Multi-source fusion maintenance work order association early warning method and system

Abstract

The invention relates to the technical field of information processing and artificial intelligence, and discloses a multi-source fusion maintenance work order association early warning method and system. The method is used for solving the problem that the accuracy and timeliness of early warning are insufficient due to comprehensive modeling of multi-modal data in a traditional method. The method comprises the steps that firstly, a work order, a log event, a monitoring index and asset information are accessed, and after time caliber and field caliber unification and quality labeling are completed, the work order, the log event, the monitoring index and the asset information are written into a real-time data lake and a batch processing data warehouse respectively; normalizing the work order text, extracting a key identifier, and generating a feature index bound with the work order number; aligning the log and the index data according to a work order time window to form an event fragment and an index fragment, and associating an asset node; and constructing a dependency graph based on an asset ledger and a deployment link, forming a work order candidate pair, carrying out classification and hierarchical pushing, and recording feedback and version information for tracing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information processing and artificial intelligence, in particular to a multi-source fusion maintenance work order association early warning method and system. BACKGROUND

[0002] With the wide application of cloud computing, microservices and Internet of Things technologies in enterprise information systems, the scale and complexity of business systems continue to increase, and a large number of maintenance work orders are generated in the daily operation of the operation and maintenance management platform. Work orders are usually used to record activities such as alarm handling, fault repair, resource expansion, configuration change, inspection and rectification, and their content includes fault phenomenon description, impact scope, processing process, priority, time information, and associated assets or service components. Due to the same abnormal source, it may be repeatedly perceived at different levels or different business sides, or it may cause cascading effects due to dependent links, so there are often potential association relationships between multiple work orders, such as same-source fault association, dependent link association, same resource bottleneck association, and change impact association. In the prior art, the identification of work order association mostly adopts manual experience investigation or rule-based matching methods, such as filtering and aggregation according to device number, business system name, keyword, time window, etc., or triggering a prompt according to pre-configured alarm rules and thresholds. However, in actual operation and maintenance scenarios, work order descriptions have characteristics such as unstructured, inconsistent expression, and much noise information, and the same fault may be accompanied by different log events, monitoring index fluctuations, and asset topology changes. Relying on a single data source or simple rules for processing may easily result in missed detection and false positives, making it difficult to form early warning of potential risks in a timely manner, thereby prolonging the fault location period, wasting disposal resources, and expanding the business impact. In addition, operation and maintenance data usually exhibit multi-source heterogeneity, including work order text, alarm and log events, as well as structured data such as monitoring index time series data and asset configuration management information. Different data sources differ in collection frequency, time alignment, field scope, and data quality, making it difficult to model and calculate work orders and system states uniformly. Existing methods generally lack joint feature construction mechanisms for multi-source data, making it difficult to depict the relationship network between work orders and devices, services, and log templates, and also difficult to output actionable risk levels and disposal suggestions at the association group level. At the same time, some solutions lack closed-loop correction capabilities based on operation and maintenance feedback, making it difficult to continuously improve the accuracy and stability of early warning as the business evolves and the environment changes. Therefore, how to automatically identify potential association relationships between work orders based on multi-source operation and maintenance data, and combine system operation status to timely warn of abnormalities, potential faults or capacity resource risks, has become a technical problem to be solved in the field of operation and maintenance management. SUMMARY

[0003] In view of the deficiencies of the prior art, the application provides a multi-source fusion maintenance work order association early warning method and system, which solves the problem of insufficient accuracy and timeliness of early warning caused by comprehensive modeling of multi-modal data in the traditional method.

[0004] To achieve the purpose of improving the stability and availability of the system, the application provides the following technical solutions: A multi-source fusion maintenance work order association early warning method comprises the following steps: S1: Obtain work order data, log events, monitoring indicators and asset information, unify timestamps, normalize field caliber, mark missing and abnormal data, and write them into real-time data lake and batch processing data warehouse respectively; S2: Perform cleaning, word segmentation, entity extraction and structured processing on the work order text, generate work order feature records, and associate them with work order numbers; S3: Align log events and monitoring indicators according to the work order occurrence period, generate event segments and indicator segments, and associate them with the corresponding asset nodes; S4: Construct a device and service dependency graph based on asset information, map work orders, device services and log templates into graph nodes, and establish association edges between the nodes; S5: Form work order association candidate pairs in the dependency graph, classify them according to homologous faults, dependency chains, resource bottlenecks and change influences, determine the early warning level and push, and record operation and maintenance feedback information.

[0005] In a preferred embodiment, obtaining work order data, log events, monitoring indicators and asset information, unifying timestamps, normalizing field caliber, marking missing and abnormal data, and writing them into real-time data lake and batch processing data warehouse respectively comprises: Obtain data according to the collection list and write in the source identifier and batch identifier; Distinguish event time and collection time, retain original values and standard values, complete alignment according to the time caliber table and write in the state and reason code; Normalize fields according to the field mapping table and record the mapping track; Mark missing and abnormal data according to the quality rule table, block the record into the isolation area, and replay and reprocess after rule update or supplementary recording; Log indicators enter the lake according to event time, work order assets enter the warehouse, asset relationships enter the graph and generate graph versions.

