Equipment remote operation and maintenance method and system, terminal and storage medium

Abstract

The invention discloses a device remote operation and maintenance method and system, a terminal and a storage medium, and the method comprises the steps: obtaining the log data of a target device, and carrying out the preprocessing, and obtaining the preprocessed log data; performing fault mode identification on the preprocessed log data by adopting a machine learning algorithm to obtain a potential fault mode and a known fault mode, and performing natural language processing on the preprocessed log data to obtain core fault information; performing index trend prediction according to the potential fault mode, the known fault mode and the core fault information to obtain a log analysis result; and obtaining a fault processing strategy corresponding to the log analysis result, processing the log analysis result to obtain a processing result, and visually displaying the log analysis result, the fault processing strategy and the processing result. According to the method, accurate analysis and fault diagnosis of the equipment log data can be realized by adopting a machine learning algorithm and a natural language technology, and the equipment fault processing efficiency is effectively improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, system, terminal, and computer-readable storage medium for remote operation and maintenance of equipment. Background Technology

[0002] With the rapid development of IoT technology, open-source devices have been widely used in smart homes, smart offices, and connected vehicles. These open-source devices generate massive amounts of log data during operation, which contains key information about the device's operating status and is crucial for ensuring stable operation and timely detection and handling of faults.

[0003] However, existing systems can only perform simple storage and querying of log data, lacking in-depth analysis capabilities and making it difficult to extract valuable information from log data. At the same time, when log data is abnormal, that is, when the device malfunctions, the fault handling efficiency is low and cannot meet the user's needs.

[0004] Therefore, existing technologies still need to be improved and developed. Summary of the Invention

[0005] The main objective of this invention is to provide a method, system, terminal, and computer-readable storage medium for remote operation and maintenance of equipment. This invention aims to solve the problems in the prior art, which can only perform simple storage and query of log data, lacks in-depth analysis capabilities, makes it difficult to extract valuable information from log data, and has low fault handling efficiency when log data is abnormal, i.e. when equipment malfunctions.

[0006] To achieve the above objectives, the present invention provides a method for remote operation and maintenance of equipment, the method comprising the following steps: Obtain log data from the target device and preprocess the log data to obtain preprocessed log data; Machine learning algorithms are used to identify fault modes in the preprocessed log data to obtain potential fault modes and known fault modes, and natural language processing is performed on the preprocessed log data to obtain core fault information. Based on the potential failure modes, the known failure modes, and the core failure information, indicator trends are predicted to obtain log analysis results. Obtain the fault handling strategy corresponding to the log analysis results, process the log analysis results according to the fault handling strategy, obtain the processing results, and visualize the log analysis results, the fault handling strategy, and the processing results.

[0007] Optionally, the remote operation and maintenance method for the device, wherein acquiring the log data of the target device and preprocessing the log data to obtain preprocessed log data specifically includes: Identify the target device and its corresponding target log interface, and set up a lightweight agent to collect log data from the target device through the target log interface. The log data includes system logs, application logs, and operation logs. The log data is preprocessed to obtain preprocessed log data, wherein the preprocessing includes data cleaning, formatting, and deduplication.

[0008] Optionally, in the aforementioned remote equipment operation and maintenance method, the step of using a machine learning algorithm to perform fault mode identification on the preprocessed log data to obtain potential fault modes and known fault modes specifically includes: The preprocessed log data is subjected to feature extraction processing to obtain feature vectors, wherein the feature extraction processing includes numerical feature extraction, text feature encoding, and feature selection optimization; The feature vector includes multiple first feature vectors without historical fault labels and multiple second feature vectors with historical fault labels. The K-means clustering method is used to perform iterative clustering calculations and latent pattern labeling on multiple first feature vectors to obtain potential fault modes. A known fault mode is obtained by matching multiple second feature vectors with known fault modes using a preset decision tree model or a preset random forest classification model.

[0009] Optionally, the remote operation and maintenance method for equipment, wherein the step of using the K-means clustering method to perform clustering iterative calculation and potential pattern labeling on multiple first feature vectors to obtain potential fault modes specifically includes: The elbow rule is used to determine the number of clusters in multiple first feature vectors, and a preset number of initial cluster centers are determined based on the number of clusters. The Euclidean distance between each first feature vector and the preset number of initial cluster centers is calculated, and clusters are divided based on the Euclidean distance to obtain multiple clusters. Calculate the feature mean of multiple clusters to obtain the updated cluster centers; The iteration calculation is performed based on the updated cluster centers. When the updated cluster centers are stable, the iteration calculation stops, and the target cluster centers are obtained. Obtain the target cluster corresponding to the target cluster center, obtain the common features of samples within the target cluster, and determine the potential fault modes based on the common features.

[0010] Optionally, the remote equipment operation and maintenance method, wherein the step of using a preset decision tree model or a preset random forest classification model to perform known fault mode matching on multiple second feature vectors to obtain known fault modes specifically includes: Identify historical failure cases and obtain the log feature matrix and failure mode labels corresponding to the historical failure cases; A training set, a validation set, and a test set are constructed based on the log feature matrix and the fault mode labels. Determine a preset decision tree model or a preset random forest classification model, and train the preset decision tree model or the preset random forest classification model based on the training set to obtain an initial classification model; The initial classification model is optimized based on the validation set and the test set to obtain the target classification model. Multiple second feature vectors are input into the target classification model to obtain known fault modes.

[0011] Optionally, in the aforementioned remote equipment operation and maintenance method, the step of performing natural language processing on the preprocessed log data to obtain core fault information specifically includes: The preprocessed log data is reprocessed using NLP technology to obtain reprocessed log data, wherein the reprocessing includes meaningless character removal, terminology standardization, and word segmentation. Determine a preset historical log, wherein the preset historical log includes fault logs and normal logs; Determine the initial BERT model, and fine-tune the initial BERT model according to the preset historical logs to obtain the target BERT model; The reprocessed log data is input into the target BERT model to obtain text semantic features; The reprocessed log data is divided into a text sequence based on the timestamp of consecutive log text belonging to the same device, and a sequence matrix is ​​constructed based on the text sequence. A bidirectional LSTM network is constructed, and key sequence information is filtered through the sequence matrix using the bidirectional LSTM network to obtain text sequence features; Key information is extracted from the text semantic features and the text sequence features to obtain core fault information. The key information extraction includes key entity annotation processing and semantic judgment processing.

[0012] Optionally, the remote equipment operation and maintenance method, wherein the step of predicting indicator trends based on the potential fault modes, the known fault modes, and the core fault information to obtain log analysis results specifically includes: Obtain preset operational indicators from the potential fault modes, the known fault modes, and the core fault information to obtain target indicator values; The target indicator values ​​are sampled and sorted at preset time intervals to obtain a variable time series. The time series of the variables is subjected to a second preprocessing, which includes stationarity test processing, outlier processing, and data normalization processing to obtain the target operating index. The target operating indicators include a first operating indicator that changes linearly and a second operating indicator that changes non-linearly. Determine the ARIMA model and train the ARIMA model using the first operational metric to obtain the target ARIMA model; Obtain the current time series data and input the current time series data into the target ARIMA model. Use the target ARIMA model to predict the trend of the first indicator of the current time series data to obtain the predicted short-term trend. The second operational metric is divided into samples to obtain training samples; Determine the LSTM model, input the training samples into the LSTM model, and iteratively train the LSTM model using the training samples to obtain the target LSTM model; Obtain the current indicator sequence data and input the current indicator sequence data into the target LSTM model. Use the target LSTM model to predict the second indicator trend of the current indicator sequence data to obtain the predicted mutation trend. Based on the predicted short-term trend and the predicted mutation trend, a fusion prediction is performed to generate log analysis results.

