IT operation service management method based on big data

Abstract

The application discloses an IT operation and maintenance service management method based on big data, and belongs to the technical field of computers. The method comprises the following steps: a static user portrait vector covering operation and maintenance personnel, IT equipment and systems is constructed through a hierarchical clustering algorithm; user behavior trajectory data is collected in real time through a path dynamic analysis engine; time series analysis is performed on the behavior trajectory data by using a behavior mode evolution trend identification engine, and behavior evolution characteristics are extracted; when it is detected that the deviation degree of the current behavior mode and historical portrait characteristics exceeds a preset threshold, a portrait dynamic updating process is triggered; an updated user portrait vector is generated by adjusting the weight of each dimension according to the evolution trend through a dynamic weight parameter generation module; and finally, the updated user portrait vector is output to a reinforcement learning scheduling engine through a standardized interface to assist operation and maintenance decision-making. The application realizes effective conversion of portrait data to intelligent decision-making, and improves the personalization and precision of operation and maintenance management.

Description

Technical Field

[0001] This application belongs to the field of computer technology, specifically relating to an IT operations and maintenance service management method based on big data. Background Technology

[0002] With the rapid development of information technology and the continuous expansion of enterprise IT systems, operation and maintenance service management plays a crucial role in ensuring the stable operation of these systems. Big data-based IT operation and maintenance service management, by integrating massive amounts of operation and maintenance data and utilizing machine learning and artificial intelligence technologies to achieve intelligent fault diagnosis, resource optimization and scheduling, and automated operation and maintenance processes, has become an important technological support for the digital transformation of modern enterprises. User profiling, as a core technical means of characterizing the features of operation and maintenance personnel, can integrate and model multi-dimensional information such as the professional capabilities of operation and maintenance personnel, the operational status of the objects being maintained, and the trajectory of operation and maintenance behavior, providing a data foundation for intelligent operation and maintenance decision-making.

[0003] Currently, research in the field of intelligent operations and maintenance (O&M) mainly focuses on fault diagnosis and prediction, employing models such as neural networks and deep learning to analyze system operating parameters and historical fault data to achieve anomaly detection and fault location. Some technical solutions also involve collaborative analysis of O&M personnel capability assessment and feature extraction. However, existing technical solutions have significant shortcomings in user profile construction and application. On the one hand, existing solutions have failed to construct a complete user profile system for O&M scenarios, lacking unified modeling of O&M personnel, O&M-related IT equipment, and O&M-related IT systems. On the other hand, static and isolated user feature descriptions cannot reflect the dynamic evolution of user behavior in O&M scenarios, resulting in profile data failing to adaptively track real-time user changes. More importantly, existing technologies have failed to establish an effective correlation mechanism between user profiles and O&M decisions, making it difficult for profile data to directly serve personalized intelligent O&M decisions.

[0004] Therefore, there is an urgent need to provide an IT operations and maintenance service management method that can build a unified profile of multiple subjects, has dynamic adaptive update capabilities, and can effectively assist in operations and maintenance decision-making, in order to solve the core problems of incomplete profile systems, inability to reflect dynamic behavioral evolution, and disconnect between profiles and decision-making in existing technologies. Summary of the Invention

[0005] The purpose of this invention is to provide an IT operations and maintenance service management method based on big data, which can effectively solve the problems in the background technology.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A big data-based IT operations and maintenance service management method includes the following specific steps: Step S1, Constructing a Static User Profile Vector: For the three types of entities—maintenance personnel, maintenance target IT equipment, and the IT system running on the maintenance target IT equipment—the corresponding feature dimensions are extracted independently for each type of entity, and an original feature matrix is ​​constructed. Then, a hierarchical clustering algorithm is independently executed on the original feature matrix corresponding to each entity type to generate an initial static user profile vector with a hierarchical structure. The initial static user profile vector includes personnel sub-vectors, equipment sub-vectors, and system sub-vectors, which correspond to the full features of the three maintenance subjects—maintenance personnel, maintenance target IT equipment, and maintenance target IT system—and the personnel sub-vectors, equipment sub-vectors, and system sub-vectors are uniformly indexed through entity association identifiers. Step S2, collect user behavior trajectory data: collect multiple types of user behavior trajectory data in the operation and maintenance scenario in real time through the path dynamic analysis engine, and build a high-concurrency, low-latency data collection and storage channel; Step S3, Identify behavioral pattern evolution trends: Through the behavioral pattern evolution trend identification engine, perform time series analysis on the user behavior trajectory data collected in step S2 to extract multi-dimensional behavioral evolution features. Step S4, determine the profile update trigger condition: the profile dynamic update trigger mechanism determines the degree of deviation of the current user behavior pattern from the historical profile features. Once the deviation exceeds the preset threshold, the user profile dynamic update process is started. Step S5, Generate dynamic weight parameters: The dynamic weight parameter generation module dynamically adjusts the weight parameters of each dimension of the user profile features based on the behavioral pattern evolution trend analysis results, and generates an updated user profile vector. Step S6, Output to Reinforcement Learning Scheduling Engine: The output interface module outputs the updated user profile vector to the reinforcement learning scheduling engine through a standardized interface, serving as one of the input features of the reinforcement learning scheduling engine to assist in operation and maintenance decision-making.

[0007] Furthermore, the determination of the image update trigger condition in step S4 further includes: A multi-level deviation threshold is set, which includes a slight deviation threshold, a moderate deviation threshold, and a severe deviation threshold; The value range of the slight deviation threshold is 0.15 to 0.25, the value range of the moderate deviation threshold is 0.40 to 0.55, and the value range of the severe deviation threshold is 0.75 to 0.90. When the deviation metric falls within the range corresponding to the slight deviation threshold, the incremental update strategy is triggered. For each feature dimension, the incremental update strategy only updates feature dimensions whose change exceeds twice the historical average change of that feature dimension. When the deviation metric falls within the range corresponding to the moderate deviation threshold, a local update strategy is triggered, which recalculates the feature clusters associated with the current behavior pattern. When the deviation metric falls within the range corresponding to the severe deviation threshold, a full update strategy is triggered, which re-executes the static user profile construction process.

[0008] Furthermore, step S3, identifying the evolution trend of behavioral patterns, further includes: The behavior pattern evolution trend recognition engine adopts a dual-model architecture that combines an autoregressive integral moving average model and a long short-term memory neural network in parallel; the parameters of the autoregressive integral moving average model are set to the autoregressive order. Equals 3, difference order Equal to 1, moving average order It equals 2; The network structure of the Long Short-Term Memory Neural Network is set with two hidden layers, each containing 128 Long Short-Term Memory Units. Each Long Short-Term Memory Unit contains three gating structures: a forget gate, an input gate, and an output gate.