[0006] In a preferred embodiment, the work order text is cleaned, segmented, entity extracted and structured, work order feature records are generated, and the work order numbers are associated, comprising: Read the work order and solidify the standard time, source identifier, collection batch identifier and rule version number, map the work order level and business domain according to the work order field correspondence table; Normalize and segment the title and body according to the text rule table, and filter the term phrases according to the synonym table, stop word table, and retention rules; Extract equipment, service, alarm, indicator, and change identifier according to the key information definition table and each reference table, and put the conflict record into the revision queue; Generate work order feature records according to time window rules and write summary identifier and search identifier, check and write to isolation area if not passed, and support playback and reprocessing; After the feature record is stored, send the feature index containing the work order number, time window, identifier list, and rule version number.

[0007] In a preferred embodiment, the log events and monitoring indicators are aligned according to the work order occurrence period, event segments and indicator segments are generated, and the corresponding asset nodes are associated, including: Receive the work order feature index, generate the alignment task, and record the rule version number; Retrieve logs according to the priority order of equipment identifier, service identifier, alarm identifier, and log template key field, unify time field, host identifier, and instance identifier, and extract link identifier, session identifier, and template identifier; Divide into log segments according to time window and interval rules and write boundary reason markers, and establish the reference relationship between log segments and equipment nodes or service nodes; Retrieve indicator sequences according to time window and indicator name list, unify indicator name and unit and mark sampling period, write markers according to missing and abnormal rules, generate indicator segments according to segmentation rules and write binding range field, and establish the reference relationship between indicator segments and asset nodes; Write the segment index record and the reference relationship record into the corresponding storage respectively.

[0008] In a preferred embodiment, based on asset information, construct the device and service dependency graph, map the work order, device service, and log template to the graph node, and establish the association edge between the nodes, including: Read asset information, segment index, and reference relationship; Generate node identifier according to asset primary key and business domain and unify, record conflicts and selected source; Generate relationship edges according to construction rules and record direction, timeliness, and rule hit markers; Hang the log template node and the indicator node according to the reference table, and enter the abnormal matching into the to-be-confirmed and complete; Hang the work order node according to the reference relationship, generate the version and incremental update of the graph after storage.

[0009] In a preferred embodiment, form the work order association candidate pair in the dependency graph, classify according to homologous fault, dependency chain, resource bottleneck, and change impact, determine the warning level and push, and record the operation and maintenance feedback information at the same time, including: Read the version identification and reference list, generate a pre-warning task and record the rule version number; According to the time window, the shared node and the associated path, the homologous fault, the dependent link, the resource bottleneck and the change influence candidate pair are generated, and when there is a conflict, the type is determined according to the priority and the alternative is reserved; According to the type, the work order level and the node level, the pre-warning level is mapped and aggregated, and the frequency control is executed according to the push record; The feedback is stored to generate labeled data, and when the rule is upgraded, the old and new versions are recalculated and recorded.

[0010] On the other hand, a multi-source fusion maintenance work order association pre-warning system comprises: Multi-source data acquisition and management module: collect and manage work order, log, index and asset data, and write into real-time data lake, batch warehouse and graph database according to storage caliber; Feature engineering and real-time processing module: standardize the work order text and extract entity vectorization, analyze log and monitoring index and aggregate modeling, and generate topology features for model use in combination with CMDB; Work order association and pre-warning model module: based on multi-modal work order association graph network, model work order and device service log nodes, identify work order association, and pre-warn according to homologous fault, dependent link, resource bottleneck and change influence; Warning and feedback module: the warning result is displayed on the visual screen and triggers real-time pre-warning push, and supports operation and maintenance personnel to confirm and feedback the effectiveness of pre-warning and association; feedback data enters a closed loop to form labeled data and update the model regularly to realize continuous optimization.

[0011] Compared with the prior art, the present application provides a multi-source fusion maintenance work order association pre-warning method and system, which has the following beneficial effects: 1. The present application, by unified access to work order, log event, monitoring index and asset information, first completes the unified management of time caliber, field caliber and data quality, providing a consistent data basis for subsequent association; then, the unstructured work order text is converted into searchable and alignable feature index, and the log and index data are aligned and divided according to the work order time window, forming event segments and index segments and establishing reference relationships with corresponding asset nodes; on this basis, combined with asset account, deployment relationship and link relationship, a dependency relationship graph is constructed, and work order, device service, log template and index nodes are included in a unified relationship network, which can reduce missed detection and false positives caused by relying on manual experience or simple rules in multi-source heterogeneous and inconsistent operation and maintenance scenarios, and form a closed loop correction through push trace and operation and maintenance feedback, so that the association determination process is traceable, recalculable and continuously updated, and finally realizes automatic identification and timely pre-warning of work order potential association and risk.

