Information operation and maintenance method, electronic equipment, storage medium and program

Abstract

The embodiment of the invention discloses an information operation and maintenance method, electronic equipment, a storage medium and a programmer.The method comprises the steps that in response to updating trigger information of a local topology element, associated topology updating reference data of the local topology element is obtained; wherein the topology elements comprise asset information elements and / or business information elements; generating current updated topological data of the local topological elements according to the associated topological update reference data of the local topological elements; and updating a global topological graph of the local topological elements according to the current updating topological data of the local topological elements. According to the technical scheme of the embodiment of the invention, the efficiency and accuracy of information operation and maintenance can be improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer software application technology, and in particular to an information operation and maintenance method, device, electronic device, storage medium and program. Background Technology

[0002] In the operation and security management of modern distributed systems and microservice architectures, asset topology maps and business topology maps are core visualization tools for understanding system architecture, tracing fault impact chains, and analyzing security event paths. They can associate discrete alarms and events with specific services, hosts, and their dependencies, greatly improving the efficiency of problem localization and analysis. As the dynamics and complexity of cloud-native environments increase, higher demands are placed on the real-time performance, accuracy, and semantic richness of topology maps.

[0003] Currently, there are three main technical solutions for constructing and maintaining such topology maps. The first solution is based on manual drawing and static configuration. This method relies entirely on domain experts such as architects and senior operations engineers to manually draw nodes and connections to generate the topology map using general drawing tools or the platform's built-in graph editor, based on design documents, memory, and some CMDB (Configuration Management Database) information, and then statically associates them through configuration files. The second solution is based on automatic infrastructure discovery. This method utilizes network scanning tools, cloud vendor APIs (Application Programming Interfaces), configuration management database synchronization, or basic monitoring agents to automatically discover infrastructure entities such as network devices, servers, virtual machines, and containers, as well as their network connections, solving the problem of automatic entry of some infrastructure. The third solution is based on distributed link tracing. This method collects and aggregates cross-service request call chain data by embedding probes in application code or utilizing service meshes, automatically generating a service dependency topology map.

[0004] In the process of developing this invention, the inventors discovered the following shortcomings in the existing technology: The first method, based on manual drawing and static configuration, is the mainstream approach for many enterprises to maintain authoritative business topology diagrams. Its core is manual decision-making and operation, resulting in extremely low efficiency, severely delayed updates, and an inability to adapt to dynamically changing cloud-native environments. Drawing is time-consuming and labor-intensive, and as systems iterate and services scale up or down, the topology quickly becomes outdated, turning into a "zombie diagram" and losing its reference value. Furthermore, this highly reliance on personal experience easily leads to knowledge silos. The second method, based on automatic infrastructure discovery, cannot understand the dependencies between business logic and high-level applications. For example, this method can only obtain IP connectivity information from server A to server B, but cannot obtain information about the "order service" running on server A calling the "payment service" on server B. For security incident analysis (such as attack chain tracing) and business fault diagnosis (such as service call timeouts), this underlying topology diagram has limited significance and lacks business semantics. The third method, based on distributed link tracing, has code intrusion and performance overhead, and is not suitable for or has not been implemented for all services or legacy systems. Furthermore, this approach suffers from a single data source, reflecting only the call relationships within the "normal request path." It fails to extract topological information from the rich topological clues contained in non-call chain data such as security, error, and audit data, limiting the comprehensiveness of the topology graph and its application in security scenarios. For example, it cannot discover the relationship between attackers and authentication services from login failure logs. Additionally, because it requires generating a complete global topology, it is often excessively large and complex, lacking contextual association with the current focus or a specific problem node, increasing information filtering costs, and lacking convenient interactive correction methods. Summary of the Invention

[0005] This invention provides an information operation and maintenance method, device, electronic device, storage medium, and program that can improve the efficiency and accuracy of information operation and maintenance.

[0006] According to one aspect of the present invention, an information operation and maintenance method is provided, comprising: In response to the update trigger information of a local topology element, the associated topology update reference data of the local topology element is obtained; wherein, the topology element includes asset information elements and / or business information elements; The current updated topology data of the local topology element is generated based on the associated topology update reference data of the local topology element; The global topology graph of the local topology element is updated based on the current updated topology data of the local topology element.

[0007] According to another aspect of the present invention, an information operation and maintenance device is provided, characterized in that it comprises: The associated topology update reference data acquisition module is used to acquire the associated topology update reference data of the local topology element in response to the update trigger information of the local topology element; wherein, the topology element includes asset information elements and / or business information elements; The current updated topology data generation module is used to generate the current updated topology data of the local topology element based on the associated topology update reference data of the local topology element; The global topology graph update module is used to update the global topology graph of the local topology element based on the current updated topology data of the local topology element.

[0008] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the information operation and maintenance method according to any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the information operation and maintenance method described in any embodiment of the present invention.

[0010] According to another aspect of the present invention, a computer program product is also provided, comprising a computer program that, when executed by a processor, implements the information operation and maintenance method described in any embodiment of the present invention.

[0011] This invention addresses asset or business information maintained using topology graphs. By responding to update trigger information of local topology elements, it obtains associated topology update reference data of the local topology elements. Based on the associated topology update reference data, it generates current updated topology data of the local topology elements and then updates the global topology graph of the local topology elements based on the current updated topology data. This solves the problems of low information maintenance efficiency and poor accuracy in existing information operations and maintenance, and can improve the efficiency and accuracy of information operations and maintenance.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart of an information operation and maintenance method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of an information operation and maintenance method provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of an information operation and maintenance tool provided in Embodiment 2 of the present invention; Figure 4 This is a schematic diagram of an information operation and maintenance device provided in Embodiment 3 of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0016] It should be noted that the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product or device.

