Machine room equipment fault diagnosis method and system based on big data

Abstract

The invention relates to the technical field of fault detection, and discloses a big data-based machine room equipment fault diagnosis method and system, and the method comprises the steps: collecting load information data streams generated by all equipment in a machine room in real time, and carrying out the filtering, and obtaining a filtered information sequence; performing grouping processing on the filtered information sequence by using a K-means clustering algorithm to obtain a dynamic change mode group, calculating a key statistical index, and obtaining an abnormal feature set; if the abnormal feature set exceeds a preset variance threshold, classifying the abnormal feature set and determining a fault mode to obtain a fault mode category set; matching the fault mode category set with a preset fault mode database to obtain a fault mode matching result, and generating a corresponding risk assessment report to obtain a risk assessment report; and adjusting the operation parameters of the machine room equipment to obtain the equipment operation parameters. According to the method, equipment faults can be diagnosed in time.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of fault diagnosis, and in particular to a data center equipment fault diagnosis method and system based on big data. BACKGROUND

[0002] At present, the stable operation of data center equipment is the key to business continuity. With the expansion of equipment scale and the enhancement of load dynamics, using sensor network chips to collect and analyze data has become the mainstream trend in the industry.

[0003] In the prior art, the mainstream data center monitoring system adopts an alarm mechanism based on a fixed threshold. When the device operating parameters, such as GPU usage and temperature, exceed the preset limit, an alarm is triggered. However, in actual operation, the device load changes in real time with the business demand, and a single fixed threshold cannot distinguish between normal business peaks and abnormal failure precursors. At the same time, the prior art lacks the ability to perform multi-source data fusion, local preprocessing, and preliminary intelligent judgment at the node end. This makes the raw data with a large amount of data uploaded directly without effective refinement, and it is impossible to capture abnormal signs associated with cross-indicators in the source of data generation in a timely manner. This makes the existing monitoring system often only issue an alarm when the fault has occurred or has intensified, and it is impossible to achieve true preventive maintenance.

[0004] Therefore, the prior art has the problem of being unable to diagnose equipment failure in a timely manner. SUMMARY

[0005] The present application provides a data center equipment fault diagnosis method and system based on big data to realize timely diagnosis of equipment failure.

[0006] In a first aspect, to solve the above technical problems, the present application provides a data center equipment fault diagnosis method based on big data, comprising: Real-time collection of load information data streams generated by each device in the data center, filtering of the load information data streams, and obtaining of filtered information sequences; Grouping processing of multi-dimensional data points in the filtered information sequences using a K-means clustering algorithm to obtain dynamic change mode groups; Calculating key statistical indicators of the dynamic change mode groups and scoring to obtain an abnormal feature set; If the variance of the abnormal feature set exceeds a preset variance threshold, classifying the abnormal feature set and determining a failure mode to obtain a failure mode category set; Matching the failure mode category set with a preset failure mode database to obtain a failure mode matching result; Generating a corresponding risk assessment report according to the failure mode matching result to obtain a risk assessment report; According to the risk assessment report, the operation parameters of the equipment room equipment are adjusted to obtain equipment operation parameters.

[0007] In a second aspect, the present application provides a big data-based equipment room equipment fault diagnosis system, comprising: A data acquisition module is configured to acquire load information data streams generated by each equipment in the equipment room in real time, filter the load information data streams, and obtain filtered information sequences. A clustering analysis module is configured to use a K-means clustering algorithm to group process multi-dimensional data points in the filtered information sequences, and obtain dynamic change mode groups. A feature extraction module is configured to calculate key statistical indicators of the dynamic change mode groups and score them, and obtain an abnormal feature set. A fault classification module is configured to classify and determine fault modes for the abnormal feature set if the variance of the abnormal feature set exceeds a preset variance threshold, and obtain a fault mode category set. A pattern matching module is configured to match the fault mode category set with a preset fault mode database, and obtain a fault mode matching result. A report generation module is configured to generate a corresponding risk assessment report according to the fault mode matching result, and obtain a risk assessment report. A parameter adjustment module is configured to adjust the operation parameters of the equipment room equipment according to the risk assessment report, and obtain equipment operation parameters.

[0008] Compared with the prior art, the present application has the following beneficial effects: (1) The present application can strip noise from dynamic and multi-dimensional operation data by time series filtering, clustering analysis and feature extraction of real-time load information streams, identify abnormal change patterns representing equipment health state degradation, and associate them with potential fault types through a classifier. This makes the fault diagnosis node advance from the traditional "alarm after fault occurs" to "early warning before fault occurs", leaving a key time window for operation and maintenance intervention.

[0009] (2) The present application uses a K clustering algorithm to automatically discover dynamic change mode groups of load data, rather than relying on manually preset fixed thresholds. It can adaptively learn the normal operation baseline of different equipment and different time periods, effectively overcoming the defects of high false alarm rate and poor adaptability of static threshold methods in dealing with business fluctuations. Combined with a support vector machine and other classifiers for pattern recognition, the accuracy and automation of fault type judgment are improved.

[0010] (3) The application converts the diagnosis result, i.e. the fault mode matching result, and the risk assessment report into specific control instructions. According to the early risk level, the preset strategy can be automatically matched and the equipment operation parameters can be adjusted to realize active intervention and closed-loop control on potential faults. This reduces the delay and misoperation risk of manual intervention and improves the overall efficiency and reliability of the machine room operation. BRIEF DESCRIPTION OF DRAWINGS

[0011] Figure 1 is a flow diagram of a machine room equipment fault diagnosis method based on big data provided by the first embodiment of the application; Figure 2 is a structural diagram of a machine room equipment fault diagnosis system based on big data provided by the second embodiment of the application. DETAILED DESCRIPTION

[0012] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the application.

[0013] Referring to Figure 1 , the first embodiment of the application provides a machine room equipment fault diagnosis method based on big data, including the following steps: S11, real-time collection of load information data streams generated by each equipment in the machine room, filtering of the load information data streams, and obtaining of filtered information sequences; S12, grouping processing of multi-dimensional data points in the filtered information sequences using a K-means clustering algorithm, and obtaining of dynamic change mode groups; S13, calculation of key statistical indicators of the dynamic change mode groups and scoring, and obtaining of an abnormal feature set; S14, if the variance of the abnormal feature set exceeds a preset variance threshold, classification of the abnormal feature set and determination of a fault mode, and obtaining of a fault mode category set; S15, matching of the fault mode category set with a preset fault mode database, and obtaining of a fault mode matching result; S16, generation of a corresponding risk assessment report according to the fault mode matching result, and obtaining of the risk assessment report; S17, adjustment of the operation parameters of the machine room equipment according to the risk assessment report, and obtaining of the equipment operation parameters.

[0014] In step S11, the load information data stream generated by each device in the machine room is collected in real time, the load information data stream is filtered, and a filtered information sequence is obtained, including: S111, collecting running data of each device in the machine room in real time to obtain a load information data stream; S112, performing time sequence smoothing processing on the load information data stream by using a sliding window mechanism to obtain a smoothed load sequence; S113, performing abnormal filtering on the smoothed load sequence based on a preset dynamic threshold range to obtain an abnormal filtering sequence; S114, predicting and filling missing values by using a preset ARIMA model according to the abnormal filtering sequence to obtain a filtered information sequence.

[0015] In step S111, the running data of each device in the machine room is collected in real time to obtain a load information data stream.

[0016] Through the sensor network deployed in the machine room, the running load data of each device is collected in real time. The sensor network includes temperature sensors, current sensors, vibration sensors, network flow monitors, etc., covering multi-dimensional indicators such as CPU usage rate, memory occupancy rate, disk I / O, network bandwidth usage rate, and environment temperature, humidity, etc. Each sensor collects data at a frequency of 10Hz, and the data format is unified as time-stamped structured data, forming a load information data stream.