[0013] Furthermore, to achieve the above objectives, the present invention also provides a remote equipment operation and maintenance system, wherein the remote equipment operation and maintenance system includes: The log data preprocessing module is used to acquire log data from the target device and preprocess the log data to obtain preprocessed log data. The fault mode generation module is used to perform fault mode identification on the preprocessed log data using machine learning algorithms to obtain potential fault modes and known fault modes, and to perform natural language processing on the preprocessed log data to obtain core fault information. The indicator trend prediction module is used to predict the indicator trend based on the potential fault modes, the known fault modes and the core fault information, and obtain log analysis results. The fault handling and visualization module is used to obtain the fault handling strategy corresponding to the log analysis results, process the log analysis results according to the fault handling strategy, obtain the processing results, and visualize the log analysis results, the fault handling strategy, and the processing results.

[0014] In addition, to achieve the above objectives, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a device remote operation and maintenance program stored in the memory and executable on the processor, wherein when the device remote operation and maintenance program is executed by the processor, it implements the steps of the device remote operation and maintenance method as described above.

[0015] In addition, to achieve the above objectives, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a device remote operation and maintenance program, which, when executed by a processor, implements the steps of the device remote operation and maintenance method described above.

[0016] In this invention, log data from a target device is acquired and preprocessed to obtain preprocessed log data. A machine learning algorithm is then used to identify fault modes in the preprocessed log data, identifying potential and known fault modes. Natural language processing is then performed on the preprocessed log data to obtain core fault information. Based on the potential fault modes, known fault modes, and core fault information, indicator trend prediction is performed to obtain log analysis results. A fault handling strategy corresponding to the log analysis results is obtained, and the log analysis results are processed according to the fault handling strategy to obtain processing results. Finally, the log analysis results, the fault handling strategy, and the processing results are visualized. This invention, by employing machine learning algorithms and natural language processing technology, enables accurate analysis and fault diagnosis of device log data, effectively improving the efficiency of device fault handling. Attached Figure Description

[0017] Figure 1 This is a flowchart of a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 2 This is a schematic diagram of the system architecture of a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 3 This is a schematic diagram of the data acquisition process of a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 4 This is a schematic diagram of the log analysis process of a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 5 This is a schematic diagram of the remote operation and maintenance process of a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 6This is a schematic diagram visually illustrating a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 7 This is a schematic diagram of the first chart display of the visualization module of a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 8 This is a schematic diagram of the second chart display module of a preferred embodiment of the remote operation and maintenance method for equipment of the present invention; Figure 9 This is a structural diagram of a preferred embodiment of the remote operation and maintenance system for equipment of the present invention; Figure 10 This is a structural diagram of a preferred embodiment of the terminal of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer and more explicit, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0019] With the rapid development of IoT technology, open-source HarmonyOS devices (i.e., the target devices in this invention, which are described here as open-source HarmonyOS devices) have been widely used in smart homes, smart offices, and connected vehicles. These devices generate massive amounts of log data during operation, which contains crucial information about the device's operational status and is essential for ensuring stable operation and timely fault detection and handling. However, existing systems have the following problems in log data processing and remote maintenance: 1. Insufficient analytical capabilities: The existing system can only perform simple storage and querying of log data, lacking in-depth analysis capabilities and making it difficult to extract valuable information from the log data. For example, it cannot predict potential equipment failures or identify potential risks during equipment operation based on log data.

[0020] 2. Inadequate remote operation and maintenance functions: Existing remote operation and maintenance systems lack intelligent and automated support, resulting in low efficiency in handling equipment faults. Operation and maintenance personnel often need to manually log in to the equipment to troubleshoot faults, which is time-consuming and prone to errors.

[0021] 3. Limitations of visualization: Existing systems are inadequate in data visualization, making it difficult for maintenance personnel to quickly understand the operating status and fault conditions of equipment in an intuitive way. The lack of interactive data display tools makes it difficult for maintenance personnel to quickly locate problems.

[0022] Therefore, there is an urgent need for a system that integrates in-depth log analysis and remote operation and maintenance functions to meet the growing equipment operation and maintenance needs in the Internet of Things environment.

[0023] To address the aforementioned issues, this invention proposes an open-source HarmonyOS device remote operation and maintenance and log analysis system (i.e., the device remote operation and maintenance method and system in this invention). By integrating remote operation and maintenance, big data analysis, cloud computing, and artificial intelligence technologies, it achieves in-depth mining of log data, accurate fault diagnosis, and efficient remote operation and maintenance, thereby comprehensively improving the efficiency and stability of device operation and maintenance.

[0024] The preferred embodiment of the device remote operation and maintenance method of the present invention, such as... Figure 1 and Figure 2 As shown, the remote operation and maintenance method for the equipment includes the following steps: Step S10: Obtain the log data of the target device and preprocess the log data to obtain preprocessed log data.

[0025] This invention relates to the fields of Internet of Things, remote operation and maintenance, big data analysis, cloud computing and artificial intelligence, and specifically to an open-source HarmonyOS device remote operation and maintenance and log analysis system, which aims to improve the operation and maintenance efficiency and stability of devices through advanced technical means.

[0026] like Figure 2 As shown, the present invention includes a data acquisition module, a log analysis module, a remote operation and maintenance module, and a visualization display module.

[0027] The data acquisition module collects log data in real time by deploying a lightweight acquisition agent on the target device. The acquisition agent obtains log data in real time through open-source HarmonyOS log interfaces (such as HiLog and HiView Log Interface) and transmits it to the cloud via an encrypted channel. Distributed servers are used to process data from multiple devices in parallel, improving acquisition efficiency. Message queue technologies such as Kafka (a high-throughput distributed publish-subscribe messaging system) are used to distribute log data to multiple processing nodes.

[0028] Specifically, the target device and its corresponding target log interface are identified, and a lightweight agent is set up to collect log data from the target device through the target log interface. The log data includes system logs, application logs, and operation logs.

[0029] like Figure 3 As shown, the data acquisition module is used to collect log data from the target device in real time. The specific process is as follows: a lightweight agent is used to collect system logs, application logs and operation logs from the device to ensure the real-time performance and integrity of the data. The lightweight agent obtains log data in real time through the open-source HarmonyOS log interface (such as HiLog) and transmits it to the cloud through an encrypted channel.

[0030] The system logs are derived from the system kernel, hardware drivers, and system services (such as the distributed soft bus and Ark runtime) of the open-source HarmonyOS device. They include kernel events (such as process creation or destruction, memory allocation or leakage, and CPU scheduling), hardware driver status (such as sensor or network chip initialization results and abnormal interruptions), system service operation status (such as distributed service startup or crash, battery or network resource status changes), and system-level errors (such as kernel panic, deadlock, and file system corruption). The application logs are derived from third-party applications developed based on open-source HarmonyOS or pre-installed system applications. They cover application lifecycle events (such as startup or exit, page navigation, and component loading), business logic execution status (such as interface call results and data processing anomalies), and application-level errors (such as null pointer exceptions, permission request failures, and memory overflows). The operation logs record the active operations of device users and maintenance personnel, including user operations (such as device power on / off, button triggers, application installation or uninstallation, and parameter configuration), maintenance operations (such as remote login, configuration modification, software upgrades, and fault recovery), and operation metadata (such as operator ID, timestamp, and operation results).