[0017] Example 1 Figure 1 This is a flowchart of an information operation and maintenance method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where a fast and accurate local update operation is performed on the global topology map based on the update data of local topology elements. This method can be executed by an information operation and maintenance device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. This electronic device can be a terminal device or a server device, as long as it can execute the information operation and maintenance method. The present invention does not limit the specific type of electronic device. Correspondingly, as... Figure 1As shown, the method includes the following operations: S110. In response to the update trigger information of a local topology element, obtain the associated topology update reference data of the local topology element; wherein, the topology element includes asset information elements and / or business information elements.

[0018] In this invention, local topological elements can be one or more topological elements in the global topological graph constructed corresponding to the target information. The target information can be the type of information that needs to be maintained through the topological graph, such as, but not limited to, asset information and business information. Asset information can include, but is not limited to, various hardware or software asset information, and business information can include, but is not limited to, sales, procurement, production, service, financial, and research and development information. This embodiment of the invention does not limit the type of target information. Topological elements are the elements that constitute the global topological graph, and can include, for example, topological nodes and relational edges. This embodiment of the invention also does not limit the specific type of topological elements. That is, local topological elements can be some nodes and / or relational edges in the global topological graph constructed corresponding to the target information. It is understood that different types of data used to generate the global topological graph result in different types of global topological graphs. For example, when the target information is asset information, the global topological graph can be an asset topological graph. Correspondingly, the local topological elements in the asset topological graph can be asset nodes and relational edges. When the target information is business information, the global topological graph can be a business topological graph. Correspondingly, local topology elements in the business topology diagram can be business nodes and relationship edges.

[0019] The update trigger information can be trigger information that provides an update indication for local topology elements. The trigger type can include, but is not limited to, notification information, highlighting, voice prompts, or email reminders. This embodiment of the invention does not limit the specific trigger type of the update trigger information. The associated topology update reference data can be reference source data that can be used to update local topology elements in the global topology graph. For example, it can include, but is not limited to, log data, audit data, and database storage data related to local topology elements, as long as it can be used for topology graph updates. This embodiment of the invention does not limit the data type of the associated topology update reference data.

[0020] In this embodiment of the invention, for information that has already generated a global topology map, when information changes occur during information operation and maintenance, it is not necessary to perform a global topology update on the entire global topology map using all the metadata of the information. This global topology update method is not only time-consuming and inefficient, but also prone to information update failures or errors. Therefore, a tool for operating and managing the global topology map (hereinafter referred to as the information operation and maintenance tool) can be used to provide local update functionality for each topology element in the global topology map. When the source data corresponding to a local topology element is updated, the local topology elements involved in the source data can be identified, and the update trigger information of the local topology elements can be displayed in an active or passive manner.

[0021] For example, when a user needs to update the global topology map according to their own requirements, they can select a topology element displayed on the global topology map's interface. Correspondingly, the global topology map's interface can highlight the user-selected local topology element as the update trigger information for that local topology element. Alternatively, the information maintenance tool can also provide an external interface. When an update operation occurs on a data source related to the topology map, affecting the topology structure, the information maintenance tool can obtain the update event or update data through the external interface and automatically generate update trigger information for the local topology elements that need to be updated. For instance, the information maintenance tool can highlight the user-selected local topology element on the display interface or generate notification information for topology element updates, and it can also generate email or SMS notifications.

[0022] Upon detecting an update trigger message for a local topology element, the information operation and maintenance tool can respond to this message by obtaining the associated topology update reference data for that local topology element. For example, the tool can obtain associated topology update reference data actively submitted by the user for a local topology element, or it can obtain such data from an external data source via an external interface.

[0023] S120. Generate the current updated topology data of the local topology element based on the associated topology update reference data of the local topology element.

[0024] The currently updated topology data can be data that can be applied to the global topology graph to update local topology elements in real time. For example, the currently updated topology data may include data on the topology nodes and / or relation edges to be updated.

[0025] After obtaining the associated topology update reference data of a local topology element, the information operation and maintenance tool can use the associated topology update reference data as a benchmark to parse and obtain the current updated topology data that can be directly updated in the global topology graph for the local topology element.

[0026] S130. Update the global topology graph of the local topology element according to the current updated topology data of the local topology element.

[0027] After the information operation and maintenance tool generates the currently updated topology data of a local topology element, it can update the global topology graph of that local topology element based on this updated data. For example, the tool can directly replace the topology structure information of the local topology element in the current global topology graph using its currently updated topology data within the current display interface. This allows for fast and accurate local updates to the global topology graph without processing other unrelated topology information.

[0028] This invention addresses asset or business information maintained using topology graphs. By responding to update trigger information of local topology elements, it obtains associated topology update reference data of the local topology elements. Based on the associated topology update reference data, it generates current updated topology data of the local topology elements and then updates the global topology graph of the local topology elements based on the current updated topology data. This solves the problems of low information maintenance efficiency and poor accuracy in existing information operations and maintenance, and can improve the efficiency and accuracy of information operations and maintenance.

[0029] Example 2 Figure 2 This is a flowchart of an information operation and maintenance method provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiment and is further specified. In this embodiment, various specific optional implementation methods are given for responding to the update trigger information of a local topology element, obtaining the associated topology update reference data of the local topology element, and generating the current updated topology data of the local topology element based on the associated topology update reference data of the local topology element. Accordingly, such as Figure 2 As shown, the method in this embodiment may include: S210. In response to the update trigger information of the local topology element, obtain the associated topology update reference data of the local topology element; wherein, the topology element includes asset information elements and / or business information elements.