[0017] It should be noted that the sensor network uses the Precision Time Protocol or the Network Time Protocol for clock synchronization to ensure that the data collected by each sensor is aligned under the same time reference, so that the multi-dimensional indicator values under the same timestamp are consistent.

[0018] Exemplarily, for the device "Rack_A_Slot_03_Server_01", the multi-dimensional load information data stream collected in 1 second (at a frequency of 10Hz) is embodied as a series of structured records arranged in time sequence. Its specific form is as follows: at T=2023-10-27T14:30:15.000Z, the collected record contains the following contents: timestamp: 2023-10-27T14:30:15.000Z, device ID: Rack_A_Slot_03_Server_01, metric set: CPU usage rate = 45.0%, memory occupancy rate = 68.5%, disk read rate = 12000KB / s, disk write rate = 8500KB / s, network bandwidth usage rate = 21.8%, and inlet air temperature = 24.3℃. The subsequent data points are similar.

[0019] In step S112, the load information data stream is time-series smoothed by using a sliding window mechanism to obtain a smoothed load sequence; The load information data stream is time-series smoothed by using a sliding window mechanism. Let the length of the sliding window be , for example , the load value at the moment in the original data stream is , then the smoothed value is calculated by the arithmetic mean of each data point in the window, and the calculation formula is: ; Among them, , for the data at the initial moment , the first window mean filling method is used to complete the smoothing, that is, the mean value calculated by the first complete window containing to is used to fill the smoothed values of to . For example, the original data of the CPU usage of a server collected within 10 seconds are 45%, 48%, 50%, 52%, 55%, 58%, 60%, 62%, 65%, and 68%, respectively, and the setting seconds, then the smoothed value of the third second is , and the fourth second is , forming a smoothed load sequence.

[0020] It should be noted that the window length W is dynamically adjusted according to the autocorrelation and volatility of real-time load data, rather than a fixed value. The specific dynamic configuration rule is that the autocorrelation function is calculated based on the load sequence of the device in the recent history time (for example, the past 15 minutes) periodically (for example, every minute). The window length is initially set to the lag order corresponding to the first time the autocorrelation coefficient decays to a preset decay threshold (such as 0.5). During the system running process, the autocorrelation coefficient is recalculated and the value is updated every fixed evaluation period (for example, 5 minutes) to adapt to the changes in load characteristics. For example, for a database server, its daily load presents a stable transaction processing feature with high autocorrelation in a short period (seconds), and the autocorrelation coefficient calculated based on historical data decays to less than 0.5 after a lag of 5 orders (i.e. 0.5 seconds), so its window length may be initially set to 5. During the monitoring of a sensitive operation requiring fast response, the window length may be dynamically reduced to 3 to more sensitively capture the transient changes in load.

[0021] In step S113, the smoothed load sequence is subjected to anomaly filtering based on a preset dynamic threshold range to obtain an anomaly filtered sequence.

[0022] Based on the equipment type and historical operating data, set reasonable preset dynamic threshold ranges for each load indicator. Specifically, for each metric (such as CPU utilization), its historical mean and standard deviation are calculated, and a set... The mean minus three standard deviations. Set the value to the mean plus three standard deviations. For example, for CPU utilization, the normal range can be set to... For memory usage, it can be set to... These thresholds can be adaptively adjusted based on equipment specifications, operating environment, and workload characteristics.

[0023] Next, iterate through each data point in the smoothed load sequence. Determine whether it satisfies: ; If a data point exceeds this range, it is identified as an outlier, removed from the sequence, and marked as "missing" at that position. The processed sequence is then output as the outlier sequence.

[0024] In step S114, based on the abnormal filtering sequence, a preset ARIMA model is used to predict and fill in missing values ​​to obtain the filtered information sequence.

[0025] To address data gaps arising from outlier removal in anomaly filtering sequences, a pre-defined ARIMA model is used for time series prediction and filling. An offline pre-training and online application strategy is employed. The construction of the pre-defined ARIMA model is completed through the following steps: First, during system deployment or periodic maintenance, long-term, uninterrupted load information sequences of various devices during their historical normal operation over the past three months are collected as training samples. Dedicated models are constructed for each typical device type and key indicator. Second, stationarity tests and necessary differencing are performed on the training samples to determine the differencing order d of the model. Subsequently, the optimal autoregressive order p and moving average order q are determined for each model using a grid search combined with the AIC information criterion. Finally, maximum likelihood estimation is used to estimate the model parameters, resulting in a trained ARIMA(p,d,q) model with fixed parameters, which is then stored in a model library—the pre-defined ARIMA model.

[0026] In the real-time filling stage, for each missing position in the anomaly filtering sequence, the system calls the corresponding preset ARIMA model from the model library according to the device type and the index type of the data source. The model takes the effective data points before and after the missing position as input conditions, performs one-step prediction, generates the expected value of the missing position, and fills the missing position in the sequence.

[0027] For example, in the CPU usage rate sequence, if the data at the 5th position is missing due to an anomaly, the expected value of the 5th position will be predicted based on the effective data at the 4th and 6th positions. After filling, the filled sequence is subjected to reverse difference to restore the original dimension, and the filtered information sequence is obtained.

[0028] In step S12, the multi-dimensional data points in the filtered information sequence are grouped using the K-means clustering algorithm to obtain a dynamic change pattern group, including: S121, extracting the peak height and fluctuation amplitude features from the filtered information sequence to obtain a multi-dimensional feature vector set; S122, K-means clustering of the multi-dimensional feature vector set to obtain a stable clustering group; S123, extracting the duration and burst frequency attributes of the stable clustering group, and determining the dynamic change pattern group according to the duration and burst frequency attributes.

[0029] In step S121, the peak height and fluctuation amplitude features are extracted from the filtered information sequence to obtain a multi-dimensional feature vector set.

[0030] The filtered information sequence is traversed in a sliding window manner, and the window length can be set to 5. Two key features, peak height and fluctuation amplitude, are extracted for the load data in each window. The peak height refers to the maximum value of the load in the window, reflecting the extreme value level of the load in that period. The fluctuation amplitude is obtained by calculating the standard deviation, and the calculation result is kept to two decimal places. For example, for the CPU usage rate sequence, if the data in a window is , the peak height is 62% and the fluctuation amplitude is 10%. The peak height and fluctuation amplitude extracted from each window are combined into a two-dimensional feature vector, and the feature vectors of all windows form a multi-dimensional feature vector set.

[0031] In step S122, the multi-dimensional feature vector set is subjected to K-means clustering to obtain a stable clustering group.

[0032] ​​​The K-means clustering algorithm is used to divide the multi-dimensional feature vector set composed of peak height and fluctuation amplitude. First, the multi-dimensional feature vector set is standardized by the Z-score standardization method. Then, the optimal value is automatically selected from the preset range [2, 10] by the silhouette coefficient method. Specifically, the silhouette coefficient of the K-means clustering result of the entire standardized feature vector set when K is 2 to 10 is calculated, and the K value corresponding to the maximum silhouette coefficient is selected as the optimal cluster number. Then, the Euclidean distance of each feature vector to each cluster center is iteratively calculated and it is assigned to the nearest center to form an initial cluster group. Then, the mean of all vectors in each group is recalculated as a new cluster center, and the assignment and update process is repeated until the position change of the cluster center is less than or reaches the preset iteration number 200 times, and finally a stable cluster group is obtained, and the output is the stable cluster group.

[0033] In step S123, the duration period and burst frequency attributes of the stable cluster group are extracted, and the dynamic change mode group is determined according to the duration period and the burst frequency attributes.

