A method, system, and device for processing operation and maintenance subject data.

Abstract

This invention provides a method, system, and device for processing operation and maintenance (O&M) topic data. The method includes: parsing the real-time O&M events to obtain a real-time event dataset; the real-time event dataset includes: business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times; matching at least two sets of target complete topic hyperedges from a hyperedge knowledge base based on the business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times; and sorting the at least two sets of target complete topic hyperedges according to their comprehensive weight, entity coverage completeness, relationship closure, event support, time co-occurrence strength, historical repetition frequency, business impact, and strong and weak entity subsets to obtain a target complete topic hyperedge list. This invention can effectively adapt to complex and massive cross-domain O&M fault diagnosis scenarios under a distributed microservice architecture.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information technology operation and maintenance technology, and in particular to a method, system and device for processing operation and maintenance subject data. Background Technology

[0002] In current distributed microservice architectures, IT system components are numerous and call chains are complex. When a failure occurs, dozens or even hundreds of real-time operational events are triggered simultaneously across devices and business domains, including alarm logs, slow queries, version changes, abnormal resource loads, network failures, and other data types. Existing operational failure analysis solutions have the following shortcomings:

[0003] Traditional operation and maintenance platforms only display individual alarms independently, lacking a unified fault theme aggregation mechanism. Multiple scattered events caused by the same root cause cannot be automatically aggregated, requiring operation and maintenance personnel to manually sort out the relationship between events, which is time-consuming for fault localization; moreover, it is impossible to distinguish between the root fault entity and the subordinate entities that are affected by it, making it difficult to quickly pinpoint the root cause of the fault.

[0004] Existing tools simply count the number of alarms to determine the severity of a fault, without comprehensively considering multiple dimensions such as entity coverage completeness, link closure, event support volume, historical fault frequency, and business loss to quantify the credibility of a fault. At the same time, there is no unified weighted sorting rule, and multiple suspected fault topics cannot be automatically sorted according to root cause priority, resulting in high manual screening costs.

[0005] Existing solutions only temporarily display real-time events and do not uniformly store entity dependencies, event evidence, and fault propagation links of similar historical faults; they lack a structured knowledge base with search indexes, requiring repeated analysis for each fault occurrence, making it impossible to reuse historical fault experience, resulting in low efficiency in fault reproduction and troubleshooting.

[0006] Traditional keyword matching and single entity matching methods rely solely on text or device name retrieval, failing to integrate the four-layer relationship of entity information, business scenario, time window, and call chain. This results in low matching accuracy, a tendency to push irrelevant fault topics incorrectly, and an increased workload for maintenance personnel in unnecessary troubleshooting. Summary of the Invention

[0007] The technical problem to be solved by the embodiments of the present invention is to provide a method, system and device for processing operation and maintenance subject data, which can effectively adapt to complex and massive cross-domain operation and maintenance fault diagnosis scenarios under distributed microservice architecture.

[0008] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0009] A method for processing operation and maintenance topic data includes:

[0010] Obtain at least two real-time operation and maintenance events;

[0011] The real-time operation and maintenance events are parsed to obtain a real-time event dataset; the real-time event dataset includes: business scenario, real-time entity, real-time relationship, real-time event and occurrence time;

[0012] Based on the business scenario, real-time entities, real-time relationships, real-time events, and occurrence time, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base;

[0013] Based on the comprehensive weight of the target complete topic superedges, entity coverage completeness, relationship closure, event support, time co-occurrence intensity, historical repetition frequency, business impact, and strong and weak entity subsets, at least two groups of target complete topic superedges are sorted to obtain a list of target complete topic superedges.

[0014] Output each target complete topic hyperedge in the target complete topic hyperedge list; wherein, the construction process of the hyperedge knowledge base includes: acquiring hierarchical and domain-specific knowledge graph data; the hierarchical and domain-specific knowledge graph data includes: entity set, relation set, event set, and time window data; determining a set of effective operation and maintenance candidate topics based on the entity set, relation set, event set, and time window data; assigning a standardized topic name and a globally unique topic number to each effective operation and maintenance candidate topic in the set of effective operation and maintenance candidate topics based on the entity set, relation set, event set, and time window data to obtain an intermediate set of effective operation and maintenance candidate topics; constructing the basic structure of topic hyperedges based on the intermediate set of effective operation and maintenance candidate topics; extracting and encapsulating multi-dimensional indicators on the basic structure of topic hyperedges to obtain complete topic hyperedges; storing the complete topic hyperedges and establishing a multi-dimensional retrieval index to obtain the hyperedge knowledge base.

[0015] Optionally, based on the entity set, relation set, event set, and time window data, a set of valid operation and maintenance candidate topics is determined, including:

[0016] The entity set, relation set, and event set are divided into time sequences according to fixed time intervals to obtain multiple groups of operation and maintenance data divided by time windows;

[0017] The data synchronization density, network link connectivity, log ticket text semantic similarity, and common impact on the same business are statistically analyzed among the operation and maintenance data groups within the same time window.

[0018] according to The comprehensive score of candidate topics among the various groups of the operation and maintenance data is obtained.

[0019] Among them, ThemeScore is the comprehensive score of candidate topics, T is the density of data synchronization, P is the network link connectivity, S is the semantic similarity of log ticket text, I is the degree of common influence of the same business, a is the first weight coefficient, b is the second weight coefficient, c is the third weight coefficient, and d is the fourth weight coefficient.

[0020] When ThemeScore ≥ TH, the corresponding two groups of operation and maintenance data are determined to be valid candidate themes.

[0021] Where TH is the topic generation threshold;

[0022] Based on the business scenario of the valid candidate topics, the valid candidate topics are labeled with topic type tags to obtain intermediate valid candidate topics;

[0023] The intermediate valid candidate topics are summarized to obtain a set of valid operation and maintenance candidate topics.

[0024] Optionally, based on the entity set, relation set, event set, and time window data, each valid operation and maintenance candidate topic in the valid operation and maintenance candidate topic set is assigned a standardized topic name and a globally unique topic number to obtain an intermediate valid operation and maintenance candidate topic set, including:

[0025] Extract key basic information from the entity set, relationship set, event set, and time window data bound to each valid operation and maintenance candidate topic; the key basic information includes: the business domain to which the topic belongs, the main level, the tagged topic type label, the deployment environment, the core entity identifier, and the start and end time of the time window;

[0026] The standardized topic name is obtained by concatenating the business domain to which the topic belongs, the main level, the tagged topic type, the deployment environment, the core entity identifier, and the start and end times of the time window.

[0027] A globally unique topic number is generated based on the topic's business domain, main level, tagged topic type, deployment environment, core entity identifier, and start and end times of the time window, using hash rules.

[0028] The standardized topic name and globally unique topic number are bound to the corresponding valid operation and maintenance candidate topic to obtain an intermediate valid operation and maintenance candidate topic set.

[0029] Optionally, based on the intermediate set of valid operation and maintenance candidate topics, a topic hyperedge infrastructure is constructed, including:

[0030] Extract all associated entities, inter-entity relationships, and operation and maintenance events from the intermediate valid operation and maintenance candidate topic set, and summarize them to obtain the entity set, relationship set, and event set;

[0031] Based on the degree of contribution of the entities in the entity set to the current topic phenomenon, the entity types are distinguished to obtain strong entity subsets and weak entity subsets;

[0032] Extract from the set of intermediate valid operation and maintenance candidate topics to obtain the business domain, main level, support level, start time, end time, evidence summary, standardized topic name and globally unique topic number;

[0033] According to the preset hyperedge storage structure, the entity set, relation set, event set, strong entity subset, and weak entity subset are uniformly encapsulated to obtain the topic hyperedge basic structure.

[0034] Optionally, the topic hyperedge infrastructure is subjected to multi-dimensional index extraction and encapsulation to obtain a complete topic hyperedge, including:

[0035] Multi-dimensional indicators were extracted from the aforementioned topic hyperedge infrastructure to obtain entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, and business impact.

