An AI agent platform security operation data correlation analysis method based on a knowledge graph

Abstract

The application provides an AI intelligent agent platform safe operation data correlation analysis method based on a knowledge graph, and belongs to the technical field of knowledge graphs.The application significantly reduces the node redundancy of the knowledge graph by performing idempotent merging on multiple operation nodes that are adjacent in time and have the same idempotent key, so that efficient storage and analysis of large-scale operation data become possible.The read-write dependency relationship between modeling operations and data entities is displayed by consuming edges and generating edges, fine-grained data tracing and impact range evaluation are realized, and the blank of untraceable data flow in traditional log analysis is filled.

Description

Technical Field

[0001] This invention belongs to the field of knowledge graph technology, specifically relating to a method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graph. Background Technology

[0002] Operation logs, as a key data source for recording system behavior, contain multi-dimensional information such as operation type, timestamp, target resource path, and operation parameters. Existing technologies commonly employ methods such as log template-based clustering (e.g., Drain, LogCluster), event sequence pattern mining (e.g., PrefixSpan), and constructing call chains or dependency graphs. In recent years, knowledge graphs, due to their powerful semantic representation and associative reasoning capabilities, have been gradually introduced into the operations and maintenance field to establish semantic relationships between entities such as IT resources, services, alarms, and changes, supporting tasks such as fault propagation analysis and impact assessment. For example, existing methods construct static resource dependency graphs by parsing configuration files and monitoring data, or construct dynamic time-series graphs by extracting causal relationships from log events.

[0003] However, existing technologies still have the following significant shortcomings: First, most methods treat operational operations as independent log entries, ignoring the repetitiveness and similarity between operations over time. For example, a large number of identical operations within a short period due to retry mechanisms, cyclic tasks, or configuration errors can introduce massive redundant nodes, leading to an explosive increase in the size of subsequent analysis graphs and making it difficult to distinguish between critical and routine operations. Second, existing solutions often only focus on the attributes of the operations themselves, without showing the dependencies between the modeled operations and the data entities read and written, thus failing to support fine-grained data tracing and impact analysis. Third, when mining temporal correlations between operations, traditional methods often rely on fixed time windows or simple sequence pattern matching, making it difficult to adapt to the changing operation interval characteristics at different time scales. Especially when the operation sequence is elastically stretched or compressed (e.g., periodic tasks shift as a whole due to changes in system load), existing methods often result in missed or incorrect correlations. Summary of the Invention

[0004] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0005] In view of the aforementioned existing problems, the present invention is proposed.

[0006] To address the aforementioned technical problems, the present invention provides the following technical solution:

[0007] A knowledge graph-based method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform includes: collecting operation and maintenance operations; creating operation nodes based on operation characteristics; creating data nodes based on the data entities involved in the operations; and associating the operation nodes with the data nodes through edges; merging multiple operation nodes that are temporally adjacent and have the same idempotent key according to the normalization results of operation content and resource paths to obtain representative operation nodes; constructing temporally dependent edges between representative operation nodes based on the distribution characteristics of representative operation nodes in the time series; and storing the representative operation nodes, the data nodes, and each edge in a knowledge graph for correlation analysis of operation and maintenance data.

[0008] As a preferred embodiment of the present invention, the step of creating an operation node based on operation characteristics includes: intercepting each operation and maintenance operation from the AI ​​intelligent agent platform, recording the system timestamp at the time of interception, and extracting the operation type, process identifier, target resource path, and operation parameters.

[0009] The operation fingerprint is generated by concatenating the operation type, process identifier, target resource path, and parameter key name list in the operation parameters, and then using a hash algorithm. The operation fingerprint is used as the unique identifier of the operation node.

[0010] In a preferred embodiment of the present invention, the attributes of the operation node include at least: system timestamp, process identifier, target resource path, operation parameters, operation count field, creation timestamp field, last occurrence timestamp field, parameter history array, merge flag, and merged fingerprint list; wherein, the initial value of the operation count field is 1, the initial value of the creation timestamp field is equal to the system timestamp, the initial value of the last occurrence timestamp field is equal to the system timestamp, the parameter history array initially contains the current operation parameters, the merge flag is initially in an unmerged state, and the merged fingerprint list is initially empty.

[0011] In a preferred embodiment of the present invention, the step of associating the operation node with the data node via an edge includes: parsing each data entity read or written by the operation and maintenance operation, using the combination of the storage path and the last modified timestamp of the data entity as the unique identifier of the data node; if the operation is a read operation, then an input data node is created or reused, and the input data node is connected to the operation node via a consumption edge, the consumption edge carrying the byte offset range of the read operation; if the operation is a write operation, then an output data node is created or reused, and the operation node is connected to the output data node via a generation edge, the generation edge carrying the amount of data written and the write mode; each data node maintains a reference counter, initially set to 0, which increments by 1 whenever a consumption edge or generation edge is associated with the data node, and decrements by 1 when an edge is deleted.

[0012] In a preferred embodiment of the present invention, the merging process includes: excluding predefined dynamic time-related fields from the operation parameters to obtain a static parameter portion; normalizing the target resource path by deleting numeric suffixes and version numbers from the path to obtain a normalized backbone; concatenating the operation type, the normalized backbone, and the static parameter portion in sequence, and generating an idempotent key using a hash algorithm; and arranging all operation nodes in ascending order of system timestamps. If multiple operation nodes have the same system timestamp, they are sorted lexicographically by operation fingerprint.

[0013] In a preferred embodiment of the present invention, the merging further includes: sequentially comparing the idempotency key of the current operation node with the idempotency key of the previous operation node, skipping nodes already marked as merged during the comparison, i.e., finding the first unmerged node as the previous node; if the idempotency key of the current operation node is the same as the idempotency key of the previous operation node, then the operation count value of the current operation node is added to the operation count field of the previous operation node, the last occurrence timestamp of the previous operation node is updated to the maximum value between the last occurrence timestamp of the previous operation node and the system timestamp of the current operation node, the creation timestamp of the previous operation node is updated to the minimum value between the creation timestamp of the previous operation node and the system timestamp of the current operation node, the operation parameters of the current operation node are appended to the parameter history array of the previous operation node, the operation fingerprint of the current operation node is stored in the merged fingerprint list of the previous operation node, and the merging flag of the current operation node is set to the merged state.