[0009] Furthermore, the generation of dynamic weight parameters in step S5 further includes: Dynamic weight parameters are generated using an exponentially weighted moving average algorithm, and a time decay factor is set. The time decay factor The value ranges from 0.85 to 0.95; Set the length of the sliding window, where the length of the sliding window is 10. For each feature dimension, the original weight coefficients are calculated based on the behavioral pattern evolution trend vector over the past 10 time windows, and the softmax function is used to map the original weight coefficient vector into a normalized weight vector. The updated user profile vector is generated by fusing the static user profile vector with the current behavior pattern evolution trend vector, which is weighted by the normalized weight vector.

[0010] Furthermore, the deviation metric is calculated by fusing cosine similarity and Mahalanobis distance. The calculation formula is: in, This represents the final deviation measurement. This represents the weighting coefficient of the first item, with a default value of 0.4; This represents the weighting coefficient for the Mahalanobis distance, with a default value of 0.6, and satisfies... ; This represents the current behavioral pattern evolution trend vector obtained from step S3; Represents the historical profile vector of a user stored in the profile system; The cosine similarity between the current behavioral pattern evolution trend vector and the historical profile vector; Represents cosine distance; The Mahalanobis distance represents the distribution between the current behavioral pattern evolution trend vector and the historical profile vector.

[0011] Furthermore, step S3, identifying the evolution trend of behavioral patterns, further includes: A multi-scale time window is set to cover behavioral patterns of different granularities. The multi-scale time window includes a short-period window, a long-period window, and a mixed-period window. The duration of the short-cycle window is set to 1 hour; The collection of user behavior trajectory data in the long-period window duration step S2 further includes: A lightweight log collection agent is deployed on the user terminal. The lightweight log collection agent assembles the captured operation events into log messages and sends them to a distributed message queue cluster. The distributed message queue cluster adopts a partitioning mechanism, using the hash value of the user identifier as the partition key for routing; Multiple parallel consumption instances are deployed on the consumer side of the distributed message queue cluster. These parallel consumption instances will effectively record and write data to the memory cache layer and the distributed file system. The memory cache layer adopts a key-value pair storage structure and is divided into a hot data area and a warm data area; The hot data area stores behavioral trajectory data for the most recent 5 minutes and uses an LRU (Least Recently Used) eviction policy, while the warm data area stores behavioral trajectory data for the most recent hour and uses an LFU (Least Recently Used) eviction policy. The time frame is set to 24 hours or 168 hours. The hybrid periodic window uses a sliding step method to dynamically adjust the window length. The sliding step length is one-tenth of the current window duration, and adjacent windows maintain a 50% time overlap.

[0012] Furthermore, the generation of dynamic weight parameters in step S5 also includes: Set the weight coefficient for static images The static image weight coefficient The value of is related to the update strategy triggered in step S4; When a slight deviation from the update strategy is triggered, the static image weight coefficient It is 0.8; When the moderate deviation update strategy is triggered, the static portrait weight coefficient It is 0.5; When a severe deviation from the update strategy is triggered, the static image weight coefficient It is 0.2; Updated user profile vector The Dimensional components The calculation is as follows: in, This represents the updated user profile vector; The dimension number representing the user profile vector; This indicates that the updated user profile vector is at the 1st position. Components in the dimension; This represents the static image weighting coefficient; The static user profile vector is represented at the th... Components in the dimension; This represents the normalized weight vector obtained after normalization by the softmax function at the th... Values ​​on the dimension; The vector representing the current behavioral pattern evolution trend is at the th... The value that can be taken on the dimension.

[0013] Furthermore, 9. The IT operation and maintenance service management method based on big data according to claim 1, wherein the construction of static user profile vectors in step S1 further includes: The feature dimensions extracted from operations and maintenance personnel include technical skill level, professional certification qualifications, historical task completion rate, and average response time; The feature dimensions extracted from the IT equipment of the operation and maintenance object include hardware model and specifications, runtime parameters, failure frequency and performance indicator baseline; The feature dimensions extracted from the IT systems of the operation and maintenance objects include system architecture level, service dependency relationship, data flow path and disaster recovery backup configuration; For the entity types of operation and maintenance personnel, IT equipment, and IT system, respectively, the comprehensive distance between any two samples within the same entity type is calculated based on the original feature matrix corresponding to each entity type. The comprehensive distance is a distance metric that combines Euclidean distance and Pearson correlation coefficient. Preset adjustment coefficient The two distances are weighted and fused to obtain the comprehensive distance. The calculation formula is: in, Represents any two samples within the same entity type and The combined distance between them; This represents the weight that balances the contributions of Euclidean distance and Pearson correlation coefficient distance, and its value is 0.6. Indicates sample and samples The Euclidean distance between them; This represents the distance metric derived from the Pearson correlation coefficient. , Indicates sample and samples Pearson correlation coefficients across each feature dimension.

[0014] Furthermore, the output to the reinforcement learning scheduling engine in step S6 further includes: The standardized interface is defined using the remote procedure call protocol and supports batch push mode and incremental update mode for image vectors; The output interface module uses a binary serialization format to encode the user profile vector, keeping the data size of a single serialized user profile vector within 2KB. The interface response latency of the output interface module is less than 50 milliseconds; The processing flow of the reinforcement learning scheduling engine server includes five stages: request parsing, permission verification, user profile query, vector assembly, and serialization encoding. Each stage is equipped with an independent timeout control and circuit breaker mechanism.

[0015] In summary, this application includes at least one of the following beneficial technical effects: 1. This invention is the first to integrate maintenance personnel and IT equipment and systems into a unified user profile system. It uses a hierarchical clustering algorithm to construct a static user profile vector with a hierarchical structure, covering the full feature characterization of three types of maintenance subjects: personnel, equipment, and systems. This solves the problem that existing technologies have not built a complete user profile system for maintenance scenarios, and provides accurate user group segmentation basis for maintenance decisions.

[0016] 2. This invention collects user behavior trajectory data in real time through a path dynamic analysis engine, identifies the evolution trend of behavior patterns using time series analysis, and triggers a dynamic profile update mechanism when a deviation from the threshold is detected. Combined with a dynamic weight parameter generation module, it realizes adaptive iterative updates of user profiles, solving the fundamental problem that static profiles cannot reflect real-time changes in users, and enabling profile data to continuously track changes in user behavior.