[0031] During the transmission of real-time logs to the cloud via an "encrypted channel" by the lightweight agent, the core encryption protocols include TLS (Transport Layer Security) / SSL (Secure Sockets Layer) protocols (specifically TLS 1.2 or TLS 1.3 can be selected, and lightweight devices adapted to UDP can supplement with DTLS protocol). This invention also sets up two-factor authentication: that is, an identity verification mechanism is added before the encrypted channel is established (requiring verification of "device dynamic verification code + operation and maintenance account token"), and TLS / SSL (or DTLS) is only initiated for encrypted transmission after successful verification. In addition, sensitive logs (such as device configuration logs) can be additionally encrypted end-to-end using the AES-128 algorithm, and the key is stored through the device hardware security module (HSM) to enhance security redundancy.

[0032] Understandably, this invention pre-installs a lightweight data collection agent (named "OHLogAgent", memory usage ≤5MB, CPU usage ≤3%, automatically starts with the system) in the open-source HarmonyOS device system service layer. The lightweight data collection agent obtains logs in real time through the open-source HarmonyOS HiLog interface: during initialization, HiLogSetOutput is called to direct the log output target, and a subscription rule of "log type + level" is registered through HiLogSubscribe. After the target device generates the target log, the HiLog interface pushes the log to the lightweight data collection agent through the OnLogReceived callback function (delay ≤50ms). The lightweight data collection agent converts the log into a unified JSON format (including fields such as device ID, timestamp, and log type), and filters duplicate logs within 1 second through the hash value of "device ID + timestamp + log content summary". During the transmission phase, an encrypted channel is established using the TLS 1.3 protocol (ECDHE key exchange algorithm, AES-256-GCM symmetric encryption algorithm, and device certificate issued by cloud CA pre-installed on the device side for verification of legality). When maintenance personnel actively pull logs, an additional two-factor authentication of "device dynamic verification code + cloud account token" is added. High-frequency logs (such as system kernel logs) are transmitted in 1KB / slice via HTTP / 2 multiplexing, while low-frequency logs (such as operation logs) are batched and transmitted every 5 seconds (single batch ≤100KB). Each batch of logs is accompanied by a CRC32 checksum. The cloud verifies consistency upon receipt, and if there is a discrepancy, a retransmission is triggered (≤3 times; if it fails, critical logs are cached locally). The cloud receives logs through Kafka, dividing them into topics according to "device model + log type", first caching them in Redis (data within 1 hour), and then asynchronously synchronizing them to HDFS. After successful reception, an ACK is returned to the broker, and the broker deletes the corresponding local cache.

[0033] The data acquisition module employs a distributed architecture: it uses a distributed data acquisition method to support concurrent data acquisition from a large number of devices. Message queue technologies such as Kafka are used to distribute log data to multiple processing nodes, improving data acquisition efficiency. The specific process is as follows: 1. Deployment Architecture Setup: Edge acquisition nodes are deployed at the edge, and a Kafka cluster is built in the cloud (categorized by "device type + log type," with multiple partitions in each topic to support parallel processing). Nodes and the cluster are interconnected via a network. 2. Device-Node Association: After the open-source HarmonyOS device is powered on, the MQTT-SN protocol is used to scan edge nodes, selecting nodes based on the principle of "proximity + low load," and establishing a long connection after verifying the device certificate.

[0034] Understandably, the data preprocessing and encapsulation process is as follows: The target device sends encrypted logs to the associated edge nodes. The nodes verify the log format, filter invalid data, and then encapsulate them into Kafka messages according to "device ID + log type". Further, Kafka distribution processing is performed: the edge nodes push the messages to the corresponding Kafka topics, and the cluster distributes the data to multiple cloud processing nodes for concurrent processing according to the "partition-processing node" mapping rule. Further, fault tolerance and load balancing are configured: Kafka monitoring tools monitor message backlog, and if the threshold is exceeded, processing nodes are expanded; when a node fails, Kafka automatically transfers messages or partitions, and the device switches to a backup edge node via heartbeat detection. Further, data is temporarily stored and transferred: after receiving data, the processing nodes temporarily store it in Redis (data within 1 hour), then asynchronously synchronize it to HDFS. After synchronization is complete, an ACK is sent to Kafka, and Kafka deletes the confirmed message.

[0035] This invention also includes data integrity protection: verification mechanisms (such as CRC check and data signature) are used to ensure that data is not lost during transmission, thus guaranteeing data integrity and reliability.

[0036] The log data is preprocessed to obtain preprocessed log data, wherein the preprocessing includes data cleaning, formatting, and deduplication.

[0037] The data preprocessing process is as follows: the collected log data is cleaned, formatted, and deduplicated to ensure data accuracy and consistency. Specifically, this invention uses ETL tools (such as Extract, Transform, Load, etc.) to clean and transform the log data, removing invalid data and noise.

[0038] Step S20: Use machine learning algorithms to identify fault modes in the preprocessed log data to obtain potential fault modes and known fault modes, and perform natural language processing on the preprocessed log data to obtain core fault information.

[0039] like Figure 4 As shown, this invention includes a log analysis module with the following functions: 1. Storing log data on a big data platform for data cleaning and preprocessing. ETL tools are used to clean and transform the log data, removing invalid data and noise. 2. Applying machine learning models to classify and predict risks from log data. The model is trained using historical log data to identify common fault patterns (such as memory leaks and network congestion). 3. Using NLP technology to parse log text and extract key fault information. Fault types are identified through keywords in the log text (such as "error" and "exception").

[0040] Specifically, feature extraction processing is performed on the preprocessed log data to obtain feature vectors, wherein the feature extraction processing includes numerical feature extraction, textual feature encoding, and feature selection optimization.

[0041] This invention employs machine learning algorithms: clustering analysis (such as K-means) and classification algorithms (such as decision trees and random forests) to automatically identify fault modes. The invention achieves accurate fault mode identification through a two-step process: "unsupervised clustering to uncover latent patterns + supervised classification to match known patterns." The specific process is as follows: The first step is fault feature engineering construction (preparation): Feature extraction is performed on the preprocessed log data, transforming unstructured or semi-structured logs into feature vectors that the algorithm can recognize. The specific process is as follows: 1. Numerical Feature Extraction: Extract device operation metrics (such as CPU utilization, memory usage, network bandwidth utilization, and process response time) from system logs and application logs, and calculate the mean, variance, and peak value of the metrics by time window (such as 5 minutes / window) to form numerical feature dimensions. 2. Text-based feature encoding: TF-IDF (term frequency-inverse document frequency) encoding is performed on key operations (such as "process crash", "driver initialization failure") and error identifiers (such as "0x0000007B" blue screen code) in the log text to transform text descriptions such as "network congestion caused data retransmission" into vector dimensions; 3. Feature selection and optimization: Redundant features (such as "device startup time" which is not related to the fault) are eliminated through analysis of variance (ANOVA), and core features such as "memory usage growth rate", "frequency of error code occurrence" and "network retransmission rate" are retained to construct a fault feature matrix.

[0042] The feature vectors include multiple first feature vectors without historical fault labels and multiple second feature vectors with historical fault labels. The elbow rule is used to determine the number of clusters among the multiple first feature vectors, and a preset number of initial cluster centers are determined based on the number of clusters. The Euclidean distance between each first feature vector and the preset number of initial cluster centers is calculated, and clusters are divided based on the Euclidean distance to obtain multiple clusters. The feature mean of the multiple clusters is calculated to obtain updated cluster centers. Iterative calculations are performed based on the updated cluster centers, and the iterative calculations stop when the updated cluster centers are stable, resulting in target cluster centers. The target cluster corresponding to the target cluster center is obtained, and the common features of samples within the target cluster are obtained. Potential fault modes are determined based on the common features.