[0014] In a preferred embodiment of the present invention, the merging further includes: for the current operation node to be merged, redirecting all consumed edges and generated edges associated with the current operation node to the previous operation node, and adjusting the reference counter of the data node; wherein the reference counter of the data node associated with the redirected edge is first decremented by 1 and then incremented by 1 according to the new connection; the data node is deleted only when the reference counter of the data node becomes 0 and the data node is no longer associated with any unmerged operation node; the merging steps are repeated until all adjacent operation nodes with the same idempotent key are processed, resulting in a merged representative operation node set.

[0015] In a preferred embodiment of the present invention, the step of constructing temporal dependency edges between representative operation nodes includes: arranging the representative operation nodes in ascending order of their weighted average timestamps; for each representative operation node except the first node in the arrangement, calculating the time difference between the representative operation node and the previous representative operation node; constructing a time difference sequence for each representative operation node, the time difference sequence being composed of several non-zero time differences preceding the representative operation node arranged in ascending order; for any two representative operation nodes in the arrangement, taking the node with the smaller weighted average timestamp as the first node, and the node with the larger weighted average timestamp as the second node... The node is designated as the second node; if the difference between the weighted average timestamp of the second node and the weighted average timestamp of the first node is less than or equal to a preset time window, then the non-zero time difference sequence of the first node and the non-zero time difference sequence of the second node are obtained; if both sequences are not empty, then the non-zero time difference sequence of the first node is scaled proportionally and aligned with the non-zero time difference sequence of the second node for comparison, and the average difference is calculated; if the average difference is less than a preset error threshold, then a directed temporal dependency edge is added between the first node and the second node, with the direction pointing from the first node to the second node.

[0016] As a preferred embodiment of the present invention, the step of constructing temporal dependency edges between representative operation nodes further includes: calculating a weight for each temporal dependency edge; the weight is determined based on the statistical characteristics of the non-zero time difference sequence of the source node; after normalizing all weights, the normalized weights are attached to the corresponding temporal dependency edges.

[0017] As a preferred embodiment of the present invention, the storage to the knowledge graph includes: storing representative operation nodes, data nodes, consumption edges, generation edges, and temporal dependency edges in an attribute graph model to a graph database; establishing an inverted index for each normalized backbone and constructing a Bloom filter for fast member query; finding a set of operation nodes with the same normalized backbone based on the inverted index, and generating a set of associated triples by combining the temporal dependency edges; storing the triple set in shards according to resource paths, and storing temporal dependency edges across resource paths in multiple shards respectively.

[0018] The beneficial effects of this invention are as follows, compared with the prior art: This invention significantly reduces the node redundancy of the knowledge graph by idempotently merging multiple operation nodes that are temporally adjacent and have the same idempotent key, making efficient storage and analysis of large-scale operation and maintenance data possible; by explicitly modeling the read-write dependencies between operations and data entities through consumption edges and generation edges, fine-grained data tracing and impact assessment are achieved, filling the gap in traditional log analysis where data flow cannot be traced; furthermore, by constructing temporal dependency edges based on non-zero time difference sequences and using scaling alignment and average difference comparison, the similarity of operation interval patterns can be adaptively identified at different time scales, effectively avoiding the problems of missed and incorrect associations caused by fixed time windows, supporting rapid cross-resource path association queries, and providing a high-precision, low-redundancy, and traceable intelligent analysis foundation for the secure operation and maintenance of AI intelligent agent platforms. Attached Figure Description

[0019] Figure 1 This is a flowchart of the creation and association of operation nodes and data nodes in this invention.

[0020] Figure 2 This is a flowchart illustrating the process of merging adjacent similar operation nodes into a representative operation node in this invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0022] like Figures 1-2 As shown, the present invention provides a method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs, comprising:

[0023] S1: Collect operation and maintenance data, create operation nodes based on operation characteristics, create data nodes based on the data entities involved in the operation, and associate the operation nodes with the data nodes through edges.

[0024] In this embodiment, the AI ​​agent platform is deployed in a cloud computing or enterprise data center environment to perform automated operation and maintenance tasks. A transparent interception proxy is set up between the AI ​​agent platform and the target resources (e.g., servers, databases, container clusters). When an operation and maintenance operation (e.g., file reading, configuration writing, process execution) is intercepted, execution information is extracted, including the system timestamp (recording the system clock value at the time the operation was intercepted), operation type, process identifier, target resource path, and operation parameters.

[0025] Furthermore, an irreversible hash digest is generated based on the operation content as an operation fingerprint, and this fingerprint is used as the unique identifier of the operation node.

[0026] Specifically, the extracted operation type, process identifier, target resource path, and all parameter keys from the operation parameters are concatenated into a single string in a fixed order. Note that only the keys are used here, not the corresponding values. For example, the concatenation format is: Operation Type|Process Identifier|Target Resource Path|Key Name 1|Key Name 2|...

[0027] The concatenated string is hashed using a secure hash algorithm (such as SHA-256), and the resulting hexadecimal string is the operation fingerprint. This operation fingerprint is used as the unique identifier (node ​​ID) of the operation node. Due to the collision-resistant nature of hash algorithms, operations with different content will almost certainly produce different operation fingerprints, while operations with the same content (including sets of keys with the same name) will produce the same operation fingerprint, providing a basis for subsequent idempotent merging.

[0028] In addition to the node ID, each operation node also includes the following dynamic attribute fields to record the historical status and merging information of the operation: system timestamp, process identifier, target resource path, operation parameters, operation count field, creation timestamp field, last occurrence timestamp field, parameter history array, merging flag, and merged fingerprint list. All of these attributes are stored in the node attribute collection of the graph database, supporting on-demand querying and updating.