[0012] 2.The application records the work order correlation analysis process in a versioned manner by aligning the tasks, rule tables, and graph versions, so that data collection, field mapping, quality checking, segment splitting, reference linking, candidate generation, classification, level mapping, pushing, and feedback all have clear version basis and trace information; after the asset account, deployment link, or configuration change is updated, the open cases can be recalculated under the new version rule, and the new and old version comparison and candidate alternative type are retained, which facilitates quick positioning of the difference link and rule influence range caused by version switching, thereby improving the auditability and cross-batch consistency of operation and maintenance analysis, and finally realizing the traceability and reviewability of the whole process of early warning output. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 A multi-source fusion maintenance work order correlation early warning method flowchart of the application; Figure 2 A multi-source fusion maintenance work order correlation early warning system structure diagram of the application. DETAILED DESCRIPTION

[0014] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the application.

[0015] Embodiment 1: Figure 1 A multi-source fusion maintenance work order correlation early warning method is given, comprising: S1: obtaining work order data, log events, monitoring indicators, and asset information, unifying timestamps, normalizing field caliber, marking missing and abnormal data, and writing them into real-time data lake and batch processing data warehouse respectively; S2: cleaning, segmenting, entity extracting, and structuring the work order text, generating work order feature records, and associating them with work order numbers; S3: aligning log events and monitoring indicators according to work order occurrence time periods, generating event segments and indicator segments, and establishing associations with corresponding asset nodes; S4: constructing a device and service dependency graph based on asset information, mapping work orders, device services, and log templates into graph nodes, and establishing association edges between nodes; S5: forming work order correlation candidate pairs in the dependency graph, classifying according to homologous faults, dependency chains, resource bottlenecks, and change influences, determining early warning levels and pushing, and recording operation and maintenance feedback information.

[0016] S1: Obtain work order data, log events, monitoring indicators and asset information, unify timestamps, normalize field caliber, mark missing and abnormal data, and write them into real-time data lake and batch data warehouse respectively, which is implemented as: The operation and maintenance management platform issues a collection list to the data access service and specifies the data source identifier; the data access service obtains work order data, log events, monitoring indicators and asset information from the work order system, log platform, monitoring platform and asset management system according to the collection list, and writes the source identifier and collection batch identifier for each record; the data access service performs unified processing on the time field of each source record, distinguishes event time and collection time, completes time format conversion according to unified time zone rules, and retains the original time value and standard time value; then, according to the time caliber configuration table, the time alignment is determined, and the alignment state mark and reason code are written into the record; the time caliber configuration table maintains the allowed offset rules according to the data source category and sets the version identifier; The data access service normalizes the field caliber of each data source according to the field mapping table; the field mapping table is maintained by the operation and maintenance configuration module, and the field name mapping, data type mapping, unit conversion rule, enumeration value correspondence relationship and null judgment rule are configured according to the business domain and environment dimension; the field mapping table sets the version identifier and the effective range, and the data access service loads the corresponding version as the normalization caliber during this batch processing; during the normalization process, the source field is converted to the standard field and the type and unit are unified, while retaining the original value copy of the source field and the mapping track record; when the field mapping table version is updated, the historical records are executed according to the mapping track for trace comparison or reprocessing playback; In the data quality labeling phase, the data access service checks each item of the record according to the quality check rule table, and writes the quality label field in the record; the quality check rule table is maintained by the operation and maintenance configuration module, and the check items, reason codes and disposal actions are defined according to the data type and business domain, and the check items cover the missing of mandatory fields, the inconsistency of field types, the mismatch of units, the out-of-range of enumeration values, the unresolvable time fields and the un-mappable key identifiers; for the records that hit the check items, the data access service retains the original values without covering, writes the missing label or abnormal label in the record, and synchronously writes the reason code, disposal action identifier and processing status; the disposal action identifier is used to indicate that the record enters the main storage or enters the isolation area, and the processing status is used to indicate that it is to be revised, to be re-processed or available; the quality check rule table configures a blocking level for the reason code, the blocking level record is written into the isolation area, and the source identifier, collection batch identifier, original field copy, time field original value and reason code are retained; the non-blocking level record is written into the main storage together with the quality label; the isolation area record enters the re-processing queue after the field mapping table or the quality check rule table is upgraded and takes effect, or the key fields are manually supplemented and submitted; the re-processing is executed by replaying with the collection batch identifier and the record identifier as the index, and the time alignment, field normalization and quality labeling are completed by referring to the current effective time range configuration table, field mapping table and quality check rule table, and finally the corresponding processing status is updated; After completing the time alignment, field normalization and quality labeling, the data access service writes the data into the real-time data lake and the batch processing data warehouse according to the storage range respectively, and writes the configuration table version identifier referred by the current batch into the database together with the record; the real-time data lake stores the detailed data of log events and monitoring indicators with event time as the organization dimension, and writes the alignment status label, quality label field, source identifier and collection batch identifier in the record; the batch processing data warehouse stores the work order details and asset account according to the business theme, and retains the traceable fields consistent with the real-time data lake; the node identifier, service directory, deployment relationship and link relationship in the asset information are synchronously written into the graph storage area, the graph storage area generates a graph version identifier according to the construction batch, and maintains the node directory and relationship edge list.

