;

[0273] The first identification submodule is used to process the first vector representation using a named entity recognition model to identify multiple target entities in the second operation and maintenance data;

[0274] The first construction submodule is used to construct an initial knowledge graph based on the target entity and the first vector representation.

[0275] Optionally, the first optimization submodule includes:

[0276] The first optimization unit is used to optimize the nodes in the initial knowledge graph based on the graph neural network (GNN) and the second feature data to obtain the second knowledge graph.

[0277] The second optimization unit is used to optimize the nodes and edges in the second knowledge graph respectively based on the RAG generated by retrieval enhancement and the second feature data to obtain the first knowledge graph.

[0278] Optionally, the device further includes:

[0279] The first assessment module is used to perform risk assessment based on the first feature data to obtain the risk score of the first operation and maintenance data.

[0280] The first update module is used to update the target knowledge graph based on the first operation and maintenance data and the first feature data when the risk score of the first operation and maintenance data is greater than a first threshold.

[0281] Optionally, the first update module includes:

[0282] The first update submodule is used to update the large language model based on incremental learning and the first feature data when the risk score of the first operation and maintenance data is greater than the first threshold.

[0283] The second processing submodule is used to process the first operation and maintenance data using the updated large language model and named entity recognition model to obtain the first target entity corresponding to the first operation and maintenance data and the relationship between the first target entities.

[0284] The second update submodule is used to update the target knowledge graph based on the first feature data, the first target entity, and the relationship between the first target entity.

[0285] It should be noted that the embodiments of this device are devices corresponding to the embodiments of the above methods. All implementations in the embodiments of the above methods are applicable to the embodiments of this device and can achieve the same technical effect.

[0286] This invention also provides a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the operation and maintenance risk analysis method as described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0287] This invention also provides a readable storage medium, comprising: a program stored on the readable storage medium, wherein when the program is executed by a processor, it implements the steps of the operation and maintenance risk analysis method described in any of the preceding claims, and achieves the same technical effect; to avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0288] This invention also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the steps of the operation and maintenance risk analysis method described in any of the preceding claims and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0289] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0290] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for analyzing operational and maintenance risks, characterized in that, include: Obtain the first operation and maintenance data and the target knowledge graph at the current moment, wherein the target knowledge graph includes multiple nodes and edges, the nodes are target entities determined based on the second operation and maintenance data at historical moments, and the edges are used to connect nodes with associations; Based on the pre-trained target value function, the weight value of the first operation and maintenance data is determined, wherein one weight value corresponds to one modality of the first operation and maintenance data. Based on the weight value of the first maintenance data, feature extraction and feature fusion are performed on the first maintenance data to generate the first feature data; Based on the first feature data, fault analysis is performed on the nodes in the target knowledge graph to obtain the first risk result for each node.

2. The operation and maintenance risk analysis method according to claim 1, characterized in that, The method further includes: Collect raw operation and maintenance data corresponding to multiple service nodes at the current moment, wherein time synchronization is performed between the service nodes; The original operation and maintenance data is cleaned and standardized to generate the first operation and maintenance data.

3. The operation and maintenance risk analysis method according to claim 2, characterized in that, The method further includes: Obtain local business load information for each of the service nodes and quality scores from multiple pre-configured benchmark time sources; Calculate the average time drift of each service node relative to the reference time source based on the local clock of the service node and the reference time source; For each of the service nodes, a weight value for each of the reference time sources is determined based on the local service load information and the quality score of each reference time source. For each of the service nodes, time synchronization is performed based on the average time drift and the weight value of each of the reference time sources.

4. The operation and maintenance risk analysis method according to claim 1, characterized in that, The step of extracting and fusing features from the first maintenance data based on the weight values ​​of the first maintenance data to generate first feature data includes: The first operation and maintenance data is projected onto a vector space through a linear transformation to generate a semantic feature vector. The first operation and maintenance data of one modality corresponds to one semantic feature vector, and the semantic feature vector includes a query vector, a key vector, and a value vector. The query vector and the key vector are normalized to obtain the similarity score between the first maintenance data of each of the two modalities; Based on the similarity scores, the value vectors are weighted and summed to obtain the feature vector of the first maintenance data for each modality; Based on the weight values ​​of the first maintenance data, multiple feature vectors are concatenated and fused to generate the first feature data.

5. The operation and maintenance risk analysis method according to claim 1, characterized in that, The step of performing fault analysis on the nodes in the target knowledge graph based on the first feature data to obtain a first risk result for each node includes: Based on the first feature data and the multilayer perceptron, fault analysis is performed on the nodes in the target knowledge graph to obtain a second risk result for each node. Based on the graph attention network, a fault cascade analysis is performed on the nodes in the target knowledge graph to obtain the third risk result for each node; A weighted linear calculation is performed on the second risk result and the third risk result to obtain the first risk result for each node.