[0029] The operation count field is initially set to 1 and is used to count the frequency of operations with the same idempotent key, which is accumulated during merging. The creation timestamp field is initially equal to the system timestamp and is updated to the minimum timestamp in the merge group during the merging process, representing the start time of the operation group. The parameter history array initially contains the current operation parameters. When multiple operations are merged, the actual parameters of each operation are appended sequentially for auditing and anomaly detection. The merge flag is initially set to an unmerged state, indicating whether the node has been merged into other nodes.

[0030] Furthermore, for each operational operation, it is necessary to analyze the actual data entities read and written. Data entities can be any addressable storage unit, such as files, database records, objects in object storage, configuration items, etc.

[0031] The storage path affected by the operation (e.g., file path, keyspace path) and the last modified timestamp of the data entity are parsed from the operation parameters or the handle returned by the operating system. The combined string of the storage path and the last modified timestamp (e.g., path|timestamp) is used as the unique identifier of the data node. The reason for using the last modified timestamp instead of just the path is that the same path represents different data versions at different points in time (e.g., log rotation, configuration file updates). By introducing timestamps, the data state of the same resource at different times can be distinguished, thereby more accurately modeling data dependencies.

[0032] Ideally, edges with different directions and semantics are established between the operation node and the data node, depending on the operation type. For example, for a read operation, an input data node representing the data entity is created or reused, and then a consumption edge is added, pointing from the data node to the operation node. This edge carries the byte offset range read, for example, start=0, end=4095, indicating that the operation read a specific interval of the data entity. If the operation reads the entire entity, the offset range can be denoted as full or use a special value (such as 0~EOF). The semantics of the consumption edge indicate that the operation node obtains data from the data node, i.e., the data is consumed. For a write operation, an output data node is created or reused, and then a production edge is added, pointing from the operation node to the data node. This edge carries the amount of data written (number of bytes) and the write mode (e.g., overwrite, append, truncation). The write mode can be extracted from the operation parameters and used to evaluate the impact of the write operation on the data content. The semantics of the production edge indicate that the operation node generates or modifies data, i.e., the data is generated.

[0033] Each data node maintains an integer reference counter, initially set to 0. The reference counter increments by 1 whenever a consumed or generated edge is associated with the data node; it decrements by 1 when an edge is deleted, for example, due to the merging of operation nodes. This counter reflects how many operation nodes in the current knowledge graph directly depend on the data node. When the reference counter reaches 0, it indicates that no operation node is reading or writing to the data entity; at this point, the data node becomes an orphan node and can be automatically deleted to free up storage space.

[0034] As can be seen, this invention transforms the original, unordered operation logs into a structured attribute graph with temporal sequence and data dependencies. Distinguishing between consumption edges and generation edges reveals the direction of data flow in the model, supporting both data tracing (tracing back from a data node to all operation nodes that have read it) and impact analysis (tracing down from an operation node to all data nodes it has modified).

[0035] S2: Based on the normalization results of the operation content and resource path, merge multiple operation nodes that are adjacent in time and have the same idempotent key to obtain a representative operation node.

[0036] This embodiment, based on the original set of operation nodes generated in step S1, eliminates duplicate or similar operation records through idempotent merging, reducing the redundancy of the knowledge graph and providing a simplified node set for subsequent temporal dependency analysis. Specifically, it includes the following steps:

[0037] S2.1: For each operation node, exclude predefined dynamic time-related fields from the operation parameter fields.

[0038] The dynamic time-related fields include, but are not limited to: timestamp, timeout value, random number, request ID, session ID, and any parameter key names that change with each operation execution. The remaining parameter key-value pairs constitute the static parameter part of this operation node.

[0039] At the same time, the target resource path of the operation node is standardized: the numeric suffix and version number in the path are removed.

[0040] For example, the ".20250101" in the path / var / log / nginx / access.log.20250101 is removed, resulting in / var / log / nginx / access.log. The normalized path is called the normalized trunk.

[0041] Furthermore, the operation type, the normalized backbone, and the static parameter part are concatenated into a string in a fixed order, for example, the concatenation format is: operation type|normalized backbone|key name 1=value 1|key name 2=value 2|…, and then the SHA-256 hash algorithm is used to perform hash calculation on the string, and the resulting hexadecimal string is used as the idempotent key of the operation node.

[0042] The idempotency key is used to determine whether two operations are functionally equivalent: if the idempotency keys of two operation nodes are the same, it means that they have the same operational semantics after excluding time-related factors and can be merged.

[0043] S2.2: Sort all operation nodes in ascending order according to the value of the system timestamp field. If multiple operation nodes have the same system timestamp, then sort them again according to the lexicographical order of the operation fingerprints to ensure the determinism of the sorting result.

[0044] After sorting, the sequence of operation nodes is traversed sequentially. For the currently traversed operation node (denoted as the current node), the first node in the sequence that has not been marked as merged is searched backwards, and this node is taken as the previous node (i.e., all merged nodes are skipped). Then, the idempotency key of the current node is compared with the idempotency key of the previous node.

[0045] If the two are equal, then perform the following merge operation:

[0046] The operation count of the current node is incremented into the operation count field of the previous node; the last occurrence timestamp field of the previous node is updated to the maximum value between the last occurrence timestamp of the previous node and the system timestamp of the current node; the creation timestamp field of the previous node is updated to the minimum value between the creation timestamp of the previous node and the system timestamp of the current node; the operation parameters (complete key-value pairs) of the current node are appended to the end of the parameter history array of the previous node, arranged in the order of system timestamps.

[0047] Store the operation fingerprint of the current node into the merged fingerprint list of the previous node; set the merge flag of the current node to the merged state.

[0048] To improve merging efficiency, in another embodiment, a hash mapping from idempotent keys to a list of operation nodes can be constructed first, then the nodes in each list can be sorted by timestamp, and then merged sequentially.

[0049] Specifically, the method iterates through all original operation nodes, adding them to a hash map value list using idempotent keys. For each value list, nodes are sorted in ascending order by system timestamp. The sorted list is then sequentially traversed, merging adjacent nodes into a single representative operation node, and updating the operation count and timestamp extreme values. This method avoids multiple iterations and backtracking, achieving a time complexity of O(nlogn).

[0050] S2.3: For the current node that is being merged, all associated consumption edges and generation edges need to be redirected to the previous node to ensure that the dependency relationship between the data node and the effective operation node is not broken.

