Enterprise intelligent integrated automated operation method based on AI engineering empowerment

Abstract

The application discloses an enterprise intelligent integrated automatic operation and maintenance method based on AI engineering empowerment, relates to the field of artificial intelligence operation and maintenance, and comprises the following steps: constructing operation and maintenance data lake by collecting infrastructure and application link data in real time, extracting entities and constructing an operation and maintenance knowledge graph. Abnormities are detected based on graph embedding and dynamic baseline, root cause positioning is carried out in combination with a graph neural network and causal inference. A processing plan is matched or generated according to the positioning result, and is converted into atomic operation execution. The execution process is monitored in real time, and rollback is interrupted when an abnormality occurs; meanwhile, the model and the baseline are continuously optimized based on feedback, thereby forming a self-learning operation and maintenance decision closed loop. The application has the advantages that the whole-process intelligent closed loop management of operation and maintenance is realized, data fusion, fault positioning and autonomous disposal are accurately completed, the operation and maintenance efficiency is greatly improved, the dependence on manual operation is reduced, and the stable operation of a system is ensured.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence-based operations and maintenance, and in particular to an enterprise intelligent integrated automated operations and maintenance method based on AI engineering empowerment. Background Technology

[0002] Driven by both the complexity of enterprise IT architecture and the demands for business continuity in the digital age, traditional operations and maintenance (O&M) models, reliant on manual processes and slow to respond, struggle to handle dynamic, large-scale, and complex systems in cloud-native, microservice, and hybrid multi-cloud environments. This results in inefficiency and a high risk of failure. Simultaneously, the business's need for rapid iteration and high availability is forcing enterprises to shift from reactive to proactive prevention.

[0003] Most current methods lack a complete closed-loop design, suffer from fragmented data collection, and fail to achieve deep integration and correlation of multi-dimensional data from servers, containers, and middleware. This hinders the construction of a unified operational data lake and knowledge graph, resulting in inaccurate service dependency tracking and weak anomaly correlation analysis capabilities. In fault localization, they rely heavily on fixed thresholds rather than dynamic baselines, leading to false positives and false negatives. Furthermore, the lack of deep application of graph neural networks and causal inference makes it difficult to quickly distinguish between sporadic noise and fault propagation chains, resulting in low efficiency and insufficient accuracy in root cause localization. For novel faults, most methods lack flexible dynamic planning capabilities, cannot autonomously generate adaptive operation sequences, and rely excessively on manual contingency plans. Simultaneously, the absence of an effective closed-loop learning mechanism means that models and knowledge graphs cannot adapt to dynamic business changes through incremental training. This results in low automation and high reliance on manual intervention, hindering the transition from passive handling to proactive prediction and self-healing. Overall, operational efficiency and system stability fail to meet the demands of large-scale and complex enterprise operations. Summary of the Invention

[0004] To improve existing methods, this paper provides an AI-powered, integrated, automated operation and maintenance (O&M) approach for enterprises. This approach enables intelligent closed-loop management of the entire O&M process, accurately completes data fusion, fault location, and autonomous handling, significantly improves O&M efficiency, reduces reliance on manual labor, and ensures stable system operation.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] AI-powered enterprise intelligent integrated automated operation and maintenance methods include:

[0007] Real-time collection of performance metrics and event logs from servers, containers, network devices, and middleware; tracking of call dependencies between application services; generation of service dependency graphs; capture of transactional operations and key business link data; and formation of an operations and maintenance data lake through timestamp synchronization, data association, and preprocessing.

[0008] Based on the standardized data flow in the operation and maintenance data lake, operation and maintenance entities are extracted from unstructured logs and alarm texts. The topological, causal and dependency relationships between entities are identified, and an initial operation and maintenance knowledge graph is constructed. A graph neural network is introduced to perform embedding representation learning on the initial operation and maintenance knowledge graph. A multi-dimensional time series prediction model is trained based on historical data to establish dynamic baselines for key performance indicators. The abnormal events of the dynamic baseline are associated with entities in the knowledge graph to form an abnormal subgraph with context.

[0009] Based on the abnormal subgraph and real-time data stream, pattern recognition is performed on the abnormal event stream to distinguish between occasional noise and potential fault propagation chains. A pre-trained root cause analysis model is invoked, and the probability of each entity becoming a root cause is calculated through graph attention network and causal inference algorithm. When associated anomalies are detected, fault propagation simulation is performed based on service dependency graph to verify candidate root cause hypotheses and locate the source of the fault, and obtain the root cause location results.