[0030] In an optional embodiment of the present invention, the step of obtaining the associated topology update reference data of the local topology element in response to the update trigger information of the local topology element may include: displaying a local data upload interface in the current information maintenance interface in response to a user's passive update trigger operation on the local topology element; the local data upload interface is used by the user to provide local data as the associated topology update reference data; and / or, in response to a user's passive update trigger operation on the local topology element, obtaining the context association information of the local topology element; automatically generating data query information based on the context association information of the local topology element; wherein the data query information includes data query conditions and data query range; determining the local original data of the local topology element based on the data query range; querying the local original data based on the data query conditions to obtain the associated topology update reference data.

[0031] Passive update triggering operations can be information update triggering operations performed by users in the display interface of the information operation and maintenance tool. The current information operation and maintenance interface is also the current display interface of the information operation and maintenance tool. Local raw data can be a portion of the global raw data used to update the global topology map, which can be used to update local topology elements; that is, partial source data.

[0032] Figure 3 This is a schematic diagram of the structure of an information operation and maintenance tool provided in Embodiment 2 of the present invention. In a specific example, such as Figure 3 As shown, the information operation and maintenance tool can include a topology visualization and interaction fusion module, an intelligent data parsing and relationship calculation engine, a data access and retrieval module, a topology graph data persistence management module, and a suggestion list management and display module. Accordingly, the information operation and maintenance tool can provide a flexible data input channel through the data access and retrieval module and deeply integrate with the context information of the topology nodes. It supports two main data processing methods: (1) uploading local data; (2) integrating the platform's data search capabilities and performing keyword retrieval through a dialog box. The data access and retrieval module can be associated with the context of the topology nodes in the global topology graph and supports user-defined updates of the local topology structure. When the user needs the automaton to update the local topology structure, they can select the local topology element to be updated based on the topology structure displayed in the current information operation and maintenance interface, such as clicking to select the topology node and / or relationship edge to be updated. Accordingly, the topology visualization and interaction fusion module of the information operation and maintenance tool can respond to the user's passive update trigger operation of the local topology element and display the local data upload interface in the current information operation and maintenance interface. Users can upload source data based on the local data upload interface, such as local log data or database data, as reference data for related topology updates.

[0033] Alternatively, the topology visualization and interaction integration module can also respond to user-triggered passive update operations on local topology elements, instructing the data access and retrieval module to automatically retrieve the contextual association information of the local topology elements. For example, the contextual association information of local topology elements may include, but is not limited to, node identifier, node type, logical layer (if any), coordinate location, and historical change records. Based on the contextual association information of local topology elements, the information operation and maintenance tool can automatically generate data query information. For instance, assuming the local topology element is one of the topology nodes, the information operation and maintenance tool can automatically pre-fill data query conditions related to that topology node, such as "host:node name OR service:node identifier," and can intelligently limit the query scope to the influence domain of source data strongly associated with that topology node, obtaining a data query scope matching that topology node. Correspondingly, the data access and retrieval module can perform queries based on the limited data query scope to obtain the local original data of the local topology element. Furthermore, the data access and retrieval module can query the local original data based on the automatically configured data query conditions to obtain related topology update reference data.

[0034] In an optional embodiment of the present invention, the step of obtaining the associated topology update reference data of the local topology element in response to the update trigger information of the local topology element may include: real-time monitoring of change events of global topology elements and determining the local topology element based on the change events; automatically displaying the update trigger information of the local topology element in the current information operation and maintenance interface; determining the local topology data query range based on the topology update routing policy corresponding to the type of the local topology element in response to the update trigger information of the local topology element; querying the update associated data of the local topology element according to the local topology data query range to obtain the associated topology update reference data.

[0035] The local topology data query range can be the defined scope used to query and retrieve the entire original data. The topology update routing strategy can be the strategy used to obtain updated data for the corresponding topology elements. For example, the topology update routing strategies for topology nodes and relational edges may be different, representing different ways of obtaining their associated topology update reference data.

[0036] Optionally, the information operation and maintenance tool can also build a real-time event stream processing mechanism. When a change in information status is detected, the system automatically identifies the change type and triggers the corresponding local update. Specifically, the information operation and maintenance tool can monitor global topology element change events in real time through the data access and retrieval module, and determine the local topology elements based on the change events. For example, the data access and retrieval module can poll the interface status and processor / memory load of network devices (switches, routers) to identify device online / offline events; or it can automatically discover the physical link connection relationship between devices to detect newly added or disconnected port pair events; or it can monitor traffic path changes to identify logical topology offset events caused by abnormal traffic migration or link congestion. Further, the data access and retrieval module sends the monitored change events to the intelligent data parsing and relation calculation engine, which compares the topology element identifiers included in the change events with the identifiers of global topology elements, and determines the topology elements whose identifiers match as local topology elements. Correspondingly, the intelligent data parsing and relation calculation engine sends the identified local topology elements to the topology visualization and interaction fusion module. The topology visualization and interaction fusion module then automatically displays the update trigger information of the local topology elements in the current information operation and maintenance interface using dynamic highlighting, pop-up summaries, and operation suggestions.

[0037] Furthermore, in response to the update trigger information of local topology elements, the information operation and maintenance tool determines the local topology data query scope based on the topology update routing policy corresponding to the type of the local topology element. For example, if the type of the local topology element is a node, the query scope can be the local topology elements involved in the data obtained from the management database, monitoring indicator system, logs and event streams, and active probing protocols. If the type of the local topology element is a relation edge, the query scope can be the end-to-end connection information of physical or logical links obtained from link layer discovery protocols, logical network paths and traffic behavior information obtained from routing protocols and flow data, and inter-service call relationship data obtained from application performance monitoring or service mesh. After determining the local topology data query scope, data related to the update of the local topology element can be queried based on this scope as reference data for associated topology updates.