[0051] Specifically, when redirecting edges, atomic operations are used to update the reference counters of data nodes: first, perform an atomic decrement, then perform an atomic increment; or, in the entire graph database transaction, write locks are applied to the data nodes involved to ensure the atomicity of counter updates and edge modifications.

[0052] It is important to note that when the current operation node being merged already has an edge of the same type pointing to the same data node with the previous operation node (e.g., both are connected to the same data node via consumption edges), the redirection operation may introduce duplicate edges. To avoid duplicate edges causing distortion of the reference counter or redundancy in the knowledge graph, before adding a redirected edge, it is necessary to check whether the previous operation node already has an edge of the same type pointing to that data node. If it already exists, no new edge is added; only the original edge of the merged node is deleted, and the reference counter is adjusted (e.g., only decrementing by 1, not incrementing by 1). If it does not exist, a new edge is added, and the reference counter is incremented by 1.

[0053] The above operations ensure the accuracy of the reference counter: the reference counter of each data node is always equal to the number of edges pointing to that data node in all currently unmerged operation nodes.

[0054] S2.4: After completing the edge redirection, check the reference counters of all data nodes.

[0055] For data nodes whose reference counter becomes 0, further determine whether the data node is still associated with any operation node that has not been merged (since the reference counter is already 0, it is theoretically no longer associated, but to prevent inconsistencies caused by concurrent modifications, a second confirmation can be performed).

[0056] If no valid operation node is associated with the data node, then the data node is deleted from the knowledge graph to free up storage space.

[0057] S2.5: Steps S2.2 to S2.4 above need to be executed repeatedly until all adjacent operation nodes with the same idempotent key in the sequence have been processed.

[0058] Since the attributes of the previous node are updated after merging, but this does not affect the idempotency keys of subsequent comparisons (because idempotency keys do not depend on these mutable fields), all adjacent merges can be completed in a single left-to-right traversal. However, to handle new adjacency relationships arising from skipping merged nodes—for example, if three nodes A, B, and C have the same idempotency key, and after A merges with B, C becomes adjacent to A—an iterative traversal approach is typically used in practice: each traversal starts from the head of the sequence and repeatedly performs comparison and merge operations until no merges occur in a certain traversal.

[0059] Ultimately, all nodes that were not marked as merged constitute the set of representative operation nodes.

[0060] In addition, the representative operation node also needs to maintain an original timestamp-count list. This list is an array, and each element is a tuple (system timestamp, operation count value), which records the system timestamp and its corresponding operation count of each original operation node in the merge group.

[0061] It's important to note that the representative operation node is essentially still an operation node, and therefore inherits all attribute fields. However, after the merge, the system timestamp field representing the operation node no longer has the meaning of a single point in time and can be set to null or ignored. Specifically, all time-based sorting, difference calculation, and time-series dependency edge construction in subsequent steps will use the weighted average timestamp generated during the merge process, and will no longer use the system timestamp attribute representing the operation node. The original value of this attribute is retained only for audit traceability and will not participate in any analysis logic to avoid confusion.

[0062] As can be seen, idempotent merging can merge the same operations that are repeatedly executed in a short period of time, such as repeated writes caused by retries, loops or configuration errors, into a single representative operation node, which significantly reduces the number of nodes in the knowledge graph and reduces the complexity of subsequent temporal dependency analysis. At the same time, the operation count field and parameter history array are preserved during the merging process, so that the frequency information of the original operation and the parameter change trajectory can still be traced and audit information will not be lost.

[0063] Furthermore, this invention employs an idempotent key generation method based on a normalized backbone and static parameters, which ensures that even if the target resource path of the operation contains dynamically generated numeric suffixes (such as log rotation files) or version numbers, it can still be correctly identified as an equivalent operation, thus improving the robustness of the merge.

[0064] S3: Based on the distribution characteristics of representative operation nodes in the time series, construct temporal dependency edges between representative operation nodes.

[0065] It should be noted that, in this embodiment of the invention, step S3, based on the representative operation node set generated in step S2, analyzes the distribution pattern of each representative operation node on the time axis, mines the temporal correlation between nodes, and adds directed temporal dependency edges. These edges are used to characterize the possible causal or temporal correlation between two operation nodes, providing a basis for subsequent anomaly detection and root cause analysis. The specific operation steps are as follows:

[0066] S3.1: First, calculate the weighted average timestamp for each representative operation node. The calculation formula is: ; in, To merge the total number of operation nodes within the group, For the first The system timestamp (i.e., the interception time) of each operation node. For the first The value of the operation count field of each operation node.

[0067] For a sorted sequence, the first representative operation node in the sequence is defined as having no nearest predecessor node. For each representative operation node in the sequence other than the first node, the system calculates the time difference between that node and its nearest predecessor node (i.e., the previous node in the sequence).

[0068] The time difference is calculated by subtracting the weighted average timestamp of the predecessor node from the weighted average timestamp of the current node.

[0069] S3.2: Maintain a fixed-length time difference sequence of length L=5 for each representative operation node. The time difference sequence stores several non-zero time difference values ​​preceding the node in ascending order of time. If the actual number of non-zero differences obtained is less than 5, fill the beginning of the sequence with zero values ​​until the length is 5.

[0070] The specific steps for constructing this sequence are as follows:

[0071] (1) Starting from the current representative operation node, trace back its predecessor node sequence. Sequentially obtain the time difference between the current node and its nearest predecessor node, and record it as the first difference.

[0072] (2) If the difference is zero, it means that the timestamps of the two nodes are the same. Then skip the difference and continue to trace back to the earlier predecessor node to get the next non-zero difference. If the difference is non-zero, then store the difference temporarily and continue to trace back to get the earlier non-zero difference.

[0073] Repeat the above tracing process until the number of temporarily stored non-zero differences reaches a preset fixed length, or until it is impossible to continue tracing forward, i.e., the starting node of the sequence has been reached.

[0074] Arrange all the temporarily stored non-zero differences in ascending order to form the time difference sequence representing the operating node. The first element of the sequence is the oldest difference, which is the difference between the current node and its farthest predecessor, and the last element is the latest difference, which is the difference between the current node and its nearest predecessor.

