An intelligent operation and maintenance visual monitoring method and system based on big data

Abstract

This invention discloses a big data-based intelligent operation and maintenance visualization monitoring method and system, belonging to the field of big data intelligent operation and maintenance technology. The method includes acquiring multi-source operational indicators of the target business system, constructing a time-series benchmark fault propagation probability matrix, and generating an anomaly situation projection map containing real-time component health scores through forward reasoning. Responding to user-specified anomaly event points, it performs reverse state inversion, tracing back along the historical timeline to locate the most recent state change point that triggered the anomaly, calculating component deviation indicators, and dynamically coloring them to form a risk distribution heatmap. The heatmap is spatially aggregated to identify high-risk fault domains, and the internal causal relationship chain is analyzed to determine root cause nodes and edge nodes, integrating them to form a visualized monitoring view that combines time axis and spatial location. This invention can accurately locate the root cause of anomalies, clarify the fault propagation path, and improve the accuracy of source tracing and analysis in operation and maintenance monitoring.

Description

Technical Field

[0001] This invention belongs to the field of big data intelligent operation and maintenance technology, specifically a big data-based intelligent operation and maintenance visualization monitoring method and system. Background Technology

[0002] Existing intelligent operation and maintenance visualization monitoring technologies primarily rely on multi-source operational indicators of the target business system for monitoring. They construct relevant data models based on time series data, perform forward inference calculations of abnormal situations using physical topology diagrams, and generate visual charts reflecting component health. This type of technology compares the status of system components with standard configurations of normal baseline states, calculates component deviation indicators, marks nodes in the physical topology diagram based on deviation, forms basic risk identification results, and ultimately outputs a standard visual monitoring view.

[0003] Existing monitoring technologies only possess forward reasoning capabilities and lack the ability to reverse process user-specified abnormal event points. They cannot initiate reverse state inversion processes, perform backtracking along historical timelines, or pinpoint the most recent state change point that triggered the abnormal state. Current risk analysis relies solely on a single deviation index for node labeling, failing to spatially aggregate risk distribution heatmaps. This prevents the identification of high-risk fault domains, causal analysis of component relationships within fault domains, and the identification of root cause nodes and affected edge nodes.

[0004] This invention addresses the functional deficiencies in existing technologies by enabling reverse state inversion and location of the most recent state change point after a user-specified abnormal event point. It also completes spatial aggregation of risk distribution heatmaps, fault domain identification, and internal causal relationship chain analysis to determine root cause nodes and affected edge nodes. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art; Therefore, this invention proposes an intelligent operation and maintenance visualization monitoring method based on big data, comprising: Obtain multi-source operational metrics of the target business system and construct a fault propagation probability matrix based on time series data; Using the fault propagation probability matrix, a forward inference calculation is performed on the physical topology map at the current moment to generate an abnormal situation projection map containing the real-time health scores of each component. Upon receiving the abnormal event point specified by the user, the reverse state inversion process of the abnormal situation projection diagram is initiated, tracing back from the abnormal outbreak point to the historical timeline to locate the most recent state change point that caused the abnormal state. The status of all system components involved in the backtracking process is compared with the standard configuration under the normal baseline state, and the deviation index of each component is calculated. Based on the calculated deviation index, the physical topology map is dynamically colored, and component nodes with deviations exceeding the tolerance are marked as high-risk areas, forming a risk distribution heat map. Spatial aggregation of the risk distribution heatmap is performed to identify several high-risk fault domains, and the causal relationship chain within the fault domains is analyzed to determine the root cause node and the affected edge node. The root cause nodes, affected edge nodes, and risk distribution heatmap obtained after state inversion and risk analysis are integrated into a visual monitoring view containing time axis and spatial location information.

[0006] Furthermore, the acquisition of multi-source operational metrics of the target business system and the construction of a fault propagation probability matrix based on time series data include: The multi-source operational metrics include resource consumption data from the infrastructure layer, request and response data from the platform service layer, and business transaction data from the application function layer. The multi-source operating indicators are divided into unified time windows, and the data after division is denoised and smoothed using the moving average method to form a standardized time-series data stream. Based on the standardized time-series data stream, a physical topology graph describing the calling dependencies between system components is constructed. Each node in the physical topology graph represents a specific system component, and each edge represents a communication link between components. All key business call paths are extracted from the physical topology map, and the business call paths are converted into a fault propagation probability matrix based on time series. The process of uniformly dividing the multi-source operational indicators into time windows and then using a moving average method to denoise and smooth the divided data to form a standardized time-series data stream includes: Based on the business cycle characteristics of the target business system, a fixed-length time window is set, the length of which fully covers a typical business transaction process; The raw operating metrics from different acquisition sources are resampled according to the boundaries of the time window to ensure that different metrics have consistent alignment granularity on the time axis. For each resampled index sequence, a moving average is calculated, the calculation range of which covers all data points within the time window; The calculated moving average is used as the representative value of the corresponding resampled index sequence within the current time window, replacing the spikes and glitches in the original data to form the standardized time-series data stream.

[0007] Furthermore, all critical service call paths are extracted from the physical topology map, and these service call paths are converted into a fault propagation probability matrix based on time series, including: Traverse the physical topology map to find all end-to-end paths starting from the external access point and ending at the core business processing node, and define them as the key business call paths; For each critical business call path, analyze the number of component nodes and communication links it passes through, and assign an initial propagation probability to each communication link on the path based on historical fault statistics. Using the time window as a unit, the propagation probabilities of each segment on each critical business call path are combined to generate a probability distribution describing the overall vulnerability of the system within the time window; The probability distributions of all time windows are stacked to form the fault propagation probability matrix based on the time series. The rows of the matrix represent time, and the columns represent different business call paths.

[0008] Furthermore, using the aforementioned fault propagation probability matrix, a forward inference calculation is performed on the physical topology map at the current moment to generate an abnormal situation projection map containing the real-time health scores of each component, including: Read the row vector corresponding to the current time window in the fault propagation probability matrix. The row vector contains the fault risk value of all business call paths at the current moment. The risk values ​​in the row vectors are written back to the corresponding edge attributes according to the mapping relationship of each communication link in the physical topology graph, thereby updating the structured data of the physical topology graph; Taking each system component node in the physical topology graph as the center, the risk values ​​on all its incoming and outgoing edges are collected and weighted to obtain the comprehensive risk pressure value of the corresponding system component node. The calculated comprehensive risk pressure value is mapped to a value between zero and one by looking up a table. This value is the real-time health score of each component. The calculated real-time health scores of each component are used to replace the original state values ​​of the corresponding nodes in the physical topology diagram to complete the generation of the abnormal situation projection diagram.