[0017] 3. This invention outputs the updated user profile vector directly to the reinforcement learning scheduling engine as one of the input features through a standardized output interface, assisting in operation and maintenance decision-making. It realizes the effective transformation of profile data into the decision-making system, forming a complete end-to-end intelligent closed loop for profile decision-making, and improving the personalization and accuracy of operation and maintenance decisions. Attached Figure Description

[0018] Figure 1 A schematic diagram of the overall technical solution for IT operations and maintenance service management based on big data; Figure 2 A schematic diagram illustrating the core principle of the adaptive dynamic update mechanism for user profiles; Figure 3 A flowchart illustrating the logic of constructing multi-subject user profiles and performing hierarchical clustering analysis; Figure 4 A flowchart for identifying behavioral pattern evolution trends and determining multi-level deviation triggers; Figure 5 A schematic diagram illustrating the interaction between the standardized output of the reinforcement learning scheduling engine and decision support, which is derived from user profile vectors. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the following description is provided in conjunction with the appendix. Figure 1 To be continued Figure 5 The present invention will be further described in detail below with reference to specific embodiments.

[0020] This invention provides a big data-based IT operations and maintenance service management method. This method constructs static user profile vectors using a hierarchical clustering algorithm, combines this with a path dynamic analysis engine to collect user behavior trajectory data in real time, employs time series analysis to identify behavioral pattern evolution trends, and triggers a dynamic profile update mechanism when deviations from a threshold are detected. After generating dynamic weight parameters, the updated user profile vector is output to a reinforcement learning scheduling engine through a standardized interface to assist in operations and maintenance decision-making. This method encompasses the following core steps: First, in step S1, a static user profile vector is constructed. Using a hierarchical clustering algorithm, maintenance personnel, IT equipment, and systems within the maintenance scenario are uniformly incorporated into the profile system, generating an initial static user profile vector with a hierarchical structure. This provides a benchmark for subsequent dynamic behavioral analysis. The specific implementation process is as follows.

[0021] Step S101: The static user profile construction module distinguishes two major categories from the operation and maintenance scenario: operation and maintenance personnel and operation and maintenance objects (IT equipment and systems), and determines a multi-dimensional indicator system to characterize the features of each category.

[0022] For operations and maintenance personnel, the extracted feature dimensions include technical skill level, professional certification qualifications, historical task completion rate, and average response time.

[0023] For IT equipment under maintenance, the extracted feature dimensions include hardware model and specifications, runtime parameters, failure frequency, and performance baseline.

[0024] For the system being operated and maintained, the extracted feature dimensions include system architecture level, service dependencies, data flow paths, and disaster recovery and backup configurations.

[0025] Step S102: For each user group, construct an original feature matrix from the multi-dimensional features of all samples within the group. The rows of the original feature matrix correspond to each specific user sample, and the columns correspond to the values ​​of each feature dimension.

[0026] Taking an operations and maintenance personnel group as an example, if the group contains a sample of 300 personnel, and each personnel sample has four feature dimensions extracted: technical skill level, professional certification qualifications, historical task completion rate, and average response time, then a 300-row, 4-column original feature matrix is ​​formed. The element in the i-th row and k-th column of the matrix represents the original value of the i-th sample in the k-th feature dimension.

[0027] Before performing the comprehensive distance calculation, the original feature matrix is ​​first standardized to eliminate the unreasonable influence of different dimensions and numerical ranges of each feature on the Euclidean distance calculation.

[0028] For each feature dimension Calculate all under this dimension Mean of a sample and standard deviation Then, for each sample, take the value in that dimension. Perform Z-score standardization: in, Indicates the standardized first The sample at the th The values ​​taken on each feature dimension For the first The mean of the dimension, For the first Standard deviation of dimension.

[0029] After the standardization process described above, the mean of each feature dimension is 0, the standard deviation is 1, the dimensions are eliminated, and the numerical range is unified to the same scale. Then, the Euclidean distance is calculated based on the standardized feature matrix. The contribution of each feature dimension to the distance is determined by the actual statistical difference of that feature, rather than by the dimensions and range of the original value of that feature. This ensures that the Euclidean distance can truly reflect the feature differences between samples and avoids large numerical features dominating the distance results.

[0030] Step S103: Based on the original feature matrix, calculate the comprehensive feature distance between any two samples and form a complete symmetric distance matrix. The comprehensive distance combines both Euclidean distance and correlation coefficient to take into account both the absolute differences in feature values ​​and the relative differences in their trends. The calculation process is as follows.

[0031] First, for any two samples i and j, calculate the Euclidean distance based on the standardized feature matrix. , Defined as: in, This represents the total number of feature dimensions. Representing the The first sample Each feature dimension value, Representing the The first sample Each feature dimension value.

[0032] Secondly, calculate the Pearson correlation coefficient between the two samples on each feature dimension. And convert it into a distance metric. , The smaller the value, the higher the similarity between samples.

[0033] Finally, by setting the adjustment coefficient The two distances are weighted and fused to obtain the comprehensive distance. : in, To balance the weights of Euclidean distance and correlation coefficient distance contributions, this embodiment uses a default value of 0.6. By iterating through all sample pairs in this manner, a symmetric distance matrix recording the combined distance between any two samples is obtained. This symmetric distance matrix serves as the direct basis for subsequent cluster merging.

[0034] Step S104: An agglomerative hierarchical clustering strategy is adopted to iteratively merge samples or clusters in a bottom-up manner. At the beginning of clustering, each sample constitutes an independent cluster. In each iteration, all elements in the current distance matrix are traversed, the distance value with the smallest value is found, and the pair of samples or clusters corresponding to the distance value are merged into a new cluster.

[0035] Next, the distances between the new cluster and all other clusters are calculated. The inter-cluster distances are determined using the average linkage method, which takes the average distances between all sample pairs within two clusters as the new inter-cluster distances. Specifically, if cluster A contains... Samples, cluster B contains If there are n samples, then the average distance between them is all The arithmetic mean of the distances between cross-cluster sample pairs.

[0036] Update the distance matrix based on the calculation results, delete the rows and columns containing the original samples or original clusters that have been merged, and add the rows and columns corresponding to the new clusters. Repeat the above process of finding the minimum distance, merging, and updating the distance matrix in the next iteration until the number of current clusters is reduced to the preset hierarchical requirement.

[0037] In this embodiment, the preset number of personnel level clusters is 4, the number of device levels is 3, and the number of system levels is 3.

[0038] Step S105: After clustering terminates, the output presents a three-tiered clustering structure. The personnel tier divides maintenance personnel into four clusters based on skill level and work performance: junior, intermediate, senior, and expert. The equipment tier divides IT equipment into three clusters based on hardware specifications and operating status: high-performance, medium-performance, and low-performance.

[0039] The system hierarchy divides IT systems into three clusters based on architectural complexity and service capabilities: core systems, auxiliary systems, and edge systems.

[0040] Based on the clustering results, an initial static user profile vector is generated for each user sample. The user profile vector is preset to 256 dimensions according to the business scenario and is stored in a sparse vector format. Only the feature dimensions with non-zero values ​​and their values ​​are recorded, and the zero-value dimension does not occupy storage space.