[0038] In an optional embodiment of the present invention, the step of obtaining the associated topology update reference data of the local topology element in response to the update trigger information of the local topology element may include: obtaining the full original data and a multi-dimensional state association graph of the local topology element in response to the update trigger information of the local topology element; wherein, the multi-dimensional state association graph establishes the association relationship between multi-dimensional states through a hierarchical structure; the multi-dimensional states include business state, technical state, and security state; querying the multi-dimensional state association graph according to the local topology element to determine the associated local topology element; and querying the full original data according to the associated local topology element to obtain the associated topology update reference data.

[0039] In an optional embodiment of the present invention, the business status of the multidimensional state association graph is updated in real time based on transaction flow or service call; the technical status of the multidimensional state association graph is updated in real time based on the heartbeat detection and performance index data collected periodically from the device; and the security status of the multidimensional state association graph is updated in real time based on the security intelligence information of the device.

[0040] The multidimensional state association diagram can be a graph structure that includes multidimensional information states and the relationships between these states. Business states can be the states between related business processes, while technical states can be the states between related technical dimensions (such as devices, systems, configurations, services, and policies). Security states can be the states between related security events. Optionally, business states can be updated in real-time based on transaction flows or service calls; technical states can be updated periodically by collecting data based on device heartbeat detection and performance indicators; and security states can be dynamically refreshed based on device security intelligence information, with high-risk events being pushed and updated immediately. When a certain dimension of state information is updated, the multidimensional state association diagram can be dynamically updated accordingly. The full set of original data can be the source data used to construct and fully update the global topology diagram. The scope of influence of state changes in the multidimensional state association diagram is also the scope of influence of local topology elements determined by the multidimensional state association diagram.

[0041] Optionally, information operations and maintenance tools can also incorporate multi-dimensional status monitoring to achieve more accurate local updates of the global topology map. Specifically, these tools can implement hierarchical status management through an intelligent data parsing and relational calculation engine. That is, the engine can categorize the managed information status corresponding to the global topology map into multiple dimensions, such as business status, technical status, and security status, and establish a multi-dimensional status correlation diagram by creating relationships between these hierarchical states. When the tool detects an update trigger for a local topology element, it can obtain the full original data and multi-dimensional status correlation diagram of that element. Based on the local topology element, it can query the multi-dimensional status correlation diagram to determine other topology elements associated with the change in that element. Specifically, querying the multi-dimensional status correlation diagram based on a local topology element allows analysis of the relationships between different states. When the status of a local topology element changes, the multi-dimensional status correlation diagram can automatically determine the update operations for other related dimensions, thus visually displaying the scope of the status change's impact and the associated other topology elements. Correspondingly, the information operation and maintenance tool can start the data access and retrieval module to query and retrieve the full amount of original data based on the related local topology elements determined by the intelligent data parsing and relational calculation engine, and obtain the part of the original data involved in the related local topology elements as reference data for related topology updates.

[0042] In one example, if a server's "technical status" is normal but its "business status" is abnormal, it may point to an application logic error rather than a hardware failure. In this case, other devices associated with the application logic error can also be used as associated topology elements.

[0043] The above technical solution can provide a data foundation for root cause analysis through a multi-dimensional state association diagram: when the "business status" declines, the information operation and maintenance tool can automatically check the corresponding "technical status" and "security status"; combined with the topology relationship, it can identify whether it is caused by downstream database performance bottlenecks or middleware attacks, improve the comprehensiveness of the detection of local topology elements to be updated, and the accuracy of the global topology diagram update.

[0044] In an optional embodiment of the present invention, the step of obtaining the associated topology update reference data of the local topology element in response to the update trigger information of the local topology element may include: determining the priority of each update trigger information in response to the multidimensional update trigger information of the target local topology element; filtering the target update trigger information according to the priority of each update trigger information; determining the target topology data source according to the target update trigger information; and obtaining the associated topology update reference data of the target local topology element from the target topology data source based on the target update trigger information.

[0045] The target local topology element can be a local topology element with multiple update trigger messages. The target update trigger message can be one of the update trigger messages referenced when performing a topology update on the target local topology element. The target topology data source can be the data source determined corresponding to the target update trigger message.

[0046] Since information operation and maintenance tools can trigger updates to local topology elements from multiple dimensions, there may be situations where a single local topology element has multiple update trigger messages of different types. In this case, the information operation and maintenance tool can pre-configure the priorities of different types of update trigger messages. For example, user-triggered update trigger messages have the highest priority, while update trigger messages automatically generated based on change events have a lower priority. If multiple update trigger messages automatically generated based on change events also exist, their priority can be determined based on the monitoring method of each change event. Furthermore, the update trigger message with the highest priority can be selected as the target update trigger message. Therefore, the target topology data source can be determined based on the type of the target update trigger message. For example, when the target update trigger message is user-triggered, the target topology data source can be a data source specified by the user, such as log data uploaded locally by the user; when the target update trigger message is event-triggered, the target topology data source can be the data source defined by the local topology data query scope determined according to the topology update routing policy corresponding to the type of local topology element. Finally, queries can be performed from the target topology data source based on the target update trigger message to obtain the associated topology update reference data of the target local topology element.

[0047] S220. Extract entity information from the associated topology update reference data of the local topology element.

[0048] S230. Using a multidimensional relationship fusion analysis method, identify the relationships between entities corresponding to the entity information.

[0049] The multidimensional relationship fusion analysis method may include at least one of co-occurrence analysis and frequent pattern mining methods, semantic and syntactic analysis methods, and temporal causal analysis.

[0050] For example, such as Figure 3 As shown, the information operation and maintenance tool can use the intelligent data parsing and relational calculation engine module to perform in-depth analysis of the associated topology update reference data of local topology elements, identify potential topology entities and multi-level relationships with clear business meanings.