[0017] S2: clean, segment, entity extraction and structure processing on the work order text, generate work order feature records, and associate with the work order number, the specific implementation is: After the multi-source data is imported into the lake and the warehouse, the operation and maintenance platform issues a list of pending work orders to the work order processing service. The work order processing service reads the corresponding work order records from the batch processing data warehouse and uses the standard time field, source identifier, collection batch identifier, and rule version number in the imported records as the processing context. The work order processing service extracts the work order number, creation time, source system, title, text description, processing record, and associated asset identifier into the text processing flow. According to the work order field mapping table, the source field is mapped to standard fields such as work order level and business domain. The work order field mapping table is maintained in the configuration module, and the rule version number used in the mapping is recorded for traceability. The work order processing service performs text normalization on the title and text description. Text normalization converts full-width and half-width characters, uppercase and lowercase letters, white spaces, and common symbols into a consistent format according to the text rule table, and removes control characters and redundant delimiters. Text normalization also formats time expressions, version information, network addresses, port information, and alarm codes according to the text rule table to ensure consistent representation of similar information in work orders from different sources. The text rule table is maintained in the configuration module with a rule version number, and the rule version number used in the processing is recorded. After text normalization, the work order processing service performs segmentation on the text according to the segmentation and phrase segmentation rules to generate segmentation results and key phrase sets. The work order processing service unifies synonymous expressions according to the synonym table, filters meaningless terms according to the stop word table, and selects retained key phrases and candidate information according to the retention rule table. The above rule tables are maintained in the configuration module with a rule version number, and the rule version number used in the processing is written into the work order feature record. In the key information identification stage, the work order processing service extracts device identifiers, service identifiers, component identifiers, alarm event identifiers, fault types, processing actions, indicator names, and change clues from the work order text according to the key information definition table and mapping rule table, and records the corresponding source fields and positions in the original text for each extraction result. Device identifiers are unified from asset numbers, hostnames, or serial numbers according to the asset identifier mapping table. Service identifiers are unified from service names and application identifiers according to the service directory mapping table. Alarm event identifiers are unified according to the alarm dictionary mapping table. Indicator names are unified according to the indicator dictionary mapping table. When there are multiple matching results for the same key information, the system writes a conflict marker, saves all matching results and corresponding rule version numbers, and enters the revision queue to support subsequent reprocessing. Duplicate key information in the same work order is removed and merged to form a key information list and retain the unified standard values. The key information list is used to establish reference relationships with asset nodes, alarm templates, or indicator items in the future. After the key information recognition is completed, the ticket processing service generates a ticket feature record and writes it into a feature library after establishing a one-to-one correspondence with a ticket number; the ticket feature record records at least a ticket number, a ticket time window, a ticket level, a business domain, a list of associated device identifiers, a list of associated service identifiers, a list of associated component identifiers, a list of alarm event identifiers, a list of fault types, a list of processing actions, a list of index names, a list of change clues, a text abstract identifier, a search identifier, and a rule version number; the ticket time window is generated based on a standard time field, the window start point takes the earlier of the ticket creation time and the first processing record time, and the window end point takes the last processing record time; when there is no processing record, the window end point takes the ticket creation time, and a window generation rule marker is recorded; the text abstract identifier is generated according to an abstract rule table based on the normalized title and body, and is used for ticket duplication or text approximation judgment; the search identifier is generated according to a search rule table based on the segmentation result, and is used for subsequent search and matching; Before writing into the feature library, the ticket processing service performs rule checking on the ticket feature record; the rule checking covers ticket number uniqueness checking, time field parsable checking, time window start point and end point order checking, key identifier matching in the reference table checking, and key field non-empty checking; the record that fails the checking is written into a feature isolation area, and the failure reason code, conflict marker, original field value copy, rule version number, and processing status are written in the isolation area record; when any rule table or reference table is updated, or the manual supplementary information submission is completed, the isolation area record enters a reprocessing queue; the reprocessing queue retrieves the original record according to the ticket number, generates a ticket feature record according to the updated rule, and synchronously updates the processing status and the failure reason code; After the ticket feature record that passes the checking is written into the feature library, the ticket processing service sends a ticket feature index to the alignment service; the ticket feature index includes a ticket number, a time window, a list of associated device identifiers, a list of associated service identifiers, a list of alarm event identifiers, a list of index names, and a rule version number; the alignment service retrieves corresponding data from the log platform and the monitoring platform according to the ticket number and the time window, and establishes a reference relationship between the retrieval result and the asset node.

