Cloud network operation and maintenance method and system

Abstract

The application relates to a cloud network operation and maintenance method and system. The method comprises the following steps: obtaining an abnormal event object through a coordination agent, and distributing the abnormal event object to at least one professional agent; analyzing and reasoning the abnormal event object through the professional agent, and generating a candidate root cause corresponding to the professional agent; fusing the candidate root cause based on the coordination agent, and generating a root cause evidence chain; and the root cause evidence chain is used to generate a treatment suggestion. Through the above method, multiple sources of evidence can be effectively fused, the uncertainty and conflict of the multiple sources of evidence can be reduced, the root cause conclusion can be traced back, the efficiency and reliability of fault positioning are improved, the business interruption time is shortened, the economic losses caused by order stagnation and business opening failure are greatly reduced, the labor cost of manual operation and maintenance is reduced, and the method is suitable for large-scale, high-complexity and high-security cloud network integrated operation and maintenance scenarios.

Description

Technical Field

[0001] This application relates to the field of network operation and maintenance technology, and in particular to cloud network orchestration operation and maintenance methods and systems. Background Technology

[0002] The cloud-network orchestration system is a core platform that supports the automated deployment, scheduling, and lifecycle management of telecom-grade services, and carries complex business processes across networks, clouds, and systems.

[0003] In related technologies, cloud-network orchestration systems typically employ an operation and maintenance solution based on a single AIOps (Artificial Intelligence for IT Operations) model. This involves directly inputting raw fault data into an independent large model / AIOps model, and then using the model's semantic understanding and fitting capabilities to directly output root cause conclusions and remedial suggestions, achieving end-to-end reasoning. However, a single AIOps model or large language model can only process a few types of input data, failing to fully utilize multi-dimensional evidence across systems; the model's reasoning process is a black box, lacking interpretability, and the conclusions cannot be traced back to the original evidence.

[0004] In summary, existing O&M solutions based on a single AIOps model have significant shortcomings in terms of fault identification accuracy and interpretability, making it difficult to meet the intelligent and automated O&M requirements of carrier-grade cloud network orchestration systems. Therefore, there is an urgent need for an O&M method for cloud network orchestration systems that can improve fault identification accuracy and achieve interpretable fault detection. Summary of the Invention

[0005] To address or partially address the problems existing in related technologies, this application provides a cloud network orchestration operation and maintenance method and system that can effectively integrate multi-source evidence, reduce the uncertainty and conflict of multi-source evidence, make root cause conclusions traceable, improve the efficiency and reliability of fault location, shorten the service interruption time, significantly reduce the economic losses caused by work order stagnation and service activation failure, and reduce the labor costs of manual operation and maintenance.

[0006] This application provides a cloud network orchestration and operation method, the method being applied to a cloud network orchestration and operation system, the cloud network orchestration and operation system including at least a coordinating agent and several specialized agents; the method includes: The abnormal event object is obtained through the coordinating agent, and the abnormal event object is assigned to at least one of the specialized agents. The professional intelligent agent performs analysis and reasoning on the abnormal event object to generate candidate root causes corresponding to the professional intelligent agent. The coordinating agent fuses the candidate root causes to generate a root cause evidence chain; the root cause evidence chain is used to generate treatment recommendations.

[0007] In some implementations, assigning the abnormal event object to at least one specialized intelligent agent includes: Obtain the capability matrix; the capability matrix is ​​used to represent the various capabilities of each of the specialized intelligent agents. The candidate professional intelligent agent set is selected based on the abnormal event object, the capability matrix, and the preset knowledge base; Calculate the comprehensive score of each professional intelligent agent in the candidate professional intelligent agent set matching the abnormal event object based on the abnormal event object and the capability matrix; Based on the comprehensive score, the abnormal event object is assigned to at least one of the specialized intelligent agents.

[0008] In some implementations, the step of filtering the candidate professional intelligent agent set based on the abnormal event object, the capability matrix, and the preset knowledge base includes: Retrieve historical cases similar to the abnormal event object from the preset knowledge base; The candidate set of specialized intelligent agents is determined based on the historical cases and the capability matrix.

[0009] In some implementations, calculating the comprehensive score of each professional agent in the candidate professional agent set relative to the abnormal event object based on the abnormal event object and the capability matrix includes: For each of the professional intelligent agents in the candidate professional intelligent agent set, the task matching degree is calculated based on the capability matrix of the abnormal event object and the professional intelligent agent. The current type of evidence is determined based on the abnormal event object and the capability matrix, and the evidence coverage is calculated based on the type of evidence. Target historical cases related to the professional intelligent agent are selected from the historical cases, and the case similarity is calculated based on the target historical cases and the abnormal event objects. The actual evidence collection risk value is determined based on the abnormal event object, and the execution risk degree is calculated based on the actual evidence collection risk value. The estimated inference time is determined based on the abnormal event object, and the resource consumption is calculated based on the estimated inference time. The comprehensive score is calculated based on preset weighting coefficients and the task matching degree, evidence coverage, case similarity, execution risk, and resource consumption.

[0010] In some implementations, assigning the anomalous event object to at least one of the specialized intelligent agents based on the comprehensive score includes: Compare the comprehensive score of each specialized intelligent agent with a preset scheduling threshold; The abnormal event object is assigned to a professional intelligent agent whose comprehensive score is higher than a preset scheduling threshold.

[0011] In some implementations, the candidate root causes have corresponding confidence levels; the step of fusing the candidate root causes based on the coordinating agent to generate a root cause evidence chain includes: The conflict coefficient is calculated based on the candidate root causes and the confidence level of the candidate root causes. The fusion confidence score is calculated based on the conflict coefficient and the confidence score of the candidate root cause. The target root cause is determined based on the fusion confidence score, and a root cause evidence chain is generated based on the target root cause and the fusion confidence score.

[0012] In some implementations, after generating the disposal recommendation, the following steps are also included: The risk value of implementing the proposed treatment is calculated using a risk quantification model; The risk level is determined based on the risk value, and the corresponding control strategy is implemented.

[0013] In some implementations, after executing the control strategy corresponding to the risk level, the method further includes: Count the number of returned orders; determine whether alarms have been cleared; Calculate the single-item response rate and the interface success rate separately; The fault is resolved when the order volume recovers to the preset normal baseline order volume, the alarm is cleared, and the order volume recovery rate and the interface success rate exceed their respective preset thresholds.

[0014] In some implementations, prior to obtaining the abnormal event object through the coordinating agent, the process further includes: Collect multi-source heterogeneous data and extract multi-dimensional features of the multi-source heterogeneous data based on different time granularities; Density clustering algorithm is used to identify anomalies in the multidimensional features in order to determine whether an abnormal event has occurred. When an abnormal event is detected, the multidimensional features corresponding to the abnormal event are encapsulated into a standardized abnormal event object.

[0015] A second aspect of this application provides a cloud network orchestration and operation and maintenance system, which includes at least a coordinating agent and several specialized agents; wherein: The coordinating agent is used to acquire abnormal event objects and assign the abnormal event objects to at least one of the specialized agents. The specialized intelligent agent is used to analyze and reason about the abnormal event object and generate candidate root causes corresponding to the specialized intelligent agent. The coordinating agent is also used to fuse the candidate root causes to generate a root cause evidence chain; the root cause evidence chain is used to generate treatment recommendations.

[0016] The technical solution provided in this application may include the following beneficial effects: This application proposes a cloud network orchestration and operation method. This method is applied to a cloud network orchestration and operation system, which includes at least a coordinating agent and several specialized agents. The method includes: acquiring abnormal event objects through the coordinating agent and assigning the abnormal event objects to at least one specialized agent; performing analytical reasoning on the abnormal event objects through the specialized agents to generate candidate root causes corresponding to the specialized agents; fusing the candidate root causes based on the coordinating agent to generate a root cause evidence chain; and using the root cause evidence chain to generate handling suggestions. This method effectively integrates multi-source evidence, reduces the uncertainty and conflict of multi-source evidence, makes root cause conclusions traceable, improves the efficiency and reliability of fault location, shortens service interruption time, significantly reduces economic losses caused by work order stagnation and service activation failure, lowers the labor costs of manual operation and maintenance, and is suitable for large-scale, highly complex, and high-security integrated cloud network operation and maintenance scenarios.

