An intelligent operation and maintenance monitoring automation method and device based on AI alarm convergence

Abstract

This application discloses an intelligent operation and maintenance monitoring automation method and device based on AI alarm convergence. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence includes: acquiring historical alarm data and real-time alarm stream data; generating a core dataset for situation modeling based on the historical alarm data; performing situation inverse reasoning and source tracing with the real-time alarm stream data and the core dataset to obtain source tracing information; generating compressed convergence information based on the source tracing information and the core dataset; and generating a core feedback set for action deduction and execution based on the compressed convergence information. This application can adaptively discover novel associated fault modes and automatically incorporate them into the knowledge base after the formation of new event nebulae, achieving continuous evolution under zero-rule maintenance, significantly reducing operation and maintenance costs and improving system adaptability.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance data processing technology, specifically to an intelligent operation and maintenance monitoring automation method and device based on AI alarm convergence. Background Technology

[0002] With the widespread adoption of cloud computing, microservices, and distributed architectures, the scale and complexity of modern IT operations and maintenance environments are growing exponentially. Against this backdrop, operations and maintenance monitoring systems need to handle real-time alarm streams from massive heterogeneous data sources such as network devices, servers, middleware, databases, applications, and cloud platforms. These alarm events often have the following characteristics: huge quantity, frequent occurrence, interconnectedness, and hidden root causes. A localized hardware failure or application anomaly can trigger a cascading reaction within seconds, generating hundreds or even thousands of derivative alarms, creating an alarm storm.

[0003] Current mainstream alarm convergence and processing methods mainly rely on rule-based filtering, aggregation, and suppression. For example, this involves setting a silent time window for identical alarms, counting and aggregating similar alarms generated from the same resource, or writing expert rules to define that if alarm A occurs, related alarm B should be suppressed. These methods reduce the number of alarms to some extent, but they have significant limitations: Inflexible rules and high maintenance costs: Rules need to be manually written and maintained by domain experts, which makes it difficult to cope with rapidly changing complex systems and new failure modes. The set of rules will expand rapidly as the system evolves and is prone to conflicts or omissions.

[0004] Lack of deep correlation and causal inference: Existing methods are mostly based on simple attribute matching (such as the same host or service) or temporal proximity for aggregation, which cannot understand the deep semantic correlation, propagation path and root cause between alarms, resulting in key root cause alarms being submerged in a large number of derivative alarms.

[0005] Delayed response and low level of automation: After alarms converge, manual intervention is usually still required for root cause analysis and handling decisions. Automated responses are mostly limited to executing predefined and simple recovery scripts, lacking the ability to make intelligent decisions and adaptive execution for complex fault scenarios. Summary of the Invention

[0006] The purpose of this invention is to provide an intelligent operation and maintenance monitoring automation method based on AI alarm convergence to at least solve one of the above-mentioned technical problems.

[0007] One aspect of the present invention provides an automated intelligent operation and maintenance monitoring method based on AI alarm convergence, wherein the automated intelligent operation and maintenance monitoring method based on AI alarm convergence includes: Step 1: Obtain historical existing alarm data and real-time alarm stream data; Step 2: Generate the core dataset for situational modeling based on historical alarm data; Step 3: Perform situation inversion and source tracing by combining real-time alarm stream data with the core dataset for situation modeling, thereby obtaining source tracing and location information; Step 4: Generate compressed convergence information based on the source tracing and location information and the core dataset for situation modeling; Step 5: Generate the core feedback set for action deduction and execution based on the compressed convergence information.

[0008] Optionally, step 2: generating the core dataset for situational modeling based on historical alarm data includes: A multi-dimensional phase space for alarm events is constructed based on historical alarm data to obtain the quantized intrinsic coordinate set of alarm events; Based on the quantized intrinsic coordinate set of the alarm events, the event cloud collapse under the influence of event gravity is performed to obtain the event nebula set; Features and singularities are extracted from the event nebula set to obtain the situation vector and root cause candidate set; The situation vectors and root cause candidate sets are labeled and encapsulated to obtain the core dataset for situation modeling.

[0009] Optionally, step 3: Perform situational inversion and source tracing by comparing the real-time alarm stream data with the core dataset for situational modeling, thereby obtaining source tracing and location information, including: Phase space projection and gravitational perturbation calculations are performed based on the core dataset of situation modeling to obtain the initial force state of real-time alarm stream data in the known gravitational field. Dynamic causal flow simulation and shortest backtracking path calculation are performed on the initial force state of real-time alarm stream data in a known gravitational field to generate one or more causal explanation chains from the real-time alarm event to the potential root cause. By aggregating backtracking paths and verifying gravitational singularities for each causal explanation chain, high-confidence source location information is generated.

[0010] Optionally, step 4: generating compressed convergence information based on the source tracing and location information and the core dataset for situation modeling includes: Entropy information data is obtained by calculating the situation entropy and assessing the state based on the source location information and the core dataset of situation modeling. A core alarm set is generated based on entropy information data, situation vectors, and root cause candidate sets. Compressed convergence information is generated based on the core alarm set.

[0011] Optionally, step 5: generating the core feedback set for action deduction and execution based on the compressed convergence information includes: By performing historical valid action pattern matching on the compressed convergence information, a set of historically verified valid actions that match the current high-entropy state can be obtained. Parameterized action sequences are generated from a set of historically validated actions to form candidate action sequences that can be adapted to the current specific scenario. The candidate action sequences are deduced and their effects are predicted to obtain the recommended execution sequence; Obtain execution feedback data after execution according to the recommended execution sequence.

[0012] Optionally, the historical alarm data includes: Identification and metadata: alarm unique identifier, alarm serial number or sequence number, data source or collector identifier; Content and description information: alarm content, alarm details, alarm type, alarm subtype; Status and lifecycle information: alarm severity, alarm status, alarm generation time, alarm update time, alarm clearing time, assignment time and personnel; Context and topology information: alarm source or monitored object identifier, resource topology path and location, related business application service information, and associated change order or work order ID; Metrics and metrics information: Name of the monitoring metric that triggered the alarm, value of the metric that triggered the alarm, and original monitoring data sampling point / time series segment; Root cause and remedial information: Root cause analysis records, remedial measures, and related fault reports or knowledge base entry IDs.

[0013] Optionally, the real-time alarm stream data includes: Key identifiers for an event: unique event identifier, original event serial number, event content and status, detailed event message, event type, event severity, event status, and event timestamp. Event source and context: Event source or generating object identifier, monitoring tool or agent identifier, original protocol and format; Raw metric information: The name and value of the metric that triggered the event, and the alarm condition expression or rule name. Optionally, the step of constructing a multi-dimensional phase space of alarm events based on historical alarm data to obtain the quantized intrinsic coordinate set of alarm events includes: Each historical alarm event in the historical alarm database is processed as follows: Calculate the time period coordinates of alarm events to obtain the time phase vector that represents the periodic pattern of the events; Calculate the resource topology coordinates of the alarm event to obtain the topology vector representing the location of the event in the infrastructure dependency relationship; Calculate the semantic essence coordinates of the alarm event to obtain the semantic vector that represents the inherent nature of the fault described by the event; Calculate the impact propagation coordinates of the alarm event to obtain the potential energy vector characterizing the potential impact range and propagation direction of the event; Construct a multidimensional phase space, which includes four eigenspaces. One eigenspace is used to accommodate one of the time phase vector, topological vector, semantic vector, and potential energy vector. The time phase vector, topological vector, semantic vector, and potential energy vector are mapped to a multi-dimensional phase space to obtain the quantized intrinsic coordinate information of the historical alarm event. A historical alarm event is considered as an event singularity in the multi-dimensional phase space. The quantized intrinsic coordinate information of each event constitutes the quantized intrinsic coordinate set of the alarm event.

[0014] Optionally, the step of performing event cloud collapse under the influence of event gravity based on the quantized intrinsic coordinate set of the alarm event to obtain the event nebula set includes: Calculate the mutual attraction between any two alarm event singularities in the multidimensional phase space, and the mutual attraction between the alarm event singularities forms a gravity matrix; Density peak search is performed based on the gravity matrix and local density to identify high gravitational density points that are potential event nebulae cores. Each high gravitational density point is called a peak event singularity. Other non-peak event singularities are clustered and each non-peak event singularity is assigned to the range of each peak event singularity, thereby forming at least one cluster set, which is called a candidate event nebula; each candidate event nebula constitutes an event nebula set.

[0015] This application also provides an intelligent operation and maintenance monitoring automation device based on AI alarm convergence, the intelligent operation and maintenance monitoring automation device based on AI alarm convergence includes: The raw data acquisition module is used to acquire historical stored alarm data and real-time alarm stream data. The situation modeling core dataset acquisition module is used to generate a situation modeling core dataset based on historical stored alarm data. The source tracing and location information acquisition module is used to perform situation inverse tracing and location by combining real-time alarm stream data with the core dataset of situation modeling, thereby acquiring source tracing and location information; A compressed convergence information acquisition module is used to generate compressed convergence information based on source tracing and location information and the core dataset for situation modeling. The motion deduction and execution core feedback set acquisition module is used to generate the motion deduction and execution core feedback set based on the compressed convergence information.