[0009] Furthermore, upon receiving the user-specified abnormal event point, the step of initiating a reverse state inversion process on the abnormal situation projection diagram, tracing back from the abnormal outbreak point to the historical timeline, to locate the most recent state change point that led to the abnormal state, includes: In the abnormal situation simulation diagram, the corresponding system component nodes and their specific timestamps of failure are locked according to the coordinates of the abnormal outbreak point selected by the user. Along the reverse link direction of the physical topology map, retrieve data slices from several consecutive time windows preceding the timestamp corresponding to the anomaly outbreak point in the fault propagation probability matrix; By comparing the changes in the health scores of the same system component nodes in the data slices of two adjacent time windows, the time points with the largest changes in scores are selected. The snapshot of the state corresponding to the time point with the largest change in the score is determined as the most recent state change point, and the specific configuration parameters and operating status of the state change point are recorded.

[0010] Furthermore, the state of all system components involved in the backtracking process is compared with the standard configuration under the normal baseline state, and the deviation index of each component is calculated, including: Retrieve the standard configuration templates of all system components involved in the most recent state change point from the configuration management database. The standard configuration templates define the threshold values ​​of various parameters when the components are running normally. When the most recent state change point is extracted, the actual operating parameter values ​​of the corresponding system components in the physical topology diagram are obtained. The actual operating parameter values ​​are compared item by item with the parameter thresholds in the corresponding standard configuration template, and the absolute value of the difference for each parameter is calculated. Normalize the absolute values ​​of the differences between all parameters, then sum them up. The resulting sum is the deviation index for each component.

[0011] Furthermore, based on the calculated deviation index, the physical topology map is dynamically colored, and component nodes with deviations exceeding the tolerance limit are marked as high-risk areas, forming a risk distribution heatmap, including: A deviation tolerance threshold is preset, which represents the range of parameter drift allowed by the system; Traverse each system component node in the physical topology diagram and read its deviation index calculated in claim 6; Determine whether the deviation index of each system component node is greater than the deviation tolerance threshold. If so, assign a red color code to the system component node. If not, assign a yellow or green color code according to the magnitude of its deviation. The color information of all nodes in the physical topology graph is overlaid and rendered, and then displayed on a map or architecture diagram to form an intuitive heatmap of risk distribution.

[0012] Furthermore, the risk distribution heatmap is spatially aggregated to identify several high-risk fault domains, and the causal relationship chains within these fault domains are analyzed to determine root cause nodes and affected edge nodes, including: Density clustering algorithm is used to perform spatial clustering analysis on the component nodes marked as high-risk areas in the risk distribution heatmap, with the network hop count and dependency strength between nodes as distance metrics. A group of high-risk component nodes whose spatial distance is less than a preset threshold and whose dependency strength is higher than a connectivity threshold are merged and identified as a high-risk fault domain. For each identified fault domain, the health score change sequence of all component nodes within the fault domain within the backtracking time window is extracted from the physical topology map and the abnormal situation simulation map; Based on the health score change sequence, a causal relationship network is constructed based on the time sequence and score mutations. The starting node where the score mutation occurs is identified as a potential cause node, while the node where the score mutation occurs subsequently is identified as an affected node. In the causal relationship network, the component node whose health score mutates earliest and subsequently triggers the most node chain reactions is selected and determined as the root cause node of the fault domain. The component node that causes a change in its own score solely due to receiving a state change from an upstream node in the causal chain, without further triggering a chain reaction in other downstream nodes, is identified as the affected edge node.

[0013] Furthermore, the root cause nodes, affected edge nodes, and the risk distribution heatmap obtained after state inversion and risk analysis are integrated into a visual monitoring view containing time axis and spatial location information, including: Create a three-dimensional coordinate system, where the horizontal axis represents time, the vertical axis represents the hierarchy depth in the physical topology graph, and the vertical axis represents the severity of the fault. The data in the risk distribution heatmap is mapped onto the bottom plane of the three-dimensional coordinate system to form a spatial background color that changes over time. The root cause node and the affected edge node are projected onto the corresponding time point and hierarchical position in the three-dimensional coordinate system according to the causal relationship chain determined in claim 9. A timeline is drawn throughout the entire process in the three-dimensional coordinate system, and all nodes and heatmaps are bound to the timeline to generate the final visualization monitoring view.

[0014] Furthermore, the present invention also includes a big data-based intelligent operation and maintenance visualization monitoring system, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements the steps of the big data-based intelligent operation and maintenance visualization monitoring method described above.

[0015] Compared with the prior art, the beneficial effects of the present invention are: In response to user-specified anomaly events, the system performs a reverse state inversion on the anomaly scenario projection diagram, tracing back along the historical timeline to locate the most recent state change point that led to the anomaly. Specifying anomaly events triggers a directed state inversion process; the backtracking logic of the historical timeline gradually reconstructs the system state changes before the anomaly occurred; the location of state change points directly corresponds to the pre-anomaly triggering conditions; component state data collected during the inversion process is compared one-to-one with the normal baseline standard configuration; the deviation index calculation accurately reflects the component parameter changes caused by state change points; the execution path of the reverse inversion aligns with the component relationships in the physical topology diagram; and the location of state change points directly connects to subsequent risk analysis stages.