[0036] according to

[0037] The overall weight of the superedge of the theme is obtained;

[0038] Among them, W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the temporal co-occurrence intensity, C freq C represents the historical repetition frequency. impact To represent the degree of business impact, α is the fifth weighting coefficient, β is the sixth weighting coefficient, γ is the seventh weighting coefficient, δ is the eighth weighting coefficient, η is the ninth weighting coefficient, and μ is the tenth weighting coefficient.

[0039] The entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, business impact degree, and topic hyperedge comprehensive weight are encapsulated with the topic hyperedge infrastructure to obtain a complete topic hyperedge.

[0040] Optionally, based on the business scenario, real-time entities, real-time relationships, real-time events, and occurrence time, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base, including:

[0041] Based on the business scenario, real-time entity, real-time relationship, real-time event and occurrence time, determine the matching degree of the operation and maintenance real-time event with the business scenario, entity overlap, time window overlap and text semantic similarity of each complete topic hyperedge in the hyperedge knowledge base;

[0042] Based on the matching degree of business scenarios, the overlap of entities, the overlap of time windows, and the semantic similarity of text, the comprehensive matching score between real-time operation and maintenance events and each complete topic hyperedge in the hyperedge knowledge base is determined.

[0043] When S match ≧S th Determine the corresponding complete topic hyperedge as the target complete topic hyperedge;

[0044] Among them, S th To match the filtering threshold.

[0045] Optionally, based on the comprehensive weight of the target complete topic superedges, entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, business impact, and strong and weak entity subsets, at least two groups of target complete topic superedges are sorted to obtain a list of target complete topic superedges, including:

[0046] according to

[0047] The sorting priority score of the superedge of the complete target topic for each group is obtained;

[0048] Among them, Score sort The ranking priority score is represented by x, which is the entity strength coefficient. The entity strength coefficient for a strong entity subset is 1, and for a weak entity subset it is 0.6. W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the temporal co-occurrence intensity, C freq C represents the historical repetition frequency. impact To determine the degree of business impact, y1 is the fifteenth weight coefficient, y2 is the sixteenth weight coefficient, y3 is the seventeenth weight coefficient, y4 is the eighteenth weight coefficient, y5 is the nineteenth weight coefficient, and y6 is the twentieth weight coefficient.

[0049] Sort the target complete topic hyperedges in descending order according to their priority scores to obtain a list of target complete topic hyperedges.

[0050] Embodiments of the present invention also provide a system for processing operation and maintenance subject data, including:

[0051] The acquisition module is used to acquire at least two real-time operation and maintenance events;

[0052] The processing module is used to parse the real-time operation and maintenance events to obtain a real-time event dataset. The real-time event dataset includes: business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times. Based on the business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base. Based on the comprehensive weight of the target complete topic hyperedges, entity coverage completeness, relationship closure, event support, time co-occurrence strength, historical repetition frequency, business impact degree, and strong and weak entity subsets, the at least two sets of target complete topic hyperedges are sorted to obtain a target complete topic hyperedge list. Each target complete topic hyperedge in the target complete topic hyperedge list is output. The construction process of the hyperedge knowledge base includes: obtaining... Hierarchical and domain-specific knowledge graph data is obtained; the hierarchical and domain-specific knowledge graph data includes: entity set, relation set, event set, and time window data; based on the entity set, relation set, event set, and time window data, a set of effective operation and maintenance candidate topics is determined; based on the entity set, relation set, event set, and time window data, each effective operation and maintenance candidate topic in the set of effective operation and maintenance candidate topics is assigned a standardized topic name and a globally unique topic number to obtain an intermediate set of effective operation and maintenance candidate topics; based on the intermediate set of effective operation and maintenance candidate topics, a topic hyperedge infrastructure is constructed; multi-dimensional indicators are extracted and encapsulated from the topic hyperedge infrastructure to obtain a complete topic hyperedge; the complete topic hyperedge is stored and a multi-dimensional retrieval index is established to obtain a hyperedge knowledge base.

[0053] Embodiments of the present invention also provide a computing device, comprising:

[0054] One or more processors;

[0055] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to perform the method as described above.

[0056] Embodiments of the present invention also provide a computing device readable storage medium storing a program that, when executed by a processor, implements the method described above.

[0057] The above-described solutions of the embodiments of the present invention have at least the following beneficial effects:

[0058] The above-described solution in this invention collects and standardizes the parsing of real-time O&M events from multiple sources. It integrates multi-dimensional information such as business scenarios, entities, relationships, and time to match topic hyperedges, replacing the traditional single-keyword matching method. This effectively avoids irrelevant faults being mistakenly pushed and improves fault matching accuracy. Furthermore, this invention abandons the single method of judging faults based solely on the number of alarms. It uses multi-dimensional indicators such as entity coverage completeness, relationship closure, and business impact, combined with strong and weak entity subsets to distinguish the root cause entity and subordinate entities of the fault, achieving automatic priority sorting of fault topics. This significantly reduces manual screening costs and quickly identifies the root cause of the fault. In addition, this invention constructs a hyperedge knowledge base with multi-dimensional retrieval indexes based on a hierarchical and domain-based knowledge graph. It structurally precipitates core data such as the transmission links and entity dependencies of historical faults, enabling the reuse of historical O&M experience. This solves the pain points of repetitive analysis and low troubleshooting efficiency in traditional solutions, effectively adapting to complex and massive cross-domain O&M fault troubleshooting scenarios under a distributed microservice architecture. Attached Figure Description

[0059] Figure 1 This is a flowchart illustrating the method for processing operation and maintenance topic data provided in an embodiment of the present invention.

[0060] Figure 2 This is a schematic diagram of the module of the operation and maintenance subject data processing system provided in the embodiment of the present invention. Detailed Implementation

[0061] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0062] like Figure 1 As shown, an embodiment of the present invention provides a method for processing operation and maintenance topic data, including:

[0063] Step 11: Obtain at least two real-time operation and maintenance events;

[0064] Step 12: Analyze the real-time operation and maintenance events to obtain a real-time event dataset; the real-time event dataset includes: business scenario, real-time entity, real-time relationship, real-time event, and occurrence time;

[0065] Step 13: Based on the business scenario, real-time entity, real-time relationship, real-time event and occurrence time, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base;

[0066] Step 14: Based on the comprehensive weight of the target complete topic superedges, entity coverage completeness, relationship closure, event support, time co-occurrence intensity, historical repetition frequency, business impact degree, and strong entity subsets and weak entity subsets, sort at least two groups of target complete topic superedges to obtain a list of target complete topic superedges.

[0067] Step 15: Output each target complete topic superedge in the target complete topic superedge list;

[0068] The construction process of the hyperedge knowledge base includes:

[0069] Step 101: Obtain hierarchical and domain-specific knowledge graph data; the hierarchical and domain-specific knowledge graph data includes: entity set, relation set, event set, and time window data;

[0070] Step 102: Determine a set of valid operation and maintenance candidate topics based on the entity set, relationship set, event set, and time window data;

[0071] Step 103: Based on the entity set, relation set, event set, and time window data, assign a standardized topic name and a globally unique topic number to each valid operation and maintenance candidate topic in the valid operation and maintenance candidate topic set to obtain an intermediate valid operation and maintenance candidate topic set.

[0072] Step 104: Based on the set of intermediate valid operation and maintenance candidate topics, construct the topic hyperedge infrastructure;

[0073] Step 105: Extract and encapsulate multi-dimensional indicators for the basic structure of the topic hyperedge to obtain the complete topic hyperedge;

[0074] Step 106: Store the complete topic hyperedge and establish a multi-dimensional retrieval index to obtain the hyperedge knowledge base.

[0075] In this embodiment, multi-source real-time operation and maintenance events are collected in batches and parsed in a standardized manner. Multi-dimensional information, including business scenarios, entities, relationships, and time, is integrated to match topic hyperedges, replacing the traditional single-keyword matching method. This effectively avoids irrelevant faults being mistakenly pushed and improves fault matching accuracy. Simultaneously, this invention abandons the single method of judging faults based solely on the number of alarms. It uses multi-dimensional indicators such as entity coverage completeness, relationship closure, and business impact, combined with strong and weak entity subsets to distinguish the root cause entity and subordinate entities of the fault, achieving automatic priority sorting of fault topics. This significantly reduces manual screening costs and quickly identifies the root cause of the fault. Furthermore, this invention constructs a hyperedge knowledge base with multi-dimensional retrieval indexes based on a hierarchical and domain-based knowledge graph. It structurally stores core data such as the transmission links and entity dependencies of historical faults, enabling the reuse of historical operation and maintenance experience. This solves the pain points of repetitive analysis and low troubleshooting efficiency in traditional solutions, effectively adapting to complex and massive cross-domain operation and maintenance fault troubleshooting scenarios under a distributed microservice architecture.