[0016] Compared to existing technologies, this application completely eliminates the reliance on manually writing and maintaining a large number of static rules. The system can automatically learn from historical alarm data and construct a core dataset for situational modeling that reflects the system's inherent fault modes. Real-time alarm processing is based on dynamic similarity matching and gravity backtracking with these learned event patterns, rather than fixed rule matching. This means that the system can adaptively discover new associated fault patterns and automatically incorporate them into the knowledge base after a new event nebula forms, achieving continuous evolution under zero-rule maintenance, significantly reducing operation and maintenance costs and improving system adaptability. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of the intelligent operation and maintenance monitoring automation method based on AI alarm convergence according to this application. Detailed Implementation

[0018] To make the objectives, technical applications, and advantages of this application clearer, the technical applications in the embodiments of this application will be described in more detail below with reference to the accompanying drawings. In the drawings, the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The described embodiments are some, but not all, of the embodiments of this application. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application. The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0019] like Figure 1 The AI-based intelligent operation and maintenance monitoring automation method shown includes: Step 1: Obtain historical existing alarm data and real-time alarm stream data; Step 2: Generate the core dataset for situational modeling based on historical alarm data; Step 3: Perform situation inversion and source tracing by combining real-time alarm stream data with the core dataset for situation modeling, thereby obtaining source tracing and location information; Step 4: Generate compressed convergence information based on the source tracing and location information and the core dataset for situation modeling; Step 5: Generate the core feedback set for action deduction and execution based on the compressed convergence information.

[0020] In this embodiment, historical alarm data and real-time alarm stream data are obtained through the following method: Configure a data acquisition interface to access and collect multi-source heterogeneous historical alarm data and real-time alarm stream data from IT infrastructure, servers, network devices, middleware, databases, applications, and cloud platforms. Historical alarm data consists of a structured collection of alarm records that have been stored and archived from a specified historical starting point to the current time. Each record contains at least one or more data items from the following categories: alarm number, alarm title, alarm source, alarm level, alarm occurrence time, alarm content, alarm status, associated resource identifier, and root cause analysis record. Real-time alarm stream data is a sequence of real-time alarm events continuously generated from the current time point, following a preset push protocol (such as Syslog, Kafka, Webhook, SNMP Trap, RESTful API). Its data items include at least the event identifier, alarm source, alarm level, timestamp, alarm content, and original payload.

[0021] The collected historical alarm data and real-time alarm stream data are cleaned, deduplicated, parsed, and standardized. Specifically, this includes: Cleaning: Remove alarm records with empty or invalid alarm titles or content, and identify and filter non-production alarms generated by test environments and planned maintenance operations.

[0022] Deduplication: Based on a preset time window, alarm source, and alarm content keyword similarity, merge consecutive alarm records with highly repeated content or belonging to the same alarm storm to generate deduplicated alarm records.

[0023] Parsing and Standardization: For unstructured or semi-structured alarm content, standardized field information is extracted through predefined regular expressions, keyword templates, or natural language processing models, and unified timestamp format, alarm level mapping, and resource identifier naming rules are formed to form alarm data records with a unified structure.

[0024] The processed historical alarm data is persistently stored in a time-series database or distributed data warehouse, and an index is built with alarm occurrence time, alarm source, alarm level, and resource identifier as key fields. At the same time, a stream processing pipeline is established for real-time alarm stream data to achieve low-latency data buffering and distribution, and the data is stored in a stream database or message queue in real time to support subsequent real-time processing and analysis.

[0025] The acquired dataset undergoes a quality assessment, including checking data integrity, consistency, and timeliness, and calculating the coverage, duplication rate, and field fill rate of the alarm data. If the data quality does not meet preset thresholds, feedback adjustments to the alarm data re-collection or cleaning process are triggered.

[0026] In this embodiment, step 2: generating the core dataset for situational modeling based on historical alarm data includes: A multi-dimensional phase space for alarm events is constructed based on historical alarm data to obtain the quantized intrinsic coordinate set of alarm events; Based on the quantized intrinsic coordinate set of the alarm events, the event cloud collapse under the influence of event gravity is performed to obtain the event nebula set; Features and singularities are extracted from the event nebula set to obtain the situation vector and root cause candidate set; The situation vectors and root cause candidate sets are labeled and encapsulated to obtain the core dataset for situation modeling.

[0027] In this embodiment, the step of constructing a multi-dimensional phase space of alarm events based on historical alarm data to obtain the quantized intrinsic coordinate set of alarm events includes: Each historical alarm event in the historical alarm database is processed as follows: Calculate the time period coordinates of alarm events to obtain the time phase vector that represents the periodic pattern of the events; Calculate the resource topology coordinates of the alarm event to obtain the topology vector representing the location of the event in the infrastructure dependency relationship; Calculate the semantic essence coordinates of the alarm event to obtain the semantic vector that represents the inherent nature of the fault described by the event; Calculate the impact propagation coordinates of the alarm event to obtain the potential energy vector characterizing the potential impact range and propagation direction of the event; Construct a multidimensional phase space, which includes four eigenspaces. One eigenspace is used to accommodate one of the time phase vector, topological vector, semantic vector, and potential energy vector. The time phase vector, topological vector, semantic vector, and potential energy vector are mapped to a multi-dimensional phase space to obtain the quantized intrinsic coordinate information of the historical alarm event. A historical alarm event is considered as an event singularity in the multi-dimensional phase space. The quantized intrinsic coordinate information of each event constitutes the quantized intrinsic coordinate set of the alarm event.

[0028] In this embodiment, this application establishes a unified and measurable high-dimensional mathematical representation for historical alarm data, mapping it from raw text and discrete attribute records to an event singularity with deterministic coordinates in an operation-state multidimensional phase space. This multidimensional phase space P is composed of four eigenspaces connected by a direct sum (⊕), i.e., P = T⊕R⊕S⊕I, where T is the time period subspace, R is the resource topology subspace, S is the semantic essence subspace, and I is the influence propagation subspace. The specific technical application is as follows: Calculate the time period coordinates of the alarm event to obtain the time phase vector representing the periodic pattern of the event: For any historical stock alarm event Extract its standardized alarm occurrence timestamp .

[0029] Define a set of benchmark cycles related to the business operation and maintenance cycle. ,in, This represents the number of seconds in the j-th reference period. Typical periods include: daily period (T1=86400 seconds) and weekly period (T2=604800 seconds).

[0030] Calculate alarm events In the j-th reference period Normalized phase within : ; Normalized phase By mapping sine and cosine functions onto a two-dimensional unit circle, abrupt changes at the periodic boundaries are eliminated, forming periodic coordinate components. .

[0031] Combine the periodic coordinate components of all reference periods with the absolute timestamp. By piecing together the data, the alarm events can be obtained. Time period coordinate vector : ; The vector It also encodes the absolute timing of the event and its phase information over multiple business cycles.

[0032] Calculate the resource topology coordinates of the alarm event to obtain a topology vector representing the event's location within infrastructure dependencies: Based on the global resource topology graph (global undirected or directed graph) obtained from the configuration management database. Where V is the set of nodes of all infrastructure resource entities (such as physical hosts, virtual machines, containers, network devices, and application service instances), and E is the set of directed edges representing the dependencies, connections, or subordinate relationships between resources, including but not limited to: physical connections (such as server-switch), logical dependencies (such as application service-database), network reachability, and deployment subordinates (such as container-host).

[0033] For alarm events The specific resource node that triggered the alarm can be parsed from its alarm source / monitored object identifier field. .

[0034] Graph embedding algorithms, such as Node2Vec or GraphSAGE, are used to embed the resource topology graph. The training process generates a low-dimensional, dense vector representation Emb(v) for each resource node v∈V in the graph, thus forming a graph embedding model.

[0035] Extract alarm events from the graph embedding results. Corresponding resource nodes The embedding vector is used to obtain the resource topology coordinate vector of the event. : ; The vector The structural similarity and proximity relationship of resource nodes in the high-dimensional topology graph are maintained in the low-dimensional space.

[0036] Calculate the semantic essence coordinates of the alarm event to obtain the semantic vector representing the intrinsic nature of the fault described by the event: Regarding alarm events The text information, including alarm titles / summaries and alarm details / messages, is used for in-depth semantic understanding.

[0037] The alarm text information is fed into a large language model (e.g., BERT or its variants based on the Transformer architecture) that has been pre-trained and fine-tuned from large-scale operation and maintenance logs, work orders, and knowledge documents.

[0038] Extract the hidden state vector from the last layer of the large language model, or perform mean pooling on the output of all labeled data to obtain a dense vector representation of a fixed dimension.

[0039] This vector is defined as an alarm event. semantic essence coordinate vector : ; The vector It encodes deep semantic information such as the fault phenomena, possible causes, and affected components described in the alarm, transforming unstructured text into a computable mathematical representation.

[0040] Calculate the impact propagation coordinates of the alarm event to obtain the potential energy vector characterizing the potential impact range and propagation direction of the event: Based on the temporal co-occurrence and transfer patterns of alarm events in historical alarm data, the potential impact of events is quantified.

[0041] First, analyze the temporal relationships of all alarm event pairs in history. Then, define a time window. .

[0042] For any two alarm types Calculated within the time window Inside, type Following the occurrence of the alarm event, a type of [event name] immediately followed. The probability of alarm events .

[0043] Construct an alarm type transition probability matrix M, where the matrix elements are... .

[0044] For alarm events Its type is Take the first element from matrix M. The row vector yields the propagation coordinate vector (or propagation potential vector) of the event's influence. : ; The vector Each dimension represents the likelihood that the current event will trigger other types of alarms, intuitively depicting its influence in the alarm propagation network.

[0045] The four coordinate vectors obtained from the above calculations are concatenated to generate an alarm event. The final coordinate representation in the complete multidimensional phase space P, i.e., the complete coordinates of the event singularity. : ; For each alarm event in the historical alarm dataset H By performing the above steps on ∈H, we finally obtain the set of quantized intrinsic coordinates of all historical alarm events. = , where N is the total number of historical alarm events.