[0010] Based on the root cause localization results, the contingency plan knowledge base is queried. If a matching scenario exists in the contingency plan knowledge base, the candidate contingency plans are dynamically evaluated and ranked. If it is a new type of fault scenario, a hybrid planner combining decision tree and Monte Carlo tree search is activated to generate candidate operation sequences, evaluate expected benefits and risks, and output a recommended set of operation instructions.

[0011] The generated operation instruction set is converted into atomic operations and issued. During operation execution, if a deviation from the expected effect or a secondary anomaly is detected, a decision interruption mechanism is triggered and the system is rolled back to a safe state. Incremental training and optimization are performed on the root cause analysis model and dynamic baseline to form a closed-loop learning system.

[0012] Preferably, the step of tracking the call dependencies between application services and generating a service dependency graph specifically includes:

[0013] Deploy a lightweight agent on the application container or host side to non-intrusively capture network connections, system calls, and application framework-level call chains using eBPF technology;

[0014] Perform protocol parsing and service identifier extraction on the call chain data to identify the call relationships and communication patterns between microservices, databases, and message queue components;

[0015] By combining application deployment metadata and configuration management database, the dynamically discovered service nodes are mapped to their affiliations and their attributes are enhanced, forming a business topology map that includes real-time health status and performance metrics.

[0016] Preferably, the construction of the initial operation and maintenance knowledge graph specifically includes:

[0017] Based on the standardized data stream preprocessing in the operation and maintenance data lake, word segmentation and sentence segmentation are performed to identify and label predefined types of operation and maintenance entities;

[0018] Based on knowledge of the operations and maintenance domain, we clearly define the core relationship types between entities and label a batch of texts with entity and relationship tags as training samples.

[0019] A pointer network based on sequence labeling is used to identify entities and determine whether there is a predefined relationship between entity pairs. The pointer network acquires the ability to semantic association by learning training samples.

[0020] The extracted entities and relationships are imported into a graph database. The real-time call chain dependencies and deployment relationships in the configuration management database are also converted and imported. These are then aligned and integrated with the knowledge extracted from the text to form an initial operation and maintenance knowledge graph.

[0021] Preferably, the dynamic baseline construction process specifically includes:

[0022] The historical performance index series is decomposed into trend, seasonality and residual components;

[0023] A time series prediction model is trained for each component. The trend component is modeled using a gated recurrent unit network, the seasonal component is modeled using a Fourier series combined with a periodic attention mechanism, and the residual component is captured by an autoregressive model.

[0024] By combining the prediction results of each component, the predicted values ​​of the indicators for the future time window and their probability distribution are obtained.

[0025] Based on the deviation between the predicted distribution and the actual value, and combined with the sliding window statistical method, the upper and lower bounds of the dynamic threshold are calculated.

[0026] When a service release, resource expansion, or sudden traffic change event is detected, local retraining of the dynamic baseline model is triggered.

[0027] Preferably, calculating the probability that each entity is the root cause specifically includes:

[0028] Based on the anomaly subgraph and real-time data stream, real-time anomaly events are sorted by time and encoded into vector sequences containing type and source.

[0029] By inputting the vector sequence into the attention-based sequence model, the association weight between any two events in the sequence is calculated through the self-attention layer, capturing the semantic and temporal dependencies between long-distance events, weakening the weight of isolated events, and strengthening event clusters that are closely related in time and semantics.

[0030] Based on the correlation strength, event clusters are marked as coherent potential fault propagation chains, while isolated events lacking contextual support are judged as sporadic noise.

[0031] Extract entities and relationships related to the propagation chain from the operation and maintenance knowledge graph to form an anomaly subgraph, and associate the real-time indicators of each entity in the anomaly subgraph with concurrent change events;

[0032] The abnormal subgraph is input into the graph attention network, and neighbor information is aggregated through multiple layers of attention to output an encoded vector representing the current abnormal state and influence of each entity.

[0033] Based on the influence characteristics, anomaly types, and change information of nodes, a causal inference algorithm is used to assess the likelihood of different entities being the root cause, and a root cause probability score is calculated for each candidate entity.

[0034] Preferably, the fault propagation simulation specifically includes:

[0035] A system propagation model is constructed based on a service dependency graph. In the graph, nodes represent services and resources, and edges represent dependencies, along with parameters for failure propagation probability and latency.

[0036] The observed abnormal events are used as the initial infection nodes, and the fault propagation process along the edges is simulated in the system propagation graph based on Bayesian networks.