[0034] According to the stable cluster group, further extract the behavior attributes in the time dimension, the duration period and the burst frequency. The duration period refers to the average length of time that the load mode represented by the group continuously appears in the time sequence, which is obtained by calculating the mean value of the length of the continuous segment of all samples in the group on the time axis, wherein the time interval between two adjacent sample points is less than 3 times the sampling interval, and they are considered to belong to the same continuous segment; the burst frequency refers to the number of sudden appearances of the load mode in unit time, which is calculated by the burst frequency wherein, represents the number of non-continuous mutation points of the cluster group appearing in the time sequence, represents the total observation time. According to the preset quantization threshold, the two are defined according to the combination rule. The group that meets the long period and low frequency is determined as the "steady state operation mode group", the group that meets the short period and high frequency is determined as the "burst abnormal mode group", and the group that presents an intermediate state in the combination of period and frequency is classified as the "transition fluctuation mode group", and the dynamic change mode group is obtained.

[0035] It should be noted that the sample point that meets the following two conditions is defined as the non-continuous mutation point of the group: first, the sample point is classified into the current group; second, the sample point at the previous time does not belong to the current group.

[0036] It is worth mentioning that the quantization threshold, i.e. the threshold for defining long / medium / short period and high / low frequency, is dynamically generated based on historical data distribution. In the initialization or periodic update phase, the statistical distribution of the duration period and burst frequency of all historical groups is calculated using kernel density estimation. The dynamic threshold is set as the key quantile of the corresponding distribution. For example, the threshold of the duration period can be set as the 33% and 66% quantiles of its distribution, thereby dynamically dividing all historical patterns into three categories of short, medium and long; the threshold of the burst frequency is set as the 75% quantile of its distribution, to distinguish between low and high frequencies.

[0037] In step S13, the key statistical indicators of the dynamic change pattern group are calculated and scored to obtain an abnormal feature set, including: S131, mean calculation is performed on the dynamic change pattern group to obtain a group mean set; S132, according to the group mean set, variance calculation is performed on the dynamic change pattern group to obtain a group variance set; S133, statistical normalization processing is performed according to the group variance set and a deviation ratio is calculated, if the deviation ratio is greater than a preset deviation threshold, it is marked as a preliminary abnormal item, and a preliminary abnormal feature set is obtained; S134, scoring is performed on the preliminary abnormal feature set to obtain a comprehensive score, if the comprehensive score exceeds a preset score threshold, an abnormal feature set is obtained.

[0038] In step S131, mean calculation is performed on the dynamic change pattern group to obtain a group mean set.

[0039] According to the dynamic change pattern group, including the steady-state operation mode group, the burst abnormal mode group and the like, the arithmetic mean of all sample points inside is calculated respectively to form the group mean set.

[0040] In step S132, according to the group mean set, variance calculation is performed on the dynamic change pattern group to obtain a group variance set.

[0041] Taking the mean vector of each group in the group mean set as a reference, for each dynamic change pattern group, the variance of all sample points inside in each load indicator dimension is calculated respectively. The sample variance formula is used for variance calculation. For a certain group in a specific indicator, such as CPU usage, the calculation formula is wherein is the number of samples in the group, is the indicator value of the sample point, The mean value of the group on the index obtained from the group mean set. The variance value is calculated independently on each load dimension to form a multi-dimensional variance vector representing the intensity of the group load fluctuation, and the variance vector of each group constitutes a group variance set.

[0042] In step S133, statistical normalization processing is performed according to the group variance set and a deviation ratio is calculated, and if the deviation ratio is greater than a preset deviation threshold, it is marked as a preliminary abnormal item to obtain a preliminary abnormal feature set.

[0043] The group variance set is standardized to eliminate the dimension effect. Normalization uses the Z-score method, which is performed independently for each load indicator dimension. The mean value of all group variances in this dimension is calculated and the standard deviation . The original variance of each group in this dimension is converted to a standard score . After normalization, the comprehensive deviation ratio of each group across dimensions is calculated, which is defined as the ratio of the sum of the absolute values of the standard scores of each dimension of the group to the total number of dimensions, that is , where is the total number of load indicator dimensions. This ratio reflects the comprehensive deviation degree of the load fluctuation of the group relative to the overall distribution. The system compares the calculated deviation ratio with the preset deviation threshold , if , it is determined that the fluctuation mode of the group has significant abnormality, and it is marked as a preliminary abnormal item, and its corresponding group identification, variance vector and deviation ratio are recorded. All marked preliminary abnormal items constitute a preliminary abnormal feature set.

[0044] It should be noted that the preset deviation threshold is set based on the statistical method of historical data distribution, and the 95th percentile of all historical deviation ratios is taken as the preset deviation threshold, which can be set to 2.

[0045] In step S134, the preliminary abnormal feature set is scored to obtain a comprehensive score, and if the comprehensive score exceeds a preset score threshold, an abnormal feature set is obtained.

[0046] Each item in the preliminary abnormal feature set is scored in multiple dimensions. The scoring basis includes the deviation ratio of the group corresponding to the item, the group size, i.e. the number of samples, the dynamic change mode type to which the group belongs, such as the risk weight of the sudden abnormal mode group is usually higher than that of the steady state operation mode group, and the variance contribution of the item on each load indicator dimension. The system sets a weight for each scoring dimension, and calculates the comprehensive score by weighted summation, the formula is , where is the deviation ratio, is the number of samples in the group, and its value is greater than 1, is the risk weight based on the mode type, is the aggregation index of the cross-dimension variance contribution, and the calculation formula is , wherein, is the dimension total number of the load index; is the Z-score normalized variance standard score of the group in the dimension; is the threshold of single-dimension variance anomaly, and is usually , which is based on the statistical significance level of the standard normal distribution, and under the normal distribution assumption, |z|>1.5 can be considered as a certain degree of anomaly; is an indicator function, which takes the value of 1 when the condition in the parentheses is true, and 0 otherwise. The calculated comprehensive score is compared with the preset score threshold . If , the item is finally confirmed as an abnormal feature and is included in the abnormal feature set; otherwise, it is excluded. The preset score threshold is usually set based on the score distribution of historical abnormal events, for example, taking the quantile of the score distribution of the confirmed abnormal events.

[0047] It should be noted that the setting of the risk weight is achieved by analyzing historical data, statistically analyzing the prior probability of each type of mode group in finally triggering a fault event requiring human intervention, and then setting the weight based on normalization. For example, in an embodiment, if it is found by statistics that the probability of “sudden abnormal mode group” as a precursor of failure is 3 times that of “steady state running mode group” and 1.5 times that of “transient fluctuation mode group”, then the normalized setting of The exemplary values of are as follows: (steady state)=0.3, (transient)=0.6, (sudden)=0.9.

[0048] It should be noted that the weight coefficient is set by the operation and maintenance expert according to the contribution degree of each type of index to the fault risk. Exemplarily, the weight coefficient can be set as , , , .

[0049] In step S14, if the variance of the abnormal feature set exceeds the preset variance threshold, the abnormal feature set is classified and the failure mode is determined to obtain a failure mode category set, including: S141, extracting the load deviation amplitude of each feature in the abnormal feature set, calculating the variance of the load deviation amplitude, and obtaining a feature variance set; S142, filter out features in the feature variance set that exceed a preset variance threshold to obtain a variance feature subset; S143, Based on the variance feature subset, construct feature vectors and use a preset support vector machine to perform pattern separation to obtain a set of classification labels; S144, extract the confidence score of the classification label set, analyze the potential failure modes based on the confidence score according to the preset confidence threshold, and obtain the failure mode category set.