[0076] In an optional embodiment of the present invention, step 101 involves acquiring hierarchical and domain-specific knowledge graph data. This hierarchical and domain-specific knowledge graph data includes: entity sets, relation sets, event sets, and time window data. Specifically, the construction process of the hierarchical and domain-specific knowledge graph data includes: collecting multi-source underlying information technology operation and maintenance raw data, including business configuration data, equipment asset data, service call logs, monitoring indicators, change orders, network link data, and historical alarm records; dividing the raw data into hierarchical and domain-specific layers according to business domains and system levels, with hierarchical dimensions including infrastructure layer, middleware layer, application service layer, and business layer, and domain dimensions including independent business segments such as payment domain, order domain, and membership domain; and extracting all... The operation and maintenance objects are aggregated into an entity set; the entity set includes hardware and software entities such as servers, containers, databases, caches, gateways, business services, switches, and storage devices; based on service call relationships, device dependency relationships, network connection relationships, and business dependency relationships, the association mapping between entities is extracted to construct a relationship set; all operation and maintenance records such as historical alarms, interface errors, resource overload, version releases, network anomalies, and security attacks are collected, organized by event type, and an event set is generated; all entities, relationships, and events are labeled with corresponding occurrence time periods according to preset fixed time intervals to generate corresponding time window data; the hierarchical and domain identifiers, entity sets, relationship sets, event sets, and time window data are structured and encapsulated to obtain complete hierarchical and domain knowledge graph data.

[0077] In this embodiment, seven major categories of operation and maintenance data sources are covered, including business configuration, hardware assets, call logs, monitoring indicators, change orders, network links, and historical alarms. Software and hardware entities such as servers, containers, databases, caches, gateways, business services, switches, and storage devices are uniformly extracted. All operation and maintenance objects involved in business operation are included in the hierarchical and domain-specific knowledge graph data, ensuring that no faulty entities are missed.

[0078] In an optional embodiment of the present invention, step 102, determining a set of valid operation and maintenance candidate topics based on the entity set, relation set, event set, and time window data, includes:

[0079] Step 1021: The entity set, relationship set, and event set are divided into time series according to fixed time intervals to obtain multiple groups of operation and maintenance data groups divided by time windows. Specifically, the fixed time interval can be selected as 5 minutes, 10 minutes, or 15 minutes, preferably 10 minutes as the time series segmentation granularity. Entity changes, link relationships, and operation and maintenance events generated within the same 10-minute interval are grouped into a group of operation and maintenance data groups to achieve data clustering in the time series dimension.

[0080] Step 1022: Statistically analyze the data synchronization density, network link connectivity, log / work order text semantic similarity, and common impact on the same business among the maintenance data groups within the same time window. Specifically, the data synchronization density ranges from [0, 1], representing the concentration of entity and event synchronization outbreaks within the window; the higher the event concurrency, the larger the value. The network link connectivity ranges from [0, 1], representing whether entities within a group can form a complete call / transmission link; if the link is closed without breaks, the value approaches 1. The log / work order text semantic similarity ranges from [0, 1], using cosine similarity to calculate the text overlap of multiple logs and change orders. The common impact on the same business ranges from [0, 1], quantified based on affected business traffic, transaction losses, and online user scale; the greater the business loss, the higher the value.

[0081] Step 1023, according to The comprehensive score of candidate topics among the various groups of the operation and maintenance data is obtained.

[0082] Among them, ThemeScore is the comprehensive score of candidate topics, T is the density of data synchronization, P is the network link connectivity, S is the semantic similarity of log ticket text, I is the degree of common influence of the same business, a is the first weight coefficient (can be 0.3), b is the second weight coefficient (can be 0.25), c is the third weight coefficient (can be 0.2), and d is the fourth weight coefficient (can be 0.25).

[0083] Step 1024: When ThemeScore ≧ TH, determine that the corresponding two groups of operation and maintenance data are valid candidate topics;

[0084] Where TH is the topic generation threshold (which can be 0.45).

[0085] Step 1025: Based on the business scenarios of the valid candidate topics, label the valid candidate topics with topic type tags (including: service topics, network topics, resource topics, data topics, change topics, fault topics, capacity topics, and security topics) to obtain intermediate valid candidate topics; for example, if the group mainly consists of service interface error events, then label it as a service topic; if it mainly consists of switch and packet loss records, then label it as a network topic; if it mainly consists of slow database queries and connection anomalies, then label it as a data topic; if it consists of program version releases and configuration modifications, then label it as a change topic; if it consists of CPU / memory full, then label it as a resource topic; if it consists of disk and bandwidth exceeding limits, then label it as a capacity topic; if it consists of intrusion and access anomalies, then label it as a security topic; if multiple types of anomalies occur concurrently, then label it as a fault topic.

[0086] Step 1026: Summarize the intermediate valid candidate topics to obtain a set of valid operation and maintenance candidate topics;

[0087] Specifically, if ThemeScore < TH, but there is a single operation and maintenance event with independent business analysis value within the corresponding two groups of operation and maintenance data, only the corresponding operation and maintenance event will be retained separately, and no complete candidate topic will be generated.

[0088] When ThemeScore < TH, and the number of event evidences within the group is insufficient and there are no valid associated entities: it is marked as candidate data to be verified, and the temporary cache is not included in the formal candidate topic.

[0089] In this embodiment, a fixed time window is used to cluster the operation and maintenance data in a time series. Entities, links, and events of the same period are uniformly collected at a granular 10-minute interval. This naturally aggregates multiple anomalies caused by the same fault chain into the same group, breaking the limitation of isolated analysis of single events and locking the scope of potential faults from a time series perspective. The group association characteristics are quantified from four dimensions: concurrency density, link integrity, text similarity, and business loss. All indicators are normalized to the 0-1 range, and the quantification standard is unified and objective, avoiding the bias in topic classification caused by subjective human judgment, and accurately identifying operation and maintenance data groups with correlation. The comprehensive score of candidate topics is calculated through a weighted fusion formula, with preset weights prioritizing both event concurrency and business impact, aligning with the core requirement of prioritizing business stability in operation and maintenance. Fixed thresholds are set to automatically filter valid topics and filter irrelevant data with weak correlation, significantly reducing the computational workload of subsequent hyperedge construction. Valid topics are automatically labeled with eight standardized types according to business scenarios, realizing automatic classification of fault scenarios. Subsequent retrieval, partitioned storage, and fault statistics can be quickly classified, facilitating operation and maintenance personnel to target and troubleshoot corresponding types of faults. Data with scores below the threshold are processed using a tiered and differentiated approach: valuable single-point events are retained separately, while data without valid clues is temporarily cached. This approach ensures that potential single-point anomalies are not overlooked while preventing invalid data from being mixed into the formal candidate topic set, balancing data integrity and computational efficiency. A standardized set of valid operational candidate topics is output, providing well-organized and filtered basic materials for subsequent standardized naming, global numbering, and topic hyperedge construction. This guarantees the data input quality of the entire fault analysis process and improves the accuracy and efficiency of subsequent matching and sorting stages.

[0090] In an optional embodiment of the present invention, in step 103, based on the entity set, relation set, event set, and time window data, a standardized topic name and a globally unique topic number are assigned to each valid operation and maintenance candidate topic in the valid operation and maintenance candidate topic set to obtain an intermediate valid operation and maintenance candidate topic set, including:

[0091] Step 1031: Extract key basic information from the entity set, relationship set, event set, and time window data bound to each valid operation and maintenance candidate topic; the key basic information includes: the business domain to which the topic belongs, the main level, the tagged topic type label, the deployment environment, the core entity identifier, and the start and end time of the time window;

[0092] Step 1032: Concatenate the business domain to which the topic belongs, the main level, the tagged topic type, the deployment environment, the core entity identifier, and the start and end times of the time window to obtain a standardized topic name;

[0093] Step 1033: Based on the business domain to which the topic belongs, the main level, the tagged topic type label, the deployment environment, the core entity identifier, and the start and end time of the time window, a globally unique topic number is generated using hash rules.