[0046] In this embodiment, the step of performing event cloud collapse under the influence of event gravity based on the quantized intrinsic coordinate set of alarm events to obtain the event nebula set includes: Calculate the mutual attraction between any two alarm event singularities in the multidimensional phase space, and the mutual attraction between the alarm event singularities forms a gravity matrix; Density peak search is performed based on the gravity matrix and local density to identify high gravitational density points that are potential event nebulae cores. Each high gravitational density point is called a peak event singularity. Other non-peak event singularities are clustered and each non-peak event singularity is assigned to the range of each peak event singularity, thereby forming at least one cluster set, which is called a candidate event nebula; each candidate event nebula constitutes an event nebula set.

[0047] In this embodiment, the present application quantizes the intrinsic coordinate set based on the generated alarm events. = This paper defines a state gravity model and simulates how discrete event singularities dynamically aggregate and merge under this gravity to form a higher-level logical entity state nebula. The process aims to adaptively emerge, from a massive number of low-level atomic alarm events, high-level logical units representing systemic faults or states. Specific technical applications are as follows: Define an event gravity model in a multidimensional phase space to obtain the quantified value of the mutual attraction between any two alarm event singularities: In the multidimensional phase space P=T⊕R⊕S⊕I constructed above, let S be the singularity of any two alarm events. and Define their mutual attraction .

[0048] Calculate the dimensional distance: For each of the four eigenspaces k∈{t,r,s,p}, calculate the singularity. and Corresponding coordinate components in this subspace Normalized distance between .

[0049] For time period coordinates and resource topology coordinates The Euclidean distance is used and the maximum-minimum normalization is applied.

[0050] For semantic essential coordinates The cosine distance is used.

[0051] For the influence of propagation coordinates The Jaccard distance or KL divergence is used to measure the difference in the distribution of the influence of two events.

[0052] Define the gravitational calculation function: event singularity and Gravity of events Defined by the following formula: ; in, These are adjustable dimension weight parameters that satisfy ∑ =1, reflecting the importance of different dimensions in event correlation. It is the absolute difference in the time of occurrence of two events. It is the time decay constant, which controls the rate at which gravity decays as the time interval increases.

[0053] Obtain the gravitational matrix: for the set of singularities of historical warning events. All events in the calculation This yields an N×N symmetric or asymmetric event gravity matrix F, which quantifies the mutual attraction strength of all point pairs in the historical event space.

[0054] Density peaks are searched based on the gravity matrix and local density to identify high gravitational density points that could be the core of a potential “event nebula”.

[0055] We employ density-based clustering to find points in a gravitational field that can serve as cluster centers.

[0056] Calculate the local gravitational density: for each event singularity Its local gravitational density Defined as its gravitational effective radius R c The sum of the gravitational forces exerted on it by other points within the area. The calculation formula is as follows: ; in, It is an indicator function. It is a preset gravity threshold used to determine whether two points are sufficiently close in terms of gravity.

[0057] Calculate the minimum high-density gravitational distance: for each point Calculate its distance to all points with higher local density than it. (i.e., satisfy) The minimum gravitational distance of the point) : ;

[0058] For the highest local density The point, its Defined as 1 / among all points The maximum value.

[0059] Identifying density peaks: On the decision graph composed of ρ and δ, select points that simultaneously have relatively high ρ values ​​and very high δ values ​​as density peaks, i.e., potential gravitational seeds. These points are typically centers of the local gravitational field and are relatively far from other density centers. This results in a set of density peaks. , where M is the number of identified peak points, and each peak point will serve as the core of an event nebula candidate.

[0060] Perform gravity propagation and membership assignment to classify each non-peak event singularity under the density peak point with the strongest attraction to determine the sphere of influence of each gravity seed.

[0061] Initial membership: for each density peak point It itself constitutes an initial event nebula candidate .

[0062] Iterative propagation and absorption: for each non-peak event singularity : Calculate its distance to all density peak points Net gravitational tendency This tendency can be determined by a combination of factors, including the gravitational pull of the peak point on it and the reciprocal of the gravitational distance from it to the peak point. The specific method is as follows: ; The singularity of events Assigned to the peak point that gives it maximum gravitational pull The nebula candidate representing the situation.

[0063] Clustering results: After assigning all non-peak points, M disjoint sets are obtained. Each set Contains a density peak point And all the singularities of events attracted by it. Each set It is referred to as a candidate event nebula.

[0064] Generate the final set: the final stable set of candidate event nebulae Where K≤M. Each event nebula It is a subset of historical warning event singularities, representing a group of events closely related in terms of time, space, resources, semantics, and impact propagation. It is the core object for subsequent situational abstraction and root cause analysis.

[0065] In this embodiment, extracting features and singularities from the event nebula set to obtain the situation vector and root cause candidate set includes: For each candidate event nebula A deep analysis is performed on ∈C to extract its core mathematical features that represent the overall state of the situation, and to identify the key internal events that drive the formation of the situation. The specific technical application is as follows: Calculate the centroid and situation vector of the event nebula to obtain a comprehensive vector representation describing the overall state of the event: Centroid calculation: for event nebulae It contains Individual alarm event singularity Each of them The above refers to the multidimensional coordinates. Calculation. The centroid in phase space P That is, the arithmetic mean of all its member points in each coordinate dimension: ; The situation vector is obtained: this centroid. This refers to the nebula that represents the state of affairs. The overall situational vector. It integrates the average attributes of the situation across all dimensions, including time, resources, semantics, and impact propagation.

[0066] Calculate the boundary and distribution range of the event nebula to obtain boundary parameters describing the internal consistency and volatility of the event: Dimensional variance calculation: In order to quantify the degree of dispersion within the event nebula, for each eigenspace k∈{t,r,s,p} in the phase space, the variance of the member points in the coordinates of that subspace is calculated.

[0067] For subspace k, the coordinates of the member points are... .

[0068] Calculate its covariance matrix or the variance of its principal components.

[0069] Obtain the boundary vector: Select the statistic that best represents the distribution range within each subspace (such as the standard deviation of the principal components, the maximum value of the standard deviation of each dimension, etc.) to form a boundary vector. This vector describes the size or density of the event nebula. The smaller the boundary value, the higher the consistency of events within the event and the clearer the pattern.

[0070] Identify gravitational singularities within the event nebula to obtain a candidate set of key root events driving the event's formation: Gravitational contribution calculation: For event nebulae Singularity of each member event within Calculate its gravitational contribution to the formation of the nebula. The contribution formula is as follows: ; in, The gravitational matrix from the above. This value reflects the point... accumulating to form nebulae The intensity of attraction during the process.

[0071] Filtering gravitational singularities: nebulae Click on the gravitational contribution of each member. Sort in descending order. Select the top R points (R can be determined based on n). k The gravitational singularities of this event nebula are set proportionally, such as the top 10% or a fixed top 3. .

[0072] ; The root cause candidate set is obtained: These gravitational singularities are identified as the core driving events or key triggers that led to the clustering of this set of alarm events and the formation of the current situation. They are the primary suspects for root cause analysis, i.e., the root cause event candidate set. Each gravitational singularity is associated with its original alarm ID and contribution score.

[0073] Extract the member fingerprints of the event nebula to preserve the traceability link from high-level events to low-level events: Record the original ID list: Save the nebula that constitutes this event. A list of original alarm unique identifiers corresponding to all alarm events.

[0074] Obtain the event fingerprint: for each event nebula It is extracted into a structured feature package, which includes: a situation vector. Boundary vector Gravitational Singularity Set And the original list of member IDs. This feature packet is the unique fingerprint of this event.

[0075] In this embodiment, the situation vector and root cause candidate set are labeled and encapsulated to obtain the core dataset for situation modeling, including: By associating the event status with the operations and maintenance knowledge base, the event status is labeled, thereby assigning semantic tags to each event nebula that describe its business impact and final handling result: Time window correlation: For an event nebula, determine the active time window of the event based on the time range of its original member alarms. .

[0076] Knowledge base query and matching: In the historical operation and maintenance knowledge base (such as fault ticket system, change management system, post-event analysis report database), query within the time window [ −Δ, All faults, changes, or major events recorded within +Δ] (Δ is the buffer time).

[0077] Manual or automatic annotation: Using natural language processing techniques or the experience of operations and maintenance experts, the queried events are correlated and matched with the event nebula. The matching criteria include: time overlap, resource overlap, and the semantic features of the fault description and the "event nebula" (from...). The similarity can be inferred from the semantic coordinates.

[0078] Generate state evolution tags: Generate state evolution tags for successfully matched states. This tag is a structured data object, which includes: Root causes include database master node hardware failure and application code bugs leading to memory leaks.

[0079] Business impact: such as a 10-minute interruption of core payment services and a drop in user login success rate to 95%.

[0080] Actions to take include restarting the database service, scaling up application instances, and rolling back the code version.

[0081] Final status: such as restored or repaired.

[0082] Related knowledge entry ID: A link to a detailed fault report or knowledge base entry.

[0083] Encapsulate standardized event samples to generate complete data records containing event characteristics, context, and result labels. Sample data structure definition: Define a standard event sample data format, including the following core fields: Event ID: A unique identifier.

[0084] Situation characteristics: Situation vector Boundary vector Gravitational Singularity Set And the original member ID list.

[0085] Event evolution labels and statistical metadata: such as the number of original alarms included in the event and the duration.

[0086] The above information is encapsulated into a data record. .

[0087] ; Dataset construction: Generate corresponding samples for all identified event nebulae. The collection of all samples constitutes the core dataset D for situational modeling in this application.

[0088] Dataset partitioning: Divide the dataset D into training, validation and test sets according to time order (e.g., the first 80% of the samples are used as the training set and the last 20% as the test set) or by random sampling.