[0018] S3: Aligning the log events and the monitoring indicators according to the ticket occurrence period, generating event segments and indicator segments, and establishing an association with the corresponding asset node, which is specifically implemented as: The alignment service receives a work order feature index sent by the work order processing service, and the work order feature index includes a work order number, a time window, an associated device identification list, an associated service identification list, an alarm event identification list, an index name list, and a rule version number; the alignment service creates an alignment processing task according to the work order number, and writes the work order number, the time window boundary, and the rule version number into a task record, and the task record enters a processing queue; when the alignment processing task is executed, log retrieval and filtering, log segmentation, index retrieval, index segmentation, missing and abnormal judgment, and binding range generation are all performed according to the corresponding rules in the configuration module, and the rules are effective according to the business domain and the environment and are provided with a rule version number; the alignment service writes the rule version number in the task record into a fragment index and a reference relationship, which is used for subsequent tracing; In the log event alignment stage, the alignment service retrieves log records from the log platform based on the time window; retrieval and filtering use device identification, service identification, alarm event identification, and log template key fields in turn according to a preset priority; the retrieved log records are arranged, and the arrangement process includes time field unification, host identification and instance identification unification, log level unification, link identification and session identification extraction, log template identification extraction, and repeated record removal, and the arranged log records are arranged in chronological order; then, the log records are segmented according to the log segmentation rules to generate log event fragments; the fragment boundary is jointly constrained by the time window boundary and the interval judgment of adjacent log records; when the interval judgment causes fragment segmentation, a boundary reason marker is written in the fragment header field; the log event fragment writes the fragment number, the fragment start and end time, the source system identification, the link identification set, and the log template identification set, and retains the original order and record position of the log records in the fragment; The alignment service generates asset node reference relationships for each log event fragment; the reference relationship preferentially uses device identification to locate a device node; when the device identification is unavailable, the service identification is used to locate a service node; when the device identification and the service identification are both available, device node reference relationships and service node reference relationships are generated respectively; the reference relationship records the work order number, the fragment number, the node type, the node identification, the reference source field, the mapping rule version number, and the time window marker, facilitating subsequent connection and review; In the monitoring index alignment stage, the alignment service acquires index sequences from the monitoring platform according to a time window, and determines a search condition according to an index name list and a device identifier or a service identifier; the acquired index sequences are arranged, and the arrangement includes uniform index name, uniform unit, sampling period annotation, and time sequence arrangement, and according to the missing and abnormal determination rule, missing point marks and abnormal point marks are written; then, according to the index segmentation rule, the index sequences are intercepted in the time window to generate monitoring index segments; the monitoring index segments are grouped and saved according to the index name, and the index name, sampling period, segment start and end time, and sequence point record position are written; the monitoring index segments establish a reference relationship with the asset nodes, the generation rule of the reference relationship is consistent with that of the log event segment, and a binding range field is written in the reference relationship, the binding range field is used to identify the corresponding device instance or service instance, and the binding range field is determined according to the binding range generation rule; After the log event segments and the monitoring index segments are generated, the alignment service generates segment index records and writes them into a segment index database; the segment index records include a work order number, a time window, a log segment list, an index segment list, an associated device node list, an associated service node list, a log template identifier set, an index name set, and a rule version number; the reference relationship between the segments and the asset nodes is written into a reference relationship database; the dependency graph construction service reads the corresponding data in the segment index database and the reference relationship database to establish the association relationship between the work order nodes, the asset nodes, and the log template nodes.

[0019] S4: Construct a device and service dependency graph based on asset information, map the work order, device service, and log template to a graph node, and establish an associated edge between the nodes, and the specific implementation is: After the segment index records and the reference relationship are generated, the dependency graph construction service enters a graph construction process; the dependency graph construction service reads the device account, service directory, instance list, deployment relationship, link relationship, and configuration change record from the asset information source, and reads the work order number, time window, log template identifier set, index name set, and rule version number from the segment index database; at the same time, the dependency graph construction service reads the corresponding relationship between the segments and the asset nodes from the reference relationship database as the graph construction input; in order to facilitate review and traceback, the node records and relationship edge records in the graph are written into a unified traceback field, and the traceback field includes a source identifier, a synchronization batch identifier, and a rule version number; The dependency graph construction service generates uniform nodes for asset-side objects; the nodes are divided into device nodes, service nodes, instance nodes, and change event nodes according to object types, and node identifiers are generated by combining asset system primary keys and business domain identifiers; node attributes record object types, ownership systems, environmental dimensions, effective times, and invalid times; for multiple records of the same object formed in different sources or different batches, the records are merged according to a node unification rule table, which specifies primary key priority orders, field value priority orders, and conflict processing methods; the merged results are written into a node directory table, which records conflict markers, conflict field lists, and selected source field markers, and is used to support subsequent backtracking and tracing; The dependency graph construction service generates a set of relationship edges between devices and services; the generation of the relationship edges follows a relationship construction rule table, which specifies edge types, directions, constraint conditions, and generation priority orders; the dependency graph construction service generates running relationship edges between instance nodes and device nodes according to deployment relationships, generates ownership relationship edges between service nodes and instance nodes according to service directories, generates dependency relationship edges between service nodes according to interface call lists and link relationships, generates connected relationship edges between device nodes according to network links and switching paths, and generates association relationship edges between object nodes and change event nodes according to configuration change records; each relationship edge is written into an edge type, a direction, an effective time, an invalid time, and a rule hit marker, which is used to indicate the basis for generating the relationship edge; The dependency graph construction service generates log template nodes and indicator nodes, and completes the establishment of hanging relationships; the log template nodes are generated according to a set of log template identifiers, and the corresponding relationship between the template nodes and the service nodes is established according to a template component correspondence table; the indicator nodes are generated according to a set of indicator names, and the corresponding relationship between the indicator nodes and the device nodes or the service nodes is established according to an indicator object correspondence table. The template component correspondence table and the indicator object correspondence table are maintained by a configuration module, and have rule version numbers; When a log template identifier or an indicator name does not match, matches multiple objects, or the matched object is in an invalid state, the dependency graph construction service registers a to-be-confirmed node, writes a to-be-confirmed state, a source work order number, and a candidate matching list into the to-be-confirmed node, and writes the record into a to-be-confirmed queue; the to-be-confirmed queue triggers a completion process when a unique valid match is generated after the correspondence table is updated or manually supplemented; the completion process establishes a corresponding relationship between the to-be-confirmed node and a target node; if merging is required, the merging is completed according to the node unification rule table, and the conflict marker and the selected source field marker are updated; The dependency graph construction service hooks the work order node into the graph; the work order node generates a node identifier with a work order number, and a node attribute is written into a time window and a source system identifier; the dependency graph construction service establishes an association relationship between the work order node and the device node, the service node, the log template node, and the index node according to the corresponding relationship in the fragment index library and the reference relationship library; the association relationship edge writes a reference type, a reference source field, and a reference time window, which are used to represent the reference relationship between the work order and each node; After the graph is constructed, the dependency graph construction service writes the node directory table, the relationship edge set, and the work order hook edge set into the graph storage area, and generates a graph version identifier according to the construction batch; when asset information is updated or configuration is changed into a new batch, the dependency graph construction service determines the update range according to the object identifier set recorded by the change event, performs incremental update on the nodes and associated edges in the range, and generates a new graph version identifier, and the historical graph version is retained for query entry; the dependency graph construction service outputs the graph version identifier, the work order node list, the relationship edge type list, and the work order to node reference list, which are used for work order association candidate generation and classification processing.