[0043] This invention utilizes the K-means clustering method to uncover potential fault patterns (unsupervised phase). For log data lacking historical fault labels, the K-means clustering algorithm is used to uncover unknown fault patterns. The specific process is as follows: 1. Cluster number initialization: Determine the number of clusters K based on the Elbow Method, calculate the in-cluster sum of squares (WCSS) corresponding to different K values ​​(e.g., K=3, 4, 5), and select the K value with a sharp decrease in WCSS rate (e.g., K=4, corresponding to the four potential modes of "memory-related failures, network-related failures, driver-related failures, and application crash failures"). 2. Clustering Iterative Calculation: Randomly select K initial cluster centers, such as feature vectors like "memory usage rate 85% + error code 0x0000001A" and "network retransmission rate 30% + logs containing "timeout""; calculate the Euclidean distance between each log sample and the K cluster centers, and assign the sample to the nearest cluster (e.g., samples with "memory usage rate exceeding 90% for 5 consecutive windows" are assigned to the "memory-related faults" cluster); recalculate the feature mean of each cluster as the new cluster center, and repeat the "distance calculation - sample partitioning - center update" steps until the cluster centers are stable (the error between the two center updates is ≤0.01). 3. Potential pattern labeling: Manually labeled each cluster formed by clustering, that is, analyzing the common characteristics of samples within the cluster (such as "all samples in cluster 1 contain the keyword "memory leak" + memory usage continues to rise"), in order to determine the potential fault modes corresponding to the cluster (such as "cluster 1 = memory leak mode", "cluster 2 = network congestion mode").

[0044] Identify historical failure cases and obtain the log feature matrix and failure mode labels corresponding to the historical failure cases; construct a training set, a validation set, and a test set based on the log feature matrix and the failure mode labels; determine a preset decision tree model or a preset random forest classification model, and train the preset decision tree model or the preset random forest classification model based on the training set to obtain an initial classification model; optimize the initial classification model based on the validation set and the test set to obtain a target classification model; input multiple second feature vectors into the target classification model to obtain known failure modes.

[0045] This invention employs decision tree or random forest classification methods to match known fault patterns (i.e., the supervised stage). For example, by training a model using historical log data, common fault patterns (such as memory leaks, network congestion, etc.) are identified. For log data with existing historical fault labels, a classification algorithm is used to construct an identification model for known fault patterns. The specific steps are as follows: 1. Construction of labeled dataset: Collect historical failure cases (such as "device shutdown due to memory leak in March 2024" and "disconnection due to network congestion in May 2024"), associate the corresponding log feature matrix with failure mode labels (such as "memory leak mode 001" and "network congestion mode 002"), and construct a training set (70%), a validation set (20%) and a test set (10%). 2. The model training and tuning process is as follows: Decision tree training: With "fault mode recognition accuracy" as the target, select splitting features based on information gain ratio (e.g., prioritize "memory usage growth rate" as the root node splitting feature), and set the tree depth (e.g., maximum depth 10) to avoid overfitting; Random forest optimization: Construct 100 decision trees, and randomly select 60% of the samples and 50% of the features for training in each tree. Output the final fault mode through a voting mechanism (e.g., if 80 trees determine "network congestion mode", then the sample is assigned to this mode); Validation and tuning: Test the model performance using the validation set. If the "driving fault mode" recognition accuracy is low (e.g., <85%), supplement with historical samples of this mode and retrain until the model's test set accuracy is ≥92%; 3. Real-time fault mode matching: Input the feature vector of real-time logs into the trained classification model, and the model outputs the matching known fault modes (e.g., input "network retransmission rate 40%+ logs contain "TCP retransmit", model output "network congestion mode 002"), and at the same time associate the historical handling scheme of the mode (e.g. "adjust router MTU value").

[0046] Furthermore, NLP technology is used to reprocess the preprocessed log data to obtain reprocessed log data, wherein the reprocessing includes meaningless character removal, terminology standardization, and word segmentation.

[0047] This invention also incorporates Natural Language Processing (NLP): applying NLP techniques (such as BERT and LSTM) for analysis. First, log text reprocessing is performed. For the text format of the open-source HarmonyOS logs (such as "exception: NullPointerException at line 56"), cleaning and standardization are first implemented, including: 1. Remove meaningless characters (such as "timestamp" and "log level marker") and keep the core text "exception: NullPointerException at line 56"; 2. Terminology Standardization: Based on the open-source HarmonyOS log dictionary (including mapping relationships such as "NullPointerException" and "HiLog"), technical terms are uniformly converted into standard expressions (e.g., "NPE" is converted to "NullPointerException"). 3. Word segmentation: Jieba word segmentation is used in conjunction with the HarmonyOS log-specific dictionary (such as "MainAbility" and "Ark running") to segment the text into word vectors (such as "exception", "null pointer exception", and "line 56").

[0048] A preset historical log is determined, which includes fault logs and normal logs; an initial BERT model is determined, and the initial BERT model is fine-tuned according to the preset historical log to obtain a target BERT model; the reprocessed log data is input into the target BERT model to obtain text semantic features.

[0049] Understandably, the BERT model extracts semantic features from text. A pre-trained BERT model (fine-tuned based on open-source HarmonyOS log corpus) is used to capture the deep semantics of log text. The specific process is as follows: 1. Model fine-tuning: The basic BERT model was fine-tuned using 100,000 open-source HarmonyOS historical logs (including "fault logs" and "normal logs" labels). Specifically, the output layer was adjusted to perform a dual task of "semantic classification + keyword prediction" to adapt the model to the semantic logic of the log text (such as distinguishing the semantic difference between "exception: insufficient memory" and "warning: high memory usage"). 2. Semantic Vector Generation: The preprocessed log text is input into the fine-tuned BERT. The model captures the relationship between words through a multi-head attention mechanism (such as the positional relationship between "NullPointerException" and "line 56") and outputs a 768-dimensional text semantic vector (which can be directly used as a feature of machine learning algorithms).

[0050] The continuous log texts belonging to the same device in the reprocessed log data are grouped into a text sequence according to the timestamp, and a sequence matrix is ​​constructed based on the text sequence; a bidirectional LSTM network is constructed, and the key sequence information of the sequence matrix is ​​filtered through the bidirectional LSTM network to obtain text sequence features.

[0051] Furthermore, an LSTM model is used to extract text sequence features. For the temporal correlation of log text (e.g., "driver initialization failed → device disconnected → log output 'timeout'"), the LSTM model is used to capture sequence patterns. The specific process is as follows: 1. Sequence Construction: Consecutive log texts from the same device (e.g., 5 logs within 10 minutes) are grouped into a text sequence based on timestamps. Each log corresponds to one BERT semantic vector, forming a sequence matrix of "time step × semantic vector dimension". 2. LSTM Training and Feature Extraction: Construct a bidirectional LSTM network (forward to capture future sequence features, backward to capture historical sequence features). After inputting the sequence matrix, key sequence information (such as the sequence association between "drive initialization failure" and "timeout") is filtered through gating units (including input gate, forget gate and output gate). Finally, a 256-dimensional sequence feature vector is output (used to determine "whether there is a fault chain reaction").

[0052] Key information is extracted from the text semantic features and the text sequence features to obtain core fault information. The key information extraction includes key entity annotation processing and semantic judgment processing.

[0053] For the extraction and output of key information, this invention extracts core fault information from log text by fusing the outputs of BERT and LSTM. The specific implementation steps are as follows: 1. Mark key entities using Named Entity Recognition (NER): Identify "error code (e.g., 0x0000007B), exception type (e.g., null pointer exception), involved module (e.g., MainAbility), and fault location (e.g., line 56)"; 2. Semantic determination: Based on LSTM sequence features, determine the severity of the anomaly (e.g., "single (warning) log → mild anomaly", "3 consecutive (error) logs → severe anomaly"), and finally output structured text analysis results (e.g., "anomaly type: null pointer exception; involved module: MainAbility; severity: severe; associated sequence: no chain reaction").