[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0018] The above and other objects, features and advantages of this application will become more apparent from the more detailed description of exemplary embodiments thereof in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments thereof.

[0019] Figure 1 This is a flowchart illustrating the cloud network orchestration and operation method in an embodiment of this application; Figure 2 This is another schematic diagram of the cloud network orchestration and operation method shown in the embodiments of this application; Figure 3 This is a diagram illustrating the structure of a six-tuple exception event object in an embodiment of this application; Figure 4 This is a timing diagram of multi-specialty intelligent agent collaborative reasoning shown in the embodiments of this application; Figure 5 This is a flowchart illustrating the hierarchical security constraint control process in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of the cloud network orchestration and operation and maintenance system shown in the embodiments of this application; Figure 7 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. Detailed Implementation

[0020] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to make this application more thorough and complete, and to fully convey the scope of this application to those skilled in the art.

[0021] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0022] It should be understood that although the terms "first," "second," "third," etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0023] Explanation of related terms DBSCAN (Density-Based Spatial Clustering of Applications with Noise): A density-based clustering algorithm used for identifying outlier data points. Dempster-Shafer Theory: A theoretical framework for uncertainty reasoning, used for the fusion of multi-source evidence. RAG (Retrieval-Augmented Generation): A retrieval enhancement generation technique used for historical case retrieval and matching. Agent Multi-Agent Framework: A collaborative architecture based on autonomous agents that supports distributed reasoning and decision-making. Text Embedding Model: Vectorizes unstructured text to support semantic similarity retrieval. Cloud-Network Orchestration: A platform system that integrates telecom cloud and network resource scheduling and automatically orchestrates business processes, enabling automated deployment and lifecycle management of cross-network and cross-domain services. Chain of evidence: A fault root cause determination chain formed by linking multi-source operation and maintenance data, multi-agent reasoning conclusions, and historical case retrieval results, possessing traceable causal logic. An agent is an autonomous software unit capable of environmental perception, logical reasoning, autonomous decision-making, and collaborative interaction, which can independently complete reasoning tasks in a specific domain. The Coordination Agent is the core agent responsible for task distribution, conclusion fusion, and process scheduling. It serves as the scheduling hub of the cloud network orchestration and operation system. Specialized Agent: A vertical domain intelligent agent that performs specialized analysis on specific data domains (such as metrics, work orders, interfaces, network elements, topology, and cases). Security constraints: Implement a pre-control mechanism for automated operation and maintenance actions, including risk quantification and classification, permission verification, and sandbox simulation verification, to ensure the business security of automated operations. Orchestration stuck: A fault condition in the cloud orchestration process where a work order is stalled at a certain stage due to reasons such as interface timeout, abnormal status, or resource conflict. In related technologies, cloud-network orchestration systems typically employ an operation and maintenance solution based on a single AIOps (Artificial Intelligence for IT Operations) model. This involves directly inputting raw fault data into an independent large model / AIOps model, and then using the model's semantic understanding and fitting capabilities to directly output root cause conclusions and remedial suggestions, achieving end-to-end reasoning. However, a single AIOps model or large language model can only process a few types of input data, failing to fully utilize multi-dimensional evidence across systems; the model's reasoning process is a black box, lacking interpretability, and the conclusions cannot be traced back to the original evidence.

[0024] In summary, existing O&M solutions based on a single AIOps model have significant shortcomings in terms of fault identification accuracy and interpretability, making it difficult to meet the intelligent and automated O&M requirements of carrier-grade cloud network orchestration systems. Therefore, there is an urgent need for an O&M method for cloud network orchestration systems that can improve fault identification accuracy and achieve interpretable fault detection.

[0025] To address the aforementioned issues, this application provides a cloud network orchestration and maintenance method that can effectively integrate multi-source evidence, reduce the uncertainty and conflict of multi-source evidence, make root cause conclusions traceable, improve the efficiency and reliability of fault location, shorten service interruption time, significantly reduce economic losses caused by work order stagnation and service activation failure, and reduce the labor costs of manual maintenance.

[0026] The technical solutions of the embodiments of this application are described in detail below with reference to the accompanying drawings.

[0027] Figure 1 This is a flowchart illustrating the cloud network orchestration and maintenance method in an embodiment of this application.

[0028] See Figure 1 This method is applied to a cloud network orchestration and operation and maintenance system, which includes at least a coordinating agent and several specialized agents; the method includes: Step 110: Obtain the abnormal event object through the coordinating agent and assign the abnormal event object to at least one specialized agent.

[0029] This application addresses the high-risk technical challenges of automated handling in cloud network orchestration systems by proposing a cloud network orchestration operation and maintenance method. This method involves complex fault diagnosis, cross-domain root cause localization, and secure self-healing in cloud network orchestration systems. It is applicable to fault diagnosis and self-healing scenarios in large-scale distributed systems such as carrier cloud network orchestration systems, government and enterprise hybrid cloud operation and maintenance platforms, and automated operation and maintenance systems for financial data centers. The cloud network orchestration system is deployed in a cloud-native microservice architecture, where each agent can be independently scaled up or down.

[0030] The cloud network orchestration operation and maintenance method proposed in this application is applied to a cloud network orchestration operation and maintenance system (hereinafter referred to as the system). The cloud network orchestration operation and maintenance system includes at least a coordinating agent and several specialized agents. When an anomaly is detected in the operation and maintenance data of the cloud network orchestration system, the abnormal operation and maintenance data can be encapsulated and transformed into a standardized abnormal event object. The abnormal event object is then obtained through the coordinating agent. The abnormal event object E = t,level,metrics,link,topo,alarm This serves as input for root cause reasoning. The abnormal event object includes a unified six-tuple object, which is the standardized input carrier for cloud network orchestration faults. The parameters within this six-tuple are the core structured attributes of the fault event, with the following specific meanings: t (time): The precise timestamp of the abnormal fault occurrence, used to align the time series of multi-source data and avoid root cause misjudgments caused by time series misalignment; level: The abnormal risk level, divided into low, medium, and high levels based on the amplitude of indicator fluctuations and the scope of business impact; metrics: Core abnormal indicator characteristics, including time series data such as work order volume, interface timeout rate, business success rate, and resource utilization rate; link: Fault business link information, recording the entire process flow nodes and blocking positions of the work order from orchestration, issuance, construction to return receipt; topo: Business topology dependency relationship, recording the upstream and downstream related architecture of the orchestration system, construction system, and network element devices involved in this fault; alarm: A set of associated alarm events, including interface alarms, resource alarms, work order status abnormality alarms, and other supporting alarm information.

[0031] In this embodiment, to perform multi-dimensional analysis and reasoning on abnormal event objects, multiple specialized intelligent agents are set up, each capable of performing analysis from different dimensions. In one example, there are six specialized intelligent agents, including: an indicator analysis agent (handling time-series indicator anomaly pattern recognition); a work order diagnosis agent (analyzing work order flow status and reasons for stagnation); an interface parsing agent (analyzing interface call logs and timeout / failure patterns); a network element assessment agent (analyzing network element operating status and instruction execution); a topology tracing agent (tracing fault propagation paths based on network topology diagrams); and a case retrieval agent (retrieving similar historical cases from the knowledge base based on RAG).

[0032] In the embodiments of this application, the coordinating agent can match the abnormal event object with the capabilities of various specialized agents and assign the abnormal event object to at least one specialized agent, which can reduce computing power consumption, improve inference speed, and is suitable for simple fault scenarios.

[0033] In another implementation, the coordinating agent can also directly assign the abnormal event object to all specialized agents, starting all six specialized agents to reason in parallel. This provides comprehensive evidence coverage and high accuracy, but increases computing power consumption and is suitable for medium-to-high-level faults and complex scenarios.