[0094] Step 1034: Bind the standardized topic name and globally unique topic number to the corresponding valid operation and maintenance candidate topic to obtain an intermediate valid operation and maintenance candidate topic set.

[0095] In this embodiment, key information from multiple dimensions such as business domain, level, entity, and time sequence is extracted, redundant fields are removed, and the data required for topic identification is simplified, reducing the overhead of subsequent matching and retrieval. Standardized topic names are generated by concatenating fixed rules, with a unified format and intuitive semantics, allowing maintenance personnel to quickly identify the business, level, and time period of a fault, reducing the cost of manual understanding. A globally unique number is generated based on the hash of unified key fields, eliminating the need for auto-incrementing sequences, adapting to distributed parallel construction scenarios, completely avoiding duplicate topic numbers, and supporting accurate indexing and fast retrieval of the knowledge base. Each candidate topic is bound to a readable name and a machine-readable identifier, and a unified set of intermediate topics is output, standardizing the input for subsequent hyperedge construction; standardized identifiers are used throughout the matching, sorting, and output process, improving the efficiency of fault retrieval, classification, and tracing, and facilitating the accumulation and reuse of historical faults.

[0096] In an optional embodiment of the present invention, step 104, based on the intermediate set of valid operation and maintenance candidate topics, constructs a topic hyperedge infrastructure, including:

[0097] Step 1041: Extract all associated entities, inter-entity relationships, and operation and maintenance events from the intermediate valid operation and maintenance candidate topic set, and summarize them to obtain entity set, relationship set, and event set; specifically, for a single intermediate valid operation and maintenance candidate topic, traverse all entities bound to it, the dependencies / calls / subordination relationships between entities, and all alarms, changes, and monitoring events within the window, and deduplicate and aggregate them to form three sets respectively; the entity set, relationship set, and event set completely carry all basic operation and maintenance objects and behaviors under the topic, and are the underlying data carriers for building hyperedges;

[0098] Step 1042: Based on the contribution of entities in the entity set to the current topic phenomenon, the entity types are distinguished to obtain strong entity subsets and weak entity subsets. Specifically, the entity contribution is determined based on the topic association score calculated in step 102 and the event trigger source. Entities that directly generate errors, anomalies, changes, or serve as the root cause of faults are classified as strong entity subsets. Subordinate entities that passively experience anomalies only due to the fault of upstream strong entities and have no original problems themselves are classified as weak entity subsets.

[0099] Step 1043: Extract from the intermediate valid operation and maintenance candidate topic set to obtain the business domain, main level, support level, start time, end time, evidence summary, standardized topic name and globally unique topic number;

[0100] Step 1044: According to the preset hyperedge storage structure, the entity set, relation set, event set, strong entity subset, and weak entity subset are uniformly encapsulated to obtain the topic hyperedge basic structure; specifically, e h ={V h R h E h V strong V weak ,Domain,MainLayer,SupLayer,t start , t end Summary, Name, ID;

[0101] Among them, e h For the theme's hyperedge basic structure, V h For entity sets, R h For a relation set, E h For event sets, V strong For a strong entity subset, V weak For a subset of weak entities, Domain represents the business domain, MainLayer is the primary layer, and SupLayer is the support layer. start Let t be the start time. end The end time is specified, Summary is the evidence summary, Name is the standardized topic name, and ID is the globally unique topic number.

[0102] In this embodiment, a standardized topic hyperedge infrastructure is constructed to achieve structured and hierarchical organization of operational fault data. First, entities, relationships, and operational events corresponding to each topic are fully collected and deduplicated, comprehensively retaining fault-related clues and eliminating data omissions and redundancy, thus laying a solid foundation for fault analysis. Second, innovative strong and weak entity subsets are created to accurately distinguish between the root cause entity and passively associated abnormal entities, stripping away interfering information at the data level. This provides a core basis for subsequent fault prioritization and root cause localization, significantly improving the accuracy of fault assessment. Simultaneously, multi-dimensional metadata such as business domain, hierarchy, time series, unique identifiers, and evidence summaries are integrated to achieve full coverage of fault topic information. Finally, a unified and fixed data structure is used for encapsulation, standardizing data storage format and achieving the organic integration of original fault clues and structured metadata. This modular construction method separates basic raw data from subsequent quantitative indicators, resulting in a clear structure and strong scalability, providing standardized and high-quality data support for subsequent complete topic hyperedge construction and knowledge base matching retrieval.

[0103] In an optional embodiment of the present invention, step 105 involves extracting and encapsulating multi-dimensional indicators of the topic hyperedge infrastructure to obtain a complete topic hyperedge, including:

[0104] Step 1051: Extract multi-dimensional indicators from the topic hyperedge infrastructure to obtain entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, and business impact. Specifically, based on the entity set, relationship set, event set, time window, business domain, and historical fault knowledge base data stored within the topic hyperedge infrastructure, six evaluation indicators are quantified and calculated. All indicators are uniformly normalized to the [0, 1] interval, with higher values ​​indicating higher credibility and analytical value of the topic fault. Entity coverage completeness: Compare with the standard dependent entity list for this business scenario and calculate the percentage of core entities already covered within the current topic. System Closure: Determines whether the entity dependency links within the topic form a closed-loop fault propagation path. A score close to 1 indicates no missing links and complete upstream and downstream connections. Event Support: Calculated based on the total number of alarms, logs, and change events within the window and the proportion of valid evidence. More valid events result in a higher score. Temporal Co-occurrence Intensity: Measures the density of all abnormal events occurring within the current time window. Higher concurrent occurrences result in a higher score. Historical Repetition Frequency: Statistically measures the recurrence frequency of historical fault topics of the same type and business domain. High-frequency faults receive higher scores. Business Impact: Quantified comprehensively based on the impact of the fault on online users, transaction losses, and interface failure rates. Greater business losses result in a higher score.

[0105] Step 1052, according to

[0106] The overall weight of the superedge of the theme is obtained;

[0107] Among them, W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the temporal co-occurrence intensity, C freq C represents the historical repetition frequency. impact To represent the degree of business impact, α is the fifth weighting coefficient (which can be 0.15), β is the sixth weighting coefficient (which can be 0.15), γ is the seventh weighting coefficient (which can be 0.2), δ is the eighth weighting coefficient (which can be 0.15), η is the ninth weighting coefficient (which can be 0.1), and μ is the tenth weighting coefficient (which can be 0.25).

[0108] Step 1053: Encapsulate the entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, business impact degree, and topic hyperedge comprehensive weight with the topic hyperedge basic structure to obtain a complete topic hyperedge;

[0109] Specifically, E h ={e h W h C cov C conf C temp C time C freq C impact};

[0110] Among them, E h For the complete theme hyperedge, e h For the theme's hyperedge infrastructure, W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the temporal co-occurrence intensity, C freq C represents the historical repetition frequency. impact The degree of impact on business.

[0111] In this embodiment, multi-dimensional quantitative modeling and secondary encapsulation are completed on top of the topic hyperedge infrastructure to construct a complete topic hyperedge with credibility evaluation capabilities, effectively compensating for the shortcomings of the infrastructure that only stores raw data and lacks quantitative evaluation capabilities. This invention constructs an evaluation system from six core dimensions: entity coverage, link closure, event support, temporal co-occurrence, historical recurrence, and business impact. It quantifies the authenticity and effectiveness of fault topics from multiple perspectives and in all aspects. All indicators are uniformly normalized, and the evaluation standards are objective and unified, avoiding misjudgments and omissions caused by single-dimensional judgments. By setting weighting coefficients that fit the actual operation and maintenance situation, the focus is placed on the degree of business impact and event support, aligning with the logic of prioritizing business stability in operation and maintenance fault handling, and accurately distinguishing high-risk, high-credibility fault topics. Simultaneously, the sub-quantitative indicators and comprehensive weights are fully encapsulated into the hyperedge structure, achieving deep integration of original fault clues and quantitative evaluation parameters, making each fault topic quantifiable, comparable, and rankable. This design enables the standardized and quantitative accumulation of fault knowledge, providing a reliable quantitative basis for subsequent real-time event matching, super-edge priority sorting, and accurate fault root cause localization. It significantly improves the system's fault identification accuracy and intelligent analysis capabilities, effectively reduces invalid fault interference, and improves the efficiency of operation and maintenance fault handling.