6. The operation and maintenance risk analysis method according to claim 1, characterized in that, The method further includes: Obtain the second operation and maintenance data and the weight value of the second operation and maintenance data at historical moments, wherein one modality of the second operation and maintenance data corresponds to one weight value; Based on the weight values ​​of the second maintenance data, feature extraction and feature fusion are performed on the second maintenance data to generate second feature data; The second operation and maintenance data is semantically encoded and entity recognized to construct an initial knowledge graph. The initial knowledge graph includes multiple nodes and edges. The nodes are target entities determined based on the second operation and maintenance data, and the edges are used to connect related nodes. Based on the second feature data, the initial knowledge graph is optimized and updated to generate the target knowledge graph and the target value function.

7. The operation and maintenance risk analysis method according to claim 6, characterized in that, The step of optimizing and updating the initial knowledge graph based on the second feature data to generate the target knowledge graph and the target value function includes: Based on the second feature data, the initial knowledge graph is optimized to generate a first knowledge graph; Fault analysis is performed on the nodes in the first knowledge graph to obtain the fourth risk result for each node; The fourth risk result is evaluated based on the actual risk result of the node to obtain a risk prediction evaluation result, wherein the risk prediction evaluation result is used to measure the accuracy of this fault analysis; Based on the risk prediction and assessment results, the value function is trained, and the first knowledge graph is updated based on the trained value function, wherein the value function is used to update the weight values ​​of the second operation and maintenance data. If the value function or the risk prediction assessment result meets the preset conditions after training, the current value function is determined as the target value function, and the current first knowledge graph is determined as the target knowledge graph.

8. The operation and maintenance risk analysis method according to claim 6, characterized in that, The step of semantically encoding and entity recognition of the second operation and maintenance data to construct an initial knowledge graph includes: The second maintenance data is semantically encoded using a large language model to generate a first vector representation. The first vector representation is processed using a named entity recognition model to identify multiple target entities in the second operation and maintenance data; An initial knowledge graph is constructed based on the target entity and the first vector representation.

9. The operation and maintenance risk analysis method according to claim 7, characterized in that, The step of optimizing the initial knowledge graph based on the second feature data to generate a first knowledge graph includes: Based on the graph neural network (GNN) and the second feature data, the nodes in the initial knowledge graph are optimized to obtain the second knowledge graph; Based on the retrieval enhancement generated RAG and the second feature data, the nodes and edges in the second knowledge graph are optimized respectively to obtain the first knowledge graph.

10. The operation and maintenance risk analysis method according to claim 1, characterized in that, Before performing fault analysis on the nodes in the target knowledge graph based on the first feature data to obtain a first risk result for each node, the method further includes: A risk assessment is performed based on the first feature data to obtain a risk score for the first operation and maintenance data. If the risk score of the first operation and maintenance data is greater than the first threshold, the target knowledge graph is updated based on the first operation and maintenance data and the first feature data.

11. The operation and maintenance risk analysis method according to claim 10, characterized in that, When the risk score of the first maintenance data is greater than a first threshold, updating the target knowledge graph based on the first maintenance data and the first feature data includes: If the risk score of the first maintenance data is greater than the first threshold, the large language model is updated according to the incremental learning method and the first feature data. The updated large language model and named entity recognition model are used to process the first operation and maintenance data to obtain the first target entity corresponding to the first operation and maintenance data and the relationship between the first target entities. The target knowledge graph is updated based on the first feature data, the first target entity, and the relationship between the first target entity.

12. An operation and maintenance risk analysis device, characterized in that, include: The first acquisition module is used to acquire the first operation and maintenance data and the target knowledge graph at the current moment. The target knowledge graph includes multiple nodes and edges. The nodes are target entities determined based on the second operation and maintenance data at historical moments. The edges are used to connect nodes with associations. The first calculation module is used to determine the weight value of the first operation and maintenance data according to the pre-trained target value function, wherein one modality of the first operation and maintenance data corresponds to one weight value. The first processing module is used to perform feature extraction and feature fusion on the first operation and maintenance data according to the weight value of the first operation and maintenance data to generate the first feature data; The first analysis module is used to perform fault analysis on the nodes in the target knowledge graph based on the first feature data, and obtain the first risk result for each node.

13. A network device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the operation and maintenance risk analysis method as described in any one of claims 1 to 11.

14. A readable storage medium, characterized in that, include: The readable storage medium stores a program that, when executed by a processor, implements the steps of the operation and maintenance risk analysis method as described in any one of claims 1 to 11.

15. A computer program product, characterized in that, It includes computer instructions, which, when executed by a processor, implement the steps of the operation and maintenance risk analysis method as described in any one of claims 1 to 11.

Images