[0034] In this embodiment of the application, before step 110, the following steps are also included: Collect multi-source heterogeneous data and extract multi-dimensional features of the multi-source heterogeneous data based on different time granularities; Density clustering algorithm is used to identify anomalies in multidimensional features in order to determine whether an abnormal event has occurred. When determining that an abnormal event has occurred, the multidimensional features corresponding to the abnormal event are encapsulated into a standardized abnormal event object.

[0035] In this embodiment, a monitoring and data collection agent can also be configured. This agent deploys lightweight collection probes on each node of the cloud-network orchestration system, responsible for collecting metrics, logs, and status data, and reporting them to the event aggregation layer via gRPC. Addressing the cross-network, cross-cloud, and cross-system characteristics of the cloud-network orchestration system, the collection probes uniformly collect five categories of multi-source heterogeneous data: metric time series, work order full process, interface logs, network element commands, and network topology relationships. This constructs a data foundation covering the entire link fault characteristics, eliminating data silos.

[0036] Core features such as order volume, success rate, timeout rate, resource utilization rate, and backlog are extracted from multi-source heterogeneous data at different time granularities such as 1 minute, 5 minutes, and 1 hour. Standardization and weighted fusion are then performed to obtain multi-dimensional features.

[0037] The DBSCAN density-based clustering algorithm is used to perform anomaly identification on multi-dimensional features to determine whether an abnormal event occurs. The formula of the density-based clustering algorithm is shown in the following Equation (1): (1) Where: p is any multi-dimensional feature to be evaluated (which may also be referred to as a sample point); D is a time-series data sample set, generated based on multi-dimensional features collected at different times; ε is the neighborhood radius (distance threshold), used to define the statistical range around the sample point; q is any sample point in the time-series data sample set; dist(p,q) is the Euclidean distance. The meaning of the formula is: count the total number of sample points within the range with p as the center and ε as the radius, and this number is the local density of the sample point p. The local density of the sample point p is compared with a preset minimum sample number threshold MinPts (a positive integer, for example, MinPts=5). If the local density of the sample point p is less than MinPts, the sample point p is determined as an outlier anomaly point, and it can be determined that an abnormal event occurs.

[0038] When it is determined that an abnormal event has occurred, the anomaly information in the multi-dimensional features may be encapsulated into a standardized abnormal event object.

[0039] The embodiments of the present application uniformly collect five major types of operation and maintenance data: indicator time series, work order status, interface logs, network element instructions, and topology relationships, adopt the DBSCAN density-based clustering algorithm to identify abnormal data points that deviate from the normal distribution, and encapsulate heterogeneous anomaly information from different systems and in different formats into a standardized six-tuple abnormal event object E = t, level, metrics, link, topo, alarm , which realizes unified representation of fragmented evidence, eliminates cross-system data barriers, and improves the accuracy and consistency of anomaly identification; the DBSCAN algorithm does not need to specify anomaly categories in advance, can discover anomaly clusters of arbitrary shapes, timely identify updated or mutated fault types, and improves the identification accuracy of unstructured sudden faults by 60% compared with the threshold method; the unified six-tuple representation solves the problem of cross-domain evidence fragmentation, provides standardized input for subsequent multi-agent collaborative reasoning, and improves the cross-system evidence correlation efficiency by more than 5 times.

[0040] Step 120: Perform parsing and reasoning on the abnormal event object through a professional agent to generate a candidate root cause corresponding to the professional agent.

[0041] Each professional agent, based on its own domain knowledge, combines RAG to retrieve historical cases and Chain-of-Thought (CoT) reasoning to perform multi-dimensional parsing and reasoning on the abnormal event object, and independently outputs a candidate root cause including confidence level, evidence source and reasoning process.

[0042] Step 130: Based on the coordination agent, the candidate root causes are fused to generate a root cause evidence chain; the root cause evidence chain is used to generate treatment recommendations.

[0043] Based on the DS evidence theory, the coordinating agent performs consistency verification on the candidate root causes output by various professional agents, resolves conflicts, and performs weighted fusion of confidence levels to generate a root cause evidence chain that is ranked by confidence level, has a clear causal relationship, and is traceable. After generating the root cause evidence chain, corresponding action recommendations can be generated based on it. Compared with a single AIOps model, multi-professional agent collaboration can simultaneously process five categories of heterogeneous operation and maintenance data, improving evidence utilization by 300%; DS evidence fusion effectively handles the uncertainty and conflict of multi-source evidence, improving the reliability of conclusions by 40%; the traceable evidence chain transforms the reasoning process from a black box to a white box, and each root cause conclusion can be traced back to the original evidence, solving interpretability issues.

[0044] This application proposes a cloud network orchestration and operation method. This method is applied to a cloud network orchestration and operation system, which includes at least a coordinating agent and several specialized agents. The method includes: acquiring abnormal event objects through the coordinating agent and assigning the abnormal event objects to at least one specialized agent; performing analytical reasoning on the abnormal event objects through the specialized agents to generate candidate root causes corresponding to the specialized agents; fusing the candidate root causes based on the coordinating agent to generate a root cause evidence chain; and using the root cause evidence chain to generate handling suggestions. This method effectively integrates multi-source evidence, reduces the uncertainty and conflict of multi-source evidence, makes root cause conclusions traceable, improves the efficiency and reliability of fault location, shortens service interruption time, significantly reduces economic losses caused by work order stagnation and service activation failure, lowers the labor costs of manual operation and maintenance, and is suitable for large-scale, highly complex, and high-security integrated cloud network operation and maintenance scenarios.

[0045] Figure 2 This is another flowchart illustrating the cloud network orchestration and maintenance method in the embodiments of this application.

[0046] See Figure 2 This method is applied to a cloud network orchestration and operation and maintenance system, which includes at least a coordinating agent and several specialized agents; the method includes: Step 210: Obtain the abnormal event object by coordinating the intelligent agent and obtain the capability matrix; the capability matrix is ​​used to represent the various capabilities of each professional intelligent agent.

[0047] When anomalies are detected in the operation and maintenance data of the cloud network orchestration system, the abnormal operation and maintenance data can be encapsulated and transformed into standardized abnormal event objects. These abnormal event objects can then be obtained through the coordination agent. Abnormal event object E= t,level,metrics,link,topo,alarm This serves as input for root cause reasoning.

[0048] The coordination agent maintains a unified capability matrix that includes the capabilities of various professional agents. It records the tasks that each professional agent can handle, input and output fields, applicable fault scenarios, historical success rate, execution cost, and permission level, which serve as the basis for scheduling.

[0049] In one specific implementation, taking the mobile service work order card failure scenario as an example, the number of pending orders surged from the normal baseline of 100 orders / minute to 500 orders / minute within 1 minute, and the construction interface timeout rate soared from 0.5% to 40%; the DBSCAN algorithm calculates the data point density, see equation (1), sets the neighborhood radius ε=0.1 and the minimum sample number threshold MinPts=5, and calculates that the number of samples in the neighborhood of the current data point p is much smaller than MinPts, and is judged as an abnormal point; the heterogeneous abnormal information is encapsulated into a standardized abnormal event object: E= t,level,metrics,link,topo,alarm Specifically: E= 2026-05-19T14:30:00, High, surge in order volume / high timeout rate, construction order link, orchestration-construction topology dependency, interface timeout alarm. Push to the Kafka message queue. See also Figure 3 This is a diagram showing the structure of a six-tuple exception event object, illustrating the exception event object E = t, level, metrics, link, topo, alarm The meaning and data format of each field are defined. Among them, the abnormal event object E is a standardized object of the current fault time, which runs through the entire life cycle from perception, reasoning, constraint, execution and reflection.

[0050] Step 220: Select a set of candidate professional intelligent agents based on the abnormal event object, the capability matrix, and the preset knowledge base.

[0051] The system also includes a pre-set knowledge base that stores vectorized historical fault cases, evidence chains, and handling solutions, supporting rapid retrieval based on cosine similarity. Upon receiving an abnormal event object, the system can search the pre-set knowledge base, retrieve the capability matrix, and match the fault type and diagnostic dimensions of the abnormal event object with the suitable scenarios and resolvable data sources of each professional intelligent agent in the capability matrix. Professional intelligent agents that meet the core diagnostic dimensions are then included in the candidate professional intelligent agent set.