[0112] In an optional embodiment of the present invention, in step 106, the complete topic hyperedge is stored and a multi-dimensional retrieval index is established to obtain a hyperedge knowledge base;

[0113] Step 1061: The complete topic superedge is partitioned and stored according to topic type tags (including: service topic, network topic, resource topic, data topic, change topic, fault topic, capacity topic and security topic) to obtain multiple independent storage partitions;

[0114] Step 1062: Establish a multi-dimensional retrieval index for the complete topic hyperedge in each independent storage partition to obtain the hyperedge knowledge base; the multi-dimensional retrieval index includes: entity index, relation index, event index, strong entity index, weak entity index, business domain index, main level index, supporting level index, start time index, end time index, evidence digest index, standardized topic name index and globally unique topic number index.

[0115] In this embodiment, a rapidly searchable hyperedge knowledge base is formed by completing the full-topic hyperedge storage and constructing a multi-dimensional index. First, the data is stored in partitions according to eight major topic types, achieving data classification and isolation. During retrieval, the corresponding partition can be directly targeted, significantly reducing the scanning scope and lowering the computational cost of full traversal. Second, a composite index covering thirteen dimensions, including entity, hierarchy, time series, text, and unique ID, is built. This supports real-time events to quickly match historical fault hyperedges from any dimension—business domain, entity, time, or text—adapting to various retrieval needs. Separate strong and weak entity indexes are used to prioritize the retrieval of hyperedges related to root cause faults, improving root cause matching efficiency. The combination of partitioned storage and multi-dimensional indexes balances storage regularity and query speed, avoiding retrieval bottlenecks with massive amounts of historical fault data. Standardized fault topic knowledge is uniformly accumulated, enabling the reuse of historical fault experience and providing efficient knowledge base support for quickly matching target hyperedges for real-time operation and maintenance events, thus improving the overall fault location and response speed.

[0116] In an optional embodiment of the present invention, step 11 involves acquiring at least two real-time operation and maintenance events, including:

[0117] It connects to multiple real-time data collection channels, including monitoring, logs, alarms, and changes, and streams raw operation and maintenance events; it caches batch events for a short time to ensure that at least two related events are obtained at a time; it filters out invalid data such as heartbeats, duplicates, and data with abnormal formats, and retains valid abnormal events; and it outputs multiple cleaned real-time operation and maintenance events.

[0118] In this embodiment, by integrating multiple types of real-time operation and maintenance data streams, unified access to abnormal events across all scenarios is achieved, preventing the loss of fault clues from a single data source. Short-term caching of batch collection of multiple events aligns with fault chain triggering characteristics, ensuring a data foundation for correlation analysis. Pre-filtering removes invalid data such as heartbeat checks, duplicate pushes, and corrupted formats, reducing the computational overhead of subsequent parsing and matching, and lowering system load. Standardized and valid events are output after cleaning, ensuring clean data and complete fields, providing high-quality input for subsequent semantic parsing and knowledge base matching, reducing invalid calculations at the source, and improving the operational efficiency and identification accuracy of the entire fault analysis process.

[0119] In an optional embodiment of the present invention, in step 12, the real-time operation and maintenance events are parsed to obtain a real-time event dataset; the real-time event dataset includes: business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times, including:

[0120] Step 121: Semantic parsing is performed on the real-time operation and maintenance events to obtain a real-time event dataset. Specifically, each operation and maintenance event is parsed through keyword matching, entity recognition, and link association parsing to extract the business scenario, the real-time hardware and software entities involved, the real-time call / subordination relationships between entities, the abnormal content of the event, and the precise occurrence time. These are then organized into unified structured fields to form a standardized real-time event dataset, providing standardized input for subsequent multi-dimensional matching of the hyper-edge knowledge base.

[0121] In this embodiment, unstructured real-time events are standardized through semantic parsing. Entity recognition and link association technologies are used to accurately extract key information about business scenarios, entities, relationships, and time sequences, which is then uniformly organized into a structured dataset. This eliminates the problems of chaotic formats and fragmented information in original logs and alarm texts, unifies data dimensions and field standards, and aligns real-time events with the hyper-edge data fields in the knowledge base. The structured output can be directly adapted to subsequent multi-dimensional matching calculations, eliminating repetitive field conversion work and simplifying the matching logic. Complete extraction of entities and relationships preserves fault propagation clues, ensuring dimensional integrity when matching with the hyper-edge knowledge base, and improving fault matching accuracy and computation speed.

[0122] In an optional embodiment of the present invention, in step 13, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base based on the business scenario, real-time entity, real-time relationship, real-time event, and occurrence time, including:

[0123] Step 131: Based on the business scenario, real-time entity, real-time relationship, real-time event, and occurrence time, determine the business scenario matching degree, entity overlap degree, time window overlap degree, and text semantic similarity between the real-time operation and maintenance event and each complete topic hyperedge in the hyperedge knowledge base. Specifically, quantify the correlation between the real-time event and the complete topic hyperedge in the database from four dimensions, and normalize the four indicators to the [0, 1] interval. The business scenario matching degree is compared with the business domain to which the two belong. If the business domains are completely consistent, the value is 1, and if they are different business domains, the value is 0. The entity overlap degree is calculated by the proportion of the number of overlapping entities between the real-time entity and the entity in the hyperedge. The more overlapping entities, the higher the score. The time window overlap degree is calculated by the proportion of the overlap between the real-time event time period and the hyperedge time window. The text semantic similarity uses the cosine similarity algorithm to compare the text similarity between the real-time event description and the evidence summary in the hyperedge.

[0124] Step 132: Determine the comprehensive matching score between real-time operation and maintenance events and each complete topic hyperedge in the hyperedge knowledge base based on business scenario matching degree, entity overlap degree, time window overlap degree and text semantic similarity.

[0125] Specifically, according to

[0126] Determine the comprehensive matching score between real-time operation and maintenance events and each complete topic hyperedge in the hyperedge knowledge base;

[0127] Among them, S match To calculate the overall matching score, S bus For business scenario matching, S ent S represents the overlap of entities. time S represents the overlap of time windows. sem For text semantic similarity, w1 is the eleventh weight coefficient (which can be 0.2), w2 is the twelfth weight coefficient (which can be 0.4), w3 is the thirteenth weight coefficient (which can be 0.25), and w4 is the fourteenth weight coefficient (which can be 0.15).

[0128] Step 133, when S match ≧S th Determine the corresponding complete topic hyperedge as the target complete topic hyperedge;

[0129] Among them, S th Set a matching filter threshold (which can be 0.35).

[0130] Specifically, when S match th Remove the corresponding super-edges of the complete theme.

[0131] ​In this embodiment, a four-dimensional quantitative weighted matching mechanism is adopted to overcome the limitations of traditional single-dimensional text matching, comprehensively measuring the correlation strength between real-time events and historical fault hyperedges. The four indicators—business domain, overlapping entities, temporal overlap, and textual semantics—are uniformly standardized to a 0-1 range, ensuring a consistent and objective quantitative standard and avoiding subjective biases from manual matching. Entity overlap is given the highest weight, aligning with the characteristics of operational faults relying on hardware and service entity propagation. Temporal matching is given the second highest weight, fully considering the temporal patterns of fault chain occurrences and significantly improving the recall accuracy of similar historical faults. A comprehensive matching score is obtained by fusing multi-dimensional features through a weighted formula. The quantitative results can be compared horizontally with all knowledge base hyperedges, and filtering is performed using a fixed threshold to automatically remove low-relevance and irrelevant fault data, significantly reducing the data computation load in subsequent sorting stages and lowering system computing power consumption. Multi-dimensional joint verification effectively avoids mismatches and missed matches caused by single-dimensional matching, preventing mismatches due to similar text but unrelated entities, and avoiding the omission of originating faults due to differences in descriptive text. Ultimately, it stably outputs multiple sets of target complete topic hyperedges with strong correlations, providing sufficient and accurate candidate materials for subsequent fault priority ranking and root cause intelligent judgment, thereby improving the reliability and response speed of real-time fault identification.