[0041] Each user profile vector record consists of three fields: the identifier field contains the user's unique identifier and the cluster number to which it belongs; the feature field contains the feature values ​​and weight coefficients of each dimension; and the timestamp field contains the generation time and last update time of the user profile vector.

[0042] Through the above steps S1, a static user profile system covering maintenance personnel, IT equipment, and systems is constructed. The user profile vectors reflect the aggregation relationship of similar subjects in the feature space, while also preserving the individual differences of each subject, providing baseline data for collecting real-time user behavior trajectories in subsequent steps S2 and identifying the dynamic evolution of behavior patterns in step S3.

[0043] The next step is S2, which involves collecting user behavior trajectory data. The path dynamic analysis engine collects various types of user behavior trajectory data in the operation and maintenance scenario in real time, and builds a high-concurrency, low-latency data collection and storage channel to provide raw data support for the identification of behavior pattern evolution trends in the subsequent step S3.

[0044] Step S201: The user behavior trajectory data collected by the path dynamic analysis engine covers four core data sources. The first type is operation and maintenance logs, which record the user's specific operation behavior, including login and logout operations, configuration change operations, service start and stop operations, and fault handling operations.

[0045] The second category is the task call sequence, which records task call chain information, including the task initiator identifier, task receiver identifier, task type identifier, and task execution status.

[0046] The third category is resource access patterns, which record users' access behavior to IT resources, including the type of resources accessed, access duration, access frequency, and number of concurrent accesses.

[0047] The fourth category is timestamp information, which records the precise time point of the above-mentioned behavioral data, accurate to the millisecond level.

[0048] Step S202: Deploy a lightweight log collection agent on the user terminal. The log collection agent monitors user operations in real time and assembles the captured operation events into log messages according to a preset structured format.

[0049] Each log message includes a user identifier, behavior type code, operation object identifier, operation timestamp, and operation details fields. After assembly, the log collection agent sends the log message to the specified topic in the distributed message queue cluster.

[0050] In step S203, the distributed message queue cluster receives and buffers log messages from each terminal. The distributed message queue adopts a partitioning mechanism, using the hash value of the user identifier as the partition key for routing, and evenly distributes messages from different users to various partitions to achieve write load balancing.

[0051] The message queue uses a sequential write log mechanism to ensure the persistence of message writes, and also provides a message backtracking function, allowing consumers to repeatedly consume historical messages within a specified offset range.

[0052] Step S204: Deploy multiple parallel consumption instances on the consumer side of the message queue. Each consumption instance is bound to an independent consumer group, and the load is distributed among the consumer groups.

[0053] After the consumer instance pulls log messages from the message queue, it parses and cleans them, removing invalid records with abnormal formats or missing fields. The valid records are sorted by user identifier and timestamp and then written to two storage paths: the memory cache layer and the distributed file system.

[0054] Step S205: The memory cache layer adopts a key-value pair storage structure. The key is composed of a user identifier and a time window identifier, and the value stores the summary data of the user's behavior trajectory within the corresponding time window. The cache partition is divided into two levels: a hot data area and a warm data area. The hot data area stores the behavior trajectory data within the most recent 5 minutes and adopts an LRU eviction policy.

[0055] The warm data area stores behavioral trajectory data for the most recent hour and employs an LFU (Least Recently Used) eviction policy. When a cache miss occurs, a source lookup is triggered to read the behavioral trajectory data for the corresponding time window from the distributed file system and asynchronously populate the corresponding cache partition.

[0056] Step S206: The distributed file system is responsible for the persistent storage of historical trajectory data. The distributed file system divides the behavior trajectory log into fixed-size data blocks in chronological order, and establishes a time continuity index between adjacent data blocks to support fast location by time range.

[0057] Data blocks are stored on storage nodes across different racks using a multi-replica mechanism, and the number of replicas can be adjusted according to the data's importance level. Historical data exceeding the preset retention period automatically triggers cold storage migration, moving the data from the hot storage pool to the object storage system.

[0058] Step S2 establishes a behavioral trajectory data channel covering the entire process of data collection, aggregation, caching, and persistence through a path dynamic analysis engine. The collected operation logs, task call sequences, resource access patterns, and timestamp information are continuously fed into the storage system, providing real-time and complete data input for the behavioral pattern evolution trend recognition engine in step S3 to perform time series analysis and pattern mining.

[0059] The next step is S3, which identifies the evolution trend of behavior patterns. Through the behavior pattern evolution trend identification engine, time series analysis is performed on the user behavior trajectory data collected in step S2 to extract multi-dimensional behavior evolution features, providing a quantitative basis for the deviation judgment in the subsequent step S4.

[0060] Step S301: Construct a dual-model architecture for the behavior pattern evolution trend recognition engine. The behavior pattern evolution trend recognition engine uses a parallel combination of an autoregressive integral moving average model and a long short-term memory neural network to capture the linear trend component and nonlinear complex patterns in the behavior sequence, respectively.

[0061] The autoregressive integral moving average (ARMA) model is used to analyze the linear structure of behavioral sequences. The ARMA model transforms non-stationary behavioral sequences into stationary sequences through differencing operations, and then fits a linear combination of the autoregressive and moving average terms onto the stationary sequences.

[0062] The parameters of the autoregressive integral moving average model are set as follows: autoregressive order p = 3, differencing order d = 1, and moving average order q = 2. The autoregressive integral moving average model performs window-by-window fitting on the input frequency sequence of behaviors and outputs a sequence of trend estimates representing a linear trend.

[0063] Long Short-Term Memory (LSTM) neural networks are used to capture nonlinear dependencies and abrupt changes in behavioral sequences that are difficult to characterize using autoregressive integral moving average (ERMA) models. The LSM network structure consists of two hidden layers, each containing 128 LSM units.

[0064] Each Long Short-Term Memory (LSTM) unit contains three gate structures: a forget gate, an input gate, and an output gate. The forget gate controls the proportion of the memory state retained from the previous moment, the input gate controls the proportion of the current input information written, and the output gate controls the proportion of the memory state being output to the hidden state.

[0065] Step S302 explains the training data construction method, loss function design, and training objective of the Long Short-Term Memory Neural Network.

[0066] The training data is constructed from the historical behavior trajectory data stored in step S2. For each user, the frequency sequence of behavior over N consecutive time windows, the expanded vector of the behavior sequence jump probability matrix, and the statistical parameter vector of behavior duration are extracted and concatenated to form a fixed-length input feature vector.