[0052] In another implementation, the coordinating agent can also directly assign the abnormal event object to all specialized agents, starting all six specialized agents to reason in parallel. This provides comprehensive evidence coverage and high accuracy, but increases computing power consumption and is suitable for medium-to-high-level faults and complex scenarios.

[0053] In an optional embodiment of this application, step 220 includes: Retrieve historical cases similar to the abnormal event object from the preset knowledge base; The candidate set of professional intelligent agents is determined based on historical cases and the capability matrix.

[0054] After receiving the abnormal event object, the abnormal event object is vectorized, and a preset knowledge base is searched to return the historical cases with the highest Top-K1 similarity. Fault type identification is performed on the historical cases, and a weighted vote is applied to the fault tags of the Top-K1 historical cases (higher similarity means higher weight). The fault type of the current abnormal event object is output (e.g., work order stuck, interface timeout, etc.). Then, the impact range of the abnormal event object is determined, the historical impact scale of the Top-K1 historical cases is aggregated, and the impact level (local / cross-module / global) is determined by combining the topology and link fields of the current abnormal event object. Next, core diagnostic dimensions are extracted, and the data source dimensions (indicators, work orders, interfaces, network elements, topology, cases) on which the root cause of the Top-K1 historical cases depend are summarized to obtain a list of dimensions that must be covered in this diagnosis. Finally, candidate professional intelligent agents are screened. The capability matrix is ​​retrieved, and the fault type and diagnostic dimensions of the abnormal event object are matched one by one with the suitable scenarios and resolvable data sources of each professional intelligent agent in the capability matrix. Professional intelligent agents that meet the core diagnostic dimensions are included in the candidate professional intelligent agent set.

[0055] Step 230: Calculate the comprehensive score of the matching between each professional intelligent agent in the candidate professional intelligent agent set and the abnormal event object based on the abnormal event object and the capability matrix.

[0056] The coordination agent is pre-configured with a five-dimensional weighted scoring system. It calculates the comprehensive score of the abnormal event object and each professional agent in the candidate professional agent set from five dimensions: task matching degree, evidence coverage, case similarity, execution risk degree, and resource consumption degree. This evaluates the matching situation between the abnormal event object and each professional agent in the candidate professional agent set.

[0057] In an optional embodiment of this application, step 230 includes: For each professional intelligent agent in the candidate professional intelligent agent set, the task matching degree is calculated based on the capability matrix of the abnormal event object and the professional intelligent agent. Determine the current type of evidence based on the abnormal event object and the capability matrix, and calculate the evidence coverage based on the type of evidence. Target historical cases related to professional intelligent agents are selected from historical cases, and case similarity is calculated based on target historical cases and abnormal event objects; Determine the actual evidence collection risk value based on the abnormal event object, and calculate the execution risk level based on the actual evidence collection risk value; Determine the estimated inference time based on the abnormal event object, and calculate the resource consumption based on the estimated inference time; A comprehensive score is calculated based on preset weighting coefficients and factors such as task matching, evidence coverage, case similarity, execution risk, and resource consumption.

[0058] In practical implementation, for each professional intelligent agent in the candidate professional intelligent agent set, the task matching degree is calculated based on the abnormal event object E of the current fault event and the capability matrix of the professional intelligent agent. Specifically, the abnormal event object can be further processed to generate a fault feature vector. Fault feature vector It includes information such as anomaly indicators, work order type, external systems, and topology type. It selects the currently candidate professional intelligent agents from the candidate professional intelligent agent set. Transforming the capability matrix into a capability quantization vector Based on the fault feature vector and capability quantization vector Gaussian kernel matching is used to calculate the task matching degree. ,in The calculation formula is as follows (2): (2) in The Gaussian kernel bandwidth, in one example, can be taken as 0.5. Task matching degree characterizes the specialized intelligent agent. The degree of fit between the capability matrix and the requirements of the abnormal event object E of the current fault event is such that the smaller the vector Euclidean distance, the closer the matching degree is to 1.

[0059] Evidence coverage It can represent a specialized intelligent agent. The overlap between the types of collectable evidence and the missing evidence for the anomalous event object E of the current failure event is considered. In practice, the system can pre-set the total number of all evidence categories required for complete root cause reasoning. In one example, It includes six categories: metrics, work orders, interfaces, network elements, topology, and cases. Furthermore, it can determine the current candidate specialized intelligent agents based on the capability matrix and abnormal event objects. Types of evidence that can be output and are currently missing from root cause reasoning Specifically, the current candidate professional intelligent agents can be selected. The number of intersections between the types of evidence that can be output from the capability matrix and the types of evidence that are still missing in this fault diagnosis, and the number of overlapping categories, is the value of the capability matrix. Evidence coverage The calculation formula is as follows (3): (3) In one example, .

[0060] To calculate case similarity, a secondary filter can be performed on the Top-K1 historical cases to further select the current candidate professional agents. Historical Top-K2 cases that have actually participated in the diagnosis, serving as professional intelligent agents for current candidates. The relevant target historical cases will transform the abnormal event object E of the current fault event into the current fault event vector. Calculate the target historical cases and the current failure event vector. The mean cosine similarity is used as the case similarity, and the calculation formula is as follows (4): (4) in, Top- Target number of historical cases; Current candidate professional intelligent agents The kth target historical case involved; Given the target historical case k and the current fault event vector The cosine similarity. In one example, .

[0061] The actual forensic risk value of the current fault event can be determined based on the abnormal event object. And obtain the current candidate professional intelligent agents. Preset benchmark risk value The execution risk level is calculated using the following formula (5): (5) Current candidate professional intelligent agents The higher the potential risk of triggering high-risk interfaces and reading large amounts of data during the evidence collection process, the higher the execution risk. In one example, .

[0062] The complexity of the current fault and the amount of data to be processed are determined based on the abnormal event object E of the current fault event, and then combined with the current candidate professional intelligent agents. Historical execution time models estimate the inference time for current failure events. Combined with the system's pre-set maximum inference time threshold for a single agent, It can calculate resource consumption. The calculation formula is as follows (6): (6) The more fault feature dimensions and the larger the data volume of the abnormal event object, the longer the estimated time will be. The higher the level. Currently, the top candidate specialized intelligent agents. The higher the resource usage, the lower the resource consumption score. In one example, .

[0063] For the five dimensions of task matching degree, evidence coverage degree, case similarity degree, execution risk degree, and resource consumption degree, preset weight coefficients can be set respectively: λ1 (task matching degree), λ2 (evidence coverage degree), λ3 (case similarity degree), λ4 (execution risk), and λ5 (resource consumption degree). Among them, the preset weight coefficients satisfy the weight normalization constraint. A comprehensive score can be calculated based on task matching degree, evidence coverage, case similarity, execution risk, resource consumption, and preset weighting coefficients. The calculation formula is as follows (7): (7) Step 240: Based on the comprehensive score, assign the abnormal event object to at least one specialized intelligent agent.

[0064] Based on the calculated total score, the abnormal event object is assigned to at least one specialized intelligent agent for analysis.

[0065] In an optional embodiment of this application, step 240 includes: Compare the overall score of each specialized intelligent agent with the preset scheduling threshold; Assign abnormal event objects to specialized intelligent agents whose comprehensive scores are higher than the preset scheduling threshold.

[0066] Furthermore, a preset scheduling threshold can be set for the comprehensive score. In one example, The comprehensive score of each specialized intelligent agent is compared with a preset scheduling threshold, and only those with a comprehensive score higher than the preset scheduling threshold are retained (i.e., Specialized intelligent agents are selected to enter the fault diagnosis room. In one example, the selected specialized intelligent agents can be sorted in descending order of their comprehensive scores, with higher-scoring agents being assigned higher-priority forensic tasks. Specialized intelligent agents with comprehensive scores below a preset scheduling threshold are considered invalid scheduling objects and are skipped directly, reducing the waste of computing resources. When facing complex faults across systems and links, where the evidence coverage of a single agent is insufficient, or when the fault level is medium / high, multiple specialized intelligent agents are launched for parallel inference, and the accuracy of root cause localization is ensured through multi-dimensional evidence cross-validation.