[0132] In an optional embodiment of the present invention, in step 14, at least two sets of target complete topic hyperedges are sorted according to the comprehensive weight of the target complete topic hyperedges, entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, business impact degree, and strong entity subsets and weak entity subsets to obtain a target complete topic hyperedge list, including:

[0133] Step 141, according to

[0134] The sorting priority score of the superedge of the complete target topic for each group is obtained;

[0135] Among them, Score sort The ranking priority score is represented by x, which is the entity strength coefficient. The entity strength coefficient for a strong entity subset is 1, and for a weak entity subset it is 0.6. W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the temporal co-occurrence intensity, C freq C represents the historical repetition frequency. impactTo determine the degree of business impact, y1 is the fifteenth weight coefficient (which can be 0.15), y2 is the sixteenth weight coefficient (which can be 0.15), y3 is the seventeenth weight coefficient (which can be 0.2), y4 is the eighteenth weight coefficient (which can be 0.15), y5 is the nineteenth weight coefficient (which can be 0.1), and y6 is the twentieth weight coefficient (which can be 0.25).

[0136] Step 142: Sort the target complete topic hyperedges in descending order according to their sorting priority scores to obtain a list of target complete topic hyperedges. Specifically, arrange all target complete topic hyperedges in descending order of their sorting priority scores. If multiple hyperedges have the same score, prioritize the hyperedges with strong entity subsets. Finally, output an ordered list in descending order of fault root cause priority, which is convenient for maintenance personnel to prioritize troubleshooting high-reliability faults.

[0137] In this embodiment, a multi-factor fusion priority scoring model is constructed to achieve intelligent hierarchical ranking of matched fault hyperedges. The scoring formula integrates six major fault credibility indicators: entity coverage, link closure, event support, time series characteristics, historical frequency, and business impact. It also incorporates weight allocation adapted to the operation and maintenance scenario, emphasizing the weight of business loss to align with the business needs of prioritizing high-impact faults in operations and maintenance. Simultaneously, an entity strength correction coefficient is introduced to distinguish between root cause strong entity faults and associated weak entity faults, reducing the interference of secondary anomalies on the ranking results and accurately highlighting the root cause of the fault. The formula superimposes the comprehensive weight of hyperedges and combines it with the credibility evaluation accumulated from historical faults, ensuring that the ranking results take into account both real-time matching relevance and historical fault verification effects, avoiding judgment bias caused by relying solely on a single matching score. A unified quantitative output provides comparable priority scores, and the ranking rules are objective and standardized, eliminating the need for subjective manual judgment. A descending order is used, with fault hyperedges containing strong entities being displayed first in case of a tie, and the ordered list directly presents the investigation order of fault risk from high to low. It helps operations and maintenance personnel skip low-reliability and secondary related faults, locate the core root cause in the first time, significantly shorten the fault analysis time, improve the efficiency of online fault handling, and reduce the manual troubleshooting burden caused by multiple candidate faults.

[0138] In an optional embodiment of the present invention, step 15, outputting each target complete topic hyperedge in the target complete topic hyperedge list, includes:

[0139] Step 151: Perform data integrity verification on the sorted list of target complete topic hyperedges; specifically, verify each complete topic hyperedge for missing entity sets, relation sets, event evidence, various quantitative indicators, strong / weak entity identifiers, standardized names and numbers, and filter out incomplete or invalid abnormal hyperedges to ensure that the output content is complete and usable.

[0140] Step 152: Encapsulate visualization display fields for each target complete topic hyperedge; specifically, extract the hyperedge standardized topic name, globally unique number, sorting priority score, strong entity, fault propagation link, business impact degree, and original event evidence summary, and assemble them into structured output content that the operation and maintenance platform can directly render and display, making it easier for operation and maintenance personnel to intuitively locate the root cause of the fault;

[0141] Step 153: Output a complete list of all target topic superedges in priority order; specifically, push the output in descending order, prioritizing the display of topics with high credibility root cause faults; the output data can be pushed to the operation and maintenance visualization dashboard, alarm notification interface, and fault analysis page to support operation and maintenance personnel in quickly locating and handling faults in multiple concurrent real-time events.

[0142] In this embodiment, the sorted fault hyperedges are standardized before output to ensure that the output data is reliable, intuitive, and adaptable to multiple terminals. First, a full-field integrity check is performed to filter out invalid hyperedges with missing fields or incomplete information, preventing incomplete information display and broken fault analysis clues on the platform, thus ensuring the integrity and reliability of the data foundation for fault assessment from the output end. Second, dedicated visualization fields are encapsulated, integrating core information such as topic name, unique number, priority score, fault entity, transmission link, business impact, and event summary. Redundant underlying raw data is discarded, lightweighting the output content and reducing the front-end rendering pressure. Operations personnel can intuitively grasp the full picture of the fault without parsing the underlying structure. Simultaneously, data is pushed strictly in descending order of fault priority, prioritizing the display of high-risk root cause faults to meet the needs of emergency operations. The output structured data can be synchronously connected to various terminals such as large screens, alarm push notifications, and fault analysis pages, establishing a data link between the fault knowledge base and the operations platform. This enables real-time automatic hierarchical fault push, significantly shortening the time for operations personnel to search and sort fault clues, and improving the efficiency of fault location and emergency response in multi-concurrency anomaly scenarios.

[0143] This invention constructs a fully intelligent operation and maintenance analysis system, from offline knowledge base construction to real-time fault matching and sorting output, effectively solving the industry pain points of traditional operation and maintenance data being fragmented, having low fault correlation, inaccurate root cause location, and low troubleshooting efficiency. First, this invention collects multi-source operation and maintenance data, combines hierarchical and domain-based, and time-series clustering strategies to standardize knowledge graph data, accurately select effective operation and maintenance topics, distinguish between strong and weak entities, and build a multi-dimensional quantitative indicator system to construct a structured, quantifiable, and searchable hyperedge knowledge base, enabling the standardized accumulation and reuse of historical fault experience. In the online real-time analysis phase, a multi-dimensional weighted matching mechanism accurately recalls associated fault hyperedges, avoiding misjudgments and omissions caused by single matching. Then, relying on a multi-factor priority scoring model, combined with features such as entity attributes, business impact, and historical frequency, it intelligently sorts the data to accurately distinguish between root causes and secondary anomalies. Finally, through data verification, visual encapsulation, and hierarchical output, it provides operation and maintenance personnel with clear and reliable fault troubleshooting priorities. This method features unified quantitative standards and a high degree of automation, significantly reducing the cost of manual analysis and effectively improving the accuracy and efficiency of locating and handling multiple concurrent faults in complex scenarios, thus ensuring the stable operation of business systems.

[0144] like Figure 2 As shown, embodiments of the present invention also provide a system 20 for processing operation and maintenance subject data, including:

[0145] Module 21 is used to acquire at least two real-time operation and maintenance events;

[0146] Processing module 22 is used to parse the real-time operation and maintenance events to obtain a real-time event dataset. The real-time event dataset includes: business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times. Based on the business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base. Based on the comprehensive weight of the topic hyperedges, entity coverage completeness, relationship closure, event support, time co-occurrence intensity, historical repetition frequency, business impact degree, and strong and weak entity subsets, the at least two sets of target complete topic hyperedges are sorted to obtain a target complete topic hyperedge list. Each target complete topic hyperedge in the target complete topic hyperedge list is output. The construction process of the hyperedge knowledge base includes: Acquire hierarchical and domain-specific knowledge graph data; the hierarchical and domain-specific knowledge graph data includes: entity set, relation set, event set, and time window data; determine a set of effective operation and maintenance candidate topics based on the entity set, relation set, event set, and time window data; assign a standardized topic name and a globally unique topic number to each effective operation and maintenance candidate topic in the set of effective operation and maintenance candidate topics based on the entity set, relation set, event set, and time window data to obtain an intermediate set of effective operation and maintenance candidate topics; construct a topic hyperedge infrastructure based on the intermediate set of effective operation and maintenance candidate topics; extract and encapsulate multi-dimensional indicators for the topic hyperedge infrastructure to obtain a complete topic hyperedge; store the complete topic hyperedge and establish a multi-dimensional retrieval index to obtain a hyperedge knowledge base.