[0016] Spatial aggregation processing is performed on the risk distribution heatmap to identify high-risk fault domains and analyze the causal relationship chains within the fault domains to determine root cause nodes and affected edge nodes. Spatial aggregation processing can integrate discrete high-risk component nodes in the physical topology map to form a high-risk fault domain identification result with clear boundaries. The division of fault domains can match the spatial distribution characteristics of the system's physical topology. The analysis of causal relationship chains can sort out the influence transmission paths between components within the fault domain. The determination of root cause nodes can screen out the core components that cause the fault. The differentiation of edge nodes can clarify the terminal coverage of the fault transmission. The dynamic coloring results of the risk distribution heatmap can serve as the basic data carrier for spatial aggregation. The analysis results of fault domains and causal chains can be directly integrated into a visual monitoring view that includes time axis and spatial location information. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the steps of an intelligent operation and maintenance visualization monitoring method based on big data as described in this invention. Figure 2 Flowchart for extracting critical business call paths and generating fault propagation probability matrices; Figure 3 A flowchart for generating an abnormal situation projection diagram using a fault propagation probability matrix; Figure 4 Heatmap of the fault propagation probability matrix; Figure 5A heatmap showing the deviation risk of system components. Detailed Implementation

[0018] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] See Figure 1 The system acquires multi-source operational metrics of the target business system and constructs a fault propagation probability matrix based on time series data. Using this matrix, the system performs a forward inference calculation on the physical topology diagram describing the system architecture, generating an anomaly scenario projection map reflecting the real-time health scores of each component. Upon receiving a user-specified anomaly event point from the monitoring interface, the system immediately initiates a reverse state inversion process. This process, based on the anomaly scenario projection map, starts from the user-specified anomaly outbreak point and traces back along the historical timeline, analyzing historical state snapshots to locate the most recent state change point that led to the anomaly. Once the state change point is located, the system compares the state of all system components involved in the backtracking process at the change point with the standard configuration under the preset normal baseline state, calculating the deviation index for each component. Based on the calculated deviation index, the system dynamically colors the physical topology diagram, marking component nodes with deviations exceeding preset tolerances as high-risk areas, ultimately forming a risk distribution heatmap with distinct color gradients. The system further performs spatial aggregation analysis on this risk distribution heatmap, identifying several high-risk fault domains with closely related internal components. It then analyzes the causal chains within each fault domain to accurately determine the root cause node and affected edge nodes. The system integrates the root cause node, affected edge nodes, and risk distribution heatmap obtained after state inversion and risk analysis into a visualized monitoring view containing timeline and spatial location information, presenting it to operations and maintenance personnel.

[0020] In one embodiment of the present invention, multi-source operational metrics of the target business system are acquired. These multi-source operational metrics include resource consumption data from the infrastructure layer, request and response data from the platform service layer, and business transaction data from the application function layer. The collected multi-source operational metrics are uniformly divided into time windows. Based on the business cycle characteristics of the target business system, a fixed-length time window is set, the length of which must fully cover a typical business transaction process. The original operational metrics from different collection sources are resampled according to the boundaries of the set time window to ensure that metrics from different sources and collection frequencies have consistent alignment granularity on the time axis. For each resampled metric sequence, its moving average is calculated, the calculation range of which must cover all data points within the current time window. The calculated moving average is used as the representative value of the corresponding resampled metric sequence within the current time window to replace the spikes and glitches in the original data sequence, thereby forming a standardized time-series data stream. Based on this standardized time-series data stream, a physical topology graph describing the call dependencies between system components is constructed. Each node in the physical topology graph represents a specific system component, and each edge represents a communication link between components. Extract all critical business call paths from the constructed physical topology map and convert these business call paths into a fault propagation probability matrix based on time series.

[0021] In practical implementation, the target business system can be an online e-commerce platform. This system involves multiple layers of components, including virtual machines and containers deployed on cloud computing infrastructure, database clusters and message queues providing middleware services, and front-end applications and back-end microservices handling user requests. For this scenario, the acquired multi-source operational metrics explicitly include resource consumption data at the infrastructure layer, specifically CPU utilization, memory utilization, and disk I / O operations. Platform service layer request and response data specifically includes query rate per second, average response time, and error rate recorded by the application programming interface gateway. Application function layer business transaction data specifically includes transaction volume, payment success rate, and shopping cart abandonment rate in the order system. In practical implementation, a unified time window is used to divide the multi-source operational metrics, with the time window length set to one minute. This length covers the typical business transaction process from a user clicking on a product to completing payment. Raw operational metrics from various sources, including system monitoring agents, application performance management probes, and business log files, are resampled at one-minute boundaries. This unifies the granularity of all metrics into minute-by-minute numerical sequences, ensuring consistent alignment across the timeline for the CPU utilization sequence at the infrastructure layer, the query rate per second sequence at the platform service layer, and the transaction volume sequence at the application function layer. In practice, a moving average is calculated for each resampled metric sequence, covering all data points within the entire one-minute time window. For a specific CPU utilization sequence at time point t, the moving average is calculated using the following formula:

[0022] in: This represents the simple moving average calculated at time point t. This indicates the length of the time window; in this example, T is 60 seconds. Indicates at a point in time The original CPU utilization sampling values ​​are used. The calculated moving average will serve as the representative value of the corresponding indicator sequence within the current time window. This operation can replace CPU utilization spikes caused by sudden traffic surges or transaction volume spikes caused by log collection delays in the original data, ultimately forming a standardized time-series data stream. In some embodiments, the moving average method can use a weighted moving average, giving higher weight to recent data within the time window. Based on the standardized time-series data stream, a physical topology graph describing the call dependencies between system components is constructed. Each node in the physical topology graph represents a specific system component, such as "product database master", "payment service instance A", and "user authentication gateway". Each edge represents a communication link between components, such as "structured query language query connection from payment service instance A to product database master". In some embodiments, the physical topology graph can be automatically generated by analyzing network traffic and call chain tracking data between applications. All key business call paths are extracted from the physical topology graph. Key business call paths include the complete call chain of "user login - product browsing - adding to cart - order payment". The business call paths are then converted into a fault propagation probability matrix based on time series. In practice, the transformation process involves assigning an initial propagation probability to each communication link along the path based on historical failure rates, and combining the path risk status within each minute time window into rows of a matrix. Optionally, historical failure rates can be obtained statistically from a past event management database. It can be understood that standardized time-series data streams eliminate inconsistencies in time and values ​​between data from different sources, providing a unified and clean data foundation for subsequently constructing accurate physical topology and probability matrices.

[0023] In one embodiment of the present invention, all key service call paths are extracted from the physical topology diagram, see reference. Figure 2 The system iterates through the physical topology to identify all end-to-end paths starting from external access points and ending at core business processing nodes, defining these paths as critical business call paths. For each identified critical business call path, it analyzes the number of component nodes and communication links it traverses, and assigns an initial propagation probability to each communication link on the path based on historical fault statistics. Using time windows as units, it combines the propagation probabilities of each communication link on each critical business call path to generate a probability distribution describing the overall vulnerability of the system within that time window. Finally, it stacks the probability distributions of all consecutive time windows to form a fault propagation probability matrix based on time series, where rows represent different time windows and columns represent different business call paths.