[0020] S5: Forming a work order association candidate pair in the dependency graph, classifying according to homologous faults, dependency chains, resource bottlenecks, and change influences, determining a warning level and pushing, and recording operation and maintenance feedback information at the same time, and the specific implementation is: After the dependency graph is stored and a graph version identifier is generated, the warning service loads the corresponding graph version, reads the work order node list and the work order to node reference list, and reads the time window, source system identifier, and work order level fields in the work order node attribute as processing entry; the warning service creates a warning processing task with a work order number, writes the task number, graph version identifier, time window boundary, and rule version number into the task record and enters the processing queue; candidate generation, classification, level determination, aggregation, pushing, and feedback processing are all performed under the graph version and the rule version number; the configuration module maintains a rule table and a mapping table, which are used to define time window relationship judgment, path traversal range, link time period selection, change influence interval judgment, type priority, level mapping, aggregation judgment, pushing strategy and frequency control, feedback processing and re-computation trigger, etc.; the warning service performs processing according to the corresponding rule version number in the task record reference, and writes a traceback field in the candidate record, event record, and pushing record for backtracking; In the candidate pair generation stage, the early warning service takes the target work order as the center, extracts its connected device nodes, service nodes, log template nodes and index nodes, and forms an associated node set. The early warning service accesses adjacent nodes and path nodes in the dependency graph according to path traversal rules to obtain a candidate work order set; the early warning service pairs the candidate work order set two by two to generate candidate pair records; the candidate pair records write candidate numbers, work order pair numbers, candidate source types, shared node lists, associated path summaries and time window relationship markers; the time window relationship marker is used to represent overlapping, adjacent or containing relationships, and its determination rule is given by the time window relationship rule; the candidate source type is limited to four types of homologous faults, dependency links, resource bottlenecks and change influences, and is generated according to the constraint conditions; the homologous fault candidate pair takes the shared device node or shared service node as the premise, and meets the evidence conditions of shared alarm event identification or shared log template identification; the dependency link candidate pair takes the service dependency path as the premise, and the candidate work order is connected to the service node at the path endpoint or on the path, and the candidate time period is determined by the link time period rule, which takes the relationship between the effective time of the dependency relationship edge, the link identification information and the work order time window as the determination input; the resource bottleneck candidate pair takes the shared index node as the premise and is connected to the same device node or the same service node; the change influence candidate pair takes the change event node as the premise, and the reference list contains the device node or service node associated with the change event, and the candidate work order time window and the change influence interval meet the matching conditions; the change influence interval takes the effective time field of the change event node as the starting point, and the endpoint determination method is determined by the change type and object type together; In the candidate pair classification stage, the early warning service determines the type of the candidate pair record according to the type determination rule, and completes the consistency verification based on the shared node list, path constraint and evidence element constraint; for the case that the same work order pair meets multiple conditions at the same time, the early warning service determines the unique type according to the type priority table, and retains the alternative type list in the candidate pair record for audit review; In the early warning level determination and aggregation stage, the early warning service writes the early warning level, treatment suggestion label and push strategy identifier in the candidate pair record according to the level mapping rule; the level mapping rule is provided by a level mapping table, and the level mapping table establishes a corresponding relationship between the association type, business importance, work order level, influence range label and node criticality; the node criticality is determined by the node level, environment dimension and service classification field in the asset information, and is written in the node attribute, and the early warning service reads the node attribute to participate in level mapping; the push strategy identifier is provided by a push strategy table, and the push strategy table defines the push channel, receiving object range and frequency control rule; the early warning service merges the candidate pairs according to the aggregation rule, and the aggregation determination is based on the intersection relationship of the shared node list and the consistency of the root node list, and writes the aggregation basis label in the group summary; after merging, the associated work order group is formed, the early warning service generates a group number for the associated work order group and writes it in the group summary, and the group summary is written in the root node list, coverage time period and association type distribution; In the push and trace stage, the early warning service generates an early warning event according to the push strategy identifier, writes it in the early warning event table, and synchronously writes it in the message queue for the visualization end and the work order system to subscribe. The early warning event table records the event number, associated work order group number, early warning level and association type, and associates the shared node list and association path summary of the candidate pair record, supporting display and review; the early warning service synchronously generates a push record, and the push record channel identifier, receiving object, push time, event number and processing mode label; the frequency control is determined according to the push strategy and historical push record; when there is an effective push record of the same event in the same channel, skip push or merge push is performed according to the strategy rule; After entering the feedback closed loop stage, the operation and maintenance personnel confirm or correct the early warning event in the feedback interface, and the feedback type is limited to associated valid, associated invalid, type correction and level correction; the feedback content is written in the feedback table, and a binding relationship is established with the event number and the candidate number; the early warning service reads the feedback table according to the feedback processing rule, generates annotation data and writes it in the data warehouse, and the annotation data carries the graph version identifier and the rule version number; after the configuration rule is updated to form a new rule version number, the early warning service re-generates the candidate pair and the early warning event for the un-concluded work order under the new rule version number, and writes the new and old rule version number comparison label in the event record, realizing process traceability.