[0050] In step S141, the load deviation amplitude of each feature in the abnormal feature set is extracted, and the variance of the load deviation amplitude is calculated to obtain the feature variance set. For each anomalous feature item in the set of anomalous features, extract its corresponding load deviation magnitude sequence. Load deviation magnitude refers to the absolute difference sequence between the base load data points constituting the anomalous feature and the baseline mean of its group. For each anomalous feature item, obtain the actual values ​​of all its sample points in each load dimension, and subtract the corresponding dimension value from the mean vector of the group corresponding to that feature, resulting in a set of deviation magnitude value sequences. Next, dimensionless processing is performed on the deviation magnitude sequences under each load dimension. Specifically, the overall deviation magnitude distribution of all anomalous feature items in that dimension is used as a reference, and Z-score standardization is applied to the deviation magnitude sequence of the current item. The global mean and global standard deviation of the deviation magnitudes of all samples of all anomalous feature items under that load dimension are selected as the standardization formula values. Subsequently, the statistical variance of the deviation magnitude sequence of each anomalous feature item is calculated, and the variance formula is... ,in This represents the number of sample points contained in the anomaly feature. For the first The standardization deviation of each sample point This is the arithmetic mean of the deviation amplitudes of the sequence. The calculated variance value characterizes the discrete fluctuation intensity of the load deviation within this anomaly. Record the identifier of each anomaly and its corresponding variance value to form a feature variance set.

[0051] In step S142, features exceeding a preset variance threshold in the feature variance set are selected to obtain a variance feature subset.

[0052] The variance value corresponding to each outlier feature in the feature variance set is compared with the preset variance threshold. Compare them. If the variance of a certain abnormal feature is greater than... If a feature exhibits significant internal volatility, it indicates a high degree of dispersion in its load deviation amplitude, potentially corresponding to a more complex or evolving failure mode, and is thus filtered out. All filtered anomalous features constitute a subset of variance features.

[0053] It should be noted that the preset variance threshold According to the statistical distribution of historical and real-time data, it is dynamically calculated and periodically updated. The dynamic setting rule is as follows: a historical window is maintained, such as in the past 30 days, all abnormal feature items marked as “normal operation” or finally not causing failure can be regarded as “benign abnormality” or “false alarm” variance value set, which is the “baseline variance set”. It is set to the (100-a) percentile of the baseline variance set, that is, a% of benign abnormal variance is allowed to exceed this threshold. Alpha is a configurable significance level parameter, usually a small value, for example, alpha = 5, which means that the system will filter out the top 5% of the most volatile abnormal features in the variance distribution and regard them as “high variance” candidates that need further attention. Exemplarily, in a certain statistical period, 1000 abnormal feature items are collected from the historical benign abnormality. The 95th percentile of the 1000 values is calculated, and = 120.

[0054] In step S143, according to the variance feature subset, a feature vector is constructed and a preset support vector machine is used for pattern separation to obtain a classification label set.

[0055] Based on each filtered abnormal feature item in the variance feature subset, a multi-dimensional feature vector is constructed for pattern classification. The feature vector includes the load deviation amplitude variance of the abnormal feature item itself, the duration period of the dynamic change mode group to which it belongs, the key statistical index mean, and the score of the abnormal feature item in the comprehensive score, etc. Subsequently, the constructed feature vector set is input into the preset classifier after Z-score standardization for pattern classification.

[0056] The classifier uses a support vector machine classifier, uses a radial basis kernel function to process possible nonlinear patterns in the feature space, and determines the penalty parameter and the kernel parameter through grid search optimization. The training of the classifier is based on historical labeled fault mode samples, which come from historical fault work orders, operation and maintenance records, and expert labeling, and cover various typical fault modes such as “CPU overload fluctuation type”, “memory leak slow change type”, “disk I / O burst type”, “network traffic anomaly type”, etc.

[0057] In the prediction phase, each input feature vector is calculated by kernel function with the support vector obtained by training, and substituted into the decision function , wherein x represents the new sample feature vector to be classified, that is, the vector containing variance, period, frequency and other multi-dimensional attributes constructed for a high-variance abnormal feature in step S143. represents the total number of support vectors, i.e. the number of key samples located on the boundary of the classification margin or misclassified after training is completed; represents the Lagrange multiplier corresponding to the th support vector, whose value is obtained by solving the optimization problem in the training; represents the Lagrange multiplier corresponding to the th support vector, whose value is obtained by solving the optimization problem in the training; represents the original class label of the th support vector in the training set, taking values of or ; represents the feature vector of the th support vector itself, i.e. the sample point selected as the support vector in the training set; represents the kernel function used to calculate the similarity between the new sample and the support vector in the high-dimensional feature space, which adopts the radial basis kernel function in the present embodiment; represents the bias term, i.e. the intercept of the decision hyperplane, which is determined together with in the training. The sign of the output value of the decision function determines the predicted class of the new sample

[0058] , and the absolute value size can reflect the classification confidence. The one-versus-one strategy is adopted to deal with the multi-classification problem, and the calibrated probability through Platt scaling gives a confidence score for each predicted output. Finally, all the predicted results are summarized into a classification label set, each entry of which contains an abnormal feature identifier, a predicted fault mode label and a confidence score.

[0059] It should be noted that the training of the preset support vector machine classifier has explicit requirements for the quality and quantity of the historical labeled samples to ensure the generalization ability and classification reliability of the model. First, for each fault mode category to be identified, the number of training samples needs to reach 50. Second, when the sample quantity difference between different categories exceeds, for example, 3:1, the synthetic minority over-sampling technique is adopted to make the sample quantities of various categories relatively balanced.

[0060] First, the predicted fault mode label corresponding to each abnormal feature item and its associated confidence score are extracted from the classification label set. Then, based on the pre-set confidence threshold, all the predicted results are preliminarily filtered to eliminate the classification labels with too low confidence, for example, lower than 0.70. Then, the occurrence frequency of each fault mode label is calculated , wherein, represents the occurrence frequency of the fault mode label , denotes the total number of labels in the filtered set of classification labels, denotes the fault mode label corresponding to the th abnormal feature item in the set, is an indicator function, which takes the value 1 when the condition in the parentheses is true, and 0 otherwise. Then, the fault impact range of each label corresponding to the abnormal feature item and the historical recovery period attribute are comprehensively analyzed. The fault impact range attribute is evaluated based on the proportion of the device cluster associated with the abnormal feature, using the formula , where is the number of abnormal devices, is the total number of devices in the device cluster, is the fault impact range (unit: %); the recovery period attribute is set according to the average repair time of similar faults in the historical database. For example, if the frequency of a "disk I / O burst type" label is high, and the impact range of its associated feature covers 40% of the storage cluster, and the historical average recovery period is 3 hours, it is determined as a high-priority potential fault mode. Finally, the set of labels that meet the preset aggregation conditions, i.e., the frequency is greater than the frequency threshold and the impact range is greater than the impact threshold, is determined as the set of fault mode categories.

[0061] It should be noted that the frequency threshold is set based on historical statistical data, for example, a retrospective analysis of historical data shows that the median frequency of occurrence of related abnormal features before the final confirmation of a fault is 4 times. And the 95% quantile of the frequency of occurrence of abnormal features of ordinary fluctuations that did not cause faults during the same period is 2 times. Therefore, the threshold can be set to 3 times, which is exactly between the extreme case of ordinary fluctuations and the typical case of fault precursors. The impact threshold is set according to the specific device, and in this embodiment it is set to 40%.

[0062] It should be noted that the specific classification rules of fault types include: CPU overload fluctuation type, i.e., peak height > 85% and fluctuation amplitude > 15% and duration period > 5 minutes. Memory leak gradual change type, i.e., memory usage rate continuously rises such as slope > 1% / minute, fluctuation amplitude < 5%, and duration period > 30 minutes. Disk I / O burst type, i.e., disk I / O waiting time > 100 ms, burst frequency > 3 times / minute. Network traffic anomaly type, i.e., network bandwidth usage rate > 80%, fluctuation amplitude > 20%. Hardware degradation type, i.e., vibration / temperature indicators continuously deviate from the baseline, load shows no significant abnormality, and only one device appears independently.