[0067] In an example of a mobile service ticket / card failure scenario, a certain interface parses the normalized results of various dimensions of the Agent: Substitute the weights With a comprehensive score of 0.697, exceeding the preset scheduling threshold of 0.4, it is determined to be an adapted Agent, and priority is given to scheduling the collection of evidence at the interface level. A directed task dependency graph is generated based on the causal relationships of the faults, clearly defining the execution order of "data parsing → evidence extraction → conclusion output → fusion verification" to ensure a closed-loop reasoning logic. If insufficient evidence, conflicting conclusions, or security verification failures occur during the reasoning process, the coordinating agent adds or switches specialized agents in real time to supplement evidence or re-reason, improving the ability to adapt to complex faults.

[0068] In another implementation, if the fault characteristics of the current fault event are singular and the root cause is clear (such as simple indicator fluctuations or single work order anomalies), and the comprehensive scheduling score of a single professional intelligent agent far exceeds the threshold and the evidence coverage reaches 100%, then only a single professional intelligent agent needs to be activated to complete the diagnosis, improving the processing efficiency of simple faults. In this case, the execution risk and resource consumption can be set as negative indicators, and a subtraction correction can be made when calculating the comprehensive score. .

[0069] Step 250: The abnormal event object is analyzed and reasoned by a professional intelligent agent to generate candidate root causes corresponding to the professional intelligent agent.

[0070] Each specialized intelligent agent, based on its own domain knowledge, combines RAG retrieval of historical cases with chain reasoning (CoT) to perform multi-dimensional analysis and reasoning on abnormal event objects, and independently outputs candidate root causes including confidence level, source of evidence, and reasoning process.

[0071] In the example of a mobile service work order card failure scenario, if all six professional agents pass the screening and participate in the parsing and reasoning, the coordinating agent pulls the abnormal event from the message queue and initiates parallel parsing and reasoning by the six professional agents; the candidate root causes (also known as evidence) output by the six professional agents are as follows: 1. Indicator Analysis Agent: Analyzes the time-series change pattern of indicators and outputs "Sudden increase in business volume leads to resource exhaustion" (confidence level 0.75); 2. Work Order Diagnosis Agent: Scans the work order status table and finds 800+ work orders stuck in the "waiting for return" state, outputting "Construction system return lost" (confidence level 0.88); 3. Interface Parsing Agent 4. Network Element Analysis Agent: Analyzing the construction system's API gateway logs revealed that 40% of call timeouts were concentrated on the / api interface, outputting "Construction interface anomaly caused timeout" (confidence 0.92); 5. Topology Tracing Agent: Checking the construction system's server resources showed normal CPU / memory usage, ruling out network element faults (confidence 0.1); 6. Topology Tracing Agent: Analyzing the call chain between the orchestration system and the construction system confirmed a strong dependency relationship (confidence 0.95); 7. Case Retrieval Agent: Retrieving data from the preset knowledge base using RAG, matching 3 similar historical cases, all of which were "interface timeout caused order blockage" (confidence 0.90).

[0072] Step 260: Based on the coordination agent, the candidate root causes are fused to generate a root cause evidence chain; the root cause evidence chain is used to generate treatment recommendations.

[0073] Based on DS evidence theory, the coordinating agent performs consistency verification on candidate root causes output by various professional agents, resolves conflicts, and performs weighted fusion of confidence levels to generate a root cause evidence chain that is ranked by confidence level, has a clear causal relationship, and is traceable. After generating the root cause evidence chain, corresponding action recommendations can be generated based on it. Compared to a single AIOps model, multi-professional agent collaboration can simultaneously process five categories of heterogeneous operation and maintenance data, improving evidence utilization by 300%; DS evidence fusion effectively handles the uncertainty and conflict of multi-source evidence, improving the reliability of conclusions by 40%; the traceable evidence chain transforms the reasoning process from a black box to a white box, with each root cause conclusion traceable back to the original evidence, thus solving interpretability issues.

[0074] In an optional embodiment of this application, the candidate root cause has a corresponding confidence level; step 260 includes: The conflict coefficient is calculated based on the candidate root causes and their confidence levels. The fusion confidence score is calculated based on the conflict coefficient and the confidence score of the candidate root causes. The target root cause is determined based on the fusion confidence score, and a root cause evidence chain is generated based on the target root cause and the fusion confidence score.

[0075] In the example of a mobile service work order card failure scenario, when using DS evidence theory to fuse candidate root causes of multiple professional agents, the conflict coefficient α can be calculated first. The calculation formula is as follows (8): (8) Among them, the conflict coefficient α is used to normalize the conflict of multiple evidences. α≠0 to avoid the anomaly of 0 in the denominator. The smaller α is, the more intense the conflict of evidence output by multiple professional agents. Two groups of intelligent agents with different specializations , Output the basic probability assignment values ​​(local confidence) of independent evidence B and C (i.e., candidate root causes). Evidence B and C intersect and correspond to the same candidate root cause A.

[0076] Then, calculate the fusion confidence of the candidate root cause based on the conflict coefficient. The calculation formula is as follows (9): (9) m(A): Fusion confidence of candidate root cause A after fusion.

[0077] In the example of a mobile service work order card failure scenario, the DS evidence theory adopts a pairwise iterative fusion approach to gradually integrate the evidence from multiple professional intelligent agents into the final result, as follows: Step 1: Convert the confidence levels output by the professional agents into Basic Probability Assignments (BPAs). Convert the evidence of each professional agent into the BPA value of the corresponding proposition, and set the BPA for "uncertain propositions" (representing the cognitive uncertainty of the professional agent). In the example of a mobile service work order card failure scenario: Interface parsing agent: m1 (interface timeout) = 0.92, m1(Θ) = 0.08 (Θ is the entire set, representing uncertainty); Work order diagnosis agent: m2 (receipt loss) = 0.88, m2(Θ) = 0.12; the other agents are similarly assigned BPA values ​​to their corresponding propositions.

[0078] Step 2: Pairwise fusion calculation. Taking the interface agent and the work order agent as an example: ①. Substitute into equation (8) to calculate the conflict: If the two pieces of evidence are mutually exclusive (interface timeout ≠ lost receipt), the intersection is empty, and the conflict is 0.92 × 0.88 = 0.8096. ②. Calculate the conflict coefficient: α = 1 - 0.8096 = 0.1904 ③. Substitute into equation (9) to normalize and calculate the fused BPA of each piece of evidence: - m(interface timeout) = (0.92 × 0.12) / 0.1904 ≈ 0.58 - m (loss of receipt) = (0.88 × 0.08) / 0.1904 ≈ 0.37 Step 3: Iteratively fuse all professional agents. The fusion result is then iteratively fused with the third, fourth, and so on professional agents until the normalized confidence scores of all evidence are obtained. These scores are then sorted from highest to lowest to form the final root cause evidence chain. In the example, since the topology tracing agent, case retrieval agent, and indicator analysis agent all support the "interface timeout" proposition, the confidence score of this candidate root cause is further increased to 0.92 after fusion. The confidence scores of other candidate root causes are compressed, resulting in the final sorted root cause evidence chain: L = [(Construction interface timeout, 0.92), (Construction system order loss, 0.05), (MQ queue blocking, 0.03)]. In each tuple, the first item is the target root cause, and the second item is the fused confidence score of that target root cause. The sum of the confidence scores is normalized to 1. The earlier a tuple appears in the root cause evidence chain, the higher its credibility.