[0075] If the actual number of non-zero differences obtained is less than the fixed length, the beginning of the sequence is padded with zero values ​​to the fixed length. Simultaneously, the actual number of non-zero differences in the sequence is recorded for subsequent determination.

[0076] In addition, for the first representative operation node in the sequence, since there is no predecessor node, all elements of its time difference sequence are set to zero, and the actual number of non-zero differences is recorded as zero.

[0077] It should be noted that the selection principle of length L is to strike a balance between computational overhead and pattern representation capability. This embodiment analyzes logs from a real-world operation and maintenance platform and statistically finds that the temporal dependencies between adjacent operations typically involve the preceding 3 to 6 operation intervals. For example, typical periodic tasks, such as data synchronization performed every 5 minutes, usually only require 2 to 3 historical intervals to identify their interval patterns; while complex cascading task chains (such as A triggering B, B triggering C, C triggering D) require tracing back at most 4 to 5 intervals to capture the complete pattern. When L is less than 4, the accuracy of identifying long-chain dependencies decreases by approximately 15%; when L is greater than 6, the computational overhead increases by approximately 30%, and excessively long historical sequences introduce noise. Therefore, this embodiment fixes L at 5. For special scenarios with extremely high or low operation frequencies and particularly long dependency chains, users can adjust the value of L according to actual needs (e.g., setting it to 10), and the adjusted solution still belongs to an equivalent variation of this invention.

[0078] S3.3: For any two nodes in the sorted sequence of representative operation nodes, the node with the smaller timestamp is designated as the first node, and the node with the larger timestamp is designated as the second node.

[0079] First, determine whether the difference between the weighted average timestamp of the second node and the weighted average timestamp of the first node is less than or equal to a preset time window. The preset time window can be configured according to the actual operation and maintenance scenario, for example, set to 3600 seconds (one hour). If the time difference exceeds this time window, it is considered that the time span between the two nodes is too large and they do not have a direct temporal dependency relationship, and subsequent judgments are skipped.

[0080] If the time difference is less than or equal to the time window, proceed to the next dependency determination process.

[0081] S3.4: For node pairs filtered by the time window, obtain the time difference sequence of each pair, and extract the non-zero difference from each sequence. Construct the non-zero sequence of the first node and the non-zero sequence of the second node in order from old to new.

[0082] If any of the non-zero sequences is empty, that is, the node has no non-zero time difference in its tracing range, then the dependency determination of the current node pair is skipped, and it is assumed that there is no temporal dependency edge between the two.

[0083] S3.5: To compare whether the time interval patterns of two nodes are similar, the non-zero sequence of the first node needs to be scaled by time to a range comparable to that of the second node. Specifically:

[0084] Multiply each element of the non-zero sequence in the first node by a scaling factor to obtain the scaled sequence. This operation is equivalent to stretching or compressing the interval pattern on the first time axis to match the time scale of the second node.

[0085] Let the last element of the non-zero sequence of the first node be... .like If the value is 0, then the construction of a temporal dependency edge between this node pair is abandoned, meaning the two patterns are considered incomparable; otherwise, the scaling factor is (weighted average timestamp of the second node - weighted average timestamp of the first node) divided by 0. .

[0086] To verify the rationality of using the time interval between the last element of a non-zero sequence (i.e., the first node and its nearest predecessor) and the scaling benchmark, a sensitivity analysis was conducted. 1000 pairs of operation nodes with a clear causal relationship were collected from actual operational data (e.g., service restart triggered after configuration file writing). The average difference between the scaled sequence and the second node sequence was calculated when the last element, median, mean, and first element of the interval sequence of the first node in each pair were used as the scaling benchmark. The results showed that when using the last element as the benchmark, the proportion of differences less than 0.001 was 94.2%, significantly higher than the results when using the median (87.6%), mean (85.1%), and first element (72.3%) as benchmarks.

[0087] This indicates that the latest interval has the strongest predictive power for the time pattern of subsequent operations in the operation and maintenance sequence. Furthermore, when an abnormal interval is artificially introduced to the end of the sequence, such as increasing the value of the last element by a factor of 5, the difference based on the last element rises sharply to over 0.5, causing dependency edges to not be created, thus avoiding erroneous associations. If users wish to improve robustness to outliers, a variation of this embodiment can be adopted: sorting the sequence elements and taking the median as the benchmark, or removing outliers exceeding the mean ± 3 standard deviations before taking the last valid value. The above verifications and variations do not depart from the spirit of this invention.

[0088] Furthermore, the shorter sequence length between the scaled sequence and the non-zero sequence of the second node is taken, denoted as K. Since both sequences are arranged in order from oldest to newest (i.e., from furthest to nearest), and the latest time interval (the end of the sequence) better reflects the temporal characteristics of the current operation, they are aligned starting from the ends of the two sequences, i.e., the last K elements of each are truncated, and denoted as the truncated first sequence and the truncated second sequence, respectively. If the length of a sequence is exactly K, then all elements are taken.

[0089] For each pair of elements at corresponding positions in the two truncated sequences, calculate the difference at that position.

[0090] The difference is calculated as follows: difference = |first sequence element - second sequence element| / (|second sequence element| + ε), where ε is a very small positive number (e.g., 1e-6) to avoid division by zero.

[0091] In summary, the average difference across all aligned positions is calculated by dividing the sum of the differences at each position by the alignment length.

[0092] It should be noted that in this invention, the last element of the non-zero sequence of the first node is used. The reason for using the latest interval as the scaling benchmark is that the last element corresponds to the time interval between the first node and its most recent predecessor operation, representing the latest operation frequency of that node in the local time sequence. In the operation sequence, recent behavior has a higher weight in determining the pattern similarity within the current time window compared to historical behavior. Therefore, using the latest interval as the benchmark for overall linear scaling can preserve the relative distribution shape of historical intervals, while stretching or compressing the time scale of the entire sequence to be consistent with the time span of the second node.