[0024] In practical implementation, all critical business call paths are extracted from the physical topology diagram, which describes the call relationships between various microservices and the database in the e-commerce platform. This physical topology diagram is traversed to identify all end-to-end paths starting from external access points and ending at core business processing nodes. These external access points can be load balancers or application programming interface gateways, and the core business processing nodes can be order databases or payment transaction processors. In practical implementation, a critical business call path was identified as "Client -> Load Balancer -> User Authentication Gateway -> Product Details Service -> Shopping Cart Service -> Order Service -> Payment Service -> Payment Database," which completely connects the core links from user access to payment completion. In practical implementation, for each identified critical business call path, the number of component nodes and communication links it traverses is analyzed. For example, "Product Details Service -> Shopping Cart Service" constitutes one communication link, and "Shopping Cart Service -> Order Service" constitutes another. Based on historical fault statistics, each communication link on the path is assigned an initial propagation probability. Historical fault statistics can be the failure rate of "Product Details Service calling Shopping Cart Service" derived from maintenance events over the past three months. In practical implementation, the initial propagation probability of a communication link from service A to service B. The probability of failure can be directly taken from historical statistics, which show the ratio of the number of failed calls to the total number of calls. In some embodiments, historical fault statistics may include weighted statistics for specific error types, such as timeout errors having a higher weight than business logic errors. Using a time window as the unit, the propagation probabilities of each segment on each critical business call path are combined to generate a probability distribution describing the overall vulnerability of the system within the time window. This combination method can calculate the overall failure probability of the entire path within the current time window. For a path consisting of n communication links in sequence, its overall failure probability... The calculation formula is as follows:

[0025] in: This indicates the overall failure probability of this critical business call path within the current time window. This indicates the total number of communication links that make up the path. Indicates the first [item] on this path This formula calculates the propagation probability of a communication link within the current time window. It is understood that this formula is based on the assumption of link failure independence and calculates the probability of at least one link failing. In specific implementations, for the "user login - order payment" path, its overall failure probability is calculated using the above formula from the propagation probabilities of each link segment, including the authentication link, product query link, shopping cart update link, order creation link, and payment link. The probability distributions of all consecutive time windows are stacked to form a failure propagation probability matrix based on a time series. Each row of the matrix corresponds to a specific time window, such as the minute window from "2023-10-27 10:00:00" to "2023-10-27 10:00:59"; each column of the matrix corresponds to a specific business call path, such as the "payment path" or "product query path". The elements in the matrix... That is to say, in the first The first time window, the first Overall failure probability of each business call path Optionally, the division of the time window can be consistent with the data standardization process. In some embodiments, the fault propagation probability matrix can be a two-dimensional array stored in memory or a time-series database. Optionally, the propagation probability... It can be dynamically fine-tuned based on real-time monitoring of link latency or error rate. It can be understood that the fault propagation probability matrix systematically depicts the evolution of fault risk in the business link from two dimensions: time and call path.

[0026] In one embodiment of the present invention, a forward inference calculation is performed on the physical topology graph at the current moment using the fault propagation probability matrix, see reference. Figure 3The system reads the row vector corresponding to the current time window from the fault propagation probability matrix. This row vector contains the fault risk value of all business call paths at the current moment. The risk values ​​in the row vector are then written back to the corresponding edge attributes according to the mapping relationship between each communication link and business call path in the physical topology diagram, thereby updating the structured data of the physical topology diagram. Centered on each system component node in the physical topology diagram, the updated risk values ​​on all its incoming and outgoing edges are collected and weighted to obtain the comprehensive risk pressure value of the corresponding system component node. The calculated comprehensive risk pressure value is converted into a value between zero and one through a preset mapping table; this value is the real-time health score of each component. The calculated real-time health scores of each component replace the original state values ​​of the corresponding nodes in the physical topology diagram, completing the generation of the abnormal situation simulation diagram. Upon receiving the abnormal event point specified by the user on the monitoring interface, the system initiates the reverse state inversion process of the abnormal situation simulation diagram. In this abnormal situation simulation diagram, based on the coordinates of the abnormal outbreak point selected by the user, the corresponding system component node and its specific timestamp of failure are located. Following the reverse link direction of the physical topology map, retrieve data slices from several consecutive time windows preceding the timestamp corresponding to the anomaly outbreak point in the fault propagation probability matrix. Compare the changes in health scores of the same system component nodes in adjacent time window data slices, and filter out the time point with the largest score mutation. Determine the system state snapshot corresponding to the time point with the largest score mutation as the most recent state change point, and record the specific configuration parameters and operating status of the components involved in this state change point.

[0027] In the implementation, a forward inference calculation is performed on the physical topology map at the current moment using the fault propagation probability matrix. The row vectors corresponding to the current time window in the fault propagation probability matrix are read. These row vectors contain the fault risk values ​​of all business call paths at the current moment. In this implementation, the current time window is from "2023-10-27 14:05:00" to "2023-10-27 14:05:59". The row vectors contain elements such as a risk value of 0.02 for the "user login path", 0.15 for the "product query path", and 0.40 for the "payment path". The risk values ​​in the row vectors are then written back to the corresponding edge attributes according to the mapping relationship between each communication link and business call path in the physical topology map, thereby updating the structured data of the physical topology map. For example, the communication link from "payment service" to "payment database" is associated with the "payment path", therefore its edge attribute is updated to a risk value of 0.40. In practice, the updated risk values ​​on all incoming and outgoing edges of each system component node in the physical topology graph are collected, and then weighted and summed to obtain the comprehensive risk pressure value of the corresponding system component node. For a single system component node, its comprehensive risk pressure value is... The calculation formula is as follows:

