An intelligent operation and maintenance method and system

Abstract

The application relates to the technical field of intelligent operation and maintenance, and particularly discloses an intelligent operation and maintenance method and system, which designs a closed-loop fusion architecture of inspection, analysis, processing and optimization for the subway IT operation and maintenance scene. The method comprises the following steps: periodically inspecting and listing abnormal indexes in an alarm queue; automatically associating log data based on event driving, performing semantic analysis and reasoning fault root causes by using a large language model; generating a fault list and intelligently recommending a solution; depositing the fault processing to a subway operation and maintenance knowledge base; and correcting the inspection threshold according to the processing result and a false alarm record to form a self-correcting closed loop. The application improves the subway operation and maintenance efficiency and avoids information silos and repeated labor.

Description

Technical Field

[0001] This invention relates to the technical field of intelligent operation and maintenance, and specifically to an intelligent operation and maintenance method and system. Background Technology

[0002] With the increasing complexity of subway information systems, IT operations and maintenance (O&M) face enormous challenges. Traditional O&M methods rely heavily on human experience, resulting in low efficiency, slow response times, and difficulties in knowledge transfer. In recent years, the rapid development of artificial intelligence technology, especially the emergence of Large Language Models (LLMs), has provided new possibilities for intelligent O&M.

[0003] The existing technology CN119847802A discloses an intelligent operation and maintenance management and alarm system based on a large model intelligent agent. This solution is designed for general IT scenarios and adopts a linear processing flow of data collection, anomaly detection, alarm optimization, root cause analysis, and automatic repair. Each step is executed sequentially, lacking a feedback and optimization mechanism from processing results to inspection parameters. Furthermore, its root cause analysis relies on a pre-built knowledge graph for graph traversal reasoning, requiring manual maintenance of the graph structure, which limits its applicability in the heterogeneous operation and maintenance environment of subway systems.

[0004] In summary, there is a need to design an intelligent operation and maintenance method and system to solve the problems in the existing technology. Summary of the Invention

[0005] To address the problems in the prior art, this invention provides an intelligent operation and maintenance method and system that improves operation and maintenance efficiency, shortens fault response time, and enhances the stability and reliability of the subway information system, specifically for the IT scenario of subways.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: An intelligent operation and maintenance method includes the following steps: S1. Periodically perform inspection tasks, generate structured inspection reports, and add abnormal indicators to the alarm queue; S2. When alarm information appears in the alarm queue in step S1, the relevant log data within the abnormal time period is automatically associated, key fault codes are extracted, and structured fault analysis results are output. S3. Generate a fault list based on the inspection report and fault analysis results, and improve the fault list according to the fault phenomenon description; S4. Based on the asset configuration management system, obtain the topological relationship and business dependency relationship of alarm devices, analyze the impact of infrastructure alarms on the upper-level business of the subway through a large language model, filter irrelevant alarms, and search and recommend solutions based on work order description, fault characteristics, and historical similar work orders through search enhancement generation technology. S5. After troubleshooting, generate a processing summary and save it to the subway operation and maintenance knowledge base; S6. Based on the actual handling results of the fault and the false alarm records, distinguish between real alarms and false alarms, and relax or tighten the inspection threshold in the inspection task in step S1 according to the occurrence frequency of the real alarms and false alarms, so as to form a self-correcting closed loop of inspection thresholds.

[0007] In some embodiments of the present invention, step S1 specifically includes the following steps: S11. Scan the key indicators of the business system, collect the real-time values ​​and trends of the key indicators; identify abnormal indicators based on the inspection threshold parameters; S12. Perform batch inspections of the monitoring dashboards for databases, middleware, and hosts to identify abnormal indicators; S13. When the error rate of any API interface increases, automatically trace along the call chain to locate the microservice or host with the problem. S14. Generate a structured inspection report; mark abnormal indicators, risk levels, and preliminary judgments; add abnormal indicators to the alarm queue.

[0008] In some embodiments of the present invention, step S2 specifically includes the following steps: S21. When alarm information appears in the alarm queue in step S1, collect and preprocess log data, automatically determine the associated time window and service scope based on the event-driven mechanism, and call the log platform interface to pull the associated log data through the model context protocol. S22. Use a large language model to perform semantic analysis on logs to identify abnormal patterns and extract key fault features; S23. Perform RAG matching between the extracted fault features and known fault modes in the subway operation and maintenance knowledge base to output structured fault analysis results.

[0009] In some embodiments of the present invention, step S3 includes the following specific steps: S31. Summarize inspection anomalies and log analysis results, generate a structured fault list, and automatically label alarm levels; S32. Receive the user's voice description of the fault phenomenon; the system automatically matches service items and extracts key information to fill the fault list.