[0147] Optionally, based on the entity set, relation set, event set, and time window data, a set of valid operation and maintenance candidate topics is determined, including:

[0148] The entity set, relation set, and event set are divided into time sequences according to fixed time intervals to obtain multiple groups of operation and maintenance data divided by time windows;

[0149] The data synchronization density, network link connectivity, log ticket text semantic similarity, and common impact on the same business are statistically analyzed among the operation and maintenance data groups within the same time window.

[0150] according to The comprehensive score of candidate topics among the various groups of the operation and maintenance data is obtained.

[0151] Among them, ThemeScore is the comprehensive score of candidate topics, T is the density of data synchronization, P is the network link connectivity, S is the semantic similarity of log ticket text, I is the degree of common influence of the same business, a is the first weight coefficient, b is the second weight coefficient, c is the third weight coefficient, and d is the fourth weight coefficient.

[0152] When ThemeScore ≥ TH, the corresponding two groups of operation and maintenance data are determined to be valid candidate themes.

[0153] Where TH is the topic generation threshold;

[0154] Based on the business scenario of the valid candidate topics, the valid candidate topics are labeled with topic type tags to obtain intermediate valid candidate topics;

[0155] The intermediate valid candidate topics are summarized to obtain a set of valid operation and maintenance candidate topics.

[0156] Optionally, based on the entity set, relation set, event set, and time window data, each valid operation and maintenance candidate topic in the valid operation and maintenance candidate topic set is assigned a standardized topic name and a globally unique topic number to obtain an intermediate valid operation and maintenance candidate topic set, including:

[0157] Extract key basic information from the entity set, relationship set, event set, and time window data bound to each valid operation and maintenance candidate topic; the key basic information includes: the business domain to which the topic belongs, the main level, the tagged topic type label, the deployment environment, the core entity identifier, and the start and end time of the time window;

[0158] The standardized topic name is obtained by concatenating the business domain to which the topic belongs, the main level, the tagged topic type, the deployment environment, the core entity identifier, and the start and end times of the time window.

[0159] A globally unique topic number is generated based on the topic's business domain, main level, tagged topic type, deployment environment, core entity identifier, and start and end times of the time window, using hash rules.

[0160] The standardized topic name and globally unique topic number are bound to the corresponding valid operation and maintenance candidate topic to obtain an intermediate valid operation and maintenance candidate topic set.

[0161] Optionally, based on the intermediate set of valid operation and maintenance candidate topics, a topic hyperedge infrastructure is constructed, including:

[0162] Extract all associated entities, inter-entity relationships, and operation and maintenance events from the intermediate valid operation and maintenance candidate topic set, and summarize them to obtain the entity set, relationship set, and event set;

[0163] Based on the degree of contribution of the entities in the entity set to the current topic phenomenon, the entity types are distinguished to obtain strong entity subsets and weak entity subsets;

[0164] Extract from the set of intermediate valid operation and maintenance candidate topics to obtain the business domain, main level, support level, start time, end time, evidence summary, standardized topic name and globally unique topic number;

[0165] According to the preset hyperedge storage structure, the entity set, relation set, event set, strong entity subset, and weak entity subset are uniformly encapsulated to obtain the topic hyperedge basic structure.

[0166] Optionally, the topic hyperedge infrastructure is subjected to multi-dimensional index extraction and encapsulation to obtain a complete topic hyperedge, including:

[0167] Multi-dimensional indicators were extracted from the aforementioned topic hyperedge infrastructure to obtain entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, and business impact.

[0168] according to

[0169] The overall weight of the superedge of the theme is obtained;

[0170] Among them, W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the temporal co-occurrence intensity, C freq C represents the historical repetition frequency. impact To represent the degree of business impact, α is the fifth weighting coefficient, β is the sixth weighting coefficient, γ is the seventh weighting coefficient, δ is the eighth weighting coefficient, η is the ninth weighting coefficient, and μ is the tenth weighting coefficient.

[0171] The entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, business impact degree, and topic hyperedge comprehensive weight are encapsulated with the topic hyperedge infrastructure to obtain a complete topic hyperedge.

[0172] Optionally, based on the business scenario, real-time entities, real-time relationships, real-time events, and occurrence time, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base, including:

[0173] Based on the business scenario, real-time entity, real-time relationship, real-time event and occurrence time, determine the matching degree of the operation and maintenance real-time event with the business scenario, entity overlap, time window overlap and text semantic similarity of each complete topic hyperedge in the hyperedge knowledge base;

[0174] Based on the matching degree of business scenarios, the overlap of entities, the overlap of time windows, and the semantic similarity of text, the comprehensive matching score between real-time operation and maintenance events and each complete topic hyperedge in the hyperedge knowledge base is determined.

[0175] When S match ≧S th Determine the corresponding complete topic hyperedge as the target complete topic hyperedge;

[0176] Among them, S th To match the filtering threshold.

[0177] Optionally, based on the comprehensive weight of the target complete topic superedges, entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, business impact, and strong and weak entity subsets, at least two groups of target complete topic superedges are sorted to obtain a list of target complete topic superedges, including:

[0178] according to

[0179] The sorting priority score of the superedge of the complete target topic for each group is obtained;

[0180] Among them, Score sort The ranking priority score is represented by x, which is the entity strength coefficient. The entity strength coefficient for a strong entity subset is 1, and for a weak entity subset it is 0.6. W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the temporal co-occurrence intensity, C freq C represents the historical repetition frequency. impact To determine the degree of business impact, y1 is the fifteenth weight coefficient, y2 is the sixteenth weight coefficient, y3 is the seventeenth weight coefficient, y4 is the eighteenth weight coefficient, y5 is the nineteenth weight coefficient, and y6 is the twentieth weight coefficient.

[0181] Sort the target complete topic hyperedges in descending order according to their priority scores to obtain a list of target complete topic hyperedges.

[0182] It should be noted that this device is a device corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0183] Embodiments of the present invention also provide a computing device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0184] Embodiments of the present invention also provide a computing device readable storage medium storing instructions that, when executed on a computing device, cause the computing device to perform the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0185] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computing device software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0186] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0187] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0188] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0189] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0190] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computing device-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computing device software product is stored in a storage medium and includes several instructions to cause a computing device (which may be a personal computing device, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0191] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above-described series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve using basic programming skills after reading the description of the present invention.

[0192] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0193] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for processing operation and maintenance subject data, characterized in that, include: Obtain at least two real-time operation and maintenance events; The real-time operation and maintenance events are parsed to obtain a real-time event dataset; The real-time event dataset includes: business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times; Based on the business scenario, real-time entities, real-time relationships, real-time events, and occurrence time, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base; Based on the comprehensive weight of the target complete topic superedges, entity coverage completeness, relationship closure, event support, time co-occurrence intensity, historical repetition frequency, business impact, and strong and weak entity subsets, at least two groups of target complete topic superedges are sorted to obtain a list of target complete topic superedges. Output each target complete topic hyperedge in the target complete topic hyperedge list; wherein, the construction process of the hyperedge knowledge base includes: acquiring hierarchical and domain-specific knowledge graph data; the hierarchical and domain-specific knowledge graph data includes: entity set, relation set, event set, and time window data; determining a set of effective operation and maintenance candidate topics based on the entity set, relation set, event set, and time window data; assigning a standardized topic name and a globally unique topic number to each effective operation and maintenance candidate topic in the set of effective operation and maintenance candidate topics based on the entity set, relation set, event set, and time window data to obtain an intermediate set of effective operation and maintenance candidate topics; constructing the basic structure of topic hyperedges based on the intermediate set of effective operation and maintenance candidate topics; extracting and encapsulating multi-dimensional indicators on the basic structure of topic hyperedges to obtain complete topic hyperedges; storing the complete topic hyperedges and establishing a multi-dimensional retrieval index to obtain the hyperedge knowledge base.