[0021] The scheme of the embodiment first accesses work orders, log events, monitoring indicators and asset data from an operation and maintenance platform, completes time unification, field caliber unification and quality marking, and then writes into real-time data lake and batch processing data warehouse respectively, and synchronously records rule version number for traceability; the work order title and text are normalized, segmented and key entity extracted to generate feature index bound with work order number; log and indicator data are searched according to work order time window, the search results are arranged and divided into log segments and indicator segments, and the reference relationship between segments and device nodes or service nodes is established; a dependency graph is constructed based on asset account, deployment relationship and link relationship, log template nodes and indicator nodes are introduced, and a graph version identifier is generated; work order candidate pairs are formed on the dependency graph according to homologous faults, dependency links, resource bottlenecks and change influences, candidate classification, level mapping and early warning pushing are completed, and pushing traces and operation and maintenance feedback are recorded; when the rule is updated, the results of the open cases are regenerated according to the new version, and the comparison information of the new and old versions is retained.

[0022] Embodiment 2: Figure 2 A multi-source fusion maintenance work order association early warning system is given, comprising: A multi-source data acquisition and management module: acquires and manages work order, log, indicator and asset data, and writes into real-time data lake, batch processing warehouse and graph database according to storage caliber; A feature engineering and real-time processing module: standardizes and extracts entity vectorization of work order text, analyzes log and monitoring indicators and aggregates modeling, and generates topological features for model use in combination with CMDB; A work order association and early warning model module: based on a multi-modal work order association graph network, models work order and device service log nodes, identifies work order association, and grades early warning according to homologous faults, dependency links, resource bottlenecks and change influences; An early warning and feedback module: early warning results are displayed on a visual large screen and other interfaces and trigger real-time early warning pushing, and operation and maintenance personnel can confirm and feedback the effectiveness of early warning and association; feedback data enters a closed loop to form labeled data and update the model regularly, realizing continuous optimization.

[0023] It should be noted that the application can be deployed on the device itself to realize embedded application, or run on PC or other terminals with user interface, so as to meet various hardware environments and use requirements.

[0024] The above-described embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the above-described embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present application are wholly or partially generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center through wireless or wired transmission. The wired transmission includes optical fiber, twisted pair, coaxial cable, etc. The wireless transmission includes infrared, microwave, etc. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. containing one or more available medium collections. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state disk.

[0025] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and module can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0026] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are only schematic, for example, the division of the modules is only a logical function division, and actual implementation can have another division manner, for example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0027] The modules described as separate components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, which can be located in one place or distributed on a plurality of network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0028] In addition, each functional module in the various embodiments of the present application can be integrated in one processing module, or each module can exist physically separately, or two or more modules can be integrated in one module.

[0029] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to make a computer device (which can be a personal computer, a server or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0030] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0031] Finally: the above is merely preferred embodiments of the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A multi-source fusion maintenance work order association early warning method, characterized in that, include: S1: Obtain work order data, log events, monitoring metrics and asset information, unify timestamps and normalize field definitions, mark missing and abnormal data, and write them to the real-time data lake and batch data warehouse respectively. S2: Clean, segment, extract entities, and structure the work order text to generate work order feature records and associate them with the work order number; S3: Align log events and monitoring metrics according to the time period of work order occurrence, generate event fragments and metric fragments, and establish associations with the corresponding asset nodes; S4: Construct a device and service dependency graph based on asset information, map work orders, device services and log templates as graph nodes, and establish association edges between nodes; S5: Create candidate pairs of work orders in the dependency graph, classify them according to the same source of faults, dependency chains, resource bottlenecks and changes, determine the warning level and push them, and record operation and maintenance feedback information at the same time.