[0028] in: Represents a node The overall risk pressure value, Represents all pointer nodes The set of incoming edges, This represents a specific incoming edge. This indicates the risk value associated with the incoming edge. This represents the weight coefficient of the incoming edge. Represents all slave nodes The set of outgoing edges is indicated. This represents a specific outgoing edge. This indicates the risk value associated with the outgoing edge. This represents the weight coefficient of the outgoing edge. In some embodiments, the weight coefficient of the incoming edge and the weight coefficient of the outgoing edge can be set to the same value. In some embodiments, different weights can be set according to whether the node is a service provider or a consumer. It can be understood that the comprehensive risk pressure value integrates the failure risks of all links flowing into and out of the node. The calculated comprehensive risk pressure value is mapped to a value between zero and one through a lookup table. This value is the real-time health score of each component. The preset mapping table can define a health score of 0.9 when the comprehensive risk pressure value is between 0 and 0.3, and a health score of 0.5 when it is between 0.3 and 0.7. The calculated real-time health scores of each component replace the original state values ​​of the corresponding nodes in the physical topology diagram, completing the generation of the abnormal situation projection diagram. Each node in the diagram will display a health score such as 0.95 or 0.45. Upon receiving the abnormal event point specified by the user on the monitoring interface, the reverse state inversion process of the abnormal situation projection diagram is initiated. The user clicked on the "Payment Database" node icon with a health score of 0.1 in the monitoring view and marked the time as "14:10:00". In the abnormal situation projection diagram, the corresponding system component node "Payment Database" and its specific timestamp of failure "2023-10-27 14:10:00" are located according to the coordinates of the abnormal outbreak point selected by the user. Data slices of several consecutive time windows before the timestamp "2023-10-27 14:10:00" are retrieved along the reverse link direction of the physical topology diagram. For example, row vector data of five consecutive minutes from "14:09:00", "14:08:00" to "14:05:00" are retrieved. The health score changes of the same system component nodes in data slices of adjacent time windows are compared one by one to identify the time point with the largest score mutation. For example, the health score of the "Payment Database" node suddenly drops from 0.85 to 0.20 within the time window from "14:08:00" to "14:09:00," a change larger than that in other adjacent windows. In practice, the mutation magnitude can be quantified by calculating the absolute value of the difference in health scores between adjacent time points. Optionally, the number of time windows to be traced can be preset according to the system complexity. It can be understood that locating the time point with the largest score mutation helps to find the starting moment of fault propagation. The system state snapshot corresponding to the time point with the largest score mutation is determined as the most recent state change point, and the specific configuration parameters and operating status of the state change point are recorded. For example, the snapshot of parameters such as the number of connections, CPU utilization, and cache hit rate of the "Payment Database" at "14:08:00" is recorded.

[0029] In one embodiment of the present invention, the states of all system components involved in the backtracking process are compared with the standard configuration under the normal baseline state. The standard configuration templates of all system components involved in the most recent state change point are retrieved from the configuration management database. These standard configuration templates define the threshold values ​​of various parameters for the corresponding components during normal operation. The actual operating parameter values ​​of the corresponding system components in the physical topology diagram at the most recent state change point are extracted. The extracted actual operating parameter values ​​are compared item by item with the parameter thresholds in the corresponding standard configuration templates, and the absolute value of the difference for each parameter is calculated. The absolute values ​​of the differences for all parameters are normalized and then summed; the sum is the deviation index for each component. Based on the calculated deviation index, the physical topology diagram is dynamically colored, and a deviation tolerance threshold is pre-set, representing the allowable parameter drift range of the system. Each system component node in the physical topology diagram is traversed, and its calculated deviation index is read. The system determines whether the deviation index of each system component node exceeds a preset deviation tolerance threshold. If so, it assigns a red color-coded level to the system component node; otherwise, it assigns a yellow or green color-coded level based on the magnitude of its deviation index. The color information of all nodes in the physical topology map is overlaid and rendered, then displayed on a map or system architecture diagram to form an intuitive risk distribution heatmap.

[0030] In practice, the status of all system components involved in the backtracking process is compared with the standard configuration under normal baseline conditions. After locating the most recent status change point "2023-10-27 14:08:00", the standard configuration templates of all system components involved in the status change point are retrieved from the configuration management database. For example, for the component "Payment Database", the standard configuration template defines the threshold values ​​of various parameters when the component is running normally, including "maximum connection count threshold of 500", "CPU utilization threshold of 70%", and "cache hit rate threshold of 90%". In practice, the actual operating parameter values ​​of the corresponding system component in the physical topology diagram at the most recent status change point "14:08:00" are extracted. By querying the system monitoring snapshot at that time, the actual operating parameters of "Payment Database" are obtained as "current connection count of 620", "CPU utilization of 85%", and "cache hit rate of 82%". In practice, the actual operating parameter values ​​are compared item by item with the parameter thresholds in the corresponding standard configuration template. The absolute value of the difference for each parameter is calculated: the difference for "current connections" is |620-500|=120, the difference for "CPU utilization" is |85%-70%|=15%, and the difference for "cache hit rate" is |82%-90%|=8%. The absolute values ​​of all parameter differences are normalized and then summed; the sum is the deviation index for each component. For a system component node... Its deviation index The calculation formula is as follows:

[0031] in: Represents component nodes Deviation index This indicates the total number of parameters compared. Indicates the first The actual operating values ​​of each parameter at the state change point. Indicates the first The threshold values ​​for these parameters are defined in the standard configuration template. It is for the first A reference factor for normalizing the differences of each parameter. In some embodiments, the normalized reference factor... The parameter can be taken from the threshold defined in the standard configuration template, or from a preset nominal range value. It can be understood that normalization allows parameter differences of different dimensions and magnitudes to be added together. For the process of calculating the deviation index of the "Payment Database" node in the example, please refer to Table 1.

[0032] Table 1: Calculation Table of Deviation Index for Component "Payment Database"

[0033] Based on the data in Table 1, the deviation index of the "Payment Database" component. In specific implementation, the physical topology map is dynamically colored based on the calculated deviation index. A deviation tolerance threshold is preset, representing the allowable parameter drift range of the system. In some embodiments, the deviation tolerance threshold can be set to 0.5. Each system component node in the physical topology map is traversed, and its deviation index calculated in the above process is read. It is determined whether the deviation index of each system component node is greater than the deviation tolerance threshold. If so, a red color-coded level is assigned to the system component node; otherwise, a yellow or green color-coded level is assigned based on the magnitude of its deviation. In specific implementation, assuming the deviation index of the "Payment Database" node is 0.543, which is greater than the tolerance threshold of 0.5, it is assigned a dark red code representing high risk; the deviation index of the "Goods and Services" node is 0.3, so it is assigned a yellow code representing medium risk; and the deviation index of the "User Authentication Gateway" node is 0.1, so it is assigned a green code representing low risk. Optionally, color coding can be determined by linear interpolation on a continuous color spectrum from green through yellow to red. Understandably, dynamic coloring transforms numerical deviations into intuitive visual signals. The color information of all nodes in the physical topology diagram is overlaid and rendered, then displayed on a map or architecture diagram to form an intuitive risk distribution heatmap. In the final visualization, nodes of different colors clearly show the distribution of risks within the system.