[0010] In some embodiments of the present invention, the retrieval recommendation solution through retrieval enhancement generation technology includes: The work order description or fault features are converted into vectors through an embedding model, and cosine similarity is calculated with document vectors in the subway operation and maintenance knowledge base to retrieve the most semantically relevant knowledge fragments. Search for the processing solutions of similar work orders in the past and extract the effective processing solutions as auxiliary references; Searching for publicly available information on the Internet as a supplementary source of information.

[0011] In some embodiments of the present invention, step S6 includes: Record the causal relationship between alarms and faults, as well as false alarm records; for inspection indicators with frequent false alarms, relax the inspection threshold to reduce invalid alarms; for real alarms that are triggered stably over a long period of time, tighten the inspection threshold to ensure that no risks are missed; archive threshold adjustment records, and support manual review and rollback.

[0012] In some embodiments of the present invention, step S6 further includes a retrieval threshold optimization step: Record feedback signals indicating whether each recommended solution is adopted by engineers; when the adoption rate of recommended solutions for a certain type of problem is consistently lower than the set threshold, reduce the semantic similarity screening threshold for the corresponding domain of that type of problem to expand the recall range; when mismatches increase, increase the semantic similarity screening threshold for the corresponding domain of that type of problem to improve accuracy.

[0013] In some embodiments of the present invention, an intelligent operation and maintenance system is provided, comprising: The data acquisition module connects to various operation and maintenance data sources through a unified communication protocol to collect various operation and maintenance data. The data processing module includes an AI agent unit, a knowledge retrieval and enhancement generation unit, a tool invocation unit, a model context protocol unit, and a large language model unit; it is used to output solutions based on the operation and maintenance data. The data application module includes an operation and maintenance assistant unit, an inspection unit, a log monitoring unit, and a fault handling unit. It communicates with the data processing module and performs the following functions: the operation and maintenance assistant unit is used for intent recognition, knowledge retrieval, and solution recommendation; the inspection unit is used for periodic inspection task execution and abnormal indicator identification; the log monitoring unit is used for log data collection, semantic analysis, and root cause analysis; and the fault handling unit is used for alarm impact analysis, troubleshooting solution recommendation, and closed-loop threshold optimization. Data exchange between the units forms a closed loop. The closed-loop feedback module records the output results and processes the feedback results of the data application module; it continuously optimizes the coverage, accuracy, and timeliness of inspection thresholds, recommendation strategies, and knowledge base through data analysis.

[0014] In some embodiments of this application, an electronic device is provided, comprising: A processor, and a memory and a transceiver communicatively connected to the processor; The memory stores computer-executed instructions; the transceiver is used for sending and receiving data. The processor executes the computer execution instructions stored in the memory to implement the above-described intelligent operation and maintenance method.

[0015] In some embodiments of this application, a computer-readable storage medium is provided, wherein computer-executable instructions are stored in the computer-readable storage medium, and the computer-executable instructions are executed by a processor to implement the above-described intelligent operation and maintenance method.

[0016] The technical solution of the present invention has the following technical effects compared with the prior art: This invention designs a closed-loop integrated architecture for inspection, analysis, processing, and optimization for subway operation scenarios, enabling data exchange and process linkage among various application scenarios; greatly improving operation and maintenance efficiency and avoiding information silos and repetitive work.

[0017] The present invention has a threshold optimization mechanism based on feedback signals. The inspection threshold can be continuously optimized as the system runs, the false alarm rate can be continuously reduced, and the effective utilization rate of alarms can be continuously improved, thereby reducing the interference of invalid alarms. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts of the intelligent operation and maintenance method shown in the embodiments of the present invention; Figure 2 This is the second flowchart of the intelligent operation and maintenance method shown in the embodiment of the present invention; Figure 3 This is the third flowchart of the intelligent operation and maintenance method shown in the embodiment of the present invention; Figure 4 This is the fourth flowchart of the intelligent operation and maintenance method shown in the embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of the intelligent operation and maintenance system shown in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an electronic device as shown in an embodiment of the present invention.

[0020] Reference numerals: 100, Intelligent Operation and Maintenance System; 110, Data Acquisition Module; 120, Data Processing Module; 130, Data Application Module; 131, Operation and Maintenance Assistant Unit; 132, Inspection Unit; 133, Log Monitoring Unit; 134, Fault Handling Unit; 140, Closed-Loop Feedback Module; 200, Electronic Equipment; 210, Processor; 220, Memory; 230, Transceiver. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the term "communication connection" refers to data interaction between two or more modules / units through a communication bus, network interface, or software call, etc.; the terms "module" and "unit" refer to software program segments, hardware circuits, or combinations thereof that implement a specific function. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0023] The following disclosure provides many different embodiments or examples for implementing different structures of the invention. To simplify the disclosure, specific examples of components and arrangements are described below. Of course, these are merely examples and are not intended to limit the invention. Furthermore, reference numerals and / or letters may be repeated in different examples; such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0024] Example 1, Reference Figure 1 As shown, the intelligent operation and maintenance method includes the following steps: S1. Periodically perform inspection tasks, generate structured inspection reports, and add abnormal indicators to the alarm queue; S2. When alarm information appears in the alarm queue in step S1, the relevant log data within the abnormal time period is automatically associated, key fault codes are extracted, and structured fault analysis results are output. S3. Generate a fault list based on the inspection report and fault analysis results, and improve the fault list according to the fault phenomenon description; S4. Based on the asset configuration management system, obtain the topological relationship and business dependency relationship of alarm devices, analyze the impact of infrastructure alarms on the upper-level business of the subway through a large language model, filter irrelevant alarms, and search and recommend solutions based on work order description, fault characteristics, and historical similar work orders through search enhancement generation technology. S5. After troubleshooting, generate a processing summary and save it to the subway operation and maintenance knowledge base; S6. Based on the actual handling results of the fault and the false alarm records, distinguish between real alarms and false alarms, and relax or tighten the inspection threshold in the inspection task in step S1 according to the occurrence frequency of the real alarms and false alarms, so as to form a self-correcting closed loop of inspection thresholds.