2. The multi-source fusion maintenance work order association early warning method according to claim 1, characterized in that, Acquire work order data, log events, monitoring metrics, and asset information; standardize timestamps and field definitions; label missing and abnormal data; and write them to a real-time data lake and a batch data warehouse, respectively, including: Obtain data according to the collection list and write it into the source identifier and batch identifier; Distinguish between event time and collection time, retain original values ​​and standard values, align according to the time caliber table, and write the status and reason codes; Map fields to a table and record the mapping trajectory; Mark missing and abnormal records according to the quality rule table, block the records and put them into the isolation area, and replay and reprocess them after the rules are updated or supplemented. Log metrics are entered into the lake according to event time, work order assets are entered into the warehouse, asset relationships are entered into the graph and a graph version is generated.

3. The multi-source fusion maintenance work order association early warning method according to claim 1, characterized in that, The work order text is cleaned, segmented, entity extracted, and structured to generate work order feature records, which are then associated with the work order number. This includes: Read the work order and solidify the standard time, source identifier, collection batch identifier and rule version number, and map the work order level and business domain according to the work order field lookup table; The title and body text are standardized and segmented according to the text rule table, and the terms and phrases are selected by combining the thesaurus, stop word list and retention rules. Extract devices, services, alarms, indicators, and change identifiers according to the key information definition table and various comparison tables, and enter conflict records into the revision queue; Work order feature records are generated according to time window rules and written with summary identifier and retrieval identifier. If the verification fails, the record is written to the isolation area and replay can be reprocessed. After the feature record is entered into the database, a feature index containing the work order number, time window, identifier list and rule version number is sent.

4. The multi-source fusion maintenance work order association early warning method according to claim 1, characterized in that, Align log events and monitoring metrics according to the time period of the work order, generate event fragments and metric fragments, and establish associations with the corresponding asset nodes, including: Receive work order feature index, generate alignment task and record rule version number; Logs are retrieved in the order of priority of device identifier, service identifier, alarm identifier and log template key fields, and the time field, host identifier and instance identifier are unified to extract link identifier, session identifier and template identifier. Log segments are divided into segments according to time windows and interval rules, and boundary cause markers are written to establish reference relationships between log segments and device nodes or service nodes. Retrieve indicator sequences by time window and indicator name list, unify indicator names and units and mark sampling period, write tags according to missing and abnormal rules, generate indicator fragments according to segmentation rules and write them into the binding range field, and establish reference relationship between indicator fragments and asset nodes; Write the fragment index record and the reference relationship record to their respective storage.

5. The multi-source fusion maintenance work order association early warning method according to claim 1, characterized in that, Based on asset information, a dependency graph of equipment and services is constructed, mapping work orders, equipment services, and log templates to graph nodes, and establishing association edges between nodes, including: Read asset information, fragment indexes, and reference relationships; Generate and unify node identifiers based on asset primary keys and business domains, and record conflicts and selection sources; Generate relation edges according to the construction rules and record their direction, timeliness, and rule hit flags; Connect log template nodes and indicator nodes according to the comparison table. If an anomaly is matched, proceed to the pending confirmation and completion stage. Work order nodes are attached according to reference relationships, and the graph is imported into the database to generate a version and is incrementally updated.

6. The multi-source fusion maintenance work order association early warning method according to claim 1, characterized in that, Candidate work order pairs are generated in the dependency graph, categorized by common-origin faults, dependency chains, resource bottlenecks, and change impacts. Early warning levels are determined and pushed out, while operational feedback information is recorded, including: Read the graph version identifier and reference list, generate an early warning task, and record the rule version number; Generate candidate pairs of common-origin faults, dependent links, resource bottlenecks and change impacts based on time windows, shared nodes and associated paths. In case of conflicts, determine the type according to priority and retain alternatives. Map and aggregate early warning levels by type, work order level, and node level, and execute frequency control based on push records; Feedback is entered into the database to generate labeled data. When the rules are upgraded, the data is recalculated and the comparison between the old and new versions is recorded.

7. A multi-source fusion maintenance work order association early warning system, used to implement the multi-source fusion maintenance work order association early warning method according to any one of claims 1-6, characterized in that, include: Multi-source data acquisition and governance module: Collects and governs work order, log, indicator and asset data, and writes them to real-time data lake, batch processing warehouse and graph database according to storage scope; Feature Engineering and Real-time Processing Module: Cleans and standardizes work order texts and extracts entity vectors, parses logs and monitoring metrics and aggregates them for modeling, and combines CMDB to generate topological features for model use; Work order association and early warning model module: Based on a multimodal work order association graph network, it models work orders and equipment service log nodes, identifies work order associations, and provides graded early warnings based on common source faults, dependent links, resource bottlenecks, and change impacts; Early warning and feedback module: Displays early warning results on interfaces such as large visualization screens and triggers real-time early warning pushes, supporting operation and maintenance personnel to confirm and provide feedback on the effectiveness of early warnings and their correlations; Feedback data enters a closed loop, is used to generate labeled data, and the model is updated regularly to achieve continuous optimization.

Images