[0063] In step S15, the set of fault mode categories is matched with the preset fault mode database to obtain a fault mode matching result, including: S151, extracting a category key attribute set according to the fault mode category set, matching with a preset fault mode database to obtain a first matching record set; S152, calculating an attribute intersection ratio according to the first matching record set, and if the attribute intersection ratio exceeds a preset ratio threshold, screening out a second matching record set; S153, calculating a matching degree score of the second matching record set and the category key attribute set to obtain a matching degree score set; S154, selecting a record with the highest score as a fault mode matching result according to the matching degree score set.

[0064] In step S151, a category key attribute set is extracted according to the fault mode category set, matched with a preset fault mode database to obtain a first matching record set.

[0065] Firstly, for each fault mode category in the fault mode category set, its core features for accurate description are extracted to form a category key attribute set. The set usually contains fault type labels such as "CPU overload type", typical load numerical characteristics such as CPU usage rate peak range, fluctuation amplitude, time behavior characteristics such as continuous period, burst frequency, spatial influence characteristics such as typical influence device proportion, and associated abnormal index combination such as whether accompanied by temperature rise and other multi-dimensional attributes.

[0066] Subsequently, the category key attribute set is used as a composite query condition to perform a multi-attribute joint query on the preset fault mode database. The core of this query is to perform semantic similarity matching on the text nature fault type label attribute. Specifically, the key words of the query label and the database record label are extracted, and the Jaccard similarity coefficient is calculated to realize it. If the similarity exceeds the preset similarity threshold, for example, 0.4, it is considered as a preliminary match on this attribute. At the same time, for numerical and range type attributes such as load peak and influence proportion, it is checked whether the typical value range of the database record overlaps with the range specified by the query condition; for threshold type attributes such as burst frequency, numerical size comparison is performed. Finally, the database records that meet the similarity of all fault type labels and the matching rules of the remaining multiple key attributes at the same time are retrieved to form the first matching record set.

[0067] The preset fault mode database is a structured knowledge base, whose core stores standardized fault mode templates refined from historical fault events and expert experience. Each record contains a unique fault mode identification, a standardized fault name and its detailed description, and defines a multi-dimensional feature fingerprint for intelligent matching, which covers typical load characteristics of the fault, such as affected performance indicators, abnormal value range and fluctuation mode, time behavior characteristics, such as duration cycle and occurrence frequency, and spatial impact characteristics, such as typical spread range. In addition, each record is also associated with extended knowledge required for diagnosis and treatment, including possible root causes, recommended processing steps and recovery schemes, related historical case references, and estimated recovery time.

[0068] It should be noted that the matching rules include semantic matching rules, i.e. the semantic similarity of the fault type label must be greater than a preset similarity threshold, such as 0.4, which is determined based on the accuracy of historical fault label matching. When the similarity is 0.4, the precision rate can reach 80%. The numerical range attribute rule is that the typical numerical range stored in the database record must have an intersection with the numerical range specified in the query condition. For example, the query condition is "CPU peak value range [85%, 100%]", the database record is "[80%, 95%]", the intersection is [85%, 95%], and the matching is successful. If the record is "[70%, 82%]", there is no intersection, and the matching fails. The threshold type attribute rule is that the value stored in the database record must satisfy the size relationship defined in the query condition. For example, the query condition is "burst frequency > 4 times / hour", and the "typical frequency" in the database record is 5 times / hour, then the matching is successful.

[0069] S152, according to the first matching record set, calculate the attribute intersection ratio, if the attribute intersection ratio exceeds the preset ratio threshold, then filter out the second matching record set.

[0070] Each historical fault record in the first matching record set is traversed, and its stored complete attribute set is compared with the category key attribute set used by the current query item by item. The attribute intersection ratio is calculated using the formula , wherein, , the matching rules are consistent with step S151, , otherwise . is the weight of the th attribute. The calculated intersection ratio of each record is compared with a preset ratio threshold, for example 70%. The historical records with an attribute intersection ratio greater than or equal to the threshold are included in the second matching record set.

[0071] It should be noted that the setting of the attribute weight wi is based on the quantitative calculation and determination of the information gain and the degree of discrimination of each attribute in historical fault judgment. Specifically, by analyzing the historical fault case library, the contribution of each attribute to the discrimination of different fault modes is calculated. The importance score of each attribute is normalized by using the random forest model for feature importance analysis, and directly used as the weight wi of the attribute. For example, if the analysis shows that the contribution of "peak height" to fault classification is 0.4, the contribution of "impact range" is 0.3, the contribution of "burst frequency" is 0.2, and the contribution of other attributes is 0.1, then these normalized values are directly set as the weights of the corresponding attributes. The setting basis of the preset proportion threshold is also based on statistical analysis of historical matching data. The distribution difference of correct matching records and error matching records in the attribute intersection proportion in each query is calculated by simulating the matching process on historical data. The threshold is usually set at a critical point that can filter out most of the error matching, for example, more than 85%, while retaining most of the correct matching, for example, more than 90%, which can be set to 70%.

[0072] In step S153, the matching degree scores of the second matching record set and the category key attribute set are calculated to obtain a matching degree score set.

[0073] Each historical fault record in the second matching record set is traversed. For each record, its feature vector, such as specific numerical value, range center value, original value of similarity, etc. is compared with the ideal feature vector defined by the current fault mode category key attribute set. The matching degree score is calculated by a weighted cosine similarity function. A matching degree score is calculated for each record in the second matching record set, thereby forming a matching degree score set, where each content is (historical record ID, matching degree score).

[0074] wherein the category key attribute set is converted into a feature vector that can be used for numerical calculation. The conversion rule is as follows: for text label type attributes such as "fault type label", it is converted into a fixed-dimensional numerical vector through an industry standard mapping table. For example, the label "CPU overload type" is mapped to a 50-dimensional semantic vector. For numerical range type attributes such as "CPU peak range [85%, 100%]", the range median value is taken as the scalar value of the dimension, i.e. 92.5. For single numerical type attributes such as "burst frequency = 5 times / hour", the numerical value is directly used. For Boolean / enum type attributes such as "whether accompanied by temperature rise", it is converted into a binary value (1 or 0).

[0075] The weight setting of cosine similarity directly follows the normalized weight obtained based on the feature importance analysis of the historical fault case library. That is, the contribution degree of each attribute differentiation calculated by the decision tree or random forest model is used as the basis for weighting in each dimension of the cosine similarity calculation. For example, if the importance score of "peak height" is 0.40 and the importance score of "impact range" is 0.30, then the weights of "peak height" and "impact range" in the weighted cosine similarity calculation are set to 0.40 and 0.30, respectively.

[0076] It should be noted that the setting of the ideal feature vector includes: for numerical range type attributes, usually take the range median. For example, the query condition is CPU peak range [85%, 100%], and 92.5 is set. For threshold type attributes: directly use the threshold itself.

[0077] In step S154, according to the matching score set, the record with the highest score is selected as the fault mode matching result.

[0078] First, the matching score set is sorted in descending order, and the historical fault record with the highest score is selected. Then, the pre-stored and structured fault mode matching result of the selected record is extracted, including the standardized fault name and label, the detailed explanation of the fault, the typical root cause analysis, and the possible impact range.