[0025] In this embodiment, the closed-loop integrated architecture of inspection, analysis, processing and optimization enables data exchange and process linkage among various application scenarios, which greatly improves the efficiency of operation and maintenance and avoids information silos and repetitive work.

[0026] In some embodiments of the present invention, reference is made to... Figure 2 As shown, step S1 specifically includes the following steps: S11. Scan the key indicators of the business system, collect the real-time values ​​and trends of the key indicators, and identify abnormal indicators based on the inspection threshold parameters.

[0027] Specifically, staff can first configure an inspection template, which includes defining the inspection scope, inspection indicators, inspection frequency, and alarm thresholds. Among them, the inspection indicators are key metrics, including CPU utilization, memory utilization, disk I / O, network throughput, service response time, and error rate; the inspection frequency can be hourly, daily, or weekly.

[0028] In some embodiments, the timing of inspections can be determined by an AI agent automatically triggering inspection tasks according to a configured inspection template, or by staff manually initiating temporary inspections.

[0029] In some embodiments, real-time values ​​and historical trend data of various inspection indicators are obtained by calling the monitoring system interface.

[0030] Data on key metrics is received through a large language model, and semantic analysis is performed on each metric to determine not only whether it exceeds a threshold, but also to analyze trends and correlations. For example, whether a continuous increase in CPU utilization is accompanied by an increase in memory usage.

[0031] S12. Perform batch inspections of the monitoring dashboards for databases, middleware, and hosts to identify abnormal indicators.

[0032] Specifically, data from dashboards of various databases, middleware, and hosts is acquired in batches, and then analyzed using a large language model to determine if each indicator is normal. Abnormal indicators include at least a sudden increase in the number of connections, a backlog of slow queries, and a surge in disk usage. S13. When the error rate of any API interface increases, automatically trace along the call chain to locate the microservice or host with the problem.

[0033] Specifically, when the API error rate increases, the large language model automatically analyzes the execution status of each span node along the trace chain to locate the first service or host that has encountered an error.

[0034] S14. Generate a structured inspection report; mark abnormal indicators, risk levels, and preliminary judgments; add abnormal indicators to the alarm queue.

[0035] Specifically, the inspection report includes the inspection time, inspection scope, summary of normal indicators, list of abnormal findings, and risk level labeling.

[0036] Anomalies are automatically entered into the alarm queue, triggering intelligent log monitoring and fault handling processes.

[0037] Inspection reports are automatically archived and can be compared and analyzed with historical inspection results.

[0038] In some embodiments of the present invention, reference is made to... Figure 3 As shown, step S2 specifically includes the following steps: S21. Log data collection and preprocessing a) When an alarm is triggered, the AI ​​agent automatically determines the associated time window (N minutes before and after the alarm trigger time) and the relevant service scope; b) Use MCP to call the log platform interface to pull relevant log data; specifically including application logs, system logs, middleware logs, security logs, etc. c) Preprocess the raw logs: format parsing, field extraction, and noise filtering (removing DEBUG level and duplicate logs).

[0039] S22, Semantic Log Analysis a) Input the preprocessed log data into a large language model in segments, and use the natural language understanding capabilities of the large language model to perform semantic analysis, rather than simple keyword matching.

[0040] Specifically, when an infrastructure alarm is generated, the AI ​​agent obtains the topological relationships and business dependencies of the alarming devices through the asset configuration management system.

[0041] b) Identify abnormal patterns in logs using large language models: stack trace analysis, error code identification, anomaly frequency analysis, and time series anomaly detection.

[0042] c) Extract key fault characteristics: error type, abnormal object, involved service / component / host, and first occurrence time.

[0043] S23, Recommendations for Fault Root Cause Analysis a) Perform RAG matching between the extracted fault features and known fault modes in the subway operation and maintenance knowledge base; b) The large language model infers the most likely root cause based on the log semantic analysis results and the matching results of the subway operation and maintenance knowledge base; c) Output the failure analysis results: including a list of root causes (sorted by probability), supporting evidence, recommended verification steps, and improvement measures; d) The generated fault analysis results are automatically associated with the corresponding alarms and work orders for subsequent fault handling.