[0051] Optionally, the intelligent data parsing and relational calculation engine can be further configured with an entity recognition unit, a logical hierarchical classification unit, and a polymorphic relation inference unit. The entity recognition unit can comprehensively utilize regular expressions, predefined business dictionaries (such as service name lists), and named entity recognition models to extract entities such as device names, IP addresses, hostnames, ports, service names, module names, and transaction IDs from the associated topology update reference data of local topology elements. The logical hierarchical classification unit can automatically classify the identified entities into user-defined or system-built-in logical hierarchical models based on entity attributes (such as process names, port ranges, and subnets) and behavioral patterns (such as typical operation sequences). For example, it can map "access layer" to "application layer," "data layer" to "front end," and "middle platform" to "back end." The logical hierarchical classification unit can be implemented by maintaining a hierarchical rule base, which can include rule-based classifiers (such as "port=3306 is classified as data layer") and machine learning-based behavioral classification models (such as "processes that frequently execute database queries are classified as data layer").

[0052] The polymorphic relationship inference unit can employ multidimensional relationship fusion analysis methods to analyze relationships between entities. This not only effectively identifies call relationships but also uncovers various relationship types with rich business semantics. Optionally, the multidimensional relationship fusion analysis method can include co-occurrence analysis and frequent pattern mining methods. This method can cluster log lines within the same transaction ID or short time window, using correlation mining algorithms to discover frequently co-occurring entity pairs as potential relationship candidates. The multidimensional relationship fusion analysis method can also include semantic and syntactic analysis methods. This method can identify directional keywords and subject-object structures in the associated topology update reference data, directly extract explicit relationships, and classify relationships into types such as "call," "dependency," "attack," and "membership" based on a keyword library. The multidimensional relationship fusion analysis method can also include temporal causal analysis methods. This method calculates event transition probabilities based on timestamps and event type sequences in the associated topology update reference data, inferring possible causal dependencies. For example, if an error in service A is often accompanied by a timeout in service B, this type of relationship is labeled as an "impact" relationship. The dimension relationship fusion analysis method can also include a membership relationship mining method. This method can identify the "membership" or "composition" relationship between containers and hosts, and services and systems by analyzing deployment logs, configuration change logs and asset association records in the asset topology map.

[0053] S240. Calculate the confidence score for the multidimensional confidence factors of the inter-entity relationships corresponding to the entity information, and delete inter-entity relationships with confidence scores lower than a set threshold.

[0054] The multidimensional confidence factors may include multiple dimensions of factors used to calculate the confidence score, such as co-occurrence frequency, keyword strength, and temporal relevance. This embodiment of the invention does not limit the specific type and number of multidimensional confidence factors.

[0055] Optionally, the intelligent data parsing and relationship calculation engine can also be configured with a confidence assessment and filtering unit. This unit can comprehensively calculate a confidence score for each inferred relationship, based on confidence factors such as co-occurrence frequency, keyword strength, and temporal relevance, as well as the corresponding relationship type weights. It can also dynamically set thresholds (e.g., adjustable based on historical user feedback) to filter low-confidence results, ensuring the quality of the relationship assessment between entities.

[0056] S250. Update the global topology graph of the local topology element according to the current updated topology data of the local topology element.

[0057] For example, such as Figure 3 As shown, the suggestion list management and display module of the information operation and maintenance tool can receive the output of the intelligent data parsing and relationship calculation engine, compare it with the existing topology map data, and generate two suggestion lists: "Node Update" and / or "Relationship Update," which are clearly displayed in the sidebar of the current information operation and maintenance interface. The content of the list items can be further enhanced. For example, in addition to update suggestions, it can also include the association information of node and relationship suggestions. For example, the association information of node suggestions may include, but is not limited to, entity identifier, automatic classification logic layer, type, and the first log fragment to appear; the association information of relationship suggestions may include, but is not limited to, source entity, target entity, relationship type (call / dependency / attack / membership / impact, etc.), confidence level, and key log evidence supporting the relationship.

[0058] The topology visualization and interaction integration module is primarily responsible for providing the main topology graph display canvas and interactive operations. The canvas supports display by logical layer, automatically placing nodes belonging to the same layer in adjacent areas. This module also provides a right-click menu for each node in the topology graph, including options such as "Improve this node's relationships," which carries the node's context information when triggered. This module can also implement the logic of dragging and dropping icon-based suggestions from the sidebar list onto the main canvas. It supports drag-and-drop creation of nodes and automatic connection of relationship lines. Visual feedback is provided during dragging, such as highlighting the target area and previewing the connection, and the node is automatically placed in the corresponding area of ​​its logical layer. The topology visualization and interaction integration module can integrate a force-directed graph layout algorithm, automatically optimizing the graph layout when a new node is added or relationships change, avoiding overlap and maintaining clear visualization.

[0059] For example, such as Figure 3As shown, the topology graph data persistence management module manages the storage, versioning, and querying of topology graph data. When a user confirms an update via drag-and-drop, this module persistently stores the incremental changes (added nodes and edges) to a graph database or relational database, recording the version number, the user performing the operation, and the timestamp, supporting historical backtracking. Simultaneously, this module can also record operation logs for each acceptance / rejection of a suggestion, including the suggestion content, user decision, timestamp, and associated context nodes. This recorded log information can be used as training data for subsequent optimization of the confidence model employed by the intelligent data parsing and relational computation engine.

[0060] In addition, information operation and maintenance tools can be configured to periodically or under triggered conditions use accumulated feedback data as training corpus to incrementally learn or fine-tune the confidence model. For example, if a topology local update suggestion is rejected multiple times, the confidence model will reduce the confidence weight of the relationship Y mined from a specific log pattern X in future suggestions, enabling the system to continuously evolve from feedback information.