[0093] The mathematical basis of this scaling method is the assumption that the operation interval pattern approximately satisfies linear scaling on the time axis. That is, the interval variation of the same operation chain within different time periods is mainly dominated by multiplicative factors such as system load and scheduling latency, rather than random disturbances. This assumption has wide applicability in typical scenarios such as periodic tasks, batch processing jobs, and automated operation and maintenance scripts. Furthermore, if the latest interval in a real-world scenario is not representative due to outliers, it can be replaced by pre-filtering outliers or using the median as a benchmark. This is a simple variation of the invention and does not depart from its spirit.

[0094] Furthermore, the scaling alignment method used in this embodiment differs from and has advantages over traditional Dynamic Time Warping (DTW) in that: DTW finds the optimal nonlinear alignment path between two sequences through dynamic programming, with a computational complexity of O(L²), and is suitable for comparing the similarity of sequences of arbitrary shapes; while this invention assumes that the operation interval pattern approximately satisfies linear scaling on the time axis. This assumption is widely valid in typical scenarios such as periodic tasks, batch processing jobs, and automated operation and maintenance scripts, thus simplifying the problem to single-parameter linear scaling. By using the latest interval at the end of the sequence as the scaling benchmark, not only is the computational complexity reduced to O(L), but the influence weight of recent behavior on similarity determination is naturally higher than that of historical behavior, which is consistent with the practical need for more recent patterns in operation and maintenance analysis. Comparative experiments show that, in determining interval pattern similarity, the method of this invention achieves an accuracy of 96.3% in the linear interval scaling scenario, which is close to DTW's 97.1%. However, when dealing with sequences containing abnormal interval values ​​(such as occasional network latency), this invention limits the length of non-zero sequences and scales only based on the latest interval at the tail, thus restricting the impact of outliers to a local level and reducing the false alarm rate of dependent edges by approximately 12%. In the scenario of operational correlation analysis, this method can significantly improve computational efficiency while maintaining high accuracy and has better suppression capabilities for occasional abnormal intervals.

[0095] S3.6: Compare the calculated average difference with the preset error threshold.

[0096] The error threshold can be configured according to the accuracy requirements of the actual application scenario, for example, set to one-thousandth (0.001). If the average difference is less than the error threshold, it is considered that the time interval patterns of the first node and the second node are highly similar, and there is a potential temporal dependency between them. At this time, a directed edge is added between the first node and the second node, with the direction from the first node to the second node, indicating that the time pattern of the second node inherits the interval characteristics of the first node, and the two may belong to the same operation chain or have a causal relationship.

[0097] It should be noted that the setting of the error threshold directly affects the number of temporally dependent edges and the accuracy of subsequent analysis. This embodiment presents an adaptive threshold determination method based on statistical distribution: In the set of operation nodes to be analyzed, 1000 pairs of nodes without explicit temporal dependencies are randomly selected, and the average dissimilarity of each pair of nodes is calculated to obtain the distribution of dissimilarity. The threshold is set to the 5th percentile of this distribution or the 3σ principle is adopted. For general operation and maintenance scenarios, the recommended value is 0.001 to 0.01; for scenarios requiring high recall (such as security auditing), it can be appropriately relaxed to 0.05; for scenarios requiring high accuracy (such as root cause localization), it can be tightened to 0.0001. Users can dynamically adjust this threshold in the system configuration file and select the optimal value that maximizes the F1 score through cross-validation. This embodiment does not limit the specific value of the threshold or the method of determination; any method for determining temporally dependent edges based on the comparison of average dissimilarity and threshold falls within the protection scope of this invention.

[0098] S3.7: To quantify the strength or importance of each temporal dependency edge, a normalized weight value is calculated for each added edge. The specific steps are as follows:

[0099] Specifically, for each edge, obtain the non-zero time difference sequence of the first node and calculate the harmonic mean of the sequence.

[0100] The harmonic mean is calculated by dividing the length of the sequence by the sum of the reciprocals of the elements in the sequence. This harmonic mean serves as the original weight of the edges, reflecting the density of time intervals between the source nodes.

[0101] Furthermore, collect the original weights of all temporally dependent edges in the graph to be constructed, and find the global minimum and global maximum values ​​among them.

[0102] Normalization is performed on each edge: If there is only one edge in the graph, or the global minimum value equals the global maximum value (i.e., all edges have the same original weight), then the normalized weight is set to 1; otherwise, the original weight of each edge is subtracted from the global minimum value, and then divided by the difference between the global maximum value and the global minimum value to obtain the normalized weight of that edge. The normalized weight ranges from 0 to 1.

[0103] The calculated normalized weights are stored as the weight attributes of the edge, and used in subsequent analysis to evaluate the relative importance of different dependent edges.

[0104] As can be seen, by constructing temporal dependency edges, this invention can establish associations between representative operation nodes based on the similarity of time interval patterns. Unlike traditional temporal association methods based on fixed thresholds, this invention constructs a historical time difference sequence for each node and uses scaling alignment and average difference comparison to identify similar operation interval patterns at different time scales, thereby discovering potential periodic tasks, cascading calls, or causal dependencies.

[0105] This invention does not rely on specific business semantics; it can automatically mine the temporal correlation between operation nodes using only timestamp information, and has strong versatility and robustness.

[0106] S4: Store the representative operation node, the data node, and each edge into the knowledge graph for correlation analysis of operation and maintenance data.

[0107] S4.1: The attribute graph model is used as the data organization method for the knowledge graph. In this model, nodes and edges can contain any number of attribute key-value pairs.

[0108] Specifically, each representative operation node is stored as a graph node, and each created and not deleted data node is stored as a graph node; all consumed edges, generated edges, and temporally dependent edges are stored as graph edges. Each edge records the source node identifier, the target node identifier, and the edge type, such as consumed edge, generated edge, or temporally dependent edge.

[0109] To ensure traceability of edge attribute updates, each edge is assigned a globally monotonically increasing edge number. Whenever an edge's attribute needs to be updated, such as when the weight of a time-dependent edge is recalculated due to new data, the original edge is not modified directly. Instead, a new edge is generated, assigned a new edge number, and the updated attribute is written to the new edge. The old edge is retained in its original position as a historical version for auditing and rollback purposes.