[0089] In this embodiment, the final situation modeling core dataset D is a high-quality, standardized knowledge base. Each sample is a complete profile of a situation, including not only its mathematical features (situation vector) and internal key points (gravitational singularities), but also its corresponding real-world semantics and the outcome of the action (situation evolution label).

[0090] In this embodiment, step 3: performing situational inversion and source tracing with the real-time alarm stream data and the core dataset for situational modeling to obtain source tracing information includes:

[0091] Phase space projection and gravitational perturbation calculations are performed based on the core dataset of situation modeling to obtain the initial force state of real-time alarm stream data in the known gravitational field.

[0092] In this embodiment, phase space projection and gravitational perturbation calculations are performed on the real-time alarm event to obtain the initial force state of the real-time alarm in the known gravitational field, including:

[0093] S301. Perform phase space coordinate mapping and gravitational perturbation calculation on the real-time alarm stream to obtain the initial force state vector of the real-time alarm event in the historical event gravitational field:

[0094] Phase space coordinate mapping for real-time alarms:

[0095] Input processing: For a new alarm event arriving from the real-time alarm stream output from step 1. Extract the standardized alarm information, including alarm title, content, and timestamp of occurrence. Alarm source resource identifier and alarm type.

[0096] Calculating the time period coordinates: The same reference period set and calculation method as described above are used. Based on... Calculate its value in each reference period. The normalized phase within the time frame is obtained, and the periodic coordinate components are obtained through sine and cosine mapping. Finally, the real-time alarm time period coordinates are obtained by splicing them together. .

[0097] Calculating resource topology coordinates: Based on a pre-trained graph embedding model, the resource identifier of the alarm source in real-time alarms is input into the model. The vector representation of the resource node in the learned resource topology embedding space is queried or inferred in real time, and used as the resource topology coordinates for real-time alarms. .

[0098] Calculate semantic essence coordinates: Combine the title and content text of real-time alerts Input the large language model used above, which has been fine-tuned for the operations and maintenance domain. Obtain the labeled vector or pooled vector output by the model, and use it as the semantic coordinates of the real-time alarm. .

[0099] Calculate the impact propagation coordinates: based on the type of real-time alarm. Extract the corresponding row vectors from the step history alarm type transition probability matrix M. As a coordinate for the propagation of real-time alarm effects .

[0100] Generating the real-time event singularity: Concatenate the four coordinate vectors mentioned above to obtain the complete coordinates of the real-time alarm event in phase space P, i.e., the real-time event singularity. .

[0101] Calculate the static gravitational potential of the real-time event singularity with respect to the centroid of historical events:

[0102] Obtaining historical event centroids: From the generated situation modeling core dataset D, read the set of situation vectors (i.e., their centroids) of all historical event samples. , where K is the total number of historical events. Each It represents the central position of a historical event in phase space.

[0103] Calculating the static gravitational potential: for real-time event singularities Calculate its centroid for each historical event. static gravitational potential U m The formula is as follows:

[0104] ;

[0105] in, Let be the distance function on subspace k. For dimension weights, The average occurrence time of historical event m (which can be obtained from dataset D). This is a time decay constant used to enhance the weight of recent historical events.

[0106] Calculation yields all Then, a K-dimensional gravitational potential vector is formed. This vector represents the initial intensity distribution of the current real-time alarm event attracted by various historical event patterns.

[0107] Dynamic causal flow simulation and shortest backtracking path calculation are performed on the initial force state of real-time alarm stream data in a known gravitational field to generate one or more causal explanation chains from the real-time alarm event to the potential root cause.

[0108] In this embodiment, dynamic causal flow simulation and shortest backtracking path calculation are performed on the initial force state of real-time alarm stream data in a known event gravitational field to generate one or more causal explanatory chains from the real-time alarm event to the potential root cause, including:

[0109] Constructing dynamic causal flow networks:

[0110] The singularity of the main real-time alarm event that triggered step 3. ;

[0111] For the current sliding time window (For example, in the last 5 minutes) except The set of singularities corresponding to all other real-time alarm events.

[0112] For all historical event centroids read from the situation modeling core dataset D The corresponding set of nodes.

[0113] .

[0114] Directed edge set With weight calculate:

[0115] Edge existence determination: For any two distinct nodes i,j∈V, edge existence is determined if and only if the temporal constraints are satisfied. A directed edge from node i to node j is only allowed when t is the average time of an alarm or event corresponding to a node. This ensures that the direction of causal flow is consistent with the direction of time flow.

[0116] Gravity calculation: for allowed edges The gravitational force of node i on node j is calculated using the event-gravity formula. It is important to note that when j is a historical event node h... m When, its coordinates use the centroid ,time The average time to use this event.

[0117] Weight assignment: Directed edges weight Defined as the reciprocal of that gravitational force, i.e. .

[0118] Obtaining a weighted directed graph: Ultimately, a weighted directed graph is obtained. Where W is all weights This is a set of causal flow networks.

[0119] Performing reverse shortest path search in a causal flow network: Define the source and target sets: using nodes (Current real-time alarm) is the starting point (source point) of the path. All historical event nodes are used as the starting point. ∈ For the set of potential target endpoints.

[0120] Performing multi-objective shortest path search: in a weighted directed graph The algorithm runs on a single source point and multiple target points. Since the edge weights are all positive (gravity Fij > 0), an improved Dijkstra's algorithm can be used.

[0121] The specific algorithm is as follows: Initialization: Setting the source point distance Distance to all other nodes u Mark all nodes as unvisited.

[0122] Create a priority queue (min-heap) and... Join the team.

[0123] When the priority queue is not empty: Pop the node u with the smallest current distance.

[0124] Iterate through all outgoing neighbors v of u (i.e., those that satisfy the condition) (nodes).

[0125] Calculate the candidate distance from u to v: .

[0126] if Then update And record the predecessor node. .Will( Add to the priority queue.

[0127] When the algorithm ends, That is, from At historical junctures The shortest path cost can be obtained by backtracking the precursor chain to get the complete path.

[0128] Generate a set of candidate paths: for each historical event node ,if (If a connected path exists), then the sequence of path nodes can be obtained by backtracking. This yields a set of candidate shortest backtracking paths. , where M≤K is the number of historical states with reachable paths.

[0129] In this embodiment, backtracking path aggregation and gravitational singularity verification are performed on each causal explanation chain to generate high-confidence source location information, including: Aggregate backtracking paths to determine the attribution state: Path validity filtering: For each candidate path Calculate its path length (number of hops) and total cost. Filter out paths that are too long (e.g., >5 hops) or have too high a total cost (e.g., ...). , For paths with a cost threshold, retain the set of high-quality paths. .

[0130] Calculate the attribution support for each filtered path: Its endpoint is the historical situation. Statistics on each historical event The number of times a destination appears in a high-quality path set .

[0131] Calculate the overall confidence level: for the most frequently occurring historical events... Calculate its overall confidence level as a "state of attribution". : ; in: This represents the total number of high-quality paths. The endpoint is The average cost of all paths. It is the current real-time alarm pair calculated in step S301. The static gravitational potential. α, β, γ are weighting coefficients, and α + β + γ = 1. max(U) is the static gravitational potential of all... The maximum value in.

[0132] Select overall confidence level The highest historical state is the final state of affairs. If the highest confidence level is lower than the preset threshold. If the condition is unknown, a special identifier will be output.

[0133] Verify gravitational singularity alignment to locate root candidate: Obtaining historical gravitational singularity coordinates: Read from dataset D List of gravitational singularities = .

[0134] Search and match within the real-time alarm set: for each historical gravitational singularity coordinate... In the current sliding time window Real-time alarm singularity set within In the process, it is calculated that it is related to each real-time singularity. semantic essence subspace cosine similarity = ,in A semantically essential subvector representing coordinates.

[0135] Identify matching pairs: For each historical gravitational singularity r, find the real-time alarm singularity with the highest semantic similarity. = If the highest similarity Greater than the threshold Then a matching pair is formed.

[0136] Generate the root source candidate set: All matching pairs constitute the root source candidate set. You can press × The products are sorted, and the higher the product, the greater the likelihood that it is the root cause of the current situation.

[0137] Encapsulated output traceability and location information: Structured encapsulation: The above results are encapsulated into a source tracing and location information object, whose data structure includes: State of Attribution Unique identifier, attribution of matter Overall confidence level List of root cause candidate sets (RCs), 1-2 supporting criteria And the lowest cost complete path Node ID sequence, initial real-time alarm ID.

[0138] In this embodiment, step 4: generating compressed convergence information based on the source tracing and location information and the core dataset for situation modeling includes: Entropy information data is obtained by calculating the situation entropy and assessing the state based on the source location information and the core dataset of situation modeling. A core alarm set is generated based on entropy information data, situation vectors, and root cause candidate sets. Compressed convergence information is generated based on the core alarm set.

[0139] In this embodiment, entropy calculation and state assessment are performed based on source tracing and location information and the core dataset for situation modeling, thereby obtaining entropy information data including: Calculate the baseline intrinsic entropy: Obtain the target situation from the source tracing and location information output in step 3. Extract the situation vector from the core dataset for situation modeling generated in step 2. and boundary vector This boundary vector characterizes the inherent range of fluctuations exhibited by this event throughout history. The inherent entropy of this event is defined. This is a weighted sum of the components of each dimension of the boundary vector, representing the inherent, acceptable level of disorder of the situation pattern itself. ;in, These are the weighting coefficients for each dimension.