[0079] For example, an abnormal mode has a matching score of 0.92, 0.85 and 0.78 with the historical record, and the record "FaultTemplate_CPU_001" corresponding to the highest score 0.92 is selected. The pre-stored fault mode description in the record is extracted as the matching result, and the content example is as follows: the "CPU overload fluctuation type" fault, the specific performance: the process continuously occupies high CPU and is accompanied by periodic large fluctuations; typical root cause: application resource leakage or poor heat dissipation leading to CPU frequency reduction; impact range: the server, but it may spread to related nodes through cluster dependency; historical average recovery period: about 2.5 hours; recommended handling steps: including logging into the server to identify high-occupancy processes, checking hardware monitoring data, and isolating the node in the load balancer as needed.

[0080] In step S16, according to the fault mode matching result, a corresponding risk assessment report is generated, and a risk assessment report is obtained, including: S161, according to the fault mode matching result, retrieving the associated risk attribute set from the pre-set load information sequence database to obtain a first risk attribute set; S162, if the fluctuation amplitude of the first risk attribute set exceeds the pre-set fluctuation threshold, outputting a second risk attribute set; S163, according to the second risk attribute set, calculating a risk impact factor and matching a preset risk probability table, calculating a cumulative risk value, and obtaining a risk value sequence; S164, according to the risk value sequence, filling a preset risk assessment report template, and obtaining a risk assessment report.

[0081] In step S161, according to the fault mode matching result, an associated risk attribute set is retrieved from a preset load information sequence database, and a first risk attribute set is obtained.

[0082] First, the core metadata guiding data retrieval is extracted from the fault mode matching result, including the main associated device or cluster identifier of the mode, the impact index such as CPU usage, and the typical development required observation historical time window. Then, the spatio-temporal query condition is constructed, and the relevant load data of the target object in the specified time range is retrieved from the preset load information sequence database. Next, all calculations are completed in a second-level time window (such as <5 seconds) on these original sequences to ensure real-time performance, mainly including calculating the current value, mean value, minimum value, and maximum value of the core impact index; using linear regression to calculate the change slope of the core index; calculating the standard deviation of the core index sequence as the quantitative value of the fluctuation amplitude; based on the current retrieval result, statistics on how many devices in the target cluster have the same index and the same abnormality, and calculating the proportion of the total number of devices in the cluster. A structured attribute set, i.e. the first risk attribute set, is generated. The set contains the current value, mean value, extreme value, and change trend slope of the core index, and also calculates the fluctuation amplitude variance of the sequence and the proportion of devices showing similar abnormal characteristics to quantify the real-time impact range.

[0083] It should be noted that the preset load information sequence database is a structured time series database, and the main fields of the core data table include device ID (unique identifier), timestamp, and a group of numerical load index fields such as cpu_usage, mem_usage, disk_io, net_traffic, and temp, which store preprocessed values. The database establishes a joint primary key index on (device ID, timestamp), and single-column indexes on device ID and timestamp to support fast retrieval of a specific device in a time range.

[0084] In step S162, if the fluctuation amplitude of the first risk attribute set exceeds a preset fluctuation threshold, the second risk attribute set is output.

[0085] First, extract the attribute values about the fluctuation amplitude in the first risk attribute set, which is usually the standard deviation of the key performance indicators (such as CPU usage, memory occupancy). Then, compare the fluctuation amplitude with a preset fluctuation threshold. If the fluctuation amplitude exceeds the preset fluctuation threshold, the output is the second risk attribute set.

[0086] Among them, the preset fluctuation threshold is dynamically set according to the stability requirement in the fault mode matching result, the historical baseline performance of the device, and the business tolerance. For example, for a database core service that requires high stability, the fluctuation threshold of CPU usage may be set to 2%; while for a batch processing computing cluster, the threshold can be relaxed to 10%.

[0087] In step S163, according to the second risk attribute set, the risk impact factor is calculated and matched with the preset risk probability table, the cumulative risk value is calculated, and the risk value sequence is obtained.

[0088] First, based on the second risk attribute set, the risk impact factor is calculated , the formula is: ; Among them is the weight of each component, is the severity component, which measures the degree of deviation of the current indicator value from the safety baseline, , CurrentValue is the current value of the core indicator (such as CPU usage 92%). SafeThreshold is the upper limit of safe operation of the indicator, such as CPU usage 80%, which is set according to experience. CriticalThreshold is the critical danger threshold of the indicator, such as CPU usage 98% which is set according to experience. is the trend component, which measures the rate of deterioration of the indicator, , Slope is the linear regression slope or simple change rate of the core indicator in the recent observation window, such as the past 5 minutes. MaxSlope is the "maximum reasonable deterioration slope", which is obtained by statistical analysis of historical data, such as the maximum normal increase of CPU usage per minute is 2%. is the fault impact range in S144. is the fluctuation component, which measures the dispersion of the indicator sequence: ; Among them, CurrentVariance is the variance of the indicator sequence in the current observation window. BaseVariance is the baseline variance of the indicator in the normal stable state. AlertVariance is the preset fluctuation threshold in S162. The weight coefficient , , , According to experience setting, it can be set to 0.4, 0.3, 0.2, 0.1 respectively. All weight components are normalized to the interval [0, 1], so the theoretical value range of risk impact factor I is also [0, 1].

[0089] Subsequently, this risk impact factor is combined with the current identified failure mode . As a joint condition, the preset risk probability table is queried. The preset risk probability table is a conditional probability mapping established in advance through historical failure data statistical analysis or expert experience, which gives the conditional probability of occurrence of a serious failure event in the future within a certain time window under a certain failure mode and a certain risk impact intensity . Then, combined with the current , the cumulative risk value in the future from the current time is calculated , is a process of converting instantaneous risk probability into time cumulative risk, the core of which is to construct and integrate a time-varying risk rate function . Based on the conditional probability , the instantaneous risk rate at the current time is estimated by the inverse operation of the exponential survival model . Subsequently, according to the typical risk evolution model of the failure mode , such as linear growth , . Finally, the cumulative risk value is obtained by integrating the risk rate function from the current time to the future target time to get the cumulative risk function , and converted to the failure occurrence probability . By calculating the value after a series of key time points in the future, such as 5, 15, 30, 60 minutes, a curve representing the cumulative evolution of risk over time, i.e. a risk value sequence, is formed.

[0090] In step S164, according to the risk value sequence, fill in the preset risk assessment report template to obtain the risk assessment report.

[0091] Firstly, a structured pre-set risk assessment report template is called, which defines all the sections, data fields and visualization chart placeholders required for the report. Then, the risk value sequence and related data are automatically filled into the corresponding positions of the template, and the report abstract part is filled with the current time, target device, and diagnosed core failure mode; the diagnosis basis part summarizes the key abnormal features triggering the assessment and the matched historical failure mode, providing traceability for the conclusion; the risk quantification analysis part draws a trend chart of the cumulative risk over time with the risk value sequence, and lists the core index real-time values, trends and impact ranges on which the risk impact factor is calculated, outputting a risk assessment report.

[0092] In step S17, according to the risk assessment report, the operation parameters of the equipment room device are adjusted to obtain the device operation parameters, including: S171, according to the risk assessment report, the risk level is analyzed to obtain a first risk parameter set; S172, comparing the first risk parameter set with the operation parameters of the equipment room device to obtain a comparison deviation, and if the comparison deviation exceeds a preset comparison threshold, outputting a second risk parameter set; S173, matching the second risk parameter set with a preset adjustment table to generate an adjustment instruction set and apply it to the equipment room device to obtain the device operation parameters.

[0093] In step S171, according to the risk assessment report, the risk level is analyzed to obtain a first risk parameter set.