[0054] The log text is used to extract key information such as error codes and exception descriptions. For example, the type of failure can be identified by keywords in the log text, such as "error" or "exception".

[0055] It's important to clarify that machine learning algorithms and NLP processing are not executed sequentially, but rather in a collaborative and parallel manner. Furthermore, the output of NLP provides key feature support for the machine learning algorithms. The specific implementation process is as follows: 1. After log data preprocessing, it synchronously enters two branches: "NLP Text Analysis" and "Machine Learning Feature Engineering": NLP extracts information such as "error code, exception type, and involved module" from the log text (e.g., extract "null pointer exception" and "MainAbility module" from "exception: NullPointerException in MainAbility"), and encodes this information into text features (e.g., feature value 1 corresponds to "exception type = null pointer exception"). 2. The text features are fused with the numerical features (such as CPU utilization) required by the machine learning algorithm to form a feature matrix for fault identification, which is then input into a clustering or classification algorithm for fault pattern identification. 3. At the same time, NLP can independently output text-level fault clues (such as error code "0x0000007B"), which can be mutually verified with the fault patterns identified by machine learning (such as "driver loading failure mode") to improve the accuracy of identification.

[0056] The core difference between machine learning algorithms and NLP processing lies in the definition of dimension and granularity, as detailed below: 1. Fault Mode: This is a set of "device fault behavior patterns and features" identified by machine learning algorithms. It focuses on "patterns and regularity" and has a relatively coarse granularity. For example, "memory leak mode" corresponds to the feature combination of "continuous increase in memory usage + process response delay + logs containing "out of memory". It can cover similar faults in different devices (such as smart home devices and in-vehicle devices). 2. Fault Type: This refers to the "specific fault name and attributes" extracted by NLP from the log text. It emphasizes "concreteness and individuality" and has a finer granularity. For example, "NullPointerException (fault type)" identified from "exception: NullPointerException in MainAbility" is a specific fault manifestation under "application crash mode". 3. Relationship: One fault mode can correspond to multiple fault types (e.g., "application crash mode" can correspond to multiple fault types such as "null pointer exception", "array out of bounds exception", "permission request failure"). Fault type is a "specific instance" of fault mode, and fault mode is a "summary of patterns" of fault type.

[0057] Step S30: Based on the potential fault modes, the known fault modes, and the core fault information, predict the trend of indicators to obtain the log analysis results.

[0058] Specifically, preset operating indicators from the potential fault modes, the known fault modes, and the core fault information are obtained to obtain target indicator values; the target indicator values ​​are sampled and sorted at preset time intervals to obtain variable time series.

[0059] For risk prediction: This invention combines historical data to predict potential equipment failure trends, supporting preventative maintenance. Time series analysis (such as ARIMA and LSTM) is used to predict trends in log data, providing early warnings of possible failures. This invention achieves accurate early warning of failure trends through a fusion prediction scheme that combines a linear model (ARIMA) to capture trends with a nonlinear model (LSTM) to capture sudden changes. The specific process is as follows: The first step is time series data construction, focusing on "equipment operation indicators" to build time series data for prediction. Specific implementation steps include: 1. Metric selection: Select operational metrics that are strongly correlated with the fault (such as memory usage, CPU utilization, network retransmission, and application response time), and extract metric values ​​from the preprocessed log data; 2. Time series generation: Sample the index values ​​at fixed time intervals (e.g., 5 minutes / interval), sort them by timestamp, and form a single variable time series (e.g., "memory occupancy rate time series: t0=50%, t1=55%, t2=60%..."). If multi-indicator collaborative prediction is required, construct a multivariate time series matrix.

[0060] The time series of the variables is subjected to a second preprocessing process, which includes stationarity testing, outlier handling, and data normalization to obtain the target operating index.

[0061] Furthermore, a second preprocessing step is performed on the time series data to ensure that the data meets the model input requirements. This second preprocessing process specifically includes: 1. Stationarity test: Use ADF (unit root test) to determine whether the time series is stationary (e.g., ARIMA requires the series to be stationary). If it is not stationary (e.g., a non-stationary series with continuously rising memory usage), convert it into a stationary series by first-order differencing (calculating the difference between adjacent time steps). 2. Outlier handling: Outliers are removed based on the 3σ principle (such as "CPU utilization = 150%" due to data transmission errors), and missing values ​​are filled with linear interpolation (such as data loss of 1 time step due to network interruption). 3. Data normalization: Normalize the preprocessed sequence data to an interval (e.g., using Min-Max normalization) to avoid the impact of differences in the magnitude of different indicators (e.g., "memory usage (%)" and "response time (ms)") on model training.

[0062] The target operating indicators include a first operating indicator that changes linearly and a second operating indicator that changes non-linearly; an ARIMA model is determined, and the first operating indicator is used to train the ARIMA model to obtain a target ARIMA model; current time series data is acquired and input into the target ARIMA model, and the target ARIMA model is used to predict the trend of the current time series data using a first indicator to obtain a predicted short-term trend.

[0063] In this invention, the ARIMA model is used for prediction (i.e., linear trend prediction). For linearly changing operating indicators (such as slowly increasing memory usage), the ARIMA model is used to predict short-term trends. The specific implementation steps are as follows: 1. Model parameter determination: The autoregression order p is determined by the autocorrelation function (ACF) (e.g., if the ACF is truncated at lag 3, p=3 is taken), the moving average order q is determined by the partial autocorrelation function (PACF) (e.g., if the PACF is truncated at lag 2, q=2 is taken), and the differencing order d is determined based on the stationarity test results (e.g., if stationary after lag 1, d=1 is taken). Finally, the model is determined to be ARIMA. 2. Model Training and Linear Prediction: Train the ARIMA model using 30 days of historical time series data to minimize the mean squared error (MSE) between the predicted and actual values; after training, input the most recent 7 days of time series data to predict the trend of indicators in the next 1-6 hours (e.g., predict that memory usage will rise from 70% to 85% in the next 3 hours).

[0064] The second operational indicator is divided into samples to obtain training samples; an LSTM model is determined, and the training samples are input into the LSTM model. The LSTM model is iteratively trained using the training samples to obtain a target LSTM model; the current indicator sequence data is obtained, and the current indicator sequence data is input into the target LSTM model. The target LSTM model is used to predict the second indicator trend of the current indicator sequence data to obtain the predicted mutation trend.

[0065] This invention also includes an LSTM model for prediction (nonlinear mutation prediction). For nonlinear, sudden-onset operational metrics (such as a sudden spike in network retransmission rate), the LSTM model is used to capture mutation trends. The specific process is as follows: 1. Sequence window construction: Divide the preprocessed time series into samples according to "input window × prediction window". For example, use the indicator data of the first 12 time steps (1 hour) to predict the indicator values ​​of the next 3 time steps (15 minutes) to construct training samples of "number of samples × input window × feature dimension". 2. LSTM Network Training: Construct an LSTM network with two hidden layers (128 neurons per layer). After inputting training samples, iterate through the Adam optimizer using MSE as the loss function (100 iterations, batch size 32). Adjust the network parameters using the validation set (e.g., add a dropout layer to avoid overfitting) to achieve a model prediction accuracy ≥ 90%. 3. Nonlinear prediction: Input the indicator sequence data of the most recent hour, and the LSTM model outputs the indicator prediction value for the next 15 minutes (such as predicting that the network retransmission rate will soar from 10% to 40% in the next 5 minutes), focusing on capturing the sudden change trend that is difficult to predict with ARIMA.