[0037] During the simulation, the status of nodes along the propagation path is corrected by combining real-time monitoring data;

[0038] Through multiple Monte Carlo simulations, the frequency of each node being triggered was statistically analyzed and used as a measure of the likelihood that the node is the source of the fault.

[0039] Preferably, the step of dynamically evaluating and ranking candidate contingency plans if a matching scenario exists in the contingency plan knowledge base specifically includes:

[0040] The operation and maintenance decision problem is modeled as a Markov decision process, with the state space including system health, business indicators, resource utilization and change context, and the action space consisting of executable operation and maintenance operations.

[0041] The parameters of the policy network are pre-trained using historical records of successful and unsuccessful actions as an offline experience replay pool.

[0042] When making decisions online, the policy network receives the current state vector and a set of candidate plans, and outputs the expected cumulative reward value for each plan. The expected cumulative reward value takes into account factors such as fault recovery speed, resource cost, business interruption risk and operational stability.

[0043] An exploration and utilization balance mechanism is adopted, which gives higher execution priority to high reward value plans, while reserving a small probability of exploration opportunities for unverified plans, and feeding the exploration results back to the experience pool.

[0044] Preferably, the generation of candidate operation sequences and the evaluation of expected returns and risks specifically include:

[0045] When a new type of fault scenario is detected, an interactive fault simulation environment is built based on the current operation and maintenance knowledge graph and system status snapshot;

[0046] The predefined domain rule decision tree is invoked, and a set of basic, operation and maintenance experience-based security operation sequences are generated as the initial candidate set, taking the entity type and abnormal attributes of the current failure as input.

[0047] Starting with the sequence generated by the decision tree, a Monte Carlo tree search is initiated. Child nodes are selected based on the statistical information of the current node. When a node that has not been fully explored is encountered, a new legal operation is added as a child node. Starting from this node, subsequent operations are randomly executed in the simulation environment until the preset endpoint is reached. The reward value is calculated based on the simulation results, and the statistical information of all nodes on the path is updated in reverse.

[0048] After multiple rounds of search iterations, the planner converges to several operation sequences with high expected reward values, and outputs the best candidate operation sequence that balances returns and risks, along with a detailed evaluation report.

[0049] Preferably, the closed-loop learning system specifically includes:

[0050] By using recent historical data, the time series prediction component is incrementally trained, and the parameters of seasonal and trend components are adjusted to ensure that the baseline thresholds are consistently aligned with the current operating environment.

[0051] New cases are stored as experience tuples in the reinforcement learning replay buffer, and the data in the buffer is sampled periodically to fine-tune the graph attention network in the root cause analysis model.

[0052] By processing text reports and configuration change records in new cases, newly emerging entities or new relationships between entities are identified and incrementally merged and updated into the operations and maintenance knowledge graph.

[0053] Compared with the prior art, the advantages of the present invention are:

[0054] This system achieves intelligent, automated, and closed-loop integration across the entire operations and maintenance (O&M) process, effectively addressing the pain points of traditional O&M. It constructs an O&M data lake through multi-dimensional data collection and fusion, combining service dependency graphs and O&M knowledge graphs to break down data silos and achieve unified monitoring and precise correlation analysis across the entire chain. Dynamic baseline construction adapts to dynamic system changes, reducing false alarms and missed alarms. Graph attention networks and causal inference combined with fault propagation simulation can quickly distinguish between occasional noise and fault propagation chains, accurately pinpointing root causes and significantly shortening fault handling time. For known and novel faults, optimal operation instructions are generated through dynamic contingency plan evaluation and a hybrid planner, respectively, achieving efficient fault self-healing. The closed-loop learning system continuously optimizes models and knowledge graphs through incremental training, continuously adapting to business changes, reducing manual reliance, lowering O&M costs, and driving enterprises to transform from passive O&M to a proactive, self-healing intelligent O&M paradigm, improving system stability and O&M efficiency. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the AI-enabled integrated automated operation and maintenance method for enterprises proposed in this invention. Detailed Implementation

[0056] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0057] See Figure 1 As shown, the enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment includes:

[0058] Step 1: Collect performance metrics and event logs of servers, containers, network devices and middleware in real time, track call dependencies between application services, generate service dependency graphs, capture transactional operations and key business link data, and form an operations and maintenance data lake after timestamp synchronization, data association and preprocessing;

[0059] Step 2: Based on the standardized data flow in the operations and maintenance data lake, extract operations and maintenance entities from unstructured logs and alarm texts, identify the topological, causal, and dependency relationships between entities, construct an initial operations and maintenance knowledge graph, introduce graph neural networks to perform embedding representation learning on the initial operations and maintenance knowledge graph, train a multi-dimensional time series prediction model based on historical data to establish dynamic baselines for key performance indicators, associate abnormal events of the dynamic baselines with entities in the knowledge graph, and form an abnormal subgraph with context.