[0044] In some embodiments of the present invention, reference is made to... Figure 4 As shown, step S3 includes the following specific steps: S31. Summarize inspection anomalies and log analysis results, generate a structured fault list, and automatically label alarm levels; Specifically, P0 indicates urgent and needs to be handled immediately, P1 indicates high priority, P2 indicates medium priority, and P3 indicates low priority and can be handled later.

[0045] S32. The system receives the user's voice description of the fault phenomenon; the system automatically matches service items, extracts key information to fill the fault list, thereby reducing manual operation.

[0046] In some embodiments of the present invention, step S4 specifically includes the following steps: S41. Quickly determine whether infrastructure alarms affect upper-layer services and filter irrelevant alarms. When an infrastructure alarm occurs, the AI ​​agent obtains the topology and service dependencies of the alarming device through the asset configuration management system. The large language model analyzes whether the device alarm affects upper-layer services and business. For example, if an access layer switch port goes down, but there is no production service under that port, it is marked as having no service impact; if it is a core switch, it is marked as the highest emergency level.

[0047] S42. Based on work order description, fault characteristics, and historical similar work orders, retrieve the most relevant solutions using search enhancement generation technology.

[0048] The search enhancement generation technology for retrieving the most relevant solutions includes: The work order description or fault features are converted into vectors through an embedding model, and cosine similarity is calculated with document vectors in the subway operation and maintenance knowledge base to retrieve the most semantically relevant knowledge fragments. Search for the processing solutions of similar work orders in the past and extract the effective processing solutions as auxiliary references; Searching for publicly available information on the Internet as a supplementary source of information.

[0049] In some embodiments, the calculation process for RAG (Retrieval-Augmented Generation) similarity includes: (1) Vectorization and construction of subway operation and maintenance knowledge base: Building a subway operation and maintenance knowledge base refers to collecting and organizing operation and maintenance knowledge content. The subway operation and maintenance knowledge base includes various unstructured documents such as historical work order records, solution documents, operation and maintenance manuals, system architecture documents, and known fault databases.

[0050] The various documents in the subway operation and maintenance knowledge base are vectorized using an embedding model to generate semantic vectors, which are then stored in a vector database. This vector database serves as the index layer of the subway operation and maintenance knowledge base, storing documents converted into semantic vectors through the embedding model to support efficient similarity retrieval. When a user asks a question, the question is also vectorized, and the most relevant text paragraphs are retrieved through similarity calculation. These paragraphs are then provided as context to a large language model to generate an answer.

[0051] (2) Similarity calculation method: This embodiment uses cosine similarity for semantic retrieval. Cosine similarity measures the degree of semantic similarity by calculating the angle between two vectors, and the formula is: cos(θ) = (A... T B) / (||A|| ||B||). The smaller the angle, the more consistent the directions, and the more similar the semantics (cos(θ) approaches 1); the larger the angle, the greater the semantic difference (cos(θ) approaches 0). The system calculates the cosine similarity between the user query vector and the document vectors in the subway operation and maintenance knowledge base, and returns the relevant knowledge fragment with the smallest semantic distance as the retrieval result.

[0052] In some embodiments, the similarity score considers not only semantic similarity but also incorporates the following dimensional weights: (a) Timeliness weight: Recently processed valid work orders receive higher weight to ensure that solutions to hot issues are recommended first.

[0053] (b) Source reliability weight: Validation schemes that have been adopted multiple times are given additional weight, while the weight of schemes recommended for the first time is reduced.

[0054] (c) Scenario matching weight: Problems with the same type of devices and the same type of systems receive higher weight.

[0055] (d) Matching weight of processing results: Based on the current alarm level, prioritize matching successful processing cases of the same urgency in the past.

[0056] In some embodiments of the present invention, step S6 includes the following steps: S61. After troubleshooting is completed, record the causal relationship between alarms and faults, such as which alarms are real precursors to faults and which are false alarms; at the same time, record the feedback signal of whether each recommended solution is adopted by the engineer.

[0057] S62. This step includes two independent feedback tuning loops: (1) Inspection threshold optimization loop: Record the causal relationship between alarms and faults, and distinguish between real alarms and false alarms. For real alarms that are triggered stably over a long period of time, tighten the inspection threshold to ensure that no risks are missed; for alarms that are frequently false alarms, relax the inspection threshold to reduce interference from invalid alarms. Threshold adjustment records are archived and support manual review and rollback.

[0058] (2) Retrieval threshold tuning loop: Record the feedback signal of whether each recommended solution is adopted by the engineer. When the adoption rate of the recommended solution for a certain type of problem is consistently lower than the set threshold, the semantic similarity screening threshold of that domain is reduced to expand the recall range; when the number of mismatches increases, the semantic similarity screening threshold of that domain is increased to improve accuracy.