[0110] This design allows the evolution of the knowledge graph to be fully recorded, facilitating time travel queries and change tracking.

[0111] S4.2: To accelerate the retrieval of operation nodes based on resource paths, an inverted index is built for each normalized backbone. The inverted index uses the normalized backbone as the key and the values ​​are a list of operation node identifiers that contain that backbone.

[0112] For example, for the normalized trunk / var / log / nginx / access.log, the inverted index entries store a list of all operation node IDs that access this log file.

[0113] Since the number of operation nodes can be very large, in order to further accelerate the determination of whether a certain operation node belongs to a given normalized backbone, a Bloom filter is constructed for each normalized backbone. The specific construction method is as follows:

[0114] After the set of representative operation nodes is determined, all representative operation nodes are traversed at once. For each node, the normalized backbone corresponding to the target resource path is obtained, and the operation fingerprint of the node is added to the Bloom filter corresponding to the backbone.

[0115] The false positive rate of the Bloom filter is set to a preset value, such as one percent (0.01), which means that there is at most a 1% probability of misclassifying a node that does not actually exist as potentially existing.

[0116] The Bloom filter uses a preset number of hash functions for mapping to balance storage space and query accuracy. In this embodiment, the preset number is 3, using three independent hash functions, for example, deriving three different seed values ​​based on the MurmurHash3 algorithm. This number can be adjusted according to the expected total number of elements and the false positive rate, but it needs to be fixed in the system configuration.

[0117] Furthermore, when performing a query, the list of operation nodes corresponding to a certain normalized backbone is first obtained directly through the inverted index; for scenarios that require quickly determining whether a node identifier may belong to a certain backbone, the corresponding Bloom filter is queried first. If it returns that it does not exist, it is skipped directly. If it returns that it may exist, it is then confirmed precisely through the inverted index.

[0118] This two-level indexing mechanism significantly reduces unnecessary disk or memory accesses.

[0119] S4.3: In order to support association analysis by resource path dimension, the set of operation nodes with the same normalized backbone is found according to the inverted index, and combined with the constructed temporal dependency edges, a set of association triples is generated.

[0120] Each association triple is an ordered triple of the form: source operation node identifier, dependency edge type, and target operation node identifier. The dependency edge type can be a time-series dependency edge, a data consumption edge, or a data generation edge.

[0121] Furthermore, the associated triplet set is stored in fragments according to the resource path.

[0122] Specifically, the normalized backbone corresponding to each operation node is extracted, and all operation nodes belonging to the same normalized backbone and their related edges are grouped into the same shard. Each shard is stored independently in a storage unit, such as a database table or a file, and the shard name is identified by the normalized backbone.

[0123] For time-series dependent edges across resource paths, where the source and target operation nodes belong to different normalized backbones, the triples of this edge are copied and stored in two shards: the normalized backbone shard containing the source operation node and the normalized backbone shard containing the target operation node. This ensures that the cross-path dependency can be retrieved regardless of which resource path the query originates from.

[0124] For example, operation node A operates on the normalized trunk ` / app / logs / a.log`, and operation node B operates on the normalized trunk ` / app / config / setting`, with a temporal dependency edge between A and B. The associated triple (A, temporal dependency, B) is stored in both the `a.log` shard and the `setting` shard. When analyzing operations related to `a.log`, this cross-path dependency can be traced; similarly, when analyzing operations related to `setting`, it can also be traced.

[0125] As can be seen, this invention organizes complex operational data into an efficient and queryable knowledge graph. The attribute graph model intuitively represents operation nodes, data nodes, and diverse edge types, facilitating graph traversal and pattern matching. Furthermore, the globally monotonically increasing edge numbers and the old version retention mechanism ensure complete traceability of the knowledge graph, supporting the backtracking and auditing of historical states. The above storage scheme provides an efficient data access interface for upper-layer applications (such as anomaly detection, root cause analysis, and impact assessment). The method also includes one or more processors and a memory.

[0126] The memory is used to store operable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations. These operations include the flow of a knowledge graph-based AI agent platform security operation and maintenance data association analysis method according to the foregoing embodiments, especially... Figure 1 The flowchart of the method is shown.

[0127] Other aspects disclosed in the embodiments of the present invention also propose a computer-readable medium for storing software including instructions executable by one or more computers, which, upon execution, cause the one or more computers to perform operations including the flow of a knowledge graph-based AI agent platform security operation and maintenance data association analysis method according to the foregoing embodiments, particularly... Figure 1 The flowchart of the method is shown.

[0128] It should be recognized that embodiments of the present invention may be implemented or carried out by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable storage medium.

[0129] The method can be implemented using standard programming techniques, including a non-transitory computer-readable storage medium configured with a computer program in the computer program, wherein the storage medium is configured such that the computer operates in a specific and predefined manner.

[0130] Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with the computer system; however, if required, the program can be implemented in assembly or machine language.

[0131] In any case, the language can be either compiled or interpreted.

[0132] Furthermore, for this purpose, the program can run on programmed application-specific integrated circuits.

[0133] The processes described herein (or variations and / or combinations thereof) can be executed under the control of one or more computer systems configured with executable instructions, and can be implemented by hardware or a combination thereof as code (e.g., executable instructions, one or more computer programs, or one or more applications) that commonly executes on one or more processors. The computer program includes a plurality of instructions executable by one or more processors.

[0134] Furthermore, the method can be implemented in any suitable computing platform, including but not limited to personal computers, minicomputers, mainframes, workstations, networked or distributed computing environments, standalone or integrated computer platforms, or in communication with charged particle tools or other imaging devices.

[0135] Various aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether portable or integrated into a computing platform, such as a hard disk, optical read and / or write storage medium, RAM, ROM, etc., such that it can be read by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the processes described herein.

[0136] Furthermore, machine-readable code, or parts thereof, can be transmitted via wired or wireless networks.

[0137] When such media includes instructions or programs that combine with a microprocessor or other data processor to implement the steps described above, the invention described herein includes these and other different types of non-transitory computer-readable storage media.