[0060] Step 3: Based on the abnormal subgraph and real-time data stream, perform pattern recognition on the abnormal event stream to distinguish between occasional noise and potential fault propagation chains. Call the pre-trained root cause analysis model and calculate the probability of each entity becoming the root cause through graph attention network and causal inference algorithm. When an associated anomaly is detected, perform fault propagation simulation based on service dependency graph to verify candidate root cause hypotheses and locate the source of the fault, and obtain the root cause location results.

[0061] Step 4: Based on the root cause localization results, query the contingency plan knowledge base. If a matching scenario exists in the contingency plan knowledge base, the candidate contingency plans are dynamically evaluated and ranked. If it is a new type of fault scenario, a hybrid planner combining decision tree and Monte Carlo tree search is started to generate candidate operation sequences, evaluate expected benefits and risks, and output a recommended set of operation instructions.

[0062] Step 5: Based on the generated operation instruction set, convert it into atomic operations and issue them. During operation execution, if a deviation from the expected effect is detected or a secondary anomaly is triggered, the decision interruption mechanism is triggered and the system is rolled back to a safe state. Incremental training and optimization are performed on the root cause analysis model and dynamic baseline to form a closed-loop learning system.

[0063] In step one, a lightweight agent is deployed on the application container or host side, using eBPF technology to non-intrusively capture network connections, system calls, and application framework-level call chain data at the kernel level. The captured call chain data is then parsed to extract service identifiers. The parsed call relationships are used as edges, and service instances as nodes to initially construct a call graph. Combined with application deployment metadata obtained from the configuration management database and application deployment platform, node affiliation mapping and attribute enhancement are performed on the graph. Finally, real-time collected performance metrics are integrated to form a dynamic business topology graph containing node and edge attributes.

[0064] The engine receives event streams from various data sources and records the system reception time and original timestamp for each data record. By estimating and compensating for time offsets between different data sources, global time base alignment is achieved. The core alignment principle is to minimize the timestamp differences between different data records originating from the same logical event.

[0065] The aligned data is associated based on common entity identifiers. The associated data is then fed into a stream-batch integrated data processing pipeline. On the stream processing side, real-time outlier cleaning and dimensionality reduction are performed. On the batch processing side, deeper feature standardization and historical archiving are conducted. Finally, all processed data is stored in a unified operations data lake, forming a single, reliable data source for subsequent analysis.

[0066] Based on the dynamic business topology graph G(V,E,t), the dependency strength between services and the risk of fault propagation are further quantified. For any two services... and The strength of its dependency It is based not only on call frequency, but also on call latency, error rate, and business importance. The strength of this relationship can be dynamically calculated as follows:

[0067]

[0068] in, Within the time window t right The number of times it is called. for Total number of calls, To average call latency, To call the error rate, For service The business importance weights. The function f(⋅) is a normalization and weighted aggregation function.

[0069] In a stream processing pipeline, a sequence of real-time performance metrics... Outlier cleaning is performed. The system employs an adaptive threshold-based detection method, where the threshold is dynamically calculated based on the recent historical distribution of the indicator. For indicator x, the threshold is within a reasonable range at time t. It can be represented as:

[0070]

[0071] in, and These are the mean and standard deviation of indicator x within a sliding window before time t, respectively, and k is a multiplier factor configured based on indicator characteristics and business sensitivity. Data points outside of this scope will be marked as suspected anomalies and will be subject to further processing or alerts.

[0072] In step two, unstructured text such as logs and alerts undergo preprocessing, including word segmentation and stop word removal. Then, a pre-trained language model is used to convert each word or subword into a context-sensitive vector representation.

[0073] Design a joint extraction model based on pointer networks, which represents text sequences. As input, entity recognition and relation extraction are performed simultaneously. The model uses two binary classifiers to locate entity spans in the text. For text positions i and j, the probability that they are the start and end positions of an entity can be calculated as follows:

[0074]

[0075] Where σ is the Sigmoid function. , , , These are trainable parameters.