[0094] Firstly, the explicit risk level is extracted from the "report abstract" or "risk quantification analysis" section of the report, such as "high risk", "medium risk", and the corresponding key load indicator target value. High risk triggers "strong intervention", and the target is to adjust the core load indicator to the lower limit value of its historical safety baseline (such as the 25th percentile of CPU usage). Medium risk triggers "medium intervention", and the target is to adjust the core load indicator to the median value of its historical safety baseline (such as the 50th percentile). Low risk triggers "weak intervention", and the target is to adjust the core load indicator to an optimized value slightly better than the current value (such as 90% of the current value). The specific target threshold Target_Value is determined by querying the historical indicator distribution percentile of the target device. For example, for "high risk" CPU overload, if the 25th percentile of the historical CPU usage of the server is 30%, then Target_CPU is set to 30%. Then, the values R(t1) and R(t2) of the risk value sequence at two consecutive future time points, such as t1=5 minutes and t2=15 minutes, are analyzed. The disposal time requirement T_response is dynamically determined by the risk growth rate, and the calculation formula is: . Wherein, , With The minimum and maximum response time window allowed by the system, such as 2 minutes and 60 minutes. Then, the target device list Device_List is directly taken from the device identifiers enumerated in the "Impact Scope Analysis" section of the report. For reports that only provide a proportion, according to the associated cluster information in the fault mode matching result, combined with real-time load ranking, the top N devices with the heaviest load or the most significant deviation from the baseline are listed as adjustment targets, and N is calculated by multiplying the impact proportion by the cluster size.

[0095] Exemplarily, a report is parsed, with a risk level of "high risk" and an associated indicator of CPU usage, and a current value of 92%. According to Rule 1, the 25th percentile of the historical baseline is 30%, so Target_CPU = 30% is set. The report shows R(5min) = 0.4 and R(15min) = 0.7. The risk growth rate is calculated as (0.7-0.4) / (15-5) = 0.03 / min, and the response time requirement is T_response = max(2, min(60, 10 / (0.7-0.4))) ≈ max(2, min(60, 33.3)) = 33.3 minutes. The report indicates that the impact scope involves "Web Cluster A". Cluster A contains 10 servers, and the top 3 servers with the highest current CPU usage are selected to generate Device_List = [Web-A-01, Web-A-05, Web-A-08]. Finally, the first risk parameter set is integrated: {Target_CPU: 30%, T_response: 33min, Device_List: [Web-A-01, Web-A-05, Web-A-08]}.

[0096] In step S172, the first risk parameter set is compared with the operating parameters of the equipment room, and a comparison deviation is obtained. If the comparison deviation exceeds a preset comparison threshold, a second risk parameter set is output.

[0097] First, the current operating parameters of the target devices or clusters specified in the first risk parameter set are collected in real time to form a current parameter snapshot . The snapshot includes indicators corresponding to the target parameter baseline values in the first risk parameter set, such as the current CPU usage , memory occupancy , disk I / O latency , and environmental temperature , etc. For each key indicator, the absolute deviation between its current value and the target baseline value in the first risk parameter set is calculated as the comparison deviation. For numerical indicators (such as CPU usage), the comparison deviation Deviation is usually calculated as the absolute difference: , where from the first risk parameter set. For example, if the target reference value and the current value = 92%, the comparison deviation of CPU usage rate = 8%. Then, the calculated comparison deviation of each item is compared with the corresponding preset comparison threshold to screen out the parameter items that need immediate intervention. The preset comparison threshold is set according to the index characteristics and business tolerance, which can be set to 15% more than the target value. After traversing all the indexes with calculated deviations, only when the Deviation of a certain index is greater than its , it is determined that the deviation of the parameter item is significant and needs to be adjusted. The screened parameter items with significant deviations and their related attributes, including the original target value, the current value, the deviation value, and the urgency requirement inherited from the first risk parameter set, device identification, etc., are re-encapsulated to form the second risk parameter set.

[0098] In step S173, the second risk parameter set is matched with the preset adjustment table to generate an adjustment instruction set and apply it to the machine room device to obtain the device running parameter.

[0099] According to the characteristics of each key risk parameter in the second risk parameter set, the preset adjustment table is queried to determine specific and executable operation instructions. The preset adjustment table is a structured strategy knowledge base, each record of which contains at least the following key fields, trigger condition, such as , target device type, and corresponding adjustment action instruction and expected target value, and its structure is [Rule ID, Trigger Condition, Adjustment Action Value, Expected Target Value]. Each entry in the second risk parameter set is used as a composite query key to perform matching retrieval in the preset adjustment table to generate a specific and device-identifiable adjustment instruction set. The matching process follows the exact matching and priority rules. For example, for the above CPU load item, first find the record that meets , and completely. If found, adopt the adjustment action in the record. All the retrieved adjustment actions for different items in the second risk parameter set and different devices are output as an adjustment instruction set. The adjustment instruction set is applied to the target machine room device to obtain the device running parameter.

[0100] It is worth mentioning that the specific content of the preset adjustment table includes multi-dimensional trigger conditions and accurate response actions. The trigger condition serves as a matching key, mainly including high-dimensional classification labels matched from the fault mode database, such as "CPU overload fluctuation type" or "memory leakage slow change type"; the device category to which the explicit rule applies, such as "X86 virtualization server" or "line-level precision air conditioner"; the specific monitoring index to which the specified rule is directed, such as "CPU usage" or "disk average response time"; and the deviation severity interval, that is For example, for CPU usage, the mild deviation interval (5%, 10%], the moderate deviation interval (10%, 20%] and the severe deviation interval (20%, +∞) can be set. The response action serves as an output value, which defines specific and automatically executable operations. These actions differ according to the device type. At the same time, the action is associated with an explicit execution target value, such as "stabilize the CPU usage to below 75%" or "maintain the cabinet inlet air temperature at 24℃", which provides a verification benchmark for the adjustment effect. The establishment of the adjustment table is based on historical data mining, which sorts, abstracts and formats common fault scenarios, standard operation procedures in the handling manual and effective actions in the emergency drill to form core rule entries.

[0101] In summary, the application discloses a machine room equipment fault diagnosis method based on big data, which can solve the problem of not being able to diagnose equipment faults in time.

[0102] With reference to Figure 2 The second embodiment of the application provides a machine room equipment fault diagnosis system based on big data, which comprises: A data acquisition module is configured to acquire load information data streams generated by each device in the machine room in real time, filter the load information data streams, and obtain filtered information sequences. A clustering analysis module is configured to use a K-means clustering algorithm to group process multi-dimensional data points in the filtered information sequences, and obtain dynamic change mode groups. A feature extraction module is configured to calculate key statistical indicators of the dynamic change mode groups and score them, and obtain an abnormal feature set. A fault classification module is configured to classify and determine a fault mode for the abnormal feature set if the variance of the abnormal feature set exceeds a preset variance threshold, and obtain a fault mode category set. A mode matching module is configured to match the fault mode category set with a preset fault mode database, and obtain a fault mode matching result. A report generation module is configured to generate a corresponding risk assessment report according to the fault mode matching result, and obtain a risk assessment report. A parameter adjustment module is configured to adjust the operation parameter of the machine room equipment according to the risk assessment report, and obtain the equipment operation parameter.

[0103] It should be noted that the machine room equipment fault diagnosis system based on big data provided by the embodiments of the present application is used to execute all process steps of the machine room equipment fault diagnosis method based on big data provided by the above embodiments, and the working principles and beneficial effects of the two are one-to-one correspondence, so they will not be repeated here.

[0104] The embodiments of the present application also provide an electronic device. The electronic device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a machine room equipment fault diagnosis program based on big data. The processor implements the steps in the above various machine room equipment fault diagnosis methods based on big data when executing the computer program, such as Figure 1 The step S11 is shown. Alternatively, the processor implements the functions of each module / unit in the above various device embodiments when executing the computer program, such as the data acquisition module.

[0105] For example, the computer program can be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the electronic device.