[0067] The feature vectors of 10 consecutive time windows, from the t-th time window to the t+9-th time window, are used as the input sequence of training samples, and the feature vector of the t+10-th time window is used as the corresponding predicted target label. A training dataset containing tens of thousands of samples is constructed by traversing all historical data in a sliding window manner.

[0068] The loss function used is the mean squared error (MSE) function, which calculates the mean of the element-wise squared differences between the behavioral trend vector predicted by the Long Short-Term Memory (LSTM) neural network and the true label vector. The expression for the MSE function is: in, This indicates the number of samples in the training batch. The total dimension of the behavior trend vector is the sum of the dimensions of behavior frequency features, behavior sequence jump probability features, and behavior duration features. This indicates that the long short-term memory neural network is for the first... The sample at the th Predicted values ​​in each dimension Indicates the first The sample at the th The true label value in each dimension.

[0069] The training objective is to iteratively update the weight and bias parameters in the Long Short-Term Memory (LSTM) neural network using the backpropagation algorithm, minimizing the mean squared error (MSE) on the validation set. The Adam optimizer is used during training, with an initial learning rate of 0.001. After every 5 complete training epochs, if the validation set loss no longer decreases, the learning rate is reduced to 0.5 times its original value. Training terminates when the learning rate drops below 1 x 10^-5 or the validation set loss no longer decreases for 10 consecutive epochs.

[0070] Step S303: Set up multi-scale time windows to cover behavioral patterns at different granularities. Multi-scale time windows include three types: short-period windows, long-period windows, and mixed-period windows.

[0071] The short-cycle window duration is set to 1 hour to capture users' real-time behavior patterns and short-term operational fluctuations.

[0072] The long-term window duration is set to 24 hours or 168 hours. 24 hours corresponds to the daily cycle mode, and 168 hours corresponds to the weekly cycle mode, which is used to identify the periodic patterns of user behavior.

[0073] The hybrid periodic window dynamically adjusts its length using a sliding step method, with the step size being one-tenth of the current window's duration. During window sliding, adjacent windows maintain a 50% time overlap to prevent the fragmentation of behavior records at window boundaries, which could lead to information loss.

[0074] Step S304: Extract behavior frequency features. For each time window, count the total number of all behavior records within the corresponding time window and generate a behavior frequency scalar value.

[0075] To eliminate the impact of different time window lengths on frequency statistics, the frequency values ​​are normalized. The normalization coefficient is taken as the average behavior frequency of the same period in history under the corresponding window length as the baseline frequency. The actual frequency within the time window is divided by the baseline frequency to obtain the relative frequency value that is concentrated in the range of 0 to 1.

[0076] A normalized behavior frequency feature value higher than 1 indicates that the behavior activity within the corresponding time window exceeds the historical baseline level, while a value lower than 1 indicates that the activity is lower than the historical baseline level.

[0077] Step S305: Extract the jump probability features of the behavior sequence. User behaviors are categorized into five types based on operational operation categories: monitoring query operations, configuration change operations, fault diagnosis operations, task scheduling operations, and resource expansion operations. Let the total number of behavior types be n, where n equals 5.

[0078] Calculate the transition probability matrix for behavior type jumps between adjacent time windows. The transition probability matrix is ​​an n x n square matrix, where the element in the a-th row and b-th column represents the conditional probability of jumping from behavior type a to behavior type b. The calculation formula is as follows: in, This represents the transition probability from behavior type a to behavior type b. This represents the sample count of transitioning from behavior type a to behavior type b within adjacent time windows, with the denominator being... This represents the total count of transitions from behavior type 'a' to all behavior types. The summation index 'c' iterates through all n behavior types. The sum of the elements in each row of the transition probability matrix is ​​1.

[0079] Step S306: Extract the duration feature of the behavior. For each behavior type, calculate the duration distribution parameters of a single continuous behavior operation, including the mean, variance, upper quartile, median, and lower quartile of the duration.

[0080] The distribution parameters are updated using a sliding statistics method. After processing the data for each time window, the duration statistics for each behavior type within the corresponding time window are calculated. The calculated results are then weighted and merged with the statistics from historical windows using exponential decay weights to update the current distribution parameter record.

[0081] Step S307: Combine the frequency characteristics of behavior, the probability characteristics of behavior sequence jumps, and the duration characteristics of behavior to form a vector of behavioral pattern evolution trends.

[0082] The total dimension of the behavioral pattern evolution trend vector is composed of three parts: the behavioral frequency feature accounts for 1 dimension, the behavioral sequence jump probability feature accounts for n times n dimensions, and the behavioral duration feature accounts for 3n dimensions, where 3n corresponds to the mean, variance, and quantile information of each of the n behavioral types.

[0083] The behavioral pattern evolution trend vector is continuously updated as the multi-scale time window slides, forming a vector sequence arranged in chronological order. The vector sequence constitutes the temporal evolution trajectory of user behavior patterns. Each node in the temporal evolution trajectory corresponds to a snapshot of behavioral features within a time window, and the vector differences between adjacent nodes reflect the magnitude and direction of the behavioral pattern evolution.

[0084] Through steps S301 to S307, the behavior pattern evolution trend recognition engine transforms the original behavior trajectory log into a structured behavior pattern evolution trend vector sequence. This behavior pattern evolution trend vector sequence provides a directly calculable numerical basis for determining the degree of deviation between the current behavior pattern and historical profile features in step S4. The cosine similarity and Mahalanobis distance required for deviation measurement both use the behavior pattern evolution trend vector sequence as input.

[0085] The next step in this embodiment is step S4, which determines the profile update trigger condition. In step S4 of this embodiment, the dynamic profile update trigger mechanism determines the degree of deviation between the current user behavior pattern and historical profile features. Once the deviation exceeds a preset threshold, the dynamic update process of the user profile is initiated.

[0086] Step S401: Set multi-level deviation thresholds. Set three levels of multi-level deviation thresholds: slight deviation threshold, moderate deviation threshold, and severe deviation threshold. The value range of the slight deviation threshold is 0.15 to 0.25, corresponding to a state where the behavior pattern changes slightly but the overall trend remains stable.

[0087] The moderate deviation threshold ranges from 0.40 to 0.55, corresponding to a significant change in behavioral patterns that has not yet reached a qualitative change. The severe deviation threshold ranges from 0.75 to 0.90, corresponding to a fundamental change in behavioral patterns. The specific value of each deviation threshold is adaptively adjusted based on the historical data distribution characteristics of each user group, with the median value used as the default value in the initial stage.

[0088] Step S402: Determine and execute the update strategy corresponding to the deviation level. If the deviation metric falls within the minor deviation threshold range, an incremental update strategy is triggered. The incremental update strategy only updates the feature dimensions that have changed significantly, while keeping other stable feature dimensions unchanged.