[0076] For the two identified entities and The model calculates its semantic representation. and And determine whether one of the predefined K types of relations exists between them. It belongs to the relation... The probability is:

[0077]

[0078] Where [;] denotes vector concatenation. This represents element-wise multiplication. , These are the classifier parameters.

[0079] By training on a manually labeled sample set to minimize the joint loss function, we gain the ability to extract such facts directly from text.

[0080] The triples obtained from the joint extraction model, the relations extracted from the call chain data, and the relations obtained from the CMDB are all imported into the graph database. Through entity disambiguation and attribute alignment, conflicts are eliminated, forming a unified initial knowledge graph that integrates topology, configuration, and operational experience facts.

[0081] To support efficient semantic retrieval and association reasoning, graph embedding representation learning is performed. A graph attention network is adopted, the core operation of which is to weighted aggregate the information of a node's neighboring nodes. Through multi-layer stacking, a low-dimensional vector representation of each entity and relation is finally obtained, so that nearby and semantically similar entities in the graph are also close to each other in the vector space.

[0082] Historical sequences of key performance indicators { Decompose: ,in These represent trend, seasonality, and residual components, respectively.

[0083] Trend Item The modeling uses a gated recurrent cell network, where update and reset gates control the flow of historical information and capture long-term trends.

[0084] Seasonal items The modeling combines Fourier series with a periodic attention mechanism. The Fourier series provides the basic periodic pattern, while the periodic attention mechanism dynamically adjusts the contribution weights of different historical periods to the current prediction.

[0085] residuals The modeling uses an autoregressive model to capture the short-term linear dependence in the residuals after decomposition.

[0086] By combining the predicted values ​​of each component, the point prediction for future time moments is obtained. Its prediction distribution is estimated using Monte Carlo sampling or analytical methods. Based on the prediction distribution and sliding window statistics of recent observation errors, the upper and lower bounds of the dynamic threshold are calculated.

[0087]

[0088] in, , It is an adjustable parameter. It is the absolute median of the difference between recent observations and predicted values.

[0089] When monitoring change events such as business releases, the system automatically marks the data before and after the event point, and uses the new data after the event to perform rapid incremental learning or local retraining on the trend and seasonality model components, so that the baseline can quickly adapt to the new state.

[0090] In step three, a real-time anomaly event stream is received and processed. Each event contains attributes such as type, source entity, timestamp, and severity level, which have been encoded into a feature vector. The vector representation of the event sequence is input into a sequence model based on a multi-head self-attention mechanism. The model calculates the association weights between any two events, a mechanism that enables the model to capture semantic and temporal dependencies across time.

[0091] Based on the learned attention weight matrix, an event association graph is constructed. Community detection or connected component analysis algorithms are used to identify event clusters that are internally tightly connected but sparsely connected to external events. Each cluster is labeled as a potential fault propagation chain. For any event, if the average attention weight of it and all other events in the sequence is below a preset threshold, it is considered occasional noise and filtered out.

[0092] For each event cluster corresponding to a identified potential fault propagation chain, perform the following steps:

[0093] Using entities involved in events within a cluster as seeds, directly related entities and relationships are extracted from the global operational knowledge graph to form a focused anomaly subgraph. This subgraph is then input into a graph attention network. For each node in the graph, its representation after l-layer aggregation is updated as follows:

[0094]

[0095] in, It is a node The neighborhood group, It is a layer-specific weight matrix. It is a non-linear activation function with attention coefficients. We measure the importance of neighbor j to node i. The final node representation is obtained. It integrates graph structure information with the abnormal states of the nodes themselves.

[0096] The probability of each node being a root cause is evaluated using node representation, anomaly scores of real-time performance metrics associated with the node, and identifiers of related change events occurring concurrently. An inference method based on a structural causal model framework is employed. A set of candidate root cause nodes is defined. For each candidate node, its likelihood score as a root cause is calculated. Finally, the root cause probability is normalized using a softmax function.

[0097] To validate candidate root causes and improve localization accuracy, a simulation inference engine is launched. A system-level directed graph model of fault propagation is constructed based on the service dependency graph. Each edge in the graph is associated with a propagation probability and propagation delay distribution; these parameters can be learned from historical fault data or preset based on architectural reliability. For each high-probability candidate root cause node, a sub-independent Monte Carlo simulation is performed. In each simulation: the candidate root cause node is used as the initial fault node. Based on the propagation probabilities and delays on the edges, the fault propagation process is simulated according to topological and temporal order. The set of nodes ultimately infected in this simulation is recorded.