2. The method for processing operation and maintenance subject data according to claim 1, characterized in that, Based on the entity set, relation set, event set, and time window data, a set of valid candidate topics for operation and maintenance is determined, including: The entity set, relation set, and event set are divided into time sequences according to fixed time intervals to obtain multiple groups of operation and maintenance data divided by time windows; The data synchronization density, network link connectivity, log ticket text semantic similarity, and common impact on the same business are statistically analyzed among the operation and maintenance data groups within the same time window. according to The comprehensive score of candidate topics among the various groups of the operation and maintenance data is obtained. Among them, ThemeScore is the comprehensive score of candidate topics, T is the density of data synchronization, P is the network link connectivity, S is the semantic similarity of log ticket text, I is the degree of common influence of the same business, a is the first weight coefficient, b is the second weight coefficient, c is the third weight coefficient, and d is the fourth weight coefficient. When ThemeScore ≥ TH, the corresponding two groups of operation and maintenance data are determined to be valid candidate themes. Where TH is the topic generation threshold; Based on the business scenario of the valid candidate topics, the valid candidate topics are labeled with topic type tags to obtain intermediate valid candidate topics; The intermediate valid candidate topics are summarized to obtain a set of valid operation and maintenance candidate topics.

3. The method for processing operation and maintenance subject data according to claim 1, characterized in that, Based on the entity set, relation set, event set, and time window data, each valid operation and maintenance candidate topic in the valid operation and maintenance candidate topic set is assigned a standardized topic name and a globally unique topic number to obtain an intermediate valid operation and maintenance candidate topic set, including: Extract key basic information from the entity set, relationship set, event set, and time window data bound to each valid operation and maintenance candidate topic; the key basic information includes: the business domain to which the topic belongs, the main level, the tagged topic type label, the deployment environment, the core entity identifier, and the start and end time of the time window; The standardized topic name is obtained by concatenating the business domain to which the topic belongs, the main level, the tagged topic type, the deployment environment, the core entity identifier, and the start and end times of the time window. A globally unique topic number is generated based on the topic's business domain, main level, tagged topic type, deployment environment, core entity identifier, and start and end times of the time window, using hash rules. The standardized topic name and globally unique topic number are bound to the corresponding valid operation and maintenance candidate topic to obtain an intermediate valid operation and maintenance candidate topic set.

4. The method for processing operation and maintenance subject data according to claim 1, characterized in that, Based on the aforementioned set of intermediate valid operation and maintenance candidate topics, a topic hyperedge infrastructure is constructed, including: Extract all associated entities, inter-entity relationships, and operation and maintenance events from the intermediate valid operation and maintenance candidate topic set, and summarize them to obtain the entity set, relationship set, and event set; Based on the degree of contribution of the entities in the entity set to the current topic phenomenon, the entity types are distinguished to obtain strong entity subsets and weak entity subsets; Extract from the set of intermediate valid operation and maintenance candidate topics to obtain the business domain, main level, support level, start time, end time, evidence summary, standardized topic name and globally unique topic number; According to the preset hyperedge storage structure, the entity set, relation set, event set, strong entity subset, and weak entity subset are uniformly encapsulated to obtain the topic hyperedge basic structure.

5. The method for processing operation and maintenance subject data according to claim 1, characterized in that, The topic hyperedge infrastructure is subjected to multi-dimensional index extraction and encapsulation to obtain a complete topic hyperedge, including: Multi-dimensional indicators were extracted from the aforementioned topic hyperedge infrastructure to obtain entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, and business impact. according to The overall weight of the superedge of the theme is obtained; Among them, W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the time co-occurrence intensity, C freq C represents the historical repetition frequency. impact To represent the degree of business impact, α is the fifth weighting coefficient, β is the sixth weighting coefficient, γ is the seventh weighting coefficient, δ is the eighth weighting coefficient, η is the ninth weighting coefficient, and μ is the tenth weighting coefficient. The entity coverage completeness, relationship closure, event support, temporal co-occurrence intensity, historical repetition frequency, business impact degree, and topic hyperedge comprehensive weight are encapsulated with the topic hyperedge infrastructure to obtain a complete topic hyperedge.

6. The method for processing operation and maintenance subject data according to claim 1, characterized in that, Based on the aforementioned business scenario, real-time entities, real-time relationships, real-time events, and occurrence time, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base, including: Based on the business scenario, real-time entity, real-time relationship, real-time event and occurrence time, determine the matching degree of the operation and maintenance real-time event with the business scenario, entity overlap, time window overlap and text semantic similarity of each complete topic hyperedge in the hyperedge knowledge base; Based on the matching degree of business scenarios, the overlap of entities, the overlap of time windows, and the semantic similarity of text, the comprehensive matching score between real-time operation and maintenance events and each complete topic hyperedge in the hyperedge knowledge base is determined. When S match ≧S th Determine the corresponding complete topic hyperedge as the target complete topic hyperedge; Among them, S th To match the filtering threshold.

7. The method for processing operation and maintenance subject data according to claim 1, characterized in that, Based on the comprehensive weight of the target complete topic hyperedges, entity coverage completeness, relationship closure, event support, temporal co-occurrence strength, historical repetition frequency, business impact, and strong and weak entity subsets, at least two groups of target complete topic hyperedges are sorted to obtain a list of target complete topic hyperedges, including: according to The sorting priority score of the superedge of the complete target topic for each group is obtained; Among them, Score sort The ranking priority score is represented by x, which is the entity strength coefficient. The entity strength coefficient for a strong entity subset is 1, and for a weak entity subset it is 0.

6. W h For the comprehensive weight of the theme superedge, C cov For entity coverage completeness, C conf C represents the degree of relation closure. temp For the support level of the event, C time For the time co-occurrence intensity, C freq C represents the historical repetition frequency. impact To determine the degree of business impact, y1 is the fifteenth weight coefficient, y2 is the sixteenth weight coefficient, y3 is the seventeenth weight coefficient, y4 is the eighteenth weight coefficient, y5 is the nineteenth weight coefficient, and y6 is the twentieth weight coefficient. Sort the target complete topic hyperedges in descending order according to their priority scores to obtain a list of target complete topic hyperedges.

8. A system for processing operation and maintenance subject data, characterized in that, include: The acquisition module is used to acquire at least two real-time operation and maintenance events; The processing module is used to parse the real-time operation and maintenance events to obtain a real-time event dataset; The real-time event dataset includes: business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times. Based on the business scenarios, real-time entities, real-time relationships, real-time events, and occurrence times, at least two sets of target complete topic hyperedges are matched from the hyperedge knowledge base. Based on the comprehensive weight of the target complete topic hyperedges, entity coverage completeness, relationship closure, event support, time co-occurrence strength, historical repetition frequency, business impact degree, and strong and weak entity subsets, the at least two sets of target complete topic hyperedges are sorted to obtain a target complete topic hyperedge list. Each target complete topic hyperedge in the target complete topic hyperedge list is output. The construction process of the hyperedge knowledge base includes: acquiring hierarchical and domain-specific knowledge graph data; the hierarchical and domain-specific knowledge graph data... The layered domain knowledge graph data includes: entity set, relation set, event set, and time window data. Based on the entity set, relation set, event set, and time window data, a set of valid operation and maintenance candidate topics is determined. Based on the entity set, relation set, event set, and time window data, each valid operation and maintenance candidate topic in the set of valid operation and maintenance candidate topics is assigned a standardized topic name and a globally unique topic number to obtain an intermediate set of valid operation and maintenance candidate topics. Based on the intermediate set of valid operation and maintenance candidate topics, a topic hyperedge infrastructure is constructed. Multi-dimensional indicators are extracted and encapsulated from the topic hyperedge infrastructure to obtain a complete topic hyperedge. The complete topic hyperedge is stored and a multi-dimensional retrieval index is established to obtain a hyperedge knowledge base.

9. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 7.

10. A computing device readable storage medium, characterized in that, The computing device readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images