[0059] S63. The handling process of this fault, the final solution and the handling effect will be automatically saved to the subway operation and maintenance knowledge base for reference in the future for similar problems.

[0060] In some embodiments, records of threshold adjustments are archived, supporting manual review and rollback.

[0061] Compared to existing technologies, this embodiment constructs a proprietary knowledge base for subway IT operations and maintenance and performs semantic retrieval using cosine similarity, resulting in knowledge recommendations that better align with the actual needs of subway operations and maintenance. This increases the success rate for engineers in obtaining solutions, reducing interference from invalid information and the time spent manually reviewing documents. A closed-loop fusion architecture for inspection, analysis, processing, and optimization is designed, enabling data interoperability and process linkage across various application scenarios. This significantly improves operational efficiency and avoids information silos and repetitive work. A threshold optimization mechanism based on feedback signals is introduced, continuously reducing false alarm rates and increasing the effective utilization rate of alarms, effectively minimizing interference from invalid alarms.

[0062] Example 2, this example will be based on Figure 5 and Figure 6 This describes an intelligent operation and maintenance system 100 and an electronic device 200. The intelligent operation and maintenance system 100 includes: The data acquisition module 110 accesses various operation and maintenance data sources through a unified communication protocol to collect various operation and maintenance data, including system monitoring indicators, link tracing data, system and application logs, infrastructure alarms, work order data, and operation and maintenance knowledge base documents. In some embodiments, the communication protocol can adopt the model context protocol for transmitting various operation and maintenance data.

[0063] The data processing module 120 includes an AI agent unit, a knowledge retrieval enhancement generation unit, a tool invocation unit, a model context protocol unit, and a large language model unit; it is used to output solutions based on the operation and maintenance data; in some embodiments, the model context protocol unit is used to assist in data transmission between other units in the data processing module 120, as well as data transmission between the data processing module 120 and other modules.

[0064] The data application module 130 includes an operation and maintenance assistant unit 131, an inspection unit 132, a log monitoring unit 133, and a fault handling unit 134; it is communicatively connected to the data processing module 120 for exchanging information between the various units. The closed-loop feedback module 140 is used to record the output results and processing feedback results of the data application module 130; through data analysis, it continuously optimizes the inspection threshold, recommendation strategy and the coverage, accuracy and timeliness of the knowledge base. The coverage refers to the completeness of the knowledge base in covering common fault types, the accuracy refers to the effectiveness of the stored solutions, and the timeliness refers to the degree of matching between the knowledge base content and the current system environment.

[0065] In some embodiments, the maintenance assistant unit 131 can utilize an AI agent unit for intent recognition. Specifically, when a user outputs a question (input method includes text or voice), the AI ​​agent unit first performs intent classification: distinguishing whether the user's intent is to submit a request, query a solution, summarize a work order, or inquire about a fault; and then routing the user to the corresponding processing flow based on the classification result. The intent classification adopts a few-sample prompting method based on a large model (intent recognition based on a large model), eliminating the need for separate classifier training.

[0066] Operation and Maintenance Assistant Unit 131 can also perform knowledge retrieval. When the intent is to query solutions or inquire about faults, the RAG retrieval process is triggered. The user's question or ticket description text is converted into a vector using an embedding model. Cosine similarity is then calculated between this vector and the document vectors in the knowledge base to retrieve the most semantically relevant knowledge fragments. Simultaneously, historical processing records of similar tickets are retrieved to extract effective solutions as supplementary references. Publicly available information from the internet (such as open-source community solutions and vendor knowledge bases) is also searched as a supplementary information source.

[0067] The AI ​​intelligent agent unit automatically determines whether external tools need to be invoked based on user requests: a) To query the real-time system status, call the monitoring system interface to obtain the current indicator data; b) To query service item information, call the work order system interface to obtain the service catalog and SLA information; c) To query equipment details, call the asset configuration management system interface to obtain equipment configuration, ownership, and responsible person information; d) Standardize all tool call interfaces through the MCP protocol to ensure cross-platform compatibility.

[0068] In addition, the maintenance assistant unit 131 is also used to implement the following functions: The retrieved knowledge context, tool call results, and user questions are merged into an enhanced Prompt, which is then input into the large language model.

[0069] The large language model enhances the Prompt to generate structured answers: the recommended solution adopts a four-part format of [problem analysis -> recommended solution -> reference source -> operation steps]; the work order summary adopts a four-part format of [summary -> processing process -> SLA achieved -> follow-up suggestions].

[0070] The generated content automatically marks the source of the references, supporting one-click navigation to view the original data. It also supports one-click population of the generated content into the corresponding fields of the work order, and allows for secondary editing.

[0071] The Operations Assistant Unit 131 can also record whether engineers have adopted recommended solutions; adopted solutions are automatically marked as "verified," improving their subsequent search ranking. It supports one-click storage of completed work orders and solutions into the subway operations and maintenance knowledge base, whose content is continuously enriched with operational practices.