[0066] Furthermore, log analysis results are generated by fusing predictions based on the predicted short-term trend and the predicted mutation trend.

[0067] It is understood that this invention incorporates fusion prediction and fault warning, combining the prediction results of ARIMA and LSTM to trigger fault warning. The specific implementation steps are as follows: 1. Indicator threshold setting: For each predictive indicator, set an early warning threshold (such as memory usage ≥90%, network retransmission rate ≥35%). This threshold can be dynamically adjusted based on historical failure cases (such as if a certain model of equipment shuts down multiple times when the memory usage is 92%, the threshold is set to 88%). 2. Fusion Judgment: If ARIMA predicts that the memory utilization rate will reach 88% in the next 6 hours (trigger threshold), and LSTM predicts no sudden changes, then a "mild warning" is triggered; if LSTM predicts that the network retransmission rate will reach 40% in the next 15 minutes (trigger threshold), and ARIMA predicts the same trend, then a "severe warning" is triggered. 3. Early warning output: Generate early warning information (including "predicted indicator: network retransmission rate; predicted value: 40%; early warning level: severe; estimated trigger time: after 15 minutes; suggested handling solution: check network routing"), push it to operation and maintenance personnel via email and application APP, and simultaneously synchronize it to the remote operation and maintenance module for subsequent fault pre-processing.

[0068] Step S40: Obtain the fault handling strategy corresponding to the log analysis result, process the log analysis result according to the fault handling strategy to obtain the processing result, and visualize the log analysis result, the fault handling strategy and the processing result.

[0069] like Figure 5As shown, this invention also includes a remote operation and maintenance module, used for: 1. Providing a secure authentication interface to ensure secure access. Operation and maintenance personnel need to use two-factor authentication (such as SMS verification code + password) to access the device. 2. Operation and maintenance personnel can perform fault recovery operations in real time through the platform. For example, when the system detects a memory leak, it automatically restarts related services or releases memory resources.

[0070] 3. The platform automatically generates recovery suggestions based on log analysis results and supports one-click execution.

[0071] like Figure 6 As shown, this invention also includes a visualization module for: 1. Generating dynamic dashboards and analysis reports in real time using data visualization technology. Dynamic charts are generated using visualization tools such as ECharts and D3.js to help maintenance personnel quickly understand equipment operation status. 2. Supporting cross-device data comparison and multi-dimensional data filtering. Maintenance personnel can choose to display specific indicators and data according to their needs. 3. Providing interactive tools to support quick queries and in-depth analysis. Real-time data updates are achieved through WebSocket technology.

[0072] The specific functions of the remote operation and maintenance module are as follows: 1. Secure Access: Employing encrypted communication protocols (such as TLS / SSL) and two-factor authentication mechanisms ensures secure data transmission and device access, preventing unauthorized access. Maintenance personnel must use two-factor authentication (such as SMS verification code + password) to access the device.

[0073] 2. Intelligent Recovery: Based on log analysis results, recommend or automatically execute fault recovery operations. The correspondence between different log analysis results and fault recovery operations is uniformly stored in the Fault Recovery RuleBase (FRRB) (this rulebase is built on a distributed relational database such as PostgreSQL, supporting high-concurrency queries and dynamic updates). The specific design and calling logic are as follows: The storage structure of the corresponding relationships includes: the rule base uses "fault characteristics - recovery operation" as the core entries, and each entry contains multi-dimensional matching fields and execution parameters, for example: Fault characteristic fields: Results associated with the log analysis module (such as "Fault Mode ID: Memory Leak Mode 001", "NLP Extracted Anomaly Type: Memory Overflow", "Risk Prediction Level: Severe"). Recovery operation fields: Specify the operation type (automatic execution or recommended execution), and the specific instructions (e.g., "Automatic execution: Call the ohos.service.memory interface of the open-source HarmonyOS device to release cached memory;"). Recommended actions: Push the "Restart Device Service" button to the operation and maintenance interface, and prioritize the execution (e.g., prioritize "Level 1" for severe memory leak faults, and execute automatically first).

[0074] 3. Constraint fields: Limit the scope of operation (e.g., "Only applicable to devices with open-source HarmonyOS 3.0 and above", "Automatic execution not more than 3 times per day to avoid frequent operation affecting the device"). The process of constructing and updating the correspondence is as follows: 1. Initial Construction: Based on historical failure cases (such as 1000+ failure handling records of open source HarmonyOS devices), operation and maintenance experts and algorithm engineers jointly sort out the mapping relationship of "fault characteristics - recovery operation" and import them into the rule base in batches; 2. Dynamic Updates: Combining operational feedback and AI optimization, when the success rate of a recovery operation is below 80% (e.g., "Release memory" is ineffective for a certain type of memory leak fault), the system automatically marks the entry and pushes optimization suggestions. After manual review, the operation instructions are updated. At the same time, when the log analysis module identifies a new fault mode (e.g., "Ark runtime component crash"), it automatically triggers the process of adding entries to the rule base, matching the preset general recovery operations (e.g., "Restart Ark runtime service"), and awaits manual supplementation and refinement. The specific steps of the corresponding relationship invocation process are as follows: 1. After the log analysis module outputs the results (such as "Fault mode: memory leak mode 001, risk level: severe"), the remote operation and maintenance module sends a matching request to the rule base to accurately query through the two dimensions of "fault mode ID + risk level". 2. If the constraints are met (e.g., the device version is compatible, and the execution count does not exceed the limit), the system directly calls the remote control interface of the open-source HarmonyOS device (e.g., sending recovery commands via SSH protocol). If marked "Recommended Execution," the operation options (e.g., "Release Memory," "Restart Service") and the fault analysis report are pushed to the operation and maintenance interface simultaneously for confirmation and execution by the operation and maintenance personnel. For example, when the system detects a memory leak, it automatically restarts the relevant services or releases memory resources.

[0075] Device Management: Supports remote device configuration modification, software updates, and real-time status monitoring. Log in to devices remotely via SSH or Remote Desktop Protocol (RDP) to perform configuration modifications and software updates.

[0076] like Figure 7 and Figure 8 As shown, the functions of the visualization module include: 1. Diverse Display: Displays equipment status, fault distribution, and maintenance records through charts, dashboards, and heatmaps. Dynamic charts are generated using visualization tools such as ECharts and D3.js to help maintenance personnel quickly understand equipment operation.

[0077] 2. Real-time Updates: Supports real-time data refresh and interactive query functions, ensuring that maintenance personnel can obtain the latest device status information in a timely manner. Real-time data updates are achieved through WebSocket technology.

[0078] 3. Personalized Configuration: Allows operations and maintenance personnel to customize the data display content and layout, improving user experience. They can choose to display specific metrics and data according to their needs.

[0079] like Figure 6 As shown, "Analysis Report → Operations Personnel Interaction" means that "the analysis report serves as the basis for operations personnel to carry out operations and transmits information to the operations personnel interaction module." The specific implementation steps are as follows: the analysis report generated by the visualization module (which integrates the results of equipment status, fault analysis, and operations and maintenance records) will be synchronized to the "Operations Personnel Interaction" module, allowing operations personnel to view the report content, initiate subsequent operations and maintenance operations (such as fault recovery and equipment configuration adjustment) based on the fault conclusions or trend suggestions in the report.

[0080] The meaning of "Data Filtering and Query → Dynamic Dashboard" is that "the results of data filtering and querying drive the dynamic dashboard to update and display content." The specific implementation steps are as follows: maintenance personnel use the "Data Filtering and Query" module (such as selecting specific equipment, time range, and fault type as filtering conditions), and the system will synchronize the filtered equipment status and fault data to the "Dynamic Dashboard" in real time, so that the dashboard displays real-time data that meets the filtering conditions (such as only displaying the memory usage trend of a certain model of equipment, the distribution of a certain type of fault), realizing the personalized and accurate display of dashboard content.