[0140] Calculate the current observation entropy: Based on the source tracing and localization results in step 3, extract the relevant event state from the current real-time alarm stream. Related alarm event set These alarms are transformed to phase space using a mapping function to obtain a set of coordinates. Calculate the situation vector of this observation set relative to the target. The degree of dispersion is defined as the observation entropy. : ; Calculate the entropy increase ratio: Compare the observed entropy with the intrinsic entropy to calculate the entropy increase ratio. : ; In this embodiment, generating the core alarm set based on entropy information data, situation vectors, and root cause candidate sets includes: This step dynamically adjusts the compression strategy based on the entropy increase ratio, selecting the most representative core alarms from the original alarms.

[0141] Determine the compression granularity: Set a compression threshold function. .when When the value is close to 1, it indicates that the current situation is highly consistent with historical patterns, and coarse-grained compression is adopted (generating fewer core alarms); when A value significantly greater than 1 indicates a new variation in the situation, requiring fine-grained compression (generating more core alarms to preserve details). The number of core alarms after compression is calculated based on the entropy increase ratio. .

[0142] Perform weighted clustering and representative point election: using the current alarm set Using the coordinate points in phase space as objects, and taking the root cause candidate set identified in the source tracing and location information in step 3 as the initial cluster centers or assigning them higher weights, weighted K-Means clustering is performed. The number of clusters is set to K. The clustering process is calculated to obtain K alarm clusters. .

[0143] Election core alert: for each cluster Calculate the weighted distance between all points within the cluster and the root source candidate set from step 3, taking into account factors such as alarm level and time freshness. Elect a core alarm. This serves as the representative of the cluster. The resulting compressed core alarm set is then obtained. .

[0144] In this embodiment, generating compressed convergence information based on the core alarm set includes: Generate compression based on the following summary: integration entropy increase ratio The compression granularity K and the cluster size (original number of alarms) of each core alarm are selected to generate a compression summary.

[0145] Generate event correlation summaries: Clearly establish the core alarm set. With the target situation The association includes the event identifier, its historical pattern description (from the dataset in step 2), and the matching degree between the current real-time alarm stream and the event pattern (from the location confidence in step 3).

[0146] Generate causal contribution summary: Clearly identify which alarms in the core alarm set belong to the root cause candidates identified in step 3, and assign them a causal contribution score.

[0147] Encapsulate convergence information: Collect core alarms The generated summaries (compressed basis summary, event correlation summary, and causal contribution summary) are encapsulated into a unified, structured compressed convergence information object, ultimately yielding the compressed convergence information.

[0148] In this embodiment, step 5: generating the core feedback set for action deduction and execution based on the compressed convergence information includes: By performing historical valid action pattern matching on the compressed convergence information, a set of historically verified valid actions that match the current high-entropy state can be obtained. In this embodiment, the historical valid action pattern matching is performed on the compressed convergence information to obtain a set of historically verified valid actions that match the current high-entropy state, including: S501. By matching the compressed convergence information, the evolutionary labels of the target event state, and the historical records of gravitational singularities with historical effective action patterns, we can obtain historical intervention experience that matches the current high-entropy state. Extracting the state context of the converged state: From the compressed convergence information in step 4, extract the state association summary, which includes the attribution state (i.e., from step 3). ( ) is the core context of decision-making.

[0149] Retrieve historically valid action patterns: In the situation modeling core dataset D generated in step 2, search for historical situation samples that are the same as or highly similar to the current situation (by comparing the cosine similarity of the situation vectors). From the situation evolution labels of these matching samples, extract the maintenance actions or operation patterns that have been actually executed and verified to be effective for that situation in the past. This yields a set of candidate action patterns based on successful experiences from historical situations.

[0150] Root cause action association: Obtain a root cause candidate set from the source location information in step 3. From the candidate action pattern set, prioritize actions historically executed for similar gravitational singularities (root cause alarm types). Finally, obtain a set of historically validated actions that match the current high-entropy state (converged state) in both event type and root cause properties.

[0151] In this embodiment, parameterized action sequences are generated from the historically validated action set to form candidate action sequences that can be adapted to the current specific scenario, including: S502. Based on the historical set of valid actions, the entropy increase ratio of the current convergence state, and core alarms, parameterized action sequences are generated to form candidate execution requests that can be adapted to the current specific scenario: Parameterized action template generation: Extract parameters from the action descriptions (such as restarting the service name, moving {host IP} out of the load balancer) in the historical valid action set obtained by S501 to form a parameterized action template.

[0152] Template instantiation: Using the specific resource identifiers (such as host IP, service name, database instance name) contained in the core alarm set in the compressed convergence information in step 4, the variables (such as ${service name}) in the parameterized action template are filled in to generate specific, executable atomic operation instructions.

[0153] Sorting and Combining Based on Entropy Increase Ratio: Based on the entropy increase ratio calculated in step 4. To guide the level of aggression in movement. Low Adopting conservative actions (such as restarting, expanding capacity), high If conservative actions fail, aggressive actions (such as rollback or failover) can be considered. The instantiated atomic operations are combined according to their aggressiveness, historical execution order, and logical priority of the root cause candidate set from step 3 to generate a sequence of candidate actions. Each sequence is an ordered list of operations for the current specific resource.

[0154] In this embodiment, the process of deducing and estimating the effects of candidate action sequences to obtain recommended execution sequences includes: S503. In the simulation space of the situation vector, candidate action sequences are deduced and their effects predicted, thereby quantitatively evaluating and selecting the optimal intervention path: This step uses the state of affairs concept of this application for deduction, rather than a full system simulation.

[0155] Constructing a situation dynamics simulator: using the situation vector of the current attribution situation Using the dataset from step 2 as the initial state, and the core alarm set reflecting the current deviation and the entropy increase ratio from the compressed convergence information in step 4 as environmental disturbance parameters, a lightweight event dynamics simulator is constructed. This simulator defines how different operational actions (such as restart and expansion) will affect the values ​​of each dimension of the situation vector.

[0156] Injecting Sequences and Deducing State Evolution: Each candidate action sequence generated by S502 is sequentially injected into the event dynamics simulator. Each action is simulated and executed, and based on its definition, the evolution trajectory of the situation vector is dynamically calculated, deducing the predicted situation vector after the sequence is executed. .

[0157] Calculate the stabilization score and select: Define a health state vector. (This typically corresponds to a vector where all indicators are normal). Calculate each predicted situation vector. and The cosine similarity is used as the stabilization score. The action sequence with the highest stabilization score and whose action aggression ratio matches the entropy increase ratio is selected as the recommended execution sequence.

[0158] In this embodiment, obtaining the execution feedback data after execution according to the recommended execution sequence includes: S504. Execute the recommended execution sequence, monitor execution feedback, and form a feedback set to optimize situation modeling: Security Execution and Monitoring: After necessary approval or security interception, execute the recommended execution sequence. Simultaneously, monitor changes in the real-time alarm stream and corresponding monitoring metrics of the core alarm set over a period after execution, collecting execution feedback data.

[0159] Generate a core feedback set for action deduction and execution: Integrate all key information from this event to generate a structured core feedback set for action deduction and execution. This set includes: Input: Source location information from step 3 and compression convergence information from step 4.

[0160] Decision: The candidate action sequence generated by S502 and the recommended execution sequence selected by S503, along with their stabilization scores.

[0161] Results: Execution feedback data and a final determination of whether convergence has occurred.

[0162] Feedback Learning and Model Optimization: This action deduction and execution core feedback set is used as a new, labeled sample. It is then updated to the situation modeling core dataset in Step 2. Specifically, the new situation formed by this real-time alarm stream (compressed in Step 4) (whose situation vector can be calculated from the alarms before execution) is associated with the recommended execution sequence and the final result as a new empirical sample. This will be used for incremental learning of the situation gravity collapse model in Step 2 and the causal gravity backtracking model in Step 3, enabling them to more accurately associate similar alarm patterns with effective response actions.

[0163] In this embodiment, the specific method for constructing the event dynamics simulator is as follows: Define and initialize the event dynamics simulator: State variables: Define the state of the simulator as a vector. This vector has the same dimension and physical meaning as the situation vector defined in step 2. It represents a quantitative snapshot of the overall operating status of the system at simulation time t.

[0164] Initial state settings: The initial state of the simulator at the start of the simulation (t=0). The centroid vector that is set as the current state of affairs (Output from step 3). This indicates that the starting point of the simulation is the fault or abnormal mode that the system is currently in.

[0165] Perturbation input setting: Extract the entropy increase ratio from the compression convergence information output in step 4. and core alarm collection This information is encoded into an environmental perturbation vector. This is used to introduce specific deviations of the current state of affairs relative to its historical baseline in a simulation. For example, The fluctuation amplitude of the state vector can be scaled linearly, while The proportion of different types of alarms can affect the initial offset of the corresponding dimension in the state vector.

[0166] Build a library of action impact models: Atomic action definition: Enumerate a set of standard operation and maintenance atomic actions, such as restart(service), scale_out(instance,count), failover(primary,standby), rollback(version), block_traffic(ip), etc.

[0167] Action-state transition function learning: Machine learning is performed based on the core dataset D for situation modeling generated in step 2, training a state transition prediction function for each atomic action a. The function takes the current state vector as input. Given action parameters (such as the target service name), the output predicts the incremental change in the state vector after the action is executed. .

[0168] Training method: Select samples from D whose event evolution labels explicitly record the execution of action 'a'. Using the state vectors before and after the event in these samples (or state changes inferred from relevant alarms), train a regression model (such as a gradient boosting tree or a shallow neural network) as... .

[0169] Obtain the model library: Obtain an action effect model library. This library contains the core knowledge for simulators to deduce motion effects.