[0089] The criterion for selecting feature dimensions that need updating is: the change in that dimension within the current time window exceeds twice the historical average change in that dimension. The historical average change for a single dimension is calculated by taking the arithmetic mean of the changes in that dimension over the past 20 time windows.

[0090] If the deviation metric falls within the moderate deviation threshold range, a local update strategy is triggered. This strategy recalculates the feature clusters associated with the current behavior pattern. The feature clusters are partitioned based on the cluster structure formed by the hierarchical clustering process in step S1; therefore, the local update only involves recalculation within the affected clusters.

[0091] If the deviation metric falls within the severely deviated threshold range, a full update strategy is triggered. In this case, the static user profile construction process is re-executed, starting from the original feature extraction and running the hierarchical clustering algorithm once to generate a completely new user profile vector.

[0092] Step S403: Calculate the deviation metric. The deviation metric is calculated using a fusion method, which combines cosine similarity and Mahalanobis distance.

[0093] First, calculate the cosine similarity between the current behavior trend vector and the historical profile vector. The formula is: in, This represents the current behavioral pattern evolution trend vector obtained from step S3; This represents the historical profile vector of the user stored in the profile system. The historical profile vector is the result of the initial static vector generated in step S1 after the last update. Represents the dot product of two vectors; and Let represent the magnitudes of the two vectors. The range of the above formula is [-1, 1], and the closer the value is to 1, the more similar the directions of the two vectors are. To ensure a positive correlation with the degree of deviation, cosine distance is used. Instead of cosine similarity itself, the range of cosine distance is [0, 2], and the larger the value, the greater the difference in direction between the two vectors.

[0094] Secondly, calculate the Mahalanobis distance between the current behavior trend vector and the historical profile vector distribution. The calculation formula is: in, and The meaning is the same as above; It is the transpose of the difference vector; It is the covariance matrix The inverse matrix. Covariance matrix. The covariance matrix is ​​calculated based on the feature matrix of all samples when constructing the static user profile in step S1. The covariance matrix reflects the covariance relationship between each feature dimension.

[0095] The above formula measures the statistical distance between the current behavior feature vector and the historical profile feature vector. A larger value indicates that the current behavior pattern deviates significantly from the historical profile in terms of statistical distribution. The Mahalanobis distance has a range of [0, 1]. The larger the value, the greater the deviation, and it is completely consistent with the direction of the cosine distance.

[0096] Finally, the two measurement results are weighted and summed to obtain the final deviation measurement value. The calculation formula is: in, This is the weighting coefficient for the first term (cosine distance), with a default value of 0.4; This is the weighting coefficient for the Mahalanobis distance, with a default value of 0.6, and it satisfies... Both weighting coefficients are adjusted in real time through the configuration center. With the above settings, The larger the value, the greater the deviation of the current behavior pattern from the historical profile, which is consistent with the judgment logic of each deviation threshold.

[0097] Step S404: Perform deviation judgment and version management. The deviation metric is calculated independently at the granularity of each user identifier. Each user maintains an independent profile version number and update timestamp in the profiling system. When this embodiment detects a user's deviation metric... When the threshold range set in step S401 is exceeded, the corresponding update strategy in step S402 is triggered. Simultaneously, the user's profile version number is incremented, and the update timestamp is updated to the current time. The updated version number and timestamp are used for subsequent version tracking and rollback control.

[0098] Through steps S401 to S404 described above, the dynamic profile update triggering mechanism in this embodiment completes a quantitative assessment of the deviation degree of the current user behavior pattern and selects an appropriate update strategy based on the assessment results. After completing these judgments, this embodiment proceeds to step S5, where dynamic weight parameters are generated and the actual update operation of the user profile is performed.

[0099] The next step is S5, which generates dynamic weight parameters. In this embodiment, the dynamic weight parameter generation module dynamically adjusts the weight parameters of each dimension of the user profile based on the behavioral pattern evolution trend analysis results. The weight adjustment uses an exponentially weighted moving average algorithm, assigning higher weight coefficients to recent behaviors. The specific implementation process is as follows.

[0100] Step S501: Set the parameters for the exponentially weighted moving average and set the time decay factor. The default value is between 0.85 and 0.95. Time decay factor. This represents the rate at which historical data contributes to the current weight calculation. The closer the value is to 1, the slower the decay, and the longer the historical data is retained for reference.

[0101] Set the length of the sliding window , This represents the number of historical time windows involved in the calculation, in this embodiment. The default value is 10.

[0102] Step S502: Calculate the original weight coefficients for each feature dimension. , The value range is 1 to , In this embodiment, the total dimension of the user profile vector is... It equals 256.

[0103] set up Indicates the first The vector of behavioral pattern evolution trends within a time window, where This is the current time window number. This represents the offset sequence number of the historical time window. The value range is 0 to . yes dimensional vector, The Each component is denoted as .

[0104] Weight update vector calculated by the exponentially weighted moving average algorithm The Each component for: molecular Indicating the past The behavioral pattern evolution trend vector of the time window is in the first... The values ​​in the dimension are summed exponentially, and the denominator is... This is the normalization term for the attenuation coefficient, used to maintain the consistency of the weight dimensions.

[0105] The original weight coefficient vector is obtained through the above calculations. . Each component reflects the importance of the corresponding feature dimension in recent behavioral patterns.

[0106] Step S503: Normalize the original weight coefficients by using the softmax function to transform the original weight coefficient vector. Mapped to a normalized weight vector in the form of a probability distribution The formula for calculating the softmax function is: in, Represented by natural constant An exponential function with base 0. The first one calculated in step S502 Original weight coefficients, denominator Summation of the exponent values ​​for all dimensions. Normalized weight vector. The sum of the weights of each dimension is equal to 1. .

[0107] Step S504: Merge the static user profile vector and the behavioral feature vector. Let the static user profile vector be... , The dimensional components are Let the vector representing the evolution trend of the behavior pattern in the current time window be... , The dimensional components are , The current behavior pattern evolution trend vector extracted from step S3 is in the... Values ​​in a dimension.

[0108] set up This refers to the static image weighting coefficient. The value range is between 0 and 1. This indicates the proportion of static images in the final update result. The value of is related to the update strategy triggered in step S4: when a slight deviation from the update strategy is triggered, The default value is 0.8; when a moderate deviation from the update policy is triggered, The default value is 0.5; when a severe deviation from the update policy is triggered, The default value is 0.2.

[0109] Updated user profile vector The Dimensional components The calculation is as follows: in The normalized weight vector calculated in step S503 is in the first... Values ​​on the dimension, The vector representing the evolution trend of the current behavior pattern at the th The value that can be taken on the dimension.

[0110] Through the above calculations, the updated user profile vector retains the baseline information of the static profile while incorporating the current behavioral features weighted by dynamic weights.