[0072] In some embodiments, the workflow of the inspection unit 132 is as follows: Step 1: Inspection Task Configuration and Scheduling Administrator configuration of inspection template: Define the inspection scope (list of business systems), inspection indicators (CPU / memory / disk / network / service status, etc.), inspection frequency (hourly / daily / weekly), and alarm threshold; The AI ​​intelligent agent unit automatically triggers inspection tasks according to the configured scheduling strategy, or temporary inspections can be manually initiated by engineers. By calling the monitoring system interface through Function Calling, the current values ​​and historical trend data of each inspection indicator can be obtained.

[0073] Step Two: Intelligent Inspection Execution Intelligent inspection application: The large language model receives all core indicator data and performs semantic analysis on each indicator; specifically, it not only determines whether the threshold is exceeded, but also analyzes trends and correlations; Intelligent trace analysis: When the API error rate increases, the large language model automatically analyzes the execution status of each span node along the trace chain to locate the first service or host that has an error. Intelligent dashboard inspection: Batch acquisition of dashboard data from various databases, middleware, and hosts, and analysis of each indicator by a large language model to determine if they are normal.

[0074] Step 3: Output of Inspection Results Generate a structured inspection report, including: inspection time, inspection scope, summary of normal indicators, list of abnormal findings, and risk level labeling; Anomalies are automatically entered into the alarm queue, triggering intelligent log monitoring and fault handling processes. Inspection reports are automatically archived and can be compared and analyzed with historical inspection results.

[0075] In some embodiments, the workflow of the log monitoring unit 133 is as follows: Step 1: Log Data Collection and Preprocessing When an alarm is triggered, the AI ​​agent unit automatically determines the associated time window (N minutes before and after the alarm trigger time) and the relevant service scope; The log platform interface is invoked via the MCP protocol to retrieve relevant log data. Preprocess the raw logs: format parsing, field extraction, and noise filtering (removing DEBUG level and duplicate logs).

[0076] Step 2: Semantic Log Analysis The preprocessed log data is segmented and input into a large language model. The natural language understanding capabilities of the large language model are used for semantic analysis, rather than simple keyword matching. Large language models identify abnormal patterns in logs: stack trace analysis, error code identification, anomaly frequency analysis, and time series anomaly detection; Extract key fault characteristics: error type, abnormal object, involved service / component / host, and first occurrence time.

[0077] Step 3: Root Cause Analysis Recommendations The extracted fault features are matched with known fault patterns in the knowledge base using RAG matching.

[0078] The large language model infers the most likely root cause based on log semantic analysis results and knowledge base matching results.

[0079] Output a root cause analysis report: a list of possible root causes (sorted by probability), supporting evidence, recommended validation steps, and improvement measures.

[0080] The generated root cause analysis results are automatically associated with the corresponding alarms and work orders for subsequent fault handling.

[0081] In some embodiments, the fault handling unit 134 operates as follows: Step 1: Intelligent Analysis of Alarm Impact When an infrastructure alarm is generated, the AI ​​intelligent agent unit obtains the topological relationship and business dependency relationship of the alarm device through the asset configuration management system; Large language model analysis determines whether the device alarms affect upper-layer services and business. Output an alarm impact analysis report to clearly inform engineers whether immediate action is required.

[0082] Step 2: Root Cause Analysis (RCA) The AI ​​agent aggregates all relevant data: end-to-end tracing data (trace + span), log analysis results, changes in monitoring indicators, and topology information of the asset allocation management system; The large language model performs multi-dimensional correlation analysis based on complete data to infer the fault propagation path and root cause. The following step-by-step decomposition method is adopted: business anomaly -> service anomaly -> host anomaly -> process anomaly -> configuration change / insufficient resources / code defect.

[0083] Step 3: Recommendation and Implementation of Troubleshooting Plan Based on the RCA conclusions, the handling solutions for similar historical faults were retrieved using RAG. The large language model, combined with the current system state, generates specific executable processing steps; It supports automatically performing safe recovery operations (such as restarting services, clearing cache, switching to backup links, etc.) via Function Calling. High-risk operations require engineer confirmation.

[0084] Step 4: Closed-loop optimization and threshold tuning After the fault is resolved, the system records the causal relationship between the alarms and the fault: which alarms are real precursors to the fault and which are false alarms; For real alarms that are triggered stably over a long period of time, the inspection threshold can be appropriately tightened to ensure that no risks are overlooked; For alarms that frequently generate false alarms, the inspection threshold can be appropriately relaxed to reduce interference from invalid alarms; Threshold adjustment records are archived and can be manually reviewed and rolled back.

[0085] The above-mentioned operation and maintenance assistant unit 131, inspection unit 132, log monitoring unit 133 and fault handling unit 134 can achieve data interoperability. Inspection results can directly drive the log analysis scope, log analysis results can directly fill the work order fields, and work order processing results can reversely optimize the inspection threshold. Data flows seamlessly between scenarios.