[0170] Execute and deduce candidate action sequences in the simulator: Sequence injection: Input a set of candidate action sequences generated in step S502 Each sequence is an ordered list of atomic actions, such as... .

[0171] Step-by-step simulation: For each candidate sequence Seq: Set the current simulation state .

[0172] For each action in the sequence in order : From the Action Impact Model Library Call the corresponding prediction function in the middle .

[0173] Calculate the state increment: .

[0174] Update simulation status: .

[0175] Random noise is added or the update is fine-tuned based on the environmental disturbance vector P to simulate uncertainty.

[0176] After the sequence is completed, record the final simulation state. .

[0177] Prediction results are obtained: After simulation of all candidate sequences, the set of predicted final situation vectors for each sequence is obtained. .

[0178] Calculate the stabilization score and select the optimal sequence: Define a health status baseline: Define a health status vector. This vector can be obtained by analyzing the centroids of all event samples marked as normal or recovered in D, or by being set by operations and maintenance experts based on ideal monitoring indicator thresholds.

[0179] Calculate the stabilization score: the predicted final state for each candidate sequence Seq. Calculate its relationship with the healthy baseline. Cosine similarity as a stabilization score : ; A score close to 1 indicates that the predicted state is highly consistent with the health state.

[0180] Calculate risk and cost adjustments: Risk correction: based on the aggressiveness of actions in the sequence (e.g., restart or rollback) and the entropy increase ratio. Calculate the risk adjustment factor. Aggressive actions at high risk... The score might be higher in the lower range. They may be punished.

[0181] Cost adjustment: Calculate the cost adjustment factor based on the estimated execution time of the sequence, resource consumption, etc.

[0182] Calculate the overall score and selection: Calculate the overall score for each sequence, for example: ; Output recommended sequence: Select the candidate action sequence with the highest comprehensive score as the recommended execution sequence. If multiple sequences have scores close to and above the threshold, they can be considered as alternatives.

[0183] This step outputs a clear recommended execution sequence along with its corresponding predicted final situation vector and stabilization score, providing the optimal decision application, rationally evaluated through simulation, for the automated execution of step S504. This simulator acts as a digital sandbox for operational actions, enabling effect verification and application optimization before taking real-world actions.

[0184] In this embodiment, it refers to the collection of all alarm records that have been collected, cleaned, and persistently stored from a specified historical time starting point (such as the system launch date or the data retention policy start point) to the current time point. Its information constitutes a multi-dimensional data model, mainly including: Identifiers and metadata: Alert ID: A unique identifier for an alarm.

[0185] Alarm serial number / serial number: a serial number based on time or source.

[0186] Data source / collector identifier: Specifies the source system or collection agent of the alarm.

[0187] Content and description information: Alert Title / Summary: A brief text describing the alert content.

[0188] Alert details / message (Alert_Message / Content): Text containing detailed error information, stack traces, log fragments, etc.

[0189] Alert type / category: such as network, application, database, hardware, etc.

[0190] Alert Subtypes / Tags: More granular classifications or custom tags, such as connection timeout, memory overflow, master-slave latency.

[0191] Status and lifecycle information: Alert Level / Severity: such as fatal, critical, warning, alert.

[0192] Alarm status (Alert_Status): such as generated, acknowledged, assigned, processing, recovered, closed.

[0193] Alert Generation Time: The timestamp when the monitoring system initially detected the anomaly and generated an alarm.

[0194] Alert Update Time: The timestamp of the last change to the alert status or information.

[0195] Alert_Recovery / Clear_Time: The timestamp when the metric returns to normal and the alarm is cleared (if applicable).

[0196] Confirmation / Assignment Time and Personnel: The time and responsible person for confirming or assigning the alarm to the maintenance personnel.

[0197] Context and topology information: Alert Source / Monitored Object Identifier: The specific resource identifier that generated the alert, such as: server IP / hostname, container ID, Pod name, virtual machine ID, network device IP, application instance name, database instance name, service interface URL.

[0198] Resource topology path / location: The location of the alarm source in the resource tree or CMDB, such as: "Cluster A / Rack 3 / Host 192.168.1.10".

[0199] Business / Application / Service: The name of the affected business system, application, or microservice, such as: payment core service, user center API, order database.

[0200] Associated change order / work order ID: Planned changes or historical work orders that may be related to this alarm.

[0201] Indicators and metrics: The name of the monitoring metric that triggered the alarm (Metric_Name): such as "cpu_utilization" or "http_request_duration_seconds".

[0202] Metric Value / Threshold that triggers an alarm: The actual metric value and the set threshold when an alarm is triggered.

[0203] Raw monitoring data sampling points / time series segments: Raw data of relevant monitoring indicators within a period of time before and after the alarm is triggered (optional, for in-depth analysis).

[0204] Root cause and treatment information (posterior analysis): Root Cause Analysis Record (RCA_Record): A description of the root causes identified in post-hoc analysis.

[0205] Resolution Action: The specific action to be taken to resolve this alarm.

[0206] Associated fault report / knowledge base entry ID: The known fault knowledge entry associated with this alarm mode.

[0207] Real-time alarm stream data refers to a continuous sequence of alarm events pushed from various monitoring sources in real time, starting from the current point in time, without being persistently stored. Its information structure basically corresponds to historical alarm data, but it places greater emphasis on real-time performance and raw data, mainly including: Key identifiers of the event: Event Unique Identifier (Event_ID): A unique identifier for a real-time event (may be generated temporarily).

[0208] Original event serial number: The event sequence number from the monitoring source.

[0209] Event details and status: Event title / summary.

[0210] Event Detail Message / Payload: This is typically the raw log or event content, which may contain unstructured data.

[0211] Event type / category.

[0212] Severity / Level of the Incident.

[0213] Event status: Usually "newly generated" or "active".

[0214] Event Generation Timestamp (Event_Timestamp): The precise time when the monitoring source generated this event.

[0215] Source and context of the event: Event source / generating object identifier: corresponds to the "alarm source" in historical data.

[0216] Monitoring tool / agent identifier: The name of the monitoring agent or tool that sent this event.

[0217] Original Protocols and Formats: Event push protocols (such as Syslog, SNMP Trap, Kafka Message, RESTful JSON) and their original data formats.

[0218] Raw measurement information: The name and value of the indicator that triggered the event.

[0219] The original, unstandardized alarm condition expression or rule name.

[0220] Historical alarm data is a complete, archived, structured collection of records rich in posterior information (such as root causes, handling results, and complete lifecycle) used for training, modeling, and analyzing historical patterns.

[0221] Real-time alarm stream data is a real-time, streaming, raw, ongoing sequence of events used for immediate detection, correlation analysis, and real-time response.

[0222] This application also provides an intelligent operation and maintenance monitoring automation device based on AI alarm convergence, the intelligent operation and maintenance monitoring automation device based on AI alarm convergence includes: The raw data acquisition module is used to acquire historical stored alarm data and real-time alarm stream data. The situation modeling core dataset acquisition module is used to generate a situation modeling core dataset based on historical stored alarm data. The source tracing and location information acquisition module is used to perform situation inverse tracing and location by combining real-time alarm stream data with the core dataset of situation modeling, thereby acquiring source tracing and location information; A compressed convergence information acquisition module is used to generate compressed convergence information based on source tracing and location information and the core dataset for situation modeling. The motion deduction and execution core feedback set acquisition module is used to generate the motion deduction and execution core feedback set based on the compressed convergence information.

[0223] The following examples further illustrate this application in detail. It is understood that these examples do not constitute any limitation on this application.

[0224] System background and scene setting System: An e-commerce platform for a certain online mall, comprising the following core components: Service layer: gateway, order service, stock service, payment service.

[0225] Data layer: MySQL database master-slave cluster (db-master, db-slave), Redis cache cluster (redis-01 (master), redis-02 (slave)).

[0226] Monitoring and Alert Sources: The platform uses Prometheus to collect metrics and generates alerts via Alertmanager. Alert data is collected and stored uniformly.

[0227] Simulated failure scenario: Due to intermittent network packet loss on the host machine where redis-01 is located, its response latency spikes, which in turn causes a large number of timeouts and errors in the order-service and stock-service that depend on Redis.

[0228] Step 1: Data Acquisition and Preprocessing (S1): Historical stock alarm data Alarm records from the past 90 days, totaling N=500,000 records. Each record contains the following fields: alert_id, timestamp, severity, service, host, alert_name, description, value.

[0229] Real-time alarm stream data Srt(t): A continuously generated stream of alarm events.

[0230] Processing (S101-S103): Collection and parsing: Consuming from message queues (such as Kafka) Read from the database .

[0231] Cleaning: Remove records whose environment tag is not production.

[0232] Remove records with an empty description.

[0233] Deduplication: For the same (service, host, alert_name) data, repeat within 5 minutes. Continuous alarms generated within 300 seconds are merged. The timestamp of the first alarm is retained as the starting time. The timestamp of the last item serves as the end time. And record the number of times it occurs.

[0234] standardization: Time: Convert timestamps to Unix timestamps (seconds), denoted as t.

[0235] Level: Mapping severity to numerical values: critical->5, warning->3, others->1.

[0236] Resource identifier: The format should be service@host, e.g.: order-service@10.0.1.101.

[0237] Text vectorization (for S2 preparation): The alert_name and description are concatenated and converted into a 384-dimensional vector using a pre-trained all-MiniLM-L6-v2 sentence embedding model. .

[0238] Final output: Cleaned historical dataset ,in .

[0239] The real-time alarm processing pipeline outputs standardized real-time alarm events. .

[0240] Step 2: Offline generation of the core dataset for situational modeling (S2) This step is a periodic (e.g., daily) offline batch processing task.