[0081] The system functions of this invention include: 1. Real-time Monitoring: Real-time collection and analysis of device logs to detect anomalies immediately. Real-time stream processing technology (such as Apache Flink) is used to analyze log data in real time, ensuring timely detection of anomalies. Specifically, real-time stream processing technology (Apache Flink) is a "data processing framework" whose core function is to receive, distribute, and perform window calculations on the collected log data stream with low latency (milliseconds), solving the "efficiency problem of real-time processing of massive logs." For example, it splits the real-time logs generated by the device into 10-second windows, quickly filtering out suspected abnormal logs containing keywords such as "error" and "exception," and then synchronously pushes the filtered data to machine learning algorithms and NLP modules, avoiding analysis delays caused by the backlog of all data.

[0082] Furthermore, machine learning algorithms (such as K-means and random forest) and NLP techniques (such as BERT and LSTM) are "deep data analysis tools." Their core function is to perform "fault mode identification and key information extraction" on suspected abnormal logs filtered by Flink. For example, machine learning algorithms identify the fault mode corresponding to the log (such as memory leak), and NLP extracts the specific anomaly type (such as null pointer exception). The analysis results of both serve as the core basis for alarm triggering.

[0083] Collaborative Logic: Flink is responsible for "real-time filtering + rapid distribution", while machine learning and NLP are responsible for "deep analysis + accurate judgment". The three have different roles and work together to achieve the core goal of "real-time anomaly detection".

[0084] Provides anomaly alert functionality, supporting multi-channel alert push (such as email, SMS, and mobile app) to ensure timely response from operations and maintenance personnel. Alarm rule design (alarm rules are based on log analysis results (fault mode, anomaly type, risk level, etc.)) supports dynamic optimization based on device operating status and historical alarm handling effects, and can also be dynamically adjusted based on log analysis results. Common rules include: a) Fault level-based alarm rules: triggering different alarms according to the risk level (mild / moderate / severe) output by log analysis, for example, "severe faults (such as kernel panic) immediately trigger SMS + mobile app alarms, mild faults (such as a single warning log) only push email alarms"; b) Metric threshold-based alarm rules: associating with device operating metrics (CPU utilization, memory usage, etc.), for example, "memory usage ≥85% for three consecutive 10-second windows, and machine learning identifies it as 'memory leak mode,' triggering an alarm"; c) Anomaly frequency-based alarm rules: ... The alarm rules are categorized into several types: d) Alarm rules based on trend changes: combining time series prediction results, such as "predicting that the network retransmission rate will rise to 40% in the next 30 minutes (exceeding the warning threshold of 35%), triggering a preventative alarm in advance"; e) Alarm rules based on related events: associating anomalies across multiple log types, such as "after Flink detects a 'driver initialization failure' log, a 'device disconnection' log appears within 1 minute, and NLP extracts the same faulty module, triggering a linked alarm"; f) Dynamic adjustment rules based on maintenance feedback: if a certain type of alarm (such as "mild memory overload") is marked as an "invalid alarm" by maintenance personnel ≥3 times, the system automatically adjusts the rules (such as raising the threshold from 80% to 90%) to reduce redundant alarms.

[0085] 2. Log Analysis: Deeply mine massive amounts of log data to accurately identify failure modes and potential risks. Through machine learning algorithms and NLP technology, extract valuable information from log data to help operations and maintenance personnel quickly locate problems. Generate automated operations and maintenance suggestions based on log analysis results to help operations and maintenance personnel quickly resolve issues. For example, when the system detects network congestion, it automatically recommends solutions to optimize network configuration.

[0086] 3. Remote Operation and Maintenance: Provides secure and convenient remote access, supporting rapid fault diagnosis and recovery. Encrypted communication protocols and two-factor authentication mechanisms ensure the security of remote access. Combined with automated operation and maintenance technologies, it improves the efficiency and accuracy of fault handling and reduces manual intervention. For example, when the system detects a device fault, it automatically executes fault recovery operations.

[0087] 4. Visual Display: Presents equipment operating status, fault trends, and maintenance operation records in an intuitive format, helping maintenance personnel quickly understand equipment operation. Dynamic charts and dashboards display key equipment indicators and fault distribution. Personalized customization and interactive data query functions are provided to improve the work efficiency of maintenance personnel. Maintenance personnel can choose to display specific indicators and data according to their needs.

[0088] The technical effects of this invention include: 1. Enhance analytical capabilities: By leveraging big data and artificial intelligence technologies to deeply mine log data, significantly improve analytical efficiency and accuracy, helping operations and maintenance personnel quickly locate problems.

[0089] 2. Improve operation and maintenance efficiency: Support remote intelligent operation and maintenance, shorten fault handling time, and reduce equipment downtime.

[0090] 3. Enhance equipment stability: Enable early detection, rapid location, and quick recovery of faults, ensuring long-term stable operation of equipment.

[0091] 4. Optimize user experience: Through visualization tools, help operations and maintenance personnel quickly obtain key information and improve decision-making efficiency.

[0092] Furthermore, such as Figure 9 As shown, based on the above-described remote equipment operation and maintenance method, the present invention also provides a remote equipment operation and maintenance system, wherein the remote equipment operation and maintenance system includes: Log data preprocessing module 51 is used to acquire log data from the target device and preprocess the log data to obtain preprocessed log data; The fault mode generation module 52 is used to perform fault mode identification on the preprocessed log data using machine learning algorithms to obtain potential fault modes and known fault modes, and to perform natural language processing on the preprocessed log data to obtain core fault information. The indicator trend prediction module 53 is used to predict the indicator trend based on the potential fault mode, the known fault mode and the core fault information, and obtain the log analysis results. The fault handling and visualization module 54 is used to obtain the fault handling strategy corresponding to the log analysis result, process the log analysis result according to the fault handling strategy, obtain the processing result, and visualize the log analysis result, the fault handling strategy, and the processing result.

[0093] Furthermore, such as Figure 10 As shown, based on the above-mentioned remote operation and maintenance method and system for equipment, the present invention also provides a terminal, which includes a processor 10, a memory 20 and a display 30. Figure 10Only some of the terminal components are shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0094] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard disk or memory. In other embodiments, the memory 20 may be an external storage device of the terminal, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc. Further, the memory 20 may include both internal and external storage devices. The memory 20 is used to store application software and various types of data installed on the terminal, such as the program code installed on the terminal. The memory 20 can also be used to temporarily store data that has been output or will be output. In one embodiment, the memory 20 stores a device remote operation and maintenance program 40, which can be executed by the processor 10 to implement the device remote operation and maintenance method of this application.

[0095] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor, or other data processing chip, used to run program code stored in the memory 20 or process data, such as executing the remote operation and maintenance method of the device.

[0096] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. The display 30 is used to display information on the terminal and to display a visual user interface.

[0097] In one embodiment, when the processor 10 executes the device remote operation and maintenance program 40 in the memory 20, it implements the steps of the device remote operation and maintenance method as described above.

[0098] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a device remote operation and maintenance program, which, when executed by a processor, implements the steps of the device remote operation and maintenance method described above.