[0111] Step S505: Re-annotate the cluster numbers of the user profile, and update the user profile vector. The cluster numbers need to be re-labeled based on the cluster structure formed by hierarchical clustering in step S1. Calculation The Euclidean distance between the user and the cluster center vectors is used to assign the user to the cluster with the closest Euclidean distance. The cluster center vector is the arithmetic mean of all sample vectors within each cluster after clustering in step S1.

[0112] If a user's cluster affiliation changes, for example, moving from a high-performance cluster to a medium-performance cluster at the device level, then calculations are performed independently for the personnel, device, and system levels. The Euclidean distance to the cluster center vector at each level is calculated, and the user's cluster affiliation at each of the three levels is updated synchronously. This ensures that the profile vector remains consistent across different levels and provides a complete attribution path for subsequent version tracking.

[0113] Through step S5 above, the dynamic weight parameter generation module completes the adaptive update of the user profile. This process dynamically adjusts the weights of each feature dimension according to the evolution trend of user behavior patterns, enabling the profile to reflect recent user behavior characteristics while retaining historical baseline information. The updated user profile vector will then proceed to step S6, where it will be output to the reinforcement learning scheduling engine through a standardized interface to assist in operational decision-making.

[0114] Finally, in step S6, the output is sent to the reinforcement learning scheduling engine. In step S6 of this embodiment, the output interface module outputs the updated user profile vector to the reinforcement learning scheduling engine through a standardized interface, serving as one of the input features of the reinforcement learning scheduling engine to assist in operation and maintenance decision-making. The specific implementation process is as follows.

[0115] Step S601: Define a standardized interface protocol. The standardized interface adopts a remote procedure call protocol for definition. The standardized interface supports two working modes: batch push mode of image vectors and incremental update mode.

[0116] Batch push mode is suitable for scenarios involving batch initialization of user profiles and full refresh. In batch push mode, the output interface module packages all user profile vectors of a specified user set into a single request and pushes it to the reinforcement learning scheduling engine.

[0117] Incremental update mode is suitable for scenarios requiring real-time user profile updates. In incremental update mode, the output interface module only pushes the changed user profile vectors. Each push message contains three fields: user identifier, user profile version number, and the updated user profile vector.

[0118] The two working modes are distinguished by the pattern identifier field in the request header. The server of the reinforcement learning scheduling engine invokes the corresponding processing logic based on the value of the pattern identifier field.

[0119] Step S602: The user profile vector is binary serialized. To reduce network transmission overhead, the output interface module encodes the user profile vector using a binary serialization format. The binary serialization format uses Protocol Buffers.

[0120] The binary serialized data consists of two parts: metadata fields and feature data fields. The metadata fields include the user identifier, user type, cluster number, user profile version number, and generation timestamp. The feature data fields contain the values ​​of each dimension of the user profile vector and their corresponding weight coefficients. Each feature value is stored as a float, occupying 4 bytes.

[0121] Step S603: Control the amount of profile vector data and the dynamic adaptation dimension. The output interface module controls the amount of serialized single user profile vector data within the preset data volume limit. In this embodiment, the default data volume limit is 2KB.

[0122] The output interface module dynamically adapts the feature dimensions according to the input requirements of the reinforcement learning scheduling engine. If the dimension of the static user profile vector exceeds the input requirements of the reinforcement learning scheduling engine, the user profile vector is reduced in dimensionality using principal component analysis.

[0123] If the dimension of the static user profile vector is lower than the input requirement of the reinforcement learning scheduling engine, the dimension is filled in using zero-padding.

[0124] Step S604: Set the interface response latency and exception handling mechanism. The output interface module requires the interface response latency to be less than the preset response latency threshold. In this embodiment, the default response latency threshold is 50 milliseconds.

[0125] The processing flow of the reinforcement learning scheduling engine server consists of five stages: request parsing, permission verification, user profile query, vector assembly, and serialization encoding.

[0126] Each stage is equipped with an independent timeout control and circuit breaker mechanism. When a stage times out or fails, the reinforcement learning scheduling engine server returns a preset error code and a degradation response to ensure the overall availability of the interface.

[0127] In step S605, the reinforcement learning scheduling engine performs feature fusion and decision output. After receiving the user profile vector pushed by the output interface module, the reinforcement learning scheduling engine fuses the user profile vector with real-time monitoring data and historical decision records to generate a complete state vector.

[0128] The position and dimension of the user profile vector in the state vector are predefined according to the interface protocol to ensure consistency with the input layer of the reinforcement learning algorithm.

[0129] The reinforcement learning scheduling engine performs inference calculations on the policy network based on the state vectors, and outputs operation and maintenance scheduling decision suggestions. The operation and maintenance scheduling decision suggestions include resource allocation schemes, task scheduling order, and fault handling priorities.

[0130] In step S6, the output interface module in this embodiment transmits the updated user profile vector to the reinforcement learning scheduling engine and assists the reinforcement learning scheduling engine in making operation and maintenance decisions.

[0131] Thus, the entire process from static construction of user profiles, collection of behavioral trajectories, identification of behavioral pattern evolution trends, judgment of profile update triggers, generation of dynamic weight parameters, to output of profile vectors and decision support is completed.

[0132] For ease of understanding, the following uses the operation and maintenance scenario of a large Internet company as an example to explain in detail the complete implementation process of the method of the present invention.

[0133] The company's operations and maintenance platform manages more than 5,000 servers and 200 business systems, with approximately 300 active operations and maintenance personnel on a daily basis.

[0134] In step S1, during the initialization of the operations and maintenance platform, static profiles are built for all operations and maintenance personnel and IT resources. The personnel profiles extract technical skill levels from 1 to 5, 11 types of professional certifications, historical task completion rates over the past 6 months, and average response times over the past 30 days. The IT equipment profiles extract 10 hardware model specifications, runtime, failure frequency over the past 12 months, and 4 performance baseline indicators.

[0135] The IT system profile extraction process extracts the system architecture hierarchy (level 3), service dependencies, data flow paths, and disaster recovery / backup configurations. Hierarchical clustering generates 300 personnel profile vectors, 5000 device profile vectors, and 200 system profile vectors. Clustering categorizes personnel into four clusters: expert, skilled, growth-stage, and intern; devices into three clusters: critical, important, and general; and systems into three clusters: core, important, and ordinary. The profile vectors have 256 dimensions.

[0136] In step S2, the path dynamic analysis engine collects behavioral trajectory data. A log collection agent is deployed on the terminals of 300 operations and maintenance personnel and on 200 business system log nodes, capturing operation logs in real time and sending them to the Kafka cluster. Kafka is configured with 12 partitions and 3 replicas, with messages retained for 7 days. Redis caches 6 nodes, with a TTL of 300 seconds for hot data and 3600 seconds for warm data.