[0079] After generating the root cause evidence chain, corresponding action recommendations can be generated based on it. For example, based on the root cause evidence chain L=[(Construction Interface Timeout, 0.92), (Construction System Order Loss, 0.05), (MQ Queue Blockage, 0.03)], work orders with a status of "Constructed but No Order Response" can be filtered out, and the action recommendation "Single Work Order Replay Operation" can be executed. See also Figure 4 This is a sequence diagram for multi-specialty agent collaborative reasoning. It shows the complete sequence from abnormal event input → coordination agent allocation → parallel reasoning by various specialty agents → conclusion return → DS evidence fusion → root cause evidence chain output.

[0080] In an optional embodiment of this application, after step 260, the method further includes: The risk value of the proposed action is calculated using a risk quantification model. Determine the risk level based on the risk value and implement the corresponding control strategy.

[0081] After generating the root cause evidence chain, security constraint verification is also required. This application provides a risk quantification model (which can be multi-dimensional) for risk quantification calculation. In one example, the risk quantification model includes three dimensions, classifying the potential risks of implementing the proposed action into three risk indicators: Impact, Scope, and Audit Compliance. Weighting coefficients are assigned to each of these three indicators. In one example, the weighting coefficient for Impact can be set to 0.4, the weighting coefficient for Scope can be set to 0.3, and the weighting coefficient for Audit Compliance can be set to 0.3.

[0082] In the example of a mobile service work order card failure scenario, the impact of the risk indicators for the execution of the handling suggestion "work order replay operation" can be quantified as Impact (0.3, affecting only work orders, small impact), Scope (0.2, involving only 800 work orders, small scope), and Audit (0.5, routine maintenance, high compliance). The risk value of the execution handling suggestion is Risk(a) = 0.4 × 0.3 + 0.3 × 0.2 + 0.3 × 0.5 = 0.35.

[0083] Refer to Table 1 below for an example of a risk classification and control system: Table 1

[0084] The security constraint execution process of the control strategy in Table 1 above includes: G1, Permission Verification: Verifies the operation permissions of the executing entity, fault scenario, and business object, and prohibits unauthorized operations.

[0085] G2, Risk Quantification: Based on a three-dimensional risk quantification model of impact degree, impact scope, and audit compliance, it accurately calculates the risk value of handling actions and matches the corresponding control level.

[0086] G3, Pre-condition verification: Check the fault status, work order status, maintenance window, and business load to ensure that the timing of the handling is compliant.

[0087] G4, Sandbox Simulation Validation: High-risk actions are simulated and executed in an isolated sandbox to verify safety and effectiveness and avoid risks in the production environment.

[0088] G5, Rollback Plan Verification: Generates executable rollback actions, triggering conditions, and scope of impact; if no valid rollback plan exists, automatic execution is prohibited.

[0089] G6, Post-Execution Verification: Continuously monitor metrics, work orders, interfaces, and alarm status to confirm fault resolution; trigger automatic rollback or manual takeover when metrics deteriorate.

[0090] G7, Audit Trail: Fully records abnormal events, agent orchestration diagrams, evidence chains, handling suggestions, verification results, and execution logs to meet compliance traceability requirements.

[0091] Based on the risk value Risk(a) = 0.35 < 0.4, the process is deemed low-risk and automatically allowed. Pre-conditioning procedures are executed: permission verification → parameter validity verification → interface health verification → rollback plan generation → full-chain auditing and record keeping. See also... Figure 5 This is a flowchart of the hierarchical security constraint control process, which shows the process from risk quantification calculation → four-level risk assessment → corresponding constraint strategy → final release / interception decision.

[0092] In this embodiment, a risk quantification model is established from three dimensions: impact level, impact scope, and audit compliance. A weighted summation method is used to calculate the comprehensive risk value, which is divided into four levels with corresponding differentiated constraint strategies: low risk is automatically executed, medium risk is manually confirmed, high risk is sandbox verification + manual approval, and prohibited level is directly blocked. A complete pre-constraint process is constructed, consisting of "authorization verification → parameter checking → pre-verification → sandbox simulation → rollback preparation → audit documentation." Compared to manual risk assessment, the consistency of the three-dimensional risk quantification model is improved from 60% to 95%, avoiding subjective judgment bias. The four-level grading strategy balances automation efficiency and business security, allowing low-risk operations to be executed quickly and unattended, while maintaining efficiency. The complete pre-constraint process achieves full-link protection for high-risk operations, reducing business interruptions caused by automated misoperations to zero.

[0093] In an optional embodiment of this application, after executing the control strategy corresponding to the risk level, the method further includes: Count the number of returned orders; determine whether alarms have been cleared; Calculate the single-item response rate and the interface success rate separately; The fault is resolved when the order volume recovers to the preset normal baseline, the alarm is cleared, and the order volume recovery rate and interface success rate exceed their respective preset thresholds.

[0094] After passing security constraint verification, corresponding control policies can be executed for implementation and effect verification. In the example of a mobile service work order card failure scenario, the execution engine can perform the action suggestion "single work order replay operation," replaying each work order by ID. After execution, multi-dimensional indicator verification can be carried out: First, the number of returned work orders after executing the action suggestion can be counted, along with the system's historical number of work orders during the same period and the standard baseline number of work orders under fault-free conditions (normal baseline number of work orders). After the fault is repaired, the number of valid work orders that are successfully closed-loop within a unit of time (steady-state work order quantity after repair). The unit recovery rate is calculated by comparing the ratio of the steady-state unit quantity after repair to the normal baseline unit quantity. The calculation formula is as follows (10): (10) Single-item response rate The degree of recovery from the backlog of chemical orders can be quantified; the closer the ratio is to 100%, the better the recovery effect.

[0095] Furthermore, it is also possible to count the number of valid and successful requests to the construction interface and orchestration interface within the verification period. The total number of requests to the interface within the verification period (including timeouts, failures, and successes). By calculating the number of valid successful requests. Compared with the total number of requests The ratio is used to calculate the interface success rate. The calculation formula is as follows (11): (11) API success rate It can accurately characterize the stability of interface services after fault repair.

[0096] The fault is resolved when the order volume recovers to the preset normal baseline, alarms are cleared, and the order response rate and interface success rate exceed their respective preset thresholds. In one example, the preset threshold for the order response rate can be set to 98%, and the interface success rate can also be set to 98%. In actual implementation, the fault is resolved when the order volume recovers to the baseline level, Rnum ≥ 98%, the interface timeout rate drops to 0.3%, the success rate Rsuccess = 99.7%, all 800+ stalled work orders are completed, the interface timeout alarms are cleared, all verifications pass, and the fault is resolved.

[0097] After the proposed action is implemented, a comprehensive effectiveness verification is conducted across four dimensions: order volume stabilization, order recovery rate, interface success rate, and alarm clearance. If any dimension fails verification, the action is deemed abnormal, and a pre-set rollback plan is automatically triggered to restore the system to its pre-action state. This four-dimensional cross-validation ensures accurate assessment of the action's effectiveness, avoiding omissions that can occur with single-dimensional validation. The automatic rollback mechanism provides ultimate security for the action, enabling rapid recovery even if the action plan is flawed, reducing business impact time from hours to minutes. The verification results also serve as feedback data to enrich the pre-set knowledge base, forming a complete closed loop.

[0098] In this embodiment, after the proposed handling is completed, reflection verification and knowledge accumulation can be performed. Specifically, the system also includes a reflection agent that retrieves similar historical cases from a preset knowledge base, compares the consistency between the current proposed handling solution and the historical successful solutions, confirms that the solution matching degree reaches 95%, passes the verification, and does not require re-reasoning; the complete event object, root cause evidence chain, handling action sequence, and execution verification results are vectorized through a text embedding model and stored in the preset knowledge base, associated with the tags "work order card - interface timeout - single work order replay", to support rapid retrieval and reuse of similar faults in the future.

[0099] First, we reflect on the historical cases retrieved by the intelligent agent and calculate the matching degree of the scheme using equation (12). : (12) in This represents the total number of core feature keywords for the current fault event, including four categories of core keywords: fault type, abnormal indicators, fault links, and topology features. This refers to the number of core feature keywords that perfectly match the current fault among retrieved historical similar cases. By calculating the feature keyword matching ratio, the similarity between the current proposed solution and the historical best solution is quantified. The higher the matching degree, the stronger the reliability of the solution. In this example, the matching degree... =95%, verification passed.