[0086] Through threshold optimization mechanisms and continuous enrichment of the knowledge base, the system can continuously improve inspection accuracy and recommendation accuracy over time, achieving intelligent operation and maintenance evolution. This forms an iterative improvement closed loop of discovery, analysis, processing, optimization, and rediscovery.

[0087] It should be understood that the intelligent operation and maintenance system 100 here is embodied in the form of functional modules. The term "module" here can refer to application-specific integrated circuits (ASICs), electronic circuits, processors (e.g., shared processors, proprietary processors, or group processors, etc.) and memory for executing one or more software or firmware programs, integrated logic circuits, and / or other suitable components supporting the described functions. In an alternative example, those skilled in the art will understand that the intelligent operation and maintenance system 100 may specifically be the electronic device 200 in the above embodiments, or the functions of the electronic device 200 in the above embodiments may be integrated into the intelligent operation and maintenance system 100. The intelligent operation and maintenance system 100 may be used to execute the various processes and / or steps corresponding to the electronic device 200 in the above method embodiments; to avoid repetition, these will not be described again here.

[0088] The aforementioned intelligent operation and maintenance system 100 has the function of implementing the corresponding steps executed by the electronic device 200 in the intelligent operation and maintenance method of Embodiment 1; the aforementioned functions can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned functions. For example, the aforementioned acquisition module can be a communication interface, such as a transceiver interface.

[0089] In the embodiments of this application, Figure 5 The intelligent operation and maintenance system 100 in the text can also be a chip or a chip system, such as a system on chip (SoC).

[0090] Reference Figure 6 As shown, in this embodiment, an electronic device 200 is provided, including: Processor 210, and memory 220 and transceiver 230 communicatively connected to said processor; The memory 220 stores computer-executed instructions; the transceiver 230 is used for sending and receiving data. The processor 210 executes the computer execution instructions stored in the memory 220 to implement the intelligent operation and maintenance method in Embodiment 1.

[0091] It should be understood that the electronic device 200 can be used to perform the corresponding steps and / or processes in the above method embodiments. Optionally, the memory 220 may include read-only memory and random access memory, and provide instructions and data to the processor. A portion of the memory 220 may also include non-volatile random access memory. For example, the memory 220 may also store device type information. The processor 210 can be used to execute instructions stored in the memory 220, and when the processor 210 executes the instructions, the processor 210 can perform the corresponding steps and / or processes in the above method embodiments.

[0092] It should be understood that, in the embodiments of this application, the processor 210 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0093] In implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware in the processor 210 or by instructions in software form. The steps of the method disclosed in the embodiments of this application can be directly embodied in the execution by the hardware processor, or by a combination of hardware and software modules in the processor 210. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor executes the instructions in the memory, combining them with its hardware to complete the steps of the above method. To avoid repetition, detailed descriptions are not provided here.

[0094] Example 3: In this example, a computer-readable storage medium is provided, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the intelligent operation and maintenance method in Example 1.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0096] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0097] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0098] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0099] The technical solution of the present invention has the following technical effects compared with the prior art: This invention designs a closed-loop integrated architecture for inspection, analysis, processing, and optimization for subway operation scenarios, enabling data exchange and process linkage among various application scenarios; greatly improving operation and maintenance efficiency and avoiding information silos and repetitive work.

[0100] The present invention has a threshold optimization mechanism based on feedback signals. The inspection threshold can be continuously optimized as the system runs, the false alarm rate can be continuously reduced, and the effective utilization rate of alarms can be continuously improved, thereby reducing the interference of invalid alarms.

[0101] This invention employs a log analysis method based on semantic understanding using a large language model to replace traditional keyword matching; it provides more accurate fault location, can identify complex anomaly patterns, and significantly improves the depth of log analysis.

[0102] A knowledge base supporting incremental updates has also been built, ensuring that new knowledge is readily available. This knowledge base is always up-to-date, preventing the lag issue where updated operational experience doesn't replace an updated knowledge base. An AI-based multi-tool collaborative architecture has been introduced, enabling automated handling of complex operational tasks. This reduces reliance on senior engineers, allowing newcomers to perform complex operations with AI assistance, thus alleviating the personnel training pressure on the operations team.

[0103] In the description of the above embodiments, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0104] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An intelligent operation and maintenance method, characterized in that, Includes the following steps: S1. Periodically perform inspection tasks, generate structured inspection reports, and add abnormal indicators to the alarm queue; S2. When alarm information appears in the alarm queue in step S1, the relevant log data within the abnormal time period is automatically associated, key fault codes are extracted, and structured fault analysis results are output. S3. Generate a fault list based on the inspection report and fault analysis results, and improve the fault list according to the fault phenomenon description; S4. Based on the asset configuration management system, obtain the topological relationship and business dependency relationship of alarm devices, analyze the impact of infrastructure alarms on the upper-level business of the subway through a large language model, filter irrelevant alarms, and search and recommend solutions based on work order description, fault characteristics, and historical similar work orders through search enhancement generation technology. S5. After troubleshooting, generate a processing summary and save it to the subway operation and maintenance knowledge base; S6. Based on the actual handling results of the fault and the false alarm records, distinguish between real alarms and false alarms, and relax or tighten the inspection threshold in the inspection task in step S1 according to the occurrence frequency of the real alarms and false alarms, so as to form a self-correcting closed loop of inspection thresholds.