[0061] The above technical solution improves the accuracy and comprehensiveness of local topology element update triggering by employing multiple optional methods and obtaining associated topology update reference data of local topology elements through multiple optional methods. This also improves the comprehensiveness and rationality of the relevant reference data used to update local topology elements. It eliminates the need to use all the original data to update the entire global topology map, which can significantly improve the efficiency and accuracy of information operation and maintenance.

[0062] Specific application scenarios In one example, the overall execution flow of the above information operation and maintenance method is illustrated through a specific process: Step S101: Context Trigger. When viewing the global topology graph, if a node N is found to have incomplete relationships or its associated parties are questionable, right-click on node N and select "Improve Relationships Based on Logs" from the pop-up menu. The system will automatically capture the context information packet of node N, such as its identifier, type, and logical layer.

[0063] Step S102: Log data input. The system pops up an operation panel, pre-populating the query conditions based on context information.

[0064] Optional path S102a: Upload log file. Upload the locally stored log file related to node N.

[0065] Optional path S102b: Search platform logs. The system opens a search dialog box, presets search conditions such as "host: or service: node N identifier", and adds keywords such as "AND error" before executing the search to obtain the log set.

[0066] Step S103: Intelligent Parsing and Calculation. The system sends the acquired log data to the intelligent data parsing and relational calculation engine, which then performs the following operations: Preprocessing: Cleaning and formatting logs.

[0067] Entity recognition: Extract all possible topological entities E={e1,e2,...}.

[0068] Logical layer classification: Automatically classify the identified entities into a preset logical layer model.

[0069] Polymorphic relation inference: Analyze the relationship between entities R={(ei,ej,type,confidence)...}, where type includes various business semantics such as invocation, dependency, attack, membership, and influence.

[0070] Comparison and filtering: Compare E and R with the existing topology data G, remove the existing parts, and obtain the suggested node set E_new (with logical layer label) and the suggested relation set R_new (with relation type label).

[0071] Step S104: Generating and Displaying the Suggestion List. The system lists E_new and R_new in separate areas on the right sidebar of the display interface. Each entry contains key information, logical layer affiliation, relationship type, and evidence summary.

[0072] Step S105: Interactive drag-and-drop merging. After reviewing the list, drag a node icon from E_new into the main canvas. The system will create the node and automatically place it in the corresponding area of ​​the canvas according to its logical layer label. Drag a relationship description from R_new into the main canvas. The system will automatically check and create the nodes at both ends of the relationship (if they do not exist), and then draw connecting lines with different visual styles (such as color and line type) according to the relationship type. For example, an attack relationship is represented by a red dashed line.

[0073] This process supports batch operations and undo / redo.

[0074] Step S106: Feedback Record. The system automatically records the accepted and ignored suggestions, forming a feedback log.

[0075] Step S107: Persistence and Version Update. After dragging and dropping, click "Save" or trigger automatically. The system will submit all newly added nodes and relationships as a single transaction to the persistence management module, update the main topology database G, and refresh the front-end view.

[0076] Step S108: Asynchronously execute model evolution. Periodically or after accumulating sufficient feedback data, trigger the model self-optimization module to incrementally train the confidence model of the intelligent parsing engine using feedback log data, thereby optimizing the accuracy of subsequent parsing results.

[0077] In a specific application scenario, suppose an analyst in a security operations center notices suspicious login alerts on the "database server" node based on a topology diagram. To trace the intrusion path, the following steps can be taken: (1) Right-click the “Database Server” node and select “Search related logs”. The system will automatically pre-fill “host:database server”. You can continue to add the keyword “AND (failed login OR unusual access)”.

[0078] (2) The system analyzed the security logs and database audit logs returned and found that a jump server with IP 10.0.1.100 made multiple connection attempts, and abnormal process creation records of "middleware server" appeared before and after these logs.

[0079] (3) Suggestions for the right sidebar: New nodes added: "Jump Host (10.0.1.100)" (classified to the attack source layer) and "Middleware Server" (automatically classified to the application layer based on its behavior pattern).

[0080] New relationships added: 10.0.1.100 (Attack Source Layer) - [Attack] -> Middleware Server (Application Layer) (High confidence, evidence: SSH brute-force logs); Middleware Server (Application Layer) - [Attack] -> Database Server (Data Layer) (Medium confidence, evidence: Abnormal connection logs).

[0081] (4) Drag these two nodes and relationships onto the topology diagram. The system will automatically place the "middleware server" in the "application layer" area of ​​the canvas, place the "jump server" in the "attack source layer" area (if the layer exists), and draw two attack relationships with red dashed lines.

[0082] (5) Underlying Mechanism: The system records the information of the attack path suggestions currently accepted from the security logs. In the future, when similar security log patterns reappear, the model will be more inclined to recommend them as "attack relationships" candidates.

[0083] (6) A clear potential attack chain: external attacker -> jump host -> middleware server -> database server. The data is immediately visualized, which greatly assists in subsequent isolation and disposal decisions.

[0084] The aforementioned technical solution, based on a localized, precise triggering and influence domain limitation mechanism within a visualized context, creatively integrates log data import and retrieval entry points directly into the graphical interface of topology graph nodes. It uses node contextual information (identifier, type, logical layer, and historical changes, etc.) as limiting conditions for retrieval and analysis. This method achieves a "what you see is what you get" operational interaction paradigm, precisely allocating computing resources to the "influence domain" currently of interest to the user, avoiding noise and redundancy from global full updates. Based on a multi-feature fusion semantic parsing method for business topology knowledge graphs, a comprehensive parsing solution is specifically designed to extract multi-level, multi-semantic business relationships from unstructured / semi-structured logs. This method not only identifies entities but, more importantly, integrates logical hierarchical classification and polymorphic relationship mining (calls, dependencies, attacks, memberships, influences), constructing a richly semantic, three-dimensional knowledge graph from business logs, transcending the traditional scope of log analysis limited to anomaly detection or indicator extraction. The "suggestion-drag-feedback" human-machine collaborative evolution closed-loop mechanism provides a sustainably evolving graph construction mode. The system handles data-intensive analysis and suggestion generation. Users complete the review and confirmation process through intuitive drag-and-drop operations. Simultaneously, the system automatically records user feedback and uses it for incremental learning and optimization of the model. This mechanism strikes a balance between automation efficiency and human control precision, enabling the silent and efficient transfer of domain expert knowledge to the system through interactive behavior, thus forming a sustainably evolving team knowledge asset.