[0100] The current event failure, root cause evidence chain, action sequence, and verification results are vectorized and stored in the following manner (13): (13) Equation (13) is the core encoding method for structured storage of fault knowledge, which splices together the complete fault closed-loop information and stores it in a vectorized form: E: Standardized abnormal event six-tuple feature; L: Complete root cause evidence chain of the fault; Action: Operation and maintenance handling action adapted to this fault; Result: Final verification result after fault repair; The feature splicing symbol integrates multi-dimensional information into a complete vector V, which is then bound with the "work order card - interface timeout - single work order replay" related tags and stored in a preset knowledge base for subsequent case retrieval and root cause reasoning optimization.

[0101] The system employs an independent reflective agent capable of independently verifying the consistency between proposed solutions and historical cases, triggering a re-reasoning process upon encountering conflicts. After reasoning and executing the proposed solutions, similar cases are retrieved from a pre-defined knowledge base based on RAG (Research Aggregate Analysis) to verify the consistency between the current solution and past successful experiences, triggering re-reasoning upon discovering conflicts. The complete abnormal event object, root cause evidence chain, action sequence, and execution verification results are vectorized using a text embedding model and stored in the pre-defined knowledge base, supporting rapid retrieval and reuse based on cosine similarity. This reflective verification adds double insurance to the reasoning conclusions, reducing the mishandling rate due to reasoning bias by 80%. Vectorized knowledge storage and RAG retrieval enable efficient reuse of experience, reducing troubleshooting time by over 90% when similar faults occur a second time. The closed-loop accumulation mechanism allows the operational system's capabilities to continuously iterate with practical experience, forming a self-evolving operational system.

[0102] In a specific implementation, the efficiency improvement can also be quantified by referring to equation (14): (14) in To improve efficiency, This represents the average time required for manual maintenance. The time consumed for automated operation and maintenance in embodiments of this application. In one example, it is known that: Substituting into equation (14), we can obtain System performance statistics: This investigation took 1.5 minutes, which is 95% more efficient than the 30 minutes of manual investigation.

[0103] In an optional embodiment of this application, the technical solution of the embodiment of this application can be extended: when multiple related alarms occur simultaneously in the cloud network orchestration system (e.g., high server CPU + interface timeout + work order stuck + slow database query), and each alarm belongs to a different system, the extended solution of the embodiment of this application is as follows: ① After receiving multiple abnormal events, the coordinating agent first performs event correlation analysis based on time window and topology dependency to identify composite fault scenarios; ② Initiate cross-domain professional agent joint reasoning, add cross-system dependency analysis agents, and sort out the causal propagation path between multiple anomalies; ③ When fusing evidence, a hierarchical DS fusion strategy is adopted, first fusing internal evidence by system, and then fusing causal chains across systems; ④ Generate a multi-level evidence chain with propagation path annotations to clarify the complete causal link of "root cause → intermediate node → manifestation"; ⑤ The action suggestions are sorted in reverse order of causal path, prioritizing the repair of root cause, then clearing the influence of intermediate node, and finally restoring the manifestation anomaly; ⑥ When accumulating knowledge, store a complete composite fault causal link map to support the rapid identification of similar complex faults in the future. By expanding the solution, it can handle complex and compound fault scenarios across systems. The root cause localization accuracy drops by only 5-8% compared to single fault scenarios, which is far better than the accuracy decay of more than 40% of related technologies. It has the ability to trace the causal propagation path, and the handling sequence is more scientific, avoiding secondary faults.

[0104] This application proposes a cloud network orchestration and operation method. Compared with a single AIOps model, multi-agent collaboration can simultaneously process five major categories of heterogeneous operation and maintenance data, improving evidence utilization by 300%. By dynamically orchestrating multi-agent professional agents, professional agents that are more closely matched to the current fault are selected for reasoning and analysis, reducing computing power consumption and improving reasoning speed. DS evidence fusion effectively handles the uncertainty and conflict of multi-source evidence, improving the reliability of conclusions by 40%. The traceable evidence chain transforms the reasoning process from a black box to a white box, and each root cause conclusion can be traced back to the original evidence, solving the interpretability problem.

[0105] Corresponding to the aforementioned application function implementation method embodiments, this application also provides a cloud network orchestration and maintenance system, electronic equipment, and corresponding embodiments.

[0106] Figure 6 This is a schematic diagram of the structure of the cloud network orchestration and maintenance system shown in the embodiments of this application.

[0107] See Figure 6 The cloud network orchestration and operation system 600 includes at least a coordinating agent 610 and several specialized agents 620; among which: Coordinating agent 610 is used to acquire abnormal event objects and assign the abnormal event objects to at least one specialized agent. Specialized intelligent agent 620 is used to analyze and reason about abnormal event objects and generate candidate root causes corresponding to the specialized intelligent agent; The coordinating agent 610 is also used to fuse candidate root causes to generate a root cause evidence chain; the root cause evidence chain is used to generate treatment recommendations.

[0108] Among them, the coordinating agent 610 includes: The capability matrix acquisition module is used to acquire the capability matrix; the capability matrix is ​​used to represent the various capabilities of each specialized intelligent agent. The filtering module is used to filter a set of candidate professional intelligent agents based on the abnormal event object, the capability matrix, and the preset knowledge base. The comprehensive score calculation module is used to calculate the comprehensive score of each professional intelligent agent in the candidate professional intelligent agent set matching with the abnormal event object based on the abnormal event object and the capability matrix. The assignment module is used to assign abnormal event objects to at least one specialized intelligent agent based on a comprehensive score.

[0109] The filtering module includes: The retrieval submodule is used to retrieve historical cases similar to the abnormal event object from a preset knowledge base; The determination submodule is used to determine the set of candidate professional intelligent agents based on historical cases and the capability matrix.

[0110] The comprehensive scoring calculation module includes: The task matching degree calculation submodule is used to calculate the task matching degree for each professional intelligent agent in the candidate professional intelligent agent set, based on the abnormal event object and the capability matrix of the professional intelligent agent. The evidence coverage calculation submodule is used to determine the current evidence type based on the abnormal event object and the capability matrix, and calculate the evidence coverage based on the evidence type. The case similarity calculation submodule is used to filter out target historical cases related to the candidate professional intelligent agent from historical cases, and calculate the case similarity based on the target historical cases and the abnormal event objects; The execution risk calculation submodule is used to determine the actual evidence collection risk value based on the abnormal event object, and calculate the execution risk level based on the actual evidence collection risk value; The resource consumption calculation submodule is used to determine the estimated inference time based on the abnormal event object and calculate the resource consumption based on the estimated inference time. The comprehensive score calculation submodule is used to calculate the comprehensive score based on preset weight coefficients and task matching degree, evidence coverage, case similarity, execution risk degree, and resource consumption degree.

[0111] The allocation module includes: The comparison submodule is used to compare the comprehensive score of each professional intelligent agent with the preset scheduling threshold; The allocation submodule is used to assign abnormal event objects to specialized intelligent agents whose comprehensive scores are higher than the preset scheduling threshold.

[0112] Among them, the candidate root causes have corresponding confidence levels, and the coordinating agent 610 also includes: The conflict coefficient calculation module is used to calculate the conflict coefficient based on the candidate root causes and the confidence level of the candidate root causes. The fusion confidence calculation module is used to calculate the fusion confidence based on the conflict coefficient and the confidence of the candidate root cause. The generation module is used to determine the target root cause based on the fusion confidence score, and to generate a root cause evidence chain based on the target root cause and the fusion confidence score.

[0113] The Cloud Network Orchestration and Maintenance System 600 also includes: The risk value calculation module is used to calculate the risk value of the proposed action using a risk quantification model. The risk level assessment module is used to determine the risk level based on the risk value and execute the corresponding control strategy.