2. The intelligent operation and maintenance method according to claim 1, characterized in that, Step S1 specifically includes the following steps: S11. Scan the key indicators of the business system, collect the real-time values ​​and trends of the key indicators; identify abnormal indicators based on the inspection threshold parameters; S12. Perform batch inspections of the monitoring dashboards for databases, middleware, and hosts to identify abnormal indicators; S13. When the error rate of any API interface increases, automatically trace along the call chain to locate the microservice or host with the problem. S14. Generate a structured inspection report; mark abnormal indicators, risk levels, and preliminary judgments; add abnormal indicators to the alarm queue.

3. The intelligent operation and maintenance method according to claim 1, characterized in that, Step S2 specifically includes the following steps: S21. When alarm information appears in the alarm queue in step S1, collect and preprocess log data, automatically determine the associated time window and service scope based on the event-driven mechanism, and call the log platform interface to pull the associated log data through the model context protocol. S22. Use a large language model to perform semantic analysis on logs to identify abnormal patterns and extract key fault features; S23. Perform RAG matching between the extracted fault features and known fault modes in the subway operation and maintenance knowledge base to output structured fault analysis results.

4. The intelligent operation and maintenance method according to claim 1, characterized in that, Step S3 includes the following specific steps: S31. Summarize inspection anomalies and log analysis results, generate a structured fault list, and automatically label alarm levels; S32. Receive the user's voice description of the fault phenomenon; the system automatically matches service items and extracts key information to fill the fault list.

5. The intelligent operation and maintenance method according to claim 1, characterized in that, The retrieval recommendation solution using retrieval enhancement generation technology includes: The work order description or fault features are converted into vectors through an embedding model, and cosine similarity is calculated with document vectors in the subway operation and maintenance knowledge base to retrieve the most semantically relevant knowledge fragments. Search for the processing solutions of similar work orders in the past and extract the effective processing solutions as auxiliary references; Searching for publicly available information on the Internet as a supplementary source of information.

6. The intelligent operation and maintenance method according to claim 1, characterized in that, Step S6 includes: Record the causal relationship between alarms and faults, as well as false alarm records; for inspection indicators with frequent false alarms, relax the inspection threshold to reduce invalid alarms; for real alarms that are triggered stably over a long period of time, tighten the inspection threshold to ensure that no risks are missed; archive threshold adjustment records, and support manual review and rollback.

7. The intelligent operation and maintenance method according to claim 1, characterized in that, Step S6 further includes a retrieval threshold optimization step: Record feedback signals indicating whether each recommended solution is adopted by engineers; when the adoption rate of recommended solutions for a certain type of problem is consistently lower than the set threshold, reduce the semantic similarity screening threshold for the corresponding domain of that type of problem to expand the recall range; when mismatches increase, increase the semantic similarity screening threshold for the corresponding domain of that type of problem to improve accuracy.

8. An intelligent operation and maintenance system, characterized in that, To implement the intelligent operation and maintenance method as described in any one of claims 1-7, the method includes: The data acquisition module connects to various operation and maintenance data sources through a unified communication protocol to collect various operation and maintenance data. The data processing module includes an AI agent unit, a knowledge retrieval and enhancement generation unit, a tool invocation unit, a model context protocol unit, and a large language model unit; it is used to output solutions based on the operation and maintenance data. The data application module includes an operation and maintenance assistant unit, an inspection unit, a log monitoring unit, and a fault handling unit. It communicates with the data processing module and performs the following functions: the operation and maintenance assistant unit is used for intent recognition, knowledge retrieval, and solution recommendation; the inspection unit is used for periodic inspection task execution and abnormal indicator identification; the log monitoring unit is used for log data collection, semantic analysis, and root cause analysis; and the fault handling unit is used for alarm impact analysis, troubleshooting solution recommendation, and closed-loop threshold optimization. Data exchange between the units forms a closed loop. The closed-loop feedback module records the output results and processes the feedback results of the data application module; it continuously optimizes the coverage, accuracy, and timeliness of inspection thresholds, recommendation strategies, and knowledge base through data analysis.

9. An electronic device, characterized in that, include: A processor, and a memory and a transceiver communicatively connected to the processor; The memory stores computer-executed instructions; the transceiver is used for sending and receiving data. The processor executes the computer execution instructions stored in the memory to implement the intelligent operation and maintenance method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the intelligent operation and maintenance method as described in any one of claims 1-7.

Images