[0034] See Figure 4This matrix presents the risk evolution characteristics of the system before and after the state change point. Using time windows as rows and business call paths as columns, it quantifies the fault propagation risk level of each path at different times. From a time perspective, before 14:08 (the state change point), the fault propagation probability of each path remained in the low-risk range of 0.10~0.29, and the system as a whole was in a stable operating state. At 14:08, the propagation probability of all paths experienced a step jump, with the probabilities of paths 4 and 5 reaching 0.78 and 0.79 respectively, and paths 1~3 also climbing to 0.52~0.68, forming a significant high-risk cluster, indicating that a critical state change occurred in the system at that moment. At 14:10, the probabilities of each path quickly dropped back to 0.11~0.26, and the risk level basically returned to the baseline, verifying that 14:08 was the core state change point that triggered the anomaly. From a path perspective, at 14:08, the propagation probability of paths 4 and 5 was significantly higher than other paths, indicating that these two business call paths experienced higher fault propagation pressure during state changes and were the core channels for risk transmission. While paths 1-3 also increased synchronously, the magnitude was relatively gradual, reflecting the differences in fault propagation across different dependent links. This heatmap provides accurate time anchors and path-level risk basis for subsequent reverse state inversion, deviation calculation, and risk domain identification, serving as a key data carrier for locating root causes and assessing the scope of impact in intelligent operation and maintenance.

[0035] In one embodiment of the present invention, a spatial aggregation of the risk distribution heatmap is performed. A density clustering algorithm is used to perform spatial clustering analysis on the component nodes marked as high-risk areas in the risk distribution heatmap, using network hop count and dependency strength between nodes as distance metrics. A group of high-risk component nodes whose spatial distance is less than a preset threshold and whose dependency strength is higher than a connectivity threshold are merged and identified as a high-risk fault domain. For each identified fault domain, the health score change sequence of all component nodes within the fault domain within the backtracking time window is extracted from the physical topology map and the abnormal situation projection map. Based on the extracted health score change sequence, a causal relationship network is constructed based on chronological order and score mutations. In this network, the starting node where a health score mutation occurs is identified as a potential cause node, while nodes that subsequently experience score mutations are identified as affected nodes. In the constructed causal relationship network, the component node whose health score mutates earliest and subsequently triggers the most node chain reactions is selected and determined as the root cause node of the fault domain. Component nodes whose scores mutate solely due to state changes received from upstream nodes in the causal chain, without triggering further chain reactions in other downstream nodes, are identified as affected edge nodes. The root cause nodes, affected edge nodes, and risk distribution heatmaps obtained after state inversion and risk analysis are integrated into a visual monitoring view containing time and spatial location information. A three-dimensional coordinate system is created, where the horizontal axis represents time, the vertical axis represents the hierarchy depth in the physical topology diagram, and the vertical axis represents the severity of the fault. The data contained in the risk distribution heatmap is mapped onto the bottom plane of the three-dimensional coordinate system, forming a spatial background that changes over time. The root cause nodes and affected edge nodes are projected onto their corresponding time points and hierarchical positions in the three-dimensional coordinate system according to their determined causal chains. A continuous timeline is drawn in the three-dimensional coordinate system, and all node projections, heatmap layers, and timelines are bound to the timeline to generate the final visual monitoring view.

[0036] In practical implementation, spatial aggregation of the risk distribution heatmap is performed using density clustering algorithms. Component nodes marked as high-risk areas in the heatmap are analyzed spatially, with network hop count and dependency strength used as distance metrics. Network hop count refers to the minimum number of intermediate nodes required to travel from one node to another, and dependency strength can be quantified by the query rate per second of the call link between two nodes or the historical failure propagation probability. Specifically, for a risk distribution heatmap containing high-red nodes such as "Payment Database," "Payment Service," "Order Service," and "Message Queue," the distance between any two high-risk nodes is calculated. The calculation formula can take into account network topology and logical dependencies, and is defined as follows:

[0037] in: Represents a node With nodes The combined distance between them Represents a node With nodes The number of network hops between them, which is obtained by querying the shortest path in the physical topology graph. Represents a node With nodes The strength of the dependency between them, whose value is normalized to between 0 and 1. This is a coefficient that adjusts the weighting of network hop count and dependency strength, with a value between 0 and 1. Essentially, this formula integrates structural distance and logical dependency into a measurable distance value. A group of high-risk component nodes whose spatial distance is less than a preset threshold and whose dependency strength is higher than a connectivity threshold are merged and identified as a high-risk fault domain. The preset distance threshold can be set to 2.5, and the connectivity strength threshold can be set to 0.7. For example, the calculated distance between "Payment Database" and "Payment Service" is 1.2, and the distances of both to "Order Service" are less than 2.5; therefore, these three nodes are identified as the same high-risk fault domain. For each identified fault domain, the health score change sequence of all component nodes within the fault domain is extracted from the physical topology map and the abnormal situation projection map within the backtracking time window. The extracted time window can be multiple time points from the most recent state change point "14:08:00" back to "14:05:00", forming a health score sequence of each node changing over time. Based on the extracted health score change sequence, a causal relationship network is constructed according to the time sequence and score mutations. In the causal relationship network, the starting node where a health score mutation occurs is identified as a potential cause node, while nodes where score mutations subsequently occur are identified as affected nodes. In some embodiments, when constructing the causal relationship, if the score mutation time of node A is earlier than that of node B, and there is a direct call link between node A and node B, then a causal relationship edge from A to B is established. In the constructed causal relationship network, the component node where the health score mutation occurs earliest and subsequently triggers the most node chain reactions is selected and identified as the root cause node of the fault domain. For example, in the fault domain consisting of "Payment Database," "Payment Service," and "Order Service," if the health score of "Payment Database" suddenly drops from 0.85 to 0.20 at "14:08:00," followed by "Payment Service" dropping from 0.90 to 0.25 at "14:08:30," and "Order Service" dropping from 0.88 to 0.40 at "14:09:00," then "Payment Database" is identified as the root cause node. Component nodes in the causal chain that experience a sudden change in their own score solely due to receiving a state change from an upstream node, without further triggering a chain reaction in other downstream nodes, are identified as affected edge nodes. Optionally, certain cache nodes or log service nodes that are only invoked may be identified as edge nodes. It is understood that identifying root causes and edge nodes helps focus on the core of fault diagnosis. In some embodiments, the number of chain reactions can be quantified by calculating the number of nodes reachable from that node in the causal network.