[0114] The Cloud Network Orchestration and Maintenance System 600 also includes: The statistics module is used to count the number of returned orders; The judgment module is used to determine whether the alarm has been cleared. The calculation module is used to calculate the single-item response rate and the interface success rate, respectively. The fault resolution module is used to resolve faults when the order volume recovers to the preset normal baseline order volume, alarms are cleared, and the order volume recovery rate and interface success rate exceed their respective preset thresholds.

[0115] The Cloud Network Orchestration and Maintenance System 600 also includes: The acquisition module is used to collect multi-source heterogeneous data and extract multi-dimensional features of the multi-source heterogeneous data based on different time granularities. The anomaly detection module is used to identify anomalies in multidimensional features using density clustering algorithms to determine whether an abnormal event has occurred. The encapsulation module is used to encapsulate the multi-dimensional features corresponding to the abnormal event into a standardized abnormal event object when it is determined that an abnormal event has occurred.

[0116] This application proposes a cloud network orchestration and operation and maintenance system. This system can effectively integrate multi-source evidence, reduce the uncertainty and conflict of multi-source evidence, make the root cause conclusion traceable, improve the efficiency and reliability of fault location, shorten the service interruption time, significantly reduce the economic losses caused by work order stagnation and service activation failure, reduce the labor cost of manual operation and maintenance, and adapt to large-scale, highly complex, and highly secure cloud network integrated operation and maintenance scenarios.

[0117] Regarding the system in the above embodiments, the specific ways in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated further here.

[0118] Figure 7 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application.

[0119] See Figure 7 The electronic device 700 includes a memory 710 and a processor 720.

[0120] The processor 720 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0121] Memory 710 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. ROM may store static data or instructions required by the processor 720 or other modules of the computer. Permanent storage devices may be read-write storage devices. Permanent storage devices may be non-volatile storage devices that retain stored instructions and data even when the computer is powered off. In some embodiments, permanent storage devices use mass storage devices (e.g., magnetic or optical disks, flash memory) as permanent storage devices. In other embodiments, permanent storage devices may be removable storage devices (e.g., floppy disks, optical drives). System memory may be a read-write storage device or a volatile read-write storage device, such as dynamic random access memory. System memory may store some or all of the instructions and data required by the processor during operation. Furthermore, memory 710 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (e.g., DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and disks and / or optical disks may also be used. In some embodiments, memory 710 may include a removable storage device that is readable and / or writable, such as a laser disc (CD), a read-only digital versatile optical disc (e.g., DVD-ROM, dual-layer DVD-ROM), a read-only Blu-ray disc, an ultra-high density optical disc, a flash memory card (e.g., SD card, mini SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not contain carrier waves or transient electronic signals transmitted wirelessly or via wired connections.

[0122] The memory 710 stores executable code, which, when processed by the processor 720, can cause the processor 720 to execute part or all of the methods described above.

[0123] Furthermore, the method according to this application can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing some or all of the steps in the method described above.

[0124] Alternatively, this application may be implemented as a computer-readable storage medium (or a non-transitory machine-readable storage medium or a machine-readable storage medium) storing executable code (or computer program or computer instruction code) that, when executed by a processor of an electronic device (or server, etc.), causes the processor to perform part or all of the steps of the methods described above according to this application.

[0125] This application also provides a computer program product, which includes computer instructions that, when executed by a processor, implement the method described above.

[0126] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A cloud network orchestration and operation method, characterized in that, The method is applied to a cloud network orchestration and operation and maintenance system, which includes at least a coordinating agent and several specialized agents; the method includes: The abnormal event object is obtained through the coordinating agent, and the abnormal event object is assigned to at least one of the specialized agents. The professional intelligent agent performs analysis and reasoning on the abnormal event object to generate candidate root causes corresponding to the professional intelligent agent. The coordinating agent fuses the candidate root causes to generate a root cause evidence chain; the root cause evidence chain is used to generate treatment recommendations.

2. The method according to claim 1, characterized in that, Assigning the abnormal event object to at least one specialized intelligent agent includes: Obtain the capability matrix; the capability matrix is ​​used to represent the various capabilities of each of the specialized intelligent agents. The candidate professional intelligent agent set is selected based on the abnormal event object, the capability matrix, and the preset knowledge base; Calculate the comprehensive score of each professional intelligent agent in the candidate professional intelligent agent set matching the abnormal event object based on the abnormal event object and the capability matrix; Based on the comprehensive score, the abnormal event object is assigned to at least one of the specialized intelligent agents.

3. The method according to claim 2, characterized in that, The step of filtering a set of candidate professional intelligent agents based on the abnormal event object, the capability matrix, and the preset knowledge base includes: Retrieve historical cases similar to the abnormal event object from the preset knowledge base; The candidate set of specialized intelligent agents is determined based on the historical cases and the capability matrix.

4. The method according to claim 3, characterized in that, The step of calculating the comprehensive score of each professional intelligent agent in the candidate professional intelligent agent set and the abnormal event object based on the abnormal event object and the capability matrix includes: For each of the professional intelligent agents in the candidate professional intelligent agent set, the task matching degree is calculated based on the capability matrix of the abnormal event object and the professional intelligent agent. The current type of evidence is determined based on the abnormal event object and the capability matrix, and the evidence coverage is calculated based on the type of evidence. Target historical cases related to the professional intelligent agent are selected from the historical cases, and the case similarity is calculated based on the target historical cases and the abnormal event objects. The actual evidence collection risk value is determined based on the abnormal event object, and the execution risk degree is calculated based on the actual evidence collection risk value. The estimated inference time is determined based on the abnormal event object, and the resource consumption is calculated based on the estimated inference time. The comprehensive score is calculated based on preset weighting coefficients and the task matching degree, evidence coverage, case similarity, execution risk, and resource consumption.

5. The method according to claim 2, characterized in that, Assigning the abnormal event object to at least one of the specialized intelligent agents based on the comprehensive score includes: Compare the comprehensive score of each specialized intelligent agent with a preset scheduling threshold; The abnormal event object is assigned to a professional intelligent agent whose comprehensive score is higher than a preset scheduling threshold.

6. The method according to claim 1, characterized in that, The candidate root causes have corresponding confidence levels; the step of fusing the candidate root causes based on the coordinating agent to generate a root cause evidence chain includes: The conflict coefficient is calculated based on the candidate root causes and the confidence level of the candidate root causes. The fusion confidence score is calculated based on the conflict coefficient and the confidence score of the candidate root cause. The target root cause is determined based on the fusion confidence score, and a root cause evidence chain is generated based on the target root cause and the fusion confidence score.

7. The method according to claim 1, characterized in that, Following the generation of the disposal recommendations, the following is also included: The risk value of implementing the proposed treatment is calculated using a risk quantification model; The risk level is determined based on the risk value, and the corresponding control strategy is implemented.

8. The method according to claim 7, characterized in that, After implementing the control strategy corresponding to the risk level, the method further includes: Count the number of returned orders; determine whether alarms have been cleared; Calculate the single-item response rate and the interface success rate separately; The fault is resolved when the order volume recovers to the preset normal baseline order volume, the alarm is cleared, and the order volume recovery rate and the interface success rate exceed their respective preset thresholds.

9. The method according to claim 1, characterized in that, Before obtaining the abnormal event object through the coordinating agent, the process also includes: Collect multi-source heterogeneous data and extract multi-dimensional features of the multi-source heterogeneous data based on different time granularities; Density clustering algorithm is used to identify anomalies in the multidimensional features in order to determine whether an abnormal event has occurred. When an abnormal event is detected, the multidimensional features corresponding to the abnormal event are encapsulated into a standardized abnormal event object.

10. A cloud network orchestration and operation system, characterized in that, The cloud network orchestration and operation system includes at least a coordinating agent and several specialized agents; wherein: The coordinating agent is used to acquire abnormal event objects and assign the abnormal event objects to at least one of the specialized agents. The specialized intelligent agent is used to analyze and reason about the abnormal event object and generate candidate root causes corresponding to the specialized intelligent agent. The coordinating agent is also used to fuse the candidate root causes to generate a root cause evidence chain; the root cause evidence chain is used to generate treatment recommendations.

Images