[0099] In summary, this invention provides a method, system, terminal, and storage medium for remote operation and maintenance of equipment. The method includes: acquiring log data from a target device and preprocessing the log data to obtain preprocessed log data; using a machine learning algorithm to identify fault modes in the preprocessed log data to obtain potential fault modes and known fault modes, and performing natural language processing on the preprocessed log data to obtain core fault information; predicting indicator trends based on the potential fault modes, the known fault modes, and the core fault information to obtain log analysis results; acquiring a fault handling strategy corresponding to the log analysis results; processing the log analysis results according to the fault handling strategy to obtain a processing result; and visually displaying the log analysis results, the fault handling strategy, and the processing result. This invention, by employing machine learning algorithms and natural language processing technology, enables accurate analysis and fault diagnosis of equipment log data and effectively improves the efficiency of equipment fault handling.

[0100] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes that element.

[0101] Of course, those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.). The program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The computer-readable storage medium can be a memory, magnetic disk, optical disk, etc.

[0102] It should be understood that the application of the present invention is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for remote operation and maintenance of equipment, characterized in that, The remote operation and maintenance method for the equipment includes: Obtain log data from the target device and preprocess the log data to obtain preprocessed log data; Machine learning algorithms are used to identify fault modes in the preprocessed log data to obtain potential fault modes and known fault modes, and natural language processing is performed on the preprocessed log data to obtain core fault information. Based on the potential failure modes, the known failure modes, and the core failure information, indicator trends are predicted to obtain log analysis results. Obtain the fault handling strategy corresponding to the log analysis results, process the log analysis results according to the fault handling strategy, obtain the processing results, and visualize the log analysis results, the fault handling strategy, and the processing results.

2. The remote operation and maintenance method for equipment according to claim 1, characterized in that, The process of acquiring log data from the target device and preprocessing the log data to obtain preprocessed log data specifically includes: Identify the target device and its corresponding target log interface, and set up a lightweight agent to collect log data from the target device through the target log interface. The log data includes system logs, application logs, and operation logs. The log data is preprocessed to obtain preprocessed log data, wherein the preprocessing includes data cleaning, formatting, and deduplication.

3. The remote operation and maintenance method for equipment according to claim 1, characterized in that, The step of using machine learning algorithms to identify fault modes in the preprocessed log data to obtain potential fault modes and known fault modes specifically includes: The preprocessed log data is subjected to feature extraction processing to obtain feature vectors, wherein the feature extraction processing includes numerical feature extraction, text feature encoding, and feature selection optimization; The feature vector includes multiple first feature vectors without historical fault labels and multiple second feature vectors with historical fault labels. The K-means clustering method is used to perform iterative clustering calculations and latent pattern labeling on multiple first feature vectors to obtain potential fault modes. A known fault mode is obtained by matching multiple second feature vectors with known fault modes using a preset decision tree model or a preset random forest classification model.

4. The remote operation and maintenance method for equipment according to claim 3, characterized in that, The step of using the K-means clustering method to perform clustering iteration calculations and potential pattern labeling on multiple first feature vectors to obtain potential fault modes specifically includes: The elbow rule is used to determine the number of clusters in multiple first feature vectors, and a preset number of initial cluster centers are determined based on the number of clusters. The Euclidean distance between each first feature vector and the preset number of initial cluster centers is calculated, and clusters are divided based on the Euclidean distance to obtain multiple clusters. Calculate the feature mean of multiple clusters to obtain the updated cluster centers; The iteration calculation is performed based on the updated cluster centers. When the updated cluster centers are stable, the iteration calculation stops, and the target cluster centers are obtained. Obtain the target cluster corresponding to the target cluster center, obtain the common features of samples within the target cluster, and determine the potential fault modes based on the common features.

5. The remote operation and maintenance method for equipment according to claim 3, characterized in that, The step of using a preset decision tree model or a preset random forest classification model to perform known fault mode matching on multiple second feature vectors to obtain known fault modes specifically includes: Identify historical failure cases and obtain the log feature matrix and failure mode labels corresponding to the historical failure cases; A training set, a validation set, and a test set are constructed based on the log feature matrix and the fault mode labels. Determine a preset decision tree model or a preset random forest classification model, and train the preset decision tree model or the preset random forest classification model based on the training set to obtain an initial classification model; The initial classification model is optimized based on the validation set and the test set to obtain the target classification model. Multiple second feature vectors are input into the target classification model to obtain known fault modes.

6. The remote operation and maintenance method for equipment according to claim 1, characterized in that, The step of performing natural language processing on the preprocessed log data to obtain core fault information specifically includes: The preprocessed log data is reprocessed using NLP technology to obtain reprocessed log data, wherein the reprocessing includes meaningless character removal, terminology standardization, and word segmentation. Determine a preset historical log, wherein the preset historical log includes fault logs and normal logs; Determine the initial BERT model, and fine-tune the initial BERT model according to the preset historical logs to obtain the target BERT model; The reprocessed log data is input into the target BERT model to obtain text semantic features; The reprocessed log data is divided into a text sequence based on the timestamp of consecutive log text belonging to the same device, and a sequence matrix is ​​constructed based on the text sequence. A bidirectional LSTM network is constructed, and key sequence information is filtered through the sequence matrix using the bidirectional LSTM network to obtain text sequence features; Key information is extracted from the text semantic features and the text sequence features to obtain core fault information. The key information extraction includes key entity annotation processing and semantic judgment processing.

7. The remote operation and maintenance method for equipment according to claim 1, characterized in that, The step of predicting indicator trends based on the potential failure modes, the known failure modes, and the core failure information to obtain log analysis results specifically includes: Obtain preset operational indicators from the potential fault modes, the known fault modes, and the core fault information to obtain target indicator values; The target indicator values ​​are sampled and sorted at preset time intervals to obtain a variable time series. The time series of the variables is subjected to a second preprocessing, which includes stationarity test processing, outlier processing, and data normalization processing to obtain the target operating index. The target operating indicators include a first operating indicator that changes linearly and a second operating indicator that changes non-linearly. Determine the ARIMA model and train the ARIMA model using the first operational metric to obtain the target ARIMA model; Obtain the current time series data and input the current time series data into the target ARIMA model. Use the target ARIMA model to predict the trend of the first indicator of the current time series data to obtain the predicted short-term trend. The second operational metric is divided into samples to obtain training samples; Determine the LSTM model, input the training samples into the LSTM model, and iteratively train the LSTM model using the training samples to obtain the target LSTM model; Obtain the current indicator sequence data and input the current indicator sequence data into the target LSTM model. Use the target LSTM model to predict the second indicator trend of the current indicator sequence data to obtain the predicted mutation trend. Based on the predicted short-term trend and the predicted mutation trend, a fusion prediction is performed to generate log analysis results.

8. A remote equipment operation and maintenance system, characterized in that, The remote operation and maintenance system for the equipment includes: The log data preprocessing module is used to acquire log data from the target device and preprocess the log data to obtain preprocessed log data. The fault mode generation module is used to perform fault mode identification on the preprocessed log data using machine learning algorithms to obtain potential fault modes and known fault modes, and to perform natural language processing on the preprocessed log data to obtain core fault information. The indicator trend prediction module is used to predict the indicator trend based on the potential fault modes, the known fault modes and the core fault information, and obtain log analysis results. The fault handling and visualization module is used to obtain the fault handling strategy corresponding to the log analysis results, process the log analysis results according to the fault handling strategy, obtain the processing results, and visualize the log analysis results, the fault handling strategy, and the processing results.

9. A terminal, characterized in that, The terminal includes: a memory, a processor, and a device remote operation and maintenance program stored in the memory and executable on the processor. When the device remote operation and maintenance program is executed by the processor, it implements the steps of the device remote operation and maintenance method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a device remote operation and maintenance program, which, when executed by a processor, implements the steps of the device remote operation and maintenance method as described in any one of claims 1-7.

Images