[0085] Therefore, this invention directly utilizes various logs inevitably generated during system runtime, without requiring modification of application code or deployment of additional probes. It is non-invasive, lower in cost, and more widely applicable, especially suitable for performance-sensitive or unmodifiable legacy systems. The above solution is not limited to call chain data; it can also analyze security logs, system logs, application error logs, and configuration change logs. This allows the constructed topology graph to reflect not only service call relationships but also security attack paths, fault propagation chains, infrastructure dependencies, and system composition relationships. Application scenarios expand from performance monitoring to security situation awareness, configuration management, and root cause analysis, with more comprehensive data sources and richer semantics. Furthermore, the above solution abandons the global full-data generation mode, adopting a localized trigger update based on user concerns. The output information is directly related to the current problem context, avoiding information overload, providing precise local updates, higher information density, and improved decision-making efficiency. By innovatively introducing a "suggestion-drag-and-drop-feedback" closed-loop mechanism, automation capabilities are used for massive data mining, leaving the final decision-making power to experts. Simultaneously, the implicit knowledge of experts is fed back to the system through interactive behavior, achieving continuous model optimization. The generated topology diagram is not only objective in its data and consistent with the team's understanding, but also becomes increasingly intelligent with use, making it extremely valuable. Through logically layered layout and visual encoding of polymorphic relationships (such as different colors and line types), it supports the visual presentation of business semantics, making complex business dependencies, attack paths, and system structure readily apparent, greatly improving the readability and analysis efficiency of the topology diagram.

[0086] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for uploading, displaying, and analyzing) involved in this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant regions.

[0087] It should be noted that any arrangement or combination of the technical features in the above embodiments also falls within the protection scope of this invention.

[0088] Example 3 Figure 4 This is a schematic diagram of an information operation and maintenance device provided in Embodiment 3 of the present invention, as shown below. Figure 4 As shown, the device includes: a related topology update reference data acquisition module 410, a current updated topology data generation module 420, and a global topology graph update module 430, wherein: The associated topology update reference data acquisition module 410 is used to acquire the associated topology update reference data of the local topology element in response to the update trigger information of the local topology element; wherein, the topology element includes asset information elements and / or business information elements. The current updated topology data generation module 420 is used to generate the current updated topology data of the local topology element based on the associated topology update reference data of the local topology element; The global topology update module 430 is used to update the global topology graph of the local topology element according to the current updated topology data of the local topology element.

[0089] This invention addresses asset or business information maintained using topology graphs. By responding to update trigger information of local topology elements, it obtains associated topology update reference data of the local topology elements. Based on the associated topology update reference data, it generates current updated topology data of the local topology elements and then updates the global topology graph of the local topology elements based on the current updated topology data. This solves the problems of low information maintenance efficiency and poor accuracy in existing information operations and maintenance, and can improve the efficiency and accuracy of information operations and maintenance.

[0090] Optionally, the associated topology update reference data acquisition module 410 is further configured to: in response to a user's passive update trigger operation on the local topology element, display a local data upload interface in the current information maintenance interface; the local data upload interface is used by the user to provide local data as the associated topology update reference data; and / or, in response to a user's passive update trigger operation on the local topology element, acquire the context association information of the local topology element; automatically generate data query information based on the context association information of the local topology element; wherein the data query information includes data query conditions and data query range; determine the local original data of the local topology element based on the data query range; query the local original data based on the data query conditions to obtain the associated topology update reference data.

[0091] Optionally, the associated topology update reference data acquisition module 410 is further configured to: monitor global topology element change events in real time, and determine the local topology element based on the change events; automatically display the update trigger information of the local topology element in the current information operation and maintenance interface; respond to the update trigger information of the local topology element, determine the local topology data query range based on the topology update routing policy corresponding to the type of the local topology element; query the update associated data of the local topology element based on the local topology data query range, and obtain the associated topology update reference data.

[0092] Optionally, the associated topology update reference data acquisition module 410 is further configured to: in response to the update trigger information of a local topology element, acquire the full original data and a multi-dimensional state association diagram of the local topology element; wherein, the multi-dimensional state association diagram establishes the association relationship between multi-dimensional states through a hierarchical structure; the multi-dimensional states include business state, technical state, and security state; query the multi-dimensional state association diagram based on the local topology element to determine the associated local topology element; and query the full original data based on the associated local topology element to obtain the associated topology update reference data.

[0093] Optionally, the business status of the multi-dimensional state association diagram is updated in real time based on transaction flow or service calls; the technical status of the multi-dimensional state association diagram is updated in real time based on data collected periodically from the device's heartbeat detection and performance indicators; and the security status of the multi-dimensional state association diagram is updated in real time based on the device's security intelligence information.

[0094] Optionally, the associated topology update reference data acquisition module 410 is further configured to: determine the priority of each update trigger information in response to the multidimensional update trigger information of the target local topology element; filter the target update trigger information according to the priority of each update trigger information; determine the target topology data source according to the target update trigger information; and acquire the associated topology update reference data of the target local topology element from the target topology data source based on the target update trigger information.