[0098] Statistics for each node in all simulations The frequency with which a node appears in the infection set. This frequency reflects the likelihood of a node appearing in the infection set, assuming the candidate root cause node is the root cause. The likelihood of anomalies is assessed. The plausibility of candidate root cause nodes is evaluated by comparing the degree of agreement between the simulation results and the actual observed set of anomalous nodes, and their probability scores are adjusted accordingly.

[0099] In step four, if the contingency plan knowledge base contains a set of candidate contingency plans that match the current fault scenario... At time t, a reinforcement learning model is used for dynamic evaluation. The operation and maintenance decision problem is modeled as a Markov decision process. At time t, the state of the system is... It is a high-dimensional vector, composed of multi-dimensional information.

[0100] The system maintains a policy network whose parameters are pre-trained offline using historical treatment records. These historical records form an experience replay pool. ,in To perform the action The immediate reward received afterward. The training objective is to maximize the expected value of the cumulative discounted reward. ,in This is the discount factor.

[0101] During online decision-making, the policy network receives the current state. and candidate contingency plan set For each contingency plan The policy network outputs its corresponding state-action value function. As an estimate of expected cumulative reward:

[0102]

[0103] The reward function R was designed to comprehensively consider fault recovery speed, resource costs, business interruption risk, and operational stability. Ultimately, the contingency plans were sorted in descending order of their Q-values ​​as the recommended priority.

[0104] For novel fault scenarios, a hybrid planner combining decision trees and Monte Carlo tree search is initiated. An interactive fault simulation environment is constructed based on the current system state snapshot and the operation and maintenance knowledge graph. This environment can simulate the execution of operation and maintenance operations and provide feedback on system state changes. A domain-rule-based decision tree is invoked. This tree, taking root cause entity type and anomaly attributes as input, quickly generates a set of initial operation sequences that conform to safety criteria.

[0105] Starting with a sequence from the initial set of operation sequences as the initial path, a Monte Carlo tree search is initiated for depth exploration. Each node in the search tree represents a system state, and each edge represents an operational operation. The core steps include: starting from the root node, recursively selecting child nodes using the upper bound confidence interval formula until a partially expanded node or a leaf node is reached. For a node, the UCT score for selecting its child nodes is calculated as follows:

[0106]

[0107] in, It is the cumulative reward of child node j. It refers to the number of visits. It represents the number of times parent node i has been visited. It is an exploration constant.

[0108] For a selected node, a valid operation is added to generate a new child node. Then, starting from this new state in the simulation environment, operations are randomly executed until a preset termination condition is reached, resulting in the simulation trajectory and final reward. The simulation results are backpropagated along the search path, updating the visit count and cumulative reward of all nodes on the path. After multiple iterations, several paths with high expected rewards converge in the search tree. The planner performs a final evaluation of these sequences, calculates their expected returns and risk assessments, and outputs one or more candidate sequences that are optimal on the return-risk curve, along with a detailed analysis report, as the final recommendation.

[0109] In step five, the gateway parses each instruction and transforms it into one or more atomic operations that can be directly executed by the underlying system. Before execution, each atomic operation and its sequence undergoes dual verification: compliance verification: verifying whether the operation conforms to predefined security policies and compliance rules; dependency verification: based on the operations and maintenance knowledge graph, verifying the logical order of the operation sequence to prevent circular dependencies or resource conflicts. After successful verification, a standardized work order is generated and sent to the operations and maintenance orchestration engine.

[0110] Before execution, the system uses historical baselines or simulation results from the decision-making phase to define key performance indicators. Define a projected evolution trajectory. During execution, continuously collect actual indicator values. Define a comprehensive execution deviation. The calculation method for time t is as follows:

[0111]

[0112] in, It is a set of key indicators. It is the weight of indicator k. It is the historical standard deviation of the indicator during normal fluctuation periods, used for normalization.

[0113] A deviation threshold and a time window are set. If, within a continuous time window, the average deviation exceeds the deviation threshold or any secondary anomaly triggering a cascading alarm is detected, a decision interruption mechanism is immediately activated. This mechanism stops the current execution sequence and automatically initiates a predefined rollback scheme. The rollback scheme is created synchronously during decision generation, and its goal is to revert the system state to a known safe state, typically achieved by executing the inverse sequence of operations.

[0114] The complete data stream from the occurrence to the resolution of this fault, including the original abnormal event, root cause analysis report, decision instructions, execution status sequence, final system status, and business indicator recovery status, is integrated into a structured case. Cases are stored uniformly in a case library.