[0241] S2.1 Constructing a multi-dimensional phase space for alarm events Objective: For each historical alarm Calculate its phase space coordinates in .

[0242] Subspace definition and coordinate calculation: Time period subspace coordinates : .

[0243] Calculate its normalized phase over a daily period (T=86400s): .

[0244] Phase is mapped onto the unit circle to eliminate periodic boundary discontinuities: ; in This is to roughly match the scale of the phase components.

[0245] Resource topology subspace coordinates : ; Graph Construction: Based on CMDB and call chain data, construct an undirected graph G=(V,E). V is a set of nodes (all services@host). If there is a call relationship between two services, then there is an edge e∈E between their corresponding nodes.

[0246] Graph embedding: Node representations are learned using the Node2Vec algorithm. Parameters: p=1, q=0.5, dimensions=16, walk_length=30, num_walks=20. The embedding function is obtained. .

[0247] For alarms Its resource identifier corresponds to the node ,but .

[0248] Semantic essence subspace coordinates : .

[0249] Use the text vectors generated during the preprocessing stage directly: .

[0250] Influence on the propagation subspace coordinates : K is the number of unique alarm types (e.g., K=50).

[0251] Construct the transition probability matrix : Define the time window ΔT = 600s.

[0252] By traversing historical data, we can count the frequency of alarms of type k occurring within ΔT after an alarm of type j occurs. .

[0253] Calculate the row-normalized transition probabilities: .

[0254] • For alarms Its type is (Mapped to integer index), then It is the first of matrix M Row vectors: ; Final coordinates: ; All historical alarm coordinates constitute a set .

[0255] S2.2 Simulated Event Gravitational Collapse: Objective: To perform clustering on point set X and discover event nebulae. Each of them It is a subset of X.

[0256] Calculate the gravitational matrix (Can be sparsified): For any two points Its gravitational pull Defined as: ; Weight: ,satisfy .

[0257] Time decay: τ = 1800 s.

[0258] To improve efficiency, only when Time calculation Otherwise, set it to 0.

[0259] Density Peak Clustering (DPC): Calculate local density ,in Pick The median of all positive values.

[0260] Calculate the minimum distance for high density For the highest density point, define its .

[0261] exist On the plane, choose the option that satisfies and The point is used as the cluster center, where The mean is given. Assume that M=3 centers are selected.

[0262] Allocation and fine-tuning: Assign each non-center point to its corresponding... The largest center point.

[0263] Examine all clusters; if the gravitational force between the centers of mass of two clusters... If so, then the two clusters will be merged.

[0264] Discard clusters with fewer than 10 members to obtain M state nebulae C={C1,C2,...,CM}.

[0265] S2.3 Extracting Event Nebula Features: For each event nebula : Calculate the situation vector (centroid): ; Calculate the boundary vector: ; in yes All points in the subspace k relative to The standard deviation.

[0266] Identifying gravitational singularities: Calculate the gravitational contribution of each point within the nebula: ; choose The top R=3 points with the largest values ​​are designated as the set of gravitational singularities. .

[0267] S2.4 Labelling and Packaging: Manual / semi-automatic annotation: label each The time frame is associated with the maintenance work order system. For example, C1 is associated with work order INC-2023-001, the root cause of which is network packet loss on the Redis master node, and the action taken is to restart the Redis service and switch traffic.

[0268] Encapsulation Samples: Each event nebula is encapsulated as a sample: ;in yes List of original IDs for alerts.

[0269] Dataset Construction: All samples constitute the core dataset for situational modeling. Stored in a vector database (such as Milvus), with the index key being... ) and relational databases.

[0270] Step 3: Real-time alarm source tracing and location (S3): Scene: In time A new alarm has appeared in the real-time alarm stream: anew:{timestamp:T_0,service:order-service,host:10.0.2.1,alert_name:"high_request_latency",description:"P95 latency>1s"}.

[0271] S3.1 Phase Space Projection and Gravitational Perturbation Calculation: Coordinate calculation: for Perform the same coordinate mapping process as in S2.1 to obtain the real-time event singularity. .

[0272] Calculate the static gravitational potential: from Read all historical event situation vectors and its average time .

[0273] calculate For each static gravitational potential : ; in =7200 s.

[0274] Obtain the gravitational potential vector Assume that the value of U2 is the largest.

[0275] S3.2 Dynamic Causal Flow Backtracking: Constructing a causal flow directed graph : node ; This is the set of other real-time alarm singularities within the past W=300s.

[0276] .

[0277] Directed edge For any two nodes u, v ∈ V, only if When, add edge e=(u→v).

[0278] edge weight .gravitational Calculate using the formula defined in S2.2.

[0279] Perform reverse shortest path search: by As the source point, in Run Dijkstra's algorithm to find the shortest path (with the minimum sum of path weights) from xnew to each historical event node μm.

[0280] M candidate paths were obtained. and its costs Assuming arrival Path cost lowest.

[0281] S3.3 Aggregate and verify the backtracking path: Determining ownership status: Calculate the attribution state by combining gravitational potential and path cost. Confidence level: ; Pick =0.6, = Calculated =0.89.

[0282] Sure This indicates the current state of the real-time alarm stream.

[0283] Verification of gravitational singularity alignment: from Extract its gravitational singularity set from Suppose that one of the historical singularities is the alert "redis response timeout".

[0284] Calculate the semantic coordinates of this historical singularity. All real-time alarm singularities within the current time window W Semantic subspace cosine similarity: ; Find the real-time alarm with the highest similarity, let's assume it is... (Alarm redis-01 High network latency), similarity 0.96.

[0285] Output source location information: ; Step 4: Alarm compression convergence based on entropy reduction (S4) S4.1 Calculate the state entropy: Inherent entropy From the state of belonging Obtain its boundary vector .calculate: ; Let λ = [0.1, 0.2, 0.5, 0.2]. Assume... =2.1.

[0286] Observational entropy : Retrieve the current set of real-time alerts related to the current situation. (Total Q=15). Calculate the coordinates to the situation vector. Average distance: ; Assumption =3.0.

[0287] Entropy increase ratio : ; S4.2 Adaptive Compression: Determine the compression number K: according to the rules The calculation yields K=3.

[0288] Perform weighted K-Means: Based on the root cause candidate alarms identified in step 3 The coordinates are used as the first initial cluster centers.

[0289] The remaining K−1 centers are initialized using the K-Means++ algorithm.

[0290] right The coordinates of all alarms are clustered, and the distance metric uses the same weighted distance used to calculate gravity.

[0291] Election core alert: Calculate the overall score in each cluster. Where L is the grade, recency is the time freshness factor, and centrality is the average attraction between this point and other points in the cluster. The alarm with the highest score is selected as the core alarm of the cluster.

[0292] S4.3 Generate compressed convergence information: ; Step 5: Motion Deduction and Execution Feedback (S5) S5.1 Historical Action Pattern Matching: From the state of belonging Extract historical valid actions from the tags and restart the Redis service.

[0293] In the dataset Search and For other event samples with a cosine similarity > 0.9, extract the actions from their labels to obtain a candidate action set. ; S5.2 Parametric Action Sequence Generation: Template instantiation: Based on the root cause alert "redis-01 high network latency", instantiate the template: ssh root@redis-01"systemctl restart redis" Curl -X POST: http: / / ha-proxy / api / switch-d'{"service":"redis","primary":"redis-01","backup":"redis-02"}'.

[0294] Generate sequences: Based on the entropy increase ratio R=1.43 (indicating moderate anomaly), two candidate sequences are generated: Seq1: [Check network connectivity (redis-01), restart redis-01]; Seq2: Switch Redis traffic to redis-02 and restart redis-01.

[0295] S5.3 Derivation in the event dynamics simulator: Emulator definition: State vector Defined as The normalized value.

[0296] Health baseline .

[0297] Current status The metrics value taken from the core alarm is: [0.8, 0.15, 15] (after normalization).

[0298] Action Influence Model : After the prediction is executed, the state becomes ; After the prediction is executed, the state becomes .

[0299] Deduction and scoring: Derivation Seq1: ; Derivation Seq2: (Note the order) = [0.3, 0.03, 0].

[0300] Calculate the stabilization score: ; ; .

[0301] Seq2 was selected as the recommended execution sequence.

[0302] S5.4 Implementation and Feedback: Safe execution: The system creates an automated work order on the operations and maintenance platform, recommending the sequence Seq2. After engineer approval, the system executes the sequence via Ansible.

[0303] Monitoring feedback: Five minutes after execution, monitoring showed that Redis latency dropped to normal levels and related alarms were cleared. Execution was recorded as successful.

[0304] Generate feedback set: ; The compressed alarm set from this event is calculated into a new event vector. It is associated with the action sequence Seq2 and the result success, and is added to the dataset as a new sample. And used for incremental update of action impact model and .

[0305] This application has the following advantages: This application creatively constructs a situational knowledge base capable of automatically learning and summarizing from historical alarm data through step 2 (generation of the core dataset for situational modeling). This knowledge base stores the deep correlations (spatiotemporal, topological, semantic, and causal) of the system's inherent fault modes in the form of an event nebula. Steps 3 (source localization) and 4 (compression convergence) are no longer based on preset rules, but rather on real-time, dynamic, and quantitative similarity matching ("gravity backtracking" and "entropy reduction model"). This means the system can: Adaptively discover and learn new, unforeseen fault association patterns, forming new event nebulae and incorporating them into the knowledge base.

[0306] Continuous evolution without manual intervention to update the rule set significantly reduces operation and maintenance costs and rule maintenance complexity, and greatly improves the system's adaptability to complex and dynamically changing IT environments.