[0038] In practical implementation, the root cause nodes, affected edge nodes, and risk distribution heatmaps obtained after state inversion and risk analysis are integrated into a visual monitoring view containing time axis and spatial location information, creating a three-dimensional coordinate system. The horizontal axis of the three-dimensional coordinate system represents time, the vertical axis represents the hierarchical depth in the physical topology diagram, and the vertical axis represents the severity of the fault. The hierarchical depth can be defined according to the position of the component in the system architecture, for example, infrastructure layer is 1, platform service layer is 2, and application layer is 3. The data contained in the risk distribution heatmap is mapped onto the bottom plane of the three-dimensional coordinate system to form a spatial background color that changes over time. For example, at the position where the horizontal axis of time is "14:08:00" and the vertical axis of hierarchical depth is "database layer", the corresponding background color is rendered according to the color of the "payment database" node. The root cause node and affected edge nodes are projected onto their corresponding time points and hierarchical positions in a 3D coordinate system according to their established causal chains. The root cause node, "Payment Database," is projected at time "14:08:00," hierarchical depth "1," and a height determined by its deviation index for fault severity. The affected edge node, "Message Queue," is projected at a slightly later time and its corresponding hierarchical position. A timeline is drawn throughout the 3D coordinate system, and all node projections and heatmaps are bound to the timeline to generate the final visual monitoring view. Optionally, different shapes or colors of markers can be used in the view to distinguish between root cause nodes and edge nodes, and connecting lines can be used to represent the causal relationships between them. This 3D view comprehensively presents the evolution and impact of the fault across three dimensions: time, system hierarchy, and severity.

[0039] See Figure 5The heatmap, with time as the horizontal axis (from 14:05:00 to 14:09:30, with a 30-second time window granularity) and system components as the vertical axis, uses color gradients to map deviation values ​​(0–1 range, dark red representing high deviation risk), fully reproducing the process of anomaly propagation from the root cause node to dependent components: Root cause node characteristics: The payment database's deviation suddenly rises to 1.00 at 14:08:00, making it the earliest core component to show high deviation, meeting the root cause node's characteristic of "earliest mutation, triggering a chain reaction." Fault propagation sequence: The payment service's deviation rises to 0.94 at 14:08:30, the order service to 0.75 at 14:09:00, and the message queue to 0.50 at 14:09:00. The risk gradually spreads along the dependency chain of "payment database → payment service → order service → message queue," perfectly matching the physical topology's call relationships. Stable component baseline: The deviation of components such as the cache server, user interface, and log service remains consistently within the range of 0.12–0.18, indicating they have not participated in fault propagation. This represents the baseline state of normal system operation and can serve as a reference benchmark for subsequent health comparisons. The heatmap is essentially a visual output of inverse state inversion and deviation calculation: by comparing the actual operating parameters of each component within the backtracking window with the standard configuration template, a normalized deviation index is obtained. High-risk areas (deviation exceeding the tolerance threshold) are then dynamically colored in dark red, ultimately forming a risk distribution view that can be directly used for fault domain identification and root cause localization.

[0040] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A big data-based intelligent operation and maintenance visualization monitoring method, characterized in that, include: Obtain multi-source operational metrics of the target business system and construct a fault propagation probability matrix based on time series data; Using the fault propagation probability matrix, a forward inference calculation is performed on the physical topology map at the current moment to generate an abnormal situation projection map containing the real-time health scores of each component. Upon receiving the abnormal event point specified by the user, the reverse state inversion process of the abnormal situation projection diagram is initiated, tracing back from the abnormal outbreak point to the historical timeline to locate the most recent state change point that caused the abnormal state. The status of all system components involved in the backtracking process is compared with the standard configuration under the normal baseline state, and the deviation index of each component is calculated. Based on the calculated deviation index, the physical topology map is dynamically colored, and component nodes with deviations exceeding the tolerance are marked as high-risk areas, forming a risk distribution heat map. Spatial aggregation of the risk distribution heatmap is performed to identify several high-risk fault domains, and the causal relationship chain within the fault domains is analyzed to determine the root cause node and the affected edge node. The root cause nodes, affected edge nodes, and risk distribution heatmap obtained after state inversion and risk analysis are integrated into a visual monitoring view containing time axis and spatial location information.

2. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 1, characterized in that, The process of acquiring multi-source operational metrics of the target business system and constructing a fault propagation probability matrix based on time series data includes: The multi-source operational metrics include resource consumption data from the infrastructure layer, request and response data from the platform service layer, and business transaction data from the application function layer. The multi-source operating indicators are divided into unified time windows, and the data after division is denoised and smoothed using the moving average method to form a standardized time-series data stream. Based on the standardized time-series data stream, a physical topology graph describing the calling dependencies between system components is constructed. Each node in the physical topology graph represents a specific system component, and each edge represents a communication link between components. All key business call paths are extracted from the physical topology map, and the business call paths are converted into a fault propagation probability matrix based on time series. The process of uniformly dividing the multi-source operational indicators into time windows and then using a moving average method to denoise and smooth the divided data to form a standardized time-series data stream includes: Based on the business cycle characteristics of the target business system, a fixed-length time window is set, the length of which fully covers a typical business transaction process; The raw operating metrics from different acquisition sources are resampled according to the boundaries of the time window to ensure that different metrics have consistent alignment granularity on the time axis. For each resampled index sequence, a moving average is calculated, the calculation range of which covers all data points within the time window; The calculated moving average is used as the representative value of the corresponding resampled index sequence within the current time window, replacing the spikes and glitches in the original data to form the standardized time-series data stream.

3. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 2, characterized in that, All critical service call paths are extracted from the physical topology map, and these service call paths are converted into a time-series-based fault propagation probability matrix, including: Traverse the physical topology map to find all end-to-end paths starting from the external access point and ending at the core business processing node, and define them as the key business call paths; For each critical business call path, analyze the number of component nodes and communication links it passes through, and assign an initial propagation probability to each communication link on the path based on historical fault statistics. Using the time window as a unit, the propagation probabilities of each segment on each critical business call path are combined to generate a probability distribution describing the overall vulnerability of the system within the time window; The probability distributions of all time windows are stacked to form the fault propagation probability matrix based on the time series. The rows of the matrix represent time, and the columns represent different business call paths.

4. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 3, characterized in that, Using the aforementioned fault propagation probability matrix, a forward inference calculation is performed on the physical topology map at the current moment to generate an abnormal situation projection map containing the real-time health scores of each component, including: Read the row vector corresponding to the current time window in the fault propagation probability matrix. The row vector contains the fault risk value of all business call paths at the current moment. The risk values ​​in the row vectors are written back to the corresponding edge attributes according to the mapping relationship of each communication link in the physical topology graph, thereby updating the structured data of the physical topology graph; Taking each system component node in the physical topology graph as the center, the risk values ​​on all its incoming and outgoing edges are collected and weighted to obtain the comprehensive risk pressure value of the corresponding system component node. The calculated comprehensive risk pressure value is mapped to a value between zero and one by looking up a table. This value is the real-time health score of each component. The calculated real-time health scores of each component are used to replace the original state values ​​of the corresponding nodes in the physical topology diagram to complete the generation of the abnormal situation projection diagram.

5. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 4, characterized in that, Upon receiving the user-specified abnormal event point, the process of inverting the state inversion process of the abnormal situation projection diagram is initiated, tracing back from the abnormal outbreak point to the historical timeline to locate the most recent state change point that led to the abnormal state, including: In the abnormal situation simulation diagram, the corresponding system component nodes and their specific timestamps of failure are locked according to the coordinates of the abnormal outbreak point selected by the user. Along the reverse link direction of the physical topology map, retrieve data slices from several consecutive time windows preceding the timestamp corresponding to the anomaly outbreak point in the fault propagation probability matrix; By comparing the changes in the health scores of the same system component nodes in the data slices of two adjacent time windows, the time points with the largest changes in scores are selected. The snapshot of the state corresponding to the time point with the largest change in the score is determined as the most recent state change point, and the specific configuration parameters and operating status of the state change point are recorded.

6. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 5, characterized in that, The process involves comparing the states of all system components involved in the backtracking process with the standard configuration under normal baseline conditions, and calculating the deviation index of each component, including: Retrieve the standard configuration templates of all system components involved in the most recent state change point from the configuration management database. The standard configuration templates define the threshold values ​​of various parameters when the components are running normally. When the most recent state change point is extracted, the actual operating parameter values ​​of the corresponding system components in the physical topology diagram are obtained. The actual operating parameter values ​​are compared item by item with the parameter thresholds in the corresponding standard configuration template, and the absolute value of the difference for each parameter is calculated. Normalize the absolute values ​​of the differences between all parameters, then sum them up. The resulting sum is the deviation index for each component.

7. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 6, characterized in that, Based on the calculated deviation index, the physical topology map is dynamically colored, and component nodes with deviations exceeding the tolerance limit are marked as high-risk areas, forming a risk distribution heatmap, including: A deviation tolerance threshold is preset, which represents the range of parameter drift allowed by the system; Traverse each system component node in the physical topology diagram and read its deviation index calculated in claim 6; Determine whether the deviation index of each system component node is greater than the deviation tolerance threshold. If so, assign a red color code to the system component node. If not, assign a yellow or green color code according to the magnitude of its deviation. The color information of all nodes in the physical topology graph is overlaid and rendered, and then displayed on a map or architecture diagram to form an intuitive heatmap of risk distribution.

8. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 7, characterized in that, Spatial aggregation of the risk distribution heatmap is performed to identify several high-risk fault domains. The causal chains within these fault domains are analyzed to determine root cause nodes and affected edge nodes, including: Density clustering algorithm is used to perform spatial clustering analysis on the component nodes marked as high-risk areas in the risk distribution heatmap, with the network hop count and dependency strength between nodes as distance metrics. A group of high-risk component nodes whose spatial distance is less than a preset threshold and whose dependency strength is higher than a connectivity threshold are merged and identified as a high-risk fault domain. For each identified fault domain, the health score change sequence of all component nodes within the fault domain within the backtracking time window is extracted from the physical topology map and the abnormal situation simulation map; Based on the health score change sequence, a causal relationship network is constructed based on the time sequence and score mutations. The starting node where the score mutation occurs is identified as a potential cause node, while the node where the score mutation occurs subsequently is identified as an affected node. In the causal relationship network, the component node whose health score mutates earliest and subsequently triggers the most node chain reactions is selected and determined as the root cause node of the fault domain. The component node that causes a change in its own score solely due to receiving a state change from an upstream node in the causal chain, without further triggering a chain reaction in other downstream nodes, is identified as the affected edge node.

9. The intelligent operation and maintenance visualization monitoring method based on big data as described in claim 8, characterized in that, The process of integrating the root cause nodes, affected edge nodes, and the risk distribution heatmap obtained after state inversion and risk analysis into a visual monitoring view containing time axis and spatial location information includes: Create a three-dimensional coordinate system, where the horizontal axis represents time, the vertical axis represents the hierarchy depth in the physical topology graph, and the vertical axis represents the severity of the fault. The data in the risk distribution heatmap is mapped onto the bottom plane of the three-dimensional coordinate system to form a spatial background color that changes over time. The root cause node and the affected edge node are projected onto the corresponding time point and hierarchical position in the three-dimensional coordinate system according to the causal relationship chain determined in claim 9. A timeline is drawn throughout the entire process in the three-dimensional coordinate system, and all nodes and heatmaps are bound to the timeline to generate the final visualization monitoring view.

10. A big data-based intelligent operation and maintenance visualization monitoring system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the intelligent operation and maintenance visualization monitoring method based on big data as described in any one of claims 1 to 9.

Images