[0138] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs, characterized in that, include: Collect operation and maintenance data, and create operation nodes based on operation characteristics; Data nodes are created based on the data entities involved in the operation, and the operation nodes are associated with the data nodes through edges; Based on the normalization results of operation content and resource paths, multiple operation nodes that are adjacent in time and have the same idempotent key are merged to obtain a representative operation node. Based on the distribution characteristics of representative operation nodes in the time series, temporal dependency edges are constructed between representative operation nodes; The representative operation node, the data node, and each edge are stored in the knowledge graph for correlation analysis of operation and maintenance data.

2. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 1, characterized in that, The creation of operation nodes based on operation characteristics includes: Intercept each operation and maintenance operation from the AI ​​intelligent agent platform, record the system timestamp at the time of interception, and extract the operation type, process identifier, target resource path, and operation parameters; The operation fingerprint is generated by concatenating the operation type, process identifier, target resource path, and parameter key name list in the operation parameters and then using a hash algorithm. The operation fingerprint is used as the unique identifier of the operation node.

3. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 2, characterized in that, The attributes of the operation node include at least: System timestamp, process identifier, target resource path, operation parameters, operation count field, creation timestamp field, last occurrence timestamp field, parameter history array, merge flag, and list of merged fingerprints; The initial value of the operation count field is 1, the initial value of the creation timestamp field is equal to the system timestamp, the initial value of the last occurrence timestamp field is equal to the system timestamp, the parameter history array initially contains the current operation parameters, the merge flag is initially in an unmerged state, and the merged fingerprint list is initially empty.

4. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 3, characterized in that, Associating the operation node with the data node via an edge includes: Each data entity read or written by the operation and maintenance is parsed, and the combination of the storage path and the last modified timestamp of the data entity is used as the unique identifier of the data node. If the operation is a read operation, an input data node is created or reused, and the input data node is connected to the operation node via a consumption edge, the consumption edge carrying the byte offset range to be read; If the operation is a write operation, an output data node is created or reused, and the operation node is connected to the output data node by generating an edge, which carries the amount of data to be written and the write mode. Each data node maintains a reference counter, initially set to 0. The reference counter increments by 1 whenever a consumed edge or generated edge is associated with the data node, and decrements by 1 when an edge is deleted.

5. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 3, characterized in that, The merger includes: Exclude predefined dynamic time-related fields from the operation parameters to obtain the static parameter part; normalize the target resource path by deleting numeric suffixes and version numbers from the path to obtain the normalized backbone; concatenate the operation type, the normalized backbone, and the static parameter part in sequence, and then use a hash algorithm to generate an idempotent key. All operation nodes are sorted in ascending order of system timestamp. If multiple operation nodes have the same system timestamp, they are sorted in lexicographical order of operation fingerprint.

6. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 5, characterized in that, The merger also includes: The idempotency key of the current operation node is compared with the idempotency key of the previous operation node in turn. During the comparison, nodes that have been marked as merged are skipped. That is, the first unmerged node is found and taken as the previous node. If the idempotency key of the current operation node is the same as that of the previous operation node, then the operation count value of the current operation node is added to the operation count field of the previous operation node, the last occurrence timestamp of the previous operation node is updated to the maximum value between the last occurrence timestamp of the previous operation node and the system timestamp of the current operation node, the creation timestamp of the previous operation node is updated to the minimum value between the creation timestamp of the previous operation node and the system timestamp of the current operation node, the operation parameters of the current operation node are appended to the parameter history array of the previous operation node, the operation fingerprint of the current operation node is stored in the merged fingerprint list of the previous operation node, and the merge flag of the current operation node is set to the merged state.

7. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 6, characterized in that, The merger also includes: For the merged current operation node, all consumed edges and generated edges associated with the current operation node are redirected to the previous operation node, and the reference counter of the data node is adjusted. The reference counter of the data node associated with the redirected edge is first decremented by 1 and then incremented by 1 according to the new connection; A data node is deleted only when its reference counter becomes 0 and the data node is no longer associated with any unmerged operation node. Repeat the merging operation until all adjacent operation nodes with the same idempotent key have been processed, resulting in a merged set of representative operation nodes.

8. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 1, characterized in that, The construction of temporal dependency edges between representative operation nodes includes: Calculate the weighted average timestamp for each representative operation node; Arrange the representative operation nodes in ascending order of weighted average timestamps; For each representative operation node in the permutation except for the first node, calculate the time difference between the representative operation node and the previous representative operation node. A time difference sequence is constructed for each representative operation node, the time difference sequence being composed of several non-zero time difference values ​​preceding the representative operation node arranged in order from oldest to newest; For any two representative operation nodes in the permutation, the node with the smaller weighted average timestamp is taken as the first node, and the node with the larger weighted average timestamp is taken as the second node. If the difference between the weighted average timestamp of the second node and the weighted average timestamp of the first node is less than or equal to a preset time window, then obtain the non-zero time difference sequence of the first node and the non-zero time difference sequence of the second node. If both sequences are not empty, the non-zero time difference sequence of the first node is scaled proportionally and then aligned and compared with the non-zero time difference sequence of the second node to calculate the average difference. If the average difference is less than a preset error threshold, a directed temporal dependency edge is added between the first node and the second node, with the direction pointing from the first node to the second node.

9. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 8, characterized in that, The construction of temporal dependency edges between representative operation nodes also includes: Calculate the weight for each temporal dependency edge; The weights are determined based on the statistical characteristics of the non-zero time difference sequence of the source nodes; After normalizing all weights, the normalized weights are attached to the corresponding temporal dependency edges.

10. The method for correlation analysis of security operation and maintenance data of an AI intelligent agent platform based on knowledge graphs according to claim 9, characterized in that, The storage to the knowledge graph includes: Store the operation nodes, data nodes, consumption edges, production edges, and temporal dependency edges in the graph database using an attribute graph model; Create an inverted index for each normalized trunk and build a Bloom filter for fast member queries; The set of operation nodes with the same normalized backbone is found based on the inverted index, and a set of associated triples is generated by combining the temporal dependency edges. The triple set is stored in segments according to resource paths. For time-dependent edges that cross resource paths, they are stored in multiple segments respectively.

Images