[0307] To address the shortcomings of existing methods that rely solely on attribute matching or temporal proximity for shallow aggregation and fail to understand deep correlations, this application introduces a physically heuristic model of multidimensional phase space and event gravitational field.

[0308] Deep Feature Fusion: Step 2 constructs a four-dimensional phase space based on time period, resource topology, semantic essence, and influence propagation, which elevates alarm events from raw text / attributes to computable high-dimensional mathematical objects, providing a foundation for deep correlation analysis.

[0309] Dynamic causal attribution: Step 3's dynamic causal flow simulation and shortest backtracking path discovery can simulate the propagation chain between alarms, not only finding the most likely fault mode (situation), but also inferring the causal explanation chain from the current phenomenon to the potential root cause, and accurately identifying the gravitational singularity as a root cause candidate.

[0310] The output source location information includes the attribution status, confidence level, root cause candidates, and causal path, providing operation and maintenance personnel with clear and understandable diagnostic basis, which greatly improves the credibility of alarm handling and decision-making efficiency.

[0311] Unlike traditional methods that only aim to reduce the number of alarms, step 4 of this application proposes the theory of situational entropy.

[0312] The degree of disorder or anomalousness of the current alarm stream relative to its historical event pattern is quantified by calculating the entropy increase ratio.

[0313] The granularity of compression (coarse or fine) is dynamically determined based on the entropy increase ratio, ensuring that noise is eliminated while maximizing the retention of key information.

[0314] The compression process is root cause candidate-oriented, and weighted clustering is used to ensure that the final core alarm set best represents the nature and impact of the current fault.

[0315] The final compressed convergence information not only includes a small number of core alarms, but also includes the situation to which they belong, the basis for compression, and a summary of causal contributions, realizing the transformation from information discarding to information purification.

[0316] To address the pain points of low automation and slow response in existing methods, step 5 of this application constructs a complete closed loop of perception-decision-execution-learning.

[0317] Intelligent simulation: Using a situation dynamics simulator, candidate repair action sequences are simulated and simulated before actual operations are carried out, predicting the changes in system state after execution, and scientifically selecting the optimal recommended execution sequence based on the stabilization score.

[0318] By transforming rationally evaluated optimal requests into specific automated instructions for execution, and combining them with necessary security approval mechanisms, an automated closed loop from diagnosis to repair is achieved, significantly shortening the mean time to repair (MTTR).

[0319] The execution results are structured into a core feedback set for action deduction and execution, and fed back to the core dataset for situation modeling. This is used to incrementally optimize the situation gravity collapse model and the causal gravity backtracking model, enabling the system to continuously learn from experience and optimize itself.

[0320] The core focus of this method is on events (such as database master-slave failover storms or microservice cascading failures), rather than isolated alerts. Through steps 2 and 3, the system can emerge from a bottom-up perspective, revealing systemic and global failure modes from a massive number of discrete atomic alert events. This provides operations personnel with a higher-level, global view of operational situation awareness, facilitating overall risk assessment, capacity planning, and preventative maintenance.

[0321] Although the present invention has been described in detail above with general description and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention are within the scope of protection claimed by the present invention.

Claims

1. An intelligent operation and maintenance monitoring automation method based on AI alarm convergence, characterized in that, The AI-based intelligent operation and maintenance monitoring automation method includes: Step 1: Obtain historical existing alarm data and real-time alarm stream data; Step 2: Generate the core dataset for situational modeling based on historical alarm data; Step 3: Perform situation inversion and source tracing by combining real-time alarm stream data with the core dataset for situation modeling, thereby obtaining source tracing and location information; Step 4: Generate compressed convergence information based on the source tracing and location information and the core dataset for situation modeling; Step 5: Generate the core feedback set for action deduction and execution based on the compressed convergence information.

2. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in claim 1, characterized in that, Step 2: Generating the core dataset for situational modeling based on historical alarm data includes: A multi-dimensional phase space for alarm events is constructed based on historical alarm data to obtain the quantized intrinsic coordinate set of alarm events; Based on the quantized intrinsic coordinate set of the alarm events, the event cloud collapse under the influence of event gravity is performed to obtain the event nebula set; Features and singularities are extracted from the event nebula set to obtain the situation vector and root cause candidate set; The situation vectors and root cause candidate sets are labeled and encapsulated to obtain the core dataset for situation modeling.

3. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in claim 2, characterized in that, Step 3: Perform situational regression and source tracing by combining real-time alarm stream data with the core dataset for situational modeling, thereby obtaining source tracing and location information, including: Phase space projection and gravitational perturbation calculations are performed based on the core dataset of situation modeling to obtain the initial force state of real-time alarm stream data in the known gravitational field. Dynamic causal flow simulation and shortest backtracking path calculation are performed on the initial force state of real-time alarm stream data in a known gravitational field to generate one or more causal explanation chains from the real-time alarm event to the potential root cause. By aggregating backtracking paths and verifying gravitational singularities for each causal explanation chain, high-confidence source location information is generated.

4. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in claim 3, characterized in that, Step 4, generating compressed convergence information based on the source tracing and location information and the core dataset for situation modeling, includes: Entropy information data is obtained by calculating the situation entropy and assessing the state based on the source location information and the core dataset of situation modeling. A core alarm set is generated based on entropy information data, situation vectors, and root cause candidate sets. Compressed convergence information is generated based on the core alarm set.

5. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in claim 4, characterized in that, Step 5: Generating the core feedback set for action deduction and execution based on the compressed convergence information includes: By performing historical valid action pattern matching on the compressed convergence information, a set of historically verified valid actions that match the current high-entropy state can be obtained. Parameterized action sequences are generated from a set of historically validated actions to form candidate action sequences that can be adapted to the current specific scenario. The candidate action sequences are deduced and their effects are predicted to obtain the recommended execution sequence; Obtain execution feedback data after execution according to the recommended execution sequence.

6. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in any one of claims 1 to 5, characterized in that, The historical alarm data includes: Identification and metadata: alarm unique identifier, alarm serial number or sequence number, data source or collector identifier; Content and description information: alarm content, alarm details, alarm type, alarm subtype; Status and lifecycle information: alarm severity, alarm status, alarm generation time, alarm update time, alarm clearing time, assignment time and personnel; Context and topology information: alarm source or monitored object identifier, resource topology path and location, related business application service information, and associated change order or work order ID; Metrics and metrics information: Name of the monitoring metric that triggered the alarm, value of the metric that triggered the alarm, and original monitoring data sampling point / time series segment; Root cause and remedial information: Root cause analysis records, remedial measures, and related fault reports or knowledge base entry IDs.

7. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in any one of claims 1 to 5, characterized in that, The real-time alarm stream data includes: Key identifiers for an event: unique event identifier, original event serial number, event content and status, detailed event message, event type, event severity, event status, and event timestamp. Event source and context: Event source or generating object identifier, monitoring tool or agent identifier, original protocol and format; Raw metric information: The name and value of the metric that triggered the event, and the alarm condition expression or rule name.

8. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in claim 2, characterized in that, The step of constructing a multi-dimensional phase space for alarm events based on historical alarm data to obtain the quantized intrinsic coordinate set of alarm events includes: Each historical alarm event in the historical alarm database is processed as follows: Calculate the time period coordinates of alarm events to obtain the time phase vector that represents the periodic pattern of the events; Calculate the resource topology coordinates of the alarm event to obtain the topology vector representing the location of the event in the infrastructure dependency relationship; Calculate the semantic essence coordinates of the alarm event to obtain the semantic vector that represents the inherent nature of the fault described by the event; Calculate the impact propagation coordinates of the alarm event to obtain the potential energy vector characterizing the potential impact range and propagation direction of the event; Construct a multidimensional phase space, which includes four eigenspaces. One eigenspace is used to accommodate one of the time phase vector, topological vector, semantic vector, and potential energy vector. The time phase vector, topological vector, semantic vector, and potential energy vector are mapped to a multi-dimensional phase space to obtain the quantized intrinsic coordinate information of the historical alarm event. A historical alarm event is considered as an event singularity in the multi-dimensional phase space. The quantized intrinsic coordinate information of each event constitutes the quantized intrinsic coordinate set of the alarm event.

9. The intelligent operation and maintenance monitoring automation method based on AI alarm convergence as described in claim 8, characterized in that, The process of collapsing the event cloud under the influence of event gravity based on the quantized intrinsic coordinate set of the alarm event to obtain the event nebula set includes: Calculate the mutual attraction between any two alarm event singularities in the multidimensional phase space, and the mutual attraction between the alarm event singularities forms a gravity matrix; Density peak search is performed based on the gravity matrix and local density to identify high gravitational density points that are potential event nebulae cores. Each high gravitational density point is called a peak event singularity. Other non-peak event singularities are clustered and each non-peak event singularity is assigned to the range of each peak event singularity, thereby forming at least one cluster set, which is called a candidate event nebula; each candidate event nebula constitutes an event nebula set.

10. An intelligent operation and maintenance monitoring automation device based on AI alarm convergence, characterized in that, The AI-based intelligent operation and maintenance monitoring automation device includes: The raw data acquisition module is used to acquire historical stored alarm data and real-time alarm stream data. The situation modeling core dataset acquisition module is used to generate a situation modeling core dataset based on historical stored alarm data. The source tracing and location information acquisition module is used to perform situation inverse tracing and location by combining real-time alarm stream data with the core dataset of situation modeling, thereby acquiring source tracing and location information; A compressed convergence information acquisition module is used to generate compressed convergence information based on source tracing and location information and the core dataset for situation modeling. The motion deduction and execution core feedback set acquisition module is used to generate the motion deduction and execution core feedback set based on the compressed convergence information.

Images