[0115] The system periodically extracts new case datasets from the case library to incrementally train and optimize the core model: successful and failed cases are used as positive and negative samples, respectively, to optimize the loss function. The dynamic baseline model uses new data to incrementally learn the time series prediction model, adjusting its internal parameters to adapt to the latest patterns of system behavior. The operations and maintenance knowledge graph is updated using entity and relationship information from new cases. Through an incrementally learned version of the knowledge graph embedding algorithm, the vector representations of entities and relationships are updated, and edges and nodes in the graph are added or removed, realizing the evolution of knowledge.

[0116] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0117] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0118] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment, characterized in that, include: Real-time collection of performance metrics and event logs from servers, containers, network devices, and middleware; tracking of call dependencies between application services; generation of service dependency graphs; capture of transactional operations and key business link data; and formation of an operations and maintenance data lake through timestamp synchronization, data association, and preprocessing. Based on the standardized data flow in the operation and maintenance data lake, operation and maintenance entities are extracted from unstructured logs and alarm texts. The topological, causal and dependency relationships between entities are identified, and an initial operation and maintenance knowledge graph is constructed. A graph neural network is introduced to perform embedding representation learning on the initial operation and maintenance knowledge graph. A multi-dimensional time series prediction model is trained based on historical data to establish dynamic baselines for key performance indicators. The abnormal events of the dynamic baseline are associated with entities in the knowledge graph to form an abnormal subgraph with context. Based on the abnormal subgraph and real-time data stream, pattern recognition is performed on the abnormal event stream to distinguish between occasional noise and potential fault propagation chains. A pre-trained root cause analysis model is invoked, and the probability of each entity becoming a root cause is calculated through graph attention network and causal inference algorithm. When associated anomalies are detected, fault propagation simulation is performed based on service dependency graph to verify candidate root cause hypotheses and locate the source of the fault, and obtain the root cause location results. Based on the root cause localization results, the contingency plan knowledge base is queried. If a matching scenario exists in the contingency plan knowledge base, the candidate contingency plans are dynamically evaluated and ranked. If it is a new type of fault scenario, a hybrid planner combining decision tree and Monte Carlo tree search is activated to generate candidate operation sequences, evaluate expected benefits and risks, and output a recommended set of operation instructions. The generated operation instruction set is converted into atomic operations and issued. During operation execution, if a deviation from the expected effect or a secondary anomaly is detected, a decision interruption mechanism is triggered and the system is rolled back to a safe state. Incremental training and optimization are performed on the root cause analysis model and dynamic baseline to form a closed-loop learning system.

2. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment as described in claim 1, characterized in that, The process of tracing the call dependencies between application services and generating a service dependency graph specifically includes: Deploy a lightweight agent on the application container or host side to non-intrusively capture network connections, system calls, and application framework-level call chains using eBPF technology; Perform protocol parsing and service identifier extraction on the call chain data to identify the call relationships and communication patterns between microservices, databases, and message queue components; By combining application deployment metadata and configuration management database, the dynamically discovered service nodes are mapped to their affiliations and their attributes are enhanced, forming a business topology map that includes real-time health status and performance metrics.

3. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment according to claim 1, characterized in that, The construction of the initial operation and maintenance knowledge graph specifically includes: Based on the standardized data stream preprocessing in the operation and maintenance data lake, word segmentation and sentence segmentation are performed to identify and label predefined types of operation and maintenance entities; Based on knowledge of the operations and maintenance domain, we clearly define the core relationship types between entities and label a batch of texts with entity and relationship tags as training samples. A pointer network based on sequence labeling is used to identify entities and determine whether there is a predefined relationship between entity pairs. The pointer network acquires the ability to semantic association by learning training samples. The extracted entities and relationships are imported into a graph database. The real-time call chain dependencies and deployment relationships in the configuration management database are also converted and imported. These are then aligned and integrated with the knowledge extracted from the text to form an initial operation and maintenance knowledge graph.

4. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment according to claim 1, characterized in that, The dynamic baseline construction process specifically includes: The historical performance index series is decomposed into trend, seasonality and residual components; A time series prediction model is trained for each component. The trend component is modeled using a gated recurrent unit network, the seasonal component is modeled using a Fourier series combined with a periodic attention mechanism, and the residual component is captured by an autoregressive model. By combining the prediction results of each component, the predicted values ​​of the indicators for the future time window and their probability distribution are obtained. Based on the deviation between the predicted distribution and the actual value, and combined with the sliding window statistical method, the upper and lower bounds of the dynamic threshold are calculated. When a service release, resource expansion, or sudden traffic change event is detected, local retraining of the dynamic baseline model is triggered.

5. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment according to claim 1, characterized in that, The calculation of the probability that each entity is the root cause specifically includes: Based on the anomaly subgraph and real-time data stream, real-time anomaly events are sorted by time and encoded into vector sequences containing type and source. By inputting the vector sequence into the attention-based sequence model, the association weight between any two events in the sequence is calculated through the self-attention layer, capturing the semantic and temporal dependencies between long-distance events, weakening the weight of isolated events, and strengthening event clusters that are closely related in time and semantics. Based on the correlation strength, event clusters are marked as coherent potential fault propagation chains, while isolated events lacking contextual support are judged as sporadic noise. Extract entities and relationships related to the propagation chain from the operation and maintenance knowledge graph to form an anomaly subgraph, and associate the real-time indicators of each entity in the anomaly subgraph with concurrent change events; The abnormal subgraph is input into the graph attention network, and neighbor information is aggregated through multiple layers of attention to output an encoded vector representing the current abnormal state and influence of each entity. Based on the influence characteristics, anomaly types, and change information of nodes, a causal inference algorithm is used to assess the likelihood of different entities being the root cause, and a root cause probability score is calculated for each candidate entity.

6. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment according to claim 1, characterized in that, The fault propagation simulation specifically includes: A system propagation model is constructed based on a service dependency graph. In the graph, nodes represent services and resources, and edges represent dependencies, along with parameters for failure propagation probability and latency. The observed abnormal events are used as the initial infection nodes, and the fault propagation process along the edges is simulated in the system propagation graph based on Bayesian networks. During the simulation, the status of nodes along the propagation path is corrected by combining real-time monitoring data; Through multiple Monte Carlo simulations, the frequency of each node being triggered was statistically analyzed and used as a measure of the likelihood that the node is the source of the fault.

7. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment according to claim 1, characterized in that, The step of dynamically evaluating and ranking candidate contingency plans if a matching scenario exists in the contingency plan knowledge base specifically includes: The operation and maintenance decision problem is modeled as a Markov decision process, with the state space including system health, business indicators, resource utilization and change context, and the action space consisting of executable operation and maintenance operations. The parameters of the policy network are pre-trained using historical records of successful and unsuccessful actions as an offline experience replay pool. When making decisions online, the policy network receives the current state vector and a set of candidate plans, and outputs the expected cumulative reward value for each plan. The expected cumulative reward value takes into account factors such as fault recovery speed, resource cost, business interruption risk and operational stability. An exploration and utilization balance mechanism is adopted, which gives higher execution priority to high reward value plans, while reserving a small probability of exploration opportunities for unverified plans, and feeding the exploration results back to the experience pool.

8. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment according to claim 1, characterized in that, The generation of candidate operation sequences and the evaluation of expected returns and risks specifically include: When a new type of fault scenario is detected, an interactive fault simulation environment is built based on the current operation and maintenance knowledge graph and system status snapshot; The predefined domain rule decision tree is invoked, and a set of basic, operation and maintenance experience-based security operation sequences are generated as the initial candidate set, taking the entity type and abnormal attributes of the current failure as input. Starting with the sequence generated by the decision tree, a Monte Carlo tree search is initiated. Child nodes are selected based on the statistical information of the current node. When a node that has not been fully explored is encountered, a new legal operation is added as a child node. Starting from this node, subsequent operations are randomly executed in the simulation environment until the preset endpoint is reached. The reward value is calculated based on the simulation results, and the statistical information of all nodes on the path is updated in reverse. After multiple rounds of search iterations, the planner converges to several operation sequences with high expected reward values, and outputs the best candidate operation sequence that balances returns and risks, along with a detailed evaluation report.

9. The enterprise intelligent integrated automated operation and maintenance method based on AI engineering empowerment according to claim 1, characterized in that, The closed-loop learning system specifically includes: By using recent historical data, the time series prediction component is incrementally trained, and the parameters of seasonal and trend components are adjusted to ensure that the baseline thresholds are consistently aligned with the current operating environment. New cases are stored as experience tuples in the reinforcement learning replay buffer, and the data in the buffer is sampled periodically to fine-tune the graph attention network in the root cause analysis model. By processing text reports and configuration change records in new cases, newly emerging entities or new relationships between entities are identified and incrementally merged and updated into the operations and maintenance knowledge graph.

Images