[0095] Optionally, the current updated topology data generation module 420 is further configured to: extract entity information from the associated topology update reference data of the local topology elements; identify the inter-entity relationships corresponding to the entity information using a multi-dimensional relationship fusion analysis method; wherein the multi-dimensional relationship fusion analysis method includes at least one of co-occurrence analysis and frequent pattern mining method, semantic and syntactic analysis method, and temporal causal analysis; calculate confidence scores for the multi-dimensional confidence factors of the inter-entity relationships corresponding to the entity information, and delete inter-entity relationships with confidence scores lower than a set threshold.

[0096] The aforementioned information operation and maintenance device can execute the information operation and maintenance method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the method. Technical details not described in detail in this embodiment can be found in the information operation and maintenance method provided in any embodiment of the present invention.

[0097] Since the information operation and maintenance device described above is a device capable of executing the information operation and maintenance method in the embodiments of the present invention, those skilled in the art can understand the specific implementation methods and various variations of the information operation and maintenance device in this embodiment based on the information operation and maintenance method described in the embodiments of the present invention. Therefore, how the information operation and maintenance device implements the information operation and maintenance method in the embodiments of the present invention will not be described in detail here. Any device used by those skilled in the art to implement the information operation and maintenance method in the embodiments of the present invention falls within the scope of protection of this application.

[0098] Example 4 Figure 5 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0099] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0100] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0101] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as information maintenance methods.

[0102] Optionally, the information operation and maintenance method may include: in response to an update trigger information of a local topology element, obtaining associated topology update reference data of the local topology element; wherein the topology element includes asset information elements and / or business information elements; generating current updated topology data of the local topology element based on the associated topology update reference data of the local topology element; and updating the global topology map of the local topology element based on the current updated topology data of the local topology element.

[0103] In some embodiments, the information maintenance method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the information maintenance method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the information maintenance method by any other suitable means (e.g., by means of firmware).

[0104] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0105] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0106] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0107] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0108] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0109] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0110] This invention also discloses a computer program product, which includes a computer program that, when executed by a processor, implements the information operation and maintenance method provided in any embodiment of this invention. This program product shares the same inventive concept as the information operation and maintenance methods disclosed in the embodiments of this invention, and therefore will not be described in detail here.

[0111] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0112] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. An information operation and maintenance method, characterized in that, include: In response to the update trigger information of a local topology element, the associated topology update reference data of the local topology element is obtained; wherein, the topology element includes asset information elements and / or business information elements; The current updated topology data of the local topology element is generated based on the associated topology update reference data of the local topology element; The global topology graph of the local topology element is updated based on the current updated topology data of the local topology element.

2. The method according to claim 1, characterized in that, The process of obtaining associated topology update reference data for the local topology element in response to update trigger information includes: In response to a user's passive update trigger operation on the local topology element, a local data upload interface is displayed in the current information maintenance interface; the local data upload interface is used by the user to provide local data as reference data for the associated topology update; and / or In response to a user's passive update trigger operation on the local topology element, obtain the context association information of the local topology element; Data query information is automatically generated based on the contextual association information of the local topology elements; wherein, the data query information includes data query conditions and data query range; The local original data of the local topology element is determined based on the data query range; The local original data is queried according to the data query conditions to obtain the related topology update reference data.

3. The method according to claim 1, characterized in that, The process of obtaining associated topology update reference data for the local topology element in response to update trigger information includes: Real-time monitoring of global topology element change events, and determination of the local topology element based on the change events; The update trigger information of the local topology element is automatically displayed in the current information operation and maintenance interface; In response to the update trigger information of the local topology element, the local topology data query range is determined according to the topology update routing policy corresponding to the type of the local topology element; Based on the local topology data query range, the update association data of the local topology element is queried to obtain the associated topology update reference data.

4. The method according to claim 1, characterized in that, The process of obtaining associated topology update reference data for the local topology element in response to update trigger information includes: In response to the update trigger information of a local topology element, the full original data and multi-dimensional state association graph of the local topology element are obtained; wherein, the multi-dimensional state association graph establishes the association relationship between multi-dimensional states through a hierarchical structure; the multi-dimensional states include business state, technical state, and security state; Based on the local topology elements, query the multidimensional state association graph to determine the associated local topology elements; Based on the associated local topology elements, query the full original data to obtain the associated topology update reference data.

5. The method according to claim 4, characterized in that: The business status of the multidimensional state association graph is updated in real time according to the transaction flow or service call. The technical status of the multidimensional state association diagram is updated in real time based on data collected periodically from the device's heartbeat detection and performance indicators. The security status of the multidimensional state association graph is updated in real time based on the security intelligence information of the device.

6. The method according to claim 1, characterized in that, The process of obtaining associated topology update reference data for the local topology element in response to update trigger information includes: In response to the multidimensional update triggering information of the target local topology element, the priority of each update triggering information is determined; Target update trigger information is filtered according to the priority of each update trigger information; The target topology data source is determined based on the target update trigger information; Based on the target update triggering information, obtain the associated topology update reference data of the target local topology element from the target topology data source.

7. The method according to claim 1, characterized in that, The step of generating the current updated topology data of the local topology element based on the associated topology update reference data of the local topology element includes: Extract entity information from the associated topology update reference data of the local topology elements; A multidimensional relationship fusion analysis method is used to identify the relationships between entities corresponding to the entity information; wherein, the multidimensional relationship fusion analysis method includes at least one of co-occurrence analysis and frequent pattern mining method, semantic and syntactic analysis method, and temporal causal analysis. Calculate confidence scores for the multidimensional confidence factors of the inter-entity relationships corresponding to the entity information, and delete inter-entity relationships with confidence scores below a set threshold.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that is executed by the at least one processor, which enables the at least one processor to perform the information operation and maintenance method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the information operation and maintenance method according to any one of claims 1-7.

10. A computer program product, characterized in that, It includes a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the information operation and maintenance method according to any one of claims 1-7.

Images