[0106] The electronic device can be a desktop computer, a notebook, a palm computer, and a smart tablet, etc. The electronic device can include, but is not limited to, a processor, a memory. Those skilled in the art can understand that the above components are only examples of the electronic device, and do not constitute a limitation on the electronic device, and can include more or less components than the above, or combine certain components, or different components, for example, the electronic device can also include an input / output device, a network access device, a bus, etc.

[0107] The processor can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The processor is a control center of the electronic device, and connects various parts of the electronic device through various interfaces and lines.

[0108] The memory can be used to store the computer program and / or modules, and the processor realizes various functions of the electronic device by running or executing the computer program and / or modules stored in the memory, and calling data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), etc.; and the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a nonvolatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state memory device.

[0109] The modules / units integrated in the electronic device, if realized in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. The computer program can implement the steps of each method embodiment when executed by a processor. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable medium can include any entity or device, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc. that can carry the computer program code. It should be noted that the contents included in the computer readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

[0110] It should be noted that the above-described device embodiments are only schematic, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. In addition, the connection relationship between the modules in the device embodiment provided by the present application indicates that there is a communication connection between them, which can be realized as one or more communication buses or signal lines. Those skilled in the art can understand and implement it without creative labor.

[0111] The above-described specific embodiments further detail the purpose, technical solutions, and beneficial effects of the present application. It should be understood that the above-described specific embodiments are only examples of the present application and are not intended to limit the scope of protection of the present application. In particular, for those skilled in the art, any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A big data-based machine room equipment fault diagnosis method, characterized in that, The method comprises the following steps: real-time acquisition of load information data streams generated by each device in the machine room, filtering of the load information data streams, and obtaining of filtered information sequences; grouping processing of multi-dimensional data points in the filtered information sequences using a K-means clustering algorithm to obtain dynamic change mode groups; calculation of key statistical indicators of the dynamic change mode groups and scoring to obtain an abnormal feature set; if the variance of the abnormal feature set exceeds a preset variance threshold, classification of the abnormal feature set and determination of a fault mode to obtain a fault mode category set; matching of the fault mode category set with a preset fault mode database to obtain a fault mode matching result; generation of a corresponding risk assessment report according to the fault mode matching result to obtain a risk assessment report; adjustment of the operating parameters of the machine room equipment according to the risk assessment report to obtain equipment operating parameters. 2.The big data-based machine room equipment fault diagnosis method according to claim 1, characterized in that, The real-time acquisition of load information data streams generated by each device in the machine room, filtering of the load information data streams, and obtaining of filtered information sequences comprise the following steps: real-time acquisition of operating data of each device in the machine room to obtain load information data streams; time series smoothing processing of the load information data streams using a sliding window mechanism to obtain smoothed load sequences; abnormal filtering of the smoothed load sequences based on a preset dynamic threshold range to obtain abnormal filtering sequences; prediction and filling of missing values using a preset ARIMA model according to the abnormal filtering sequences to obtain filtered information sequences. 3.The method of claim 1, wherein, The grouping processing of multi-dimensional data points in the filtered information sequences using a K-means clustering algorithm to obtain dynamic change mode groups comprises the following steps: extraction of peak height and fluctuation amplitude features from the filtered information sequences to obtain a multi-dimensional feature vector set; K-means clustering of the multi-dimensional feature vector set to obtain stable clustering groups; extraction of sustained period and burst frequency attributes of the stable clustering groups, and determination of dynamic change mode groups according to the sustained period and the burst frequency attributes. 4.The big data-based machine room equipment fault diagnosis method according to claim 1, characterized in that, The calculation of key statistical indicators of the dynamic change mode groups and scoring to obtain an abnormal feature set comprises the following steps: mean value calculation of the dynamic change mode groups to obtain a group mean value set; variance calculation of the dynamic change mode groups according to the group mean value set to obtain a group variance set; statistical normalization processing and calculation of a deviation ratio according to the group variance set, and if the deviation ratio is greater than a preset deviation threshold, marking as a preliminary abnormal item to obtain a preliminary abnormal feature set; scoring of the preliminary abnormal feature set to obtain a comprehensive score, and if the comprehensive score exceeds a preset score threshold, obtaining an abnormal feature set. 5.The big data based machine room equipment fault diagnosis method according to claim 1, characterized in that, The classification of the abnormal feature set and the determination of a fault mode to obtain a fault mode category set if the variance of the abnormal feature set exceeds a preset variance threshold comprise the following steps: extraction of load deviation amplitudes of each feature in the abnormal feature set, calculation of the variance of the load deviation amplitudes, and obtaining of a feature variance set; screening of features in the feature variance set that exceed the preset variance threshold to obtain a variance feature subset; According to the variance feature subset, a feature vector is constructed and a preset support vector machine is used for mode separation to obtain a classification label set; A confidence score of the classification label set is extracted, and a preset confidence threshold is used to analyze potential fault modes based on the confidence score to obtain a fault mode category set. 6.The big data-based machine room equipment fault diagnosis method according to claim 1, characterized in that, The fault mode category set is matched with a preset fault mode database to obtain a fault mode matching result, including: According to the fault mode category set, a category key attribute set is extracted and matched with the preset fault mode database to obtain a first matching record set; According to the first matching record set, an attribute intersection ratio is calculated, and if the attribute intersection ratio exceeds a preset ratio threshold, a second matching record set is selected; The matching degree score of the second matching record set and the category key attribute set is calculated to obtain a matching degree score set; According to the matching degree score set, the record with the highest score is selected as the fault mode matching result. 7.The big data-based machine room equipment fault diagnosis method according to claim 1, characterized in that, According to the fault mode matching result, a corresponding risk assessment report is generated to obtain a risk assessment report, including: According to the fault mode matching result, an associated risk attribute set is retrieved from a preset load information sequence database to obtain a first risk attribute set; If the fluctuation amplitude of the first risk attribute set exceeds a preset fluctuation threshold, a second risk attribute set is outputted; According to the second risk attribute set, a risk influence factor is calculated and matched with a preset risk probability table to calculate a cumulative risk value and obtain a risk value sequence; According to the risk value sequence, a preset risk assessment report template is filled to obtain a risk assessment report. 8.The big data-based machine room equipment fault diagnosis method according to claim 1, characterized in that, According to the risk assessment report, the operating parameters of the equipment room equipment are adjusted to obtain equipment operating parameters, including: According to the risk assessment report, a risk level is analyzed to obtain a first risk parameter set; The first risk parameter set is compared with the operating parameters of the equipment room equipment to obtain a comparison deviation, and if the comparison deviation exceeds a preset comparison threshold, a second risk parameter set is outputted; The second risk parameter set is matched with a preset adjustment table to generate an adjustment instruction set and apply it to the equipment room equipment to obtain the equipment operating parameters. 9.A big data-based machine room equipment fault diagnosis system, characterized in that, Including: A data acquisition module is configured to collect load information data streams generated by each device in the equipment room in real time, filter the load information data streams, and obtain filtered information sequences; A clustering analysis module is configured to use a K-means clustering algorithm to group multi-dimensional data points in the filtered information sequences to obtain dynamic change mode groups; A feature extraction module is configured to calculate key statistical indicators of the dynamic change mode groups and score them to obtain an abnormal feature set; A fault classification module is configured to classify the abnormal feature set and determine a fault mode if the variance of the abnormal feature set exceeds a preset variance threshold to obtain a fault mode category set; A mode matching module is configured to match the fault mode category set with a preset fault mode database to obtain a fault mode matching result; A report generation module is configured to generate a corresponding risk assessment report according to the fault mode matching result to obtain a risk assessment report. A parameter adjustment module is configured to adjust the operation parameters of the equipment room equipment according to the risk assessment report, and obtain the equipment operation parameters.

Images