[0137] HDFS storage has 20 nodes, 128MB data blocks, 3 replicas, and historical data is retained for 90 days. On a certain workday, approximately 1.5 million operation logs, 800,000 task call sequences, and 2 million resource access records were collected.

[0138] In step S3, the behavior pattern evolution trend recognition engine analyzes the behavior trajectory. The engine uses an ARIMA model, where the autoregressive order p equals 3, the differencing order d equals 1, the moving average order q equals 2, and an LSTM network. The LSTM network is configured with two hidden layers, each with 128 long short-term memory units. The short-term window is 1 hour, the long-term window is 24 hours, and the mixed window has a sliding step size of 10 minutes.

[0139] Taking maintenance personnel A as an example: On day 1, the frequency of actions was 45 times per day, mainly involving monitoring queries and fault diagnosis; on day 2, the frequency increased to 62 times per day, and the fault diagnosis rate increased from 15% to 28%, with resource expansion operations occurring; on day 3, the frequency increased to 78 times per day, the resource expansion rate was 35%, and the fault diagnosis rate decreased to 12%. The total number of behavior types, n, equals 5, and the dimension of the behavior pattern evolution trend vector is 1 + 25 + 15 = 41 dimensions. The deviation metric between this vector and the historical behavior pattern vector is 0.48.

[0140] In step S4, if the deviation metric of 0.48 falls within the moderate deviation threshold range of 0.40 to 0.55, a local update strategy is triggered. The update scope is determined to be the feature cluster associated with the resource expansion operation, including personnel skill certification features, equipment performance baseline features, and system service dependency features.

[0141] The change in the skills certification dimension was 1.8 times the historical average, and did not trigger an incremental update; the change in the performance baseline dimension was 2.3 times the historical average, and triggered an incremental update; the change in the service dependency dimension was 1.5 times the historical average, and did not trigger an incremental update.

[0142] In step S5, the dynamic weight parameter generation module calculates the adaptive weight vector. The exponentially weighted moving average time decay factor is 0.9, and the sliding window length is 10. The deviation sequence of the most recent 10 time windows is 0.15, 0.18, 0.22, 0.25, 0.31, 0.38, 0.42, 0.45, 0.47, and 0.48.

[0143] After weighting, an adaptive weight vector is generated through softmax normalization. Due to triggering a moderate deviation from the local update strategy, the static profile weight coefficient λ is set to 0.5. The updated profile vector is generated by fusing the static profile vector and the weighted sum of the feature clusters at a ratio of 0.5 to 0.5. Personnel A's cluster affiliation is changed from growth type to skilled type, and the associated device cluster and system cluster are updated synchronously.

[0144] In step S6, the output interface module pushes the updated profile vector to the reinforcement learning scheduling engine. The gRPC protocol is used, and the request message includes the user identifier OP-20240515-00300, user type PERSONNEL, version number v20240515-002, and 256 floating-point values. The serialized data size is 1024 bytes, and the interface response latency is 28 milliseconds.

[0145] The reinforcement learning scheduling engine integrates the profile vector with real-time monitoring data and historical decision records to generate a 1024-dimensional state vector. The policy network then infers and outputs a scheduling decision suggestion: relocate personnel A from a regular monitoring post to the emergency response team, increasing their priority for handling resource expansion tasks. This suggestion is executed through the work order system, completing an end-to-end closed loop.

[0146] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A big data-based IT operations and maintenance service management method, characterized in that, Includes the following steps: Step S1, Constructing a Static User Profile Vector: For the three types of entities—maintenance personnel, maintenance target IT equipment, and the IT system running on the maintenance target IT equipment—the corresponding feature dimensions are extracted independently for each type of entity, and an original feature matrix is ​​constructed. Then, a hierarchical clustering algorithm is independently executed on the original feature matrix corresponding to each entity type to generate an initial static user profile vector with a hierarchical structure. The initial static user profile vector includes personnel sub-vectors, equipment sub-vectors, and system sub-vectors, which correspond to the full features of the three maintenance subjects—maintenance personnel, maintenance target IT equipment, and maintenance target IT system—and the personnel sub-vectors, equipment sub-vectors, and system sub-vectors are uniformly indexed through entity association identifiers. Step S2, collect user behavior trajectory data: collect multiple types of user behavior trajectory data in the operation and maintenance scenario in real time through the path dynamic analysis engine, and build a high-concurrency, low-latency data collection and storage channel; Step S3, Identify behavioral pattern evolution trends: Through the behavioral pattern evolution trend identification engine, perform time series analysis on the user behavior trajectory data collected in step S2 to extract multi-dimensional behavioral evolution features. Step S4, determine the profile update trigger condition: the profile dynamic update trigger mechanism determines the degree of deviation of the current user behavior pattern from the historical profile features. Once the deviation exceeds the preset threshold, the user profile dynamic update process is started. Step S5, Generate dynamic weight parameters: The dynamic weight parameter generation module dynamically adjusts the weight parameters of each dimension of the user profile features based on the behavioral pattern evolution trend analysis results, and generates an updated user profile vector. Step S6, Output to Reinforcement Learning Scheduling Engine: The output interface module outputs the updated user profile vector to the reinforcement learning scheduling engine through a standardized interface, serving as one of the input features of the reinforcement learning scheduling engine to assist in operation and maintenance decision-making.

2. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S4 further includes determining the conditions for triggering the image update: A multi-level deviation threshold is set, which includes a slight deviation threshold, a moderate deviation threshold, and a severe deviation threshold; The value range of the slight deviation threshold is 0.15 to 0.25, the value range of the moderate deviation threshold is 0.40 to 0.55, and the value range of the severe deviation threshold is 0.75 to 0.

90. When the deviation metric falls within the range corresponding to the slight deviation threshold, the incremental update strategy is triggered. For each feature dimension, the incremental update strategy only updates feature dimensions whose change exceeds twice the historical average change of that feature dimension. When the deviation metric falls within the range corresponding to the moderate deviation threshold, a local update strategy is triggered, which recalculates the feature clusters associated with the current behavior pattern. When the deviation metric falls within the range corresponding to the severe deviation threshold, a full update strategy is triggered, which re-executes the static user profile construction process.

3. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S3, identifying the evolution trend of behavioral patterns, further includes: The behavior pattern evolution trend recognition engine adopts a dual-model architecture that combines an autoregressive integral moving average model and a long short-term memory neural network in parallel; the parameters of the autoregressive integral moving average model are set to the autoregressive order. Equals 3, difference order Equal to 1, moving average order It equals 2; The network structure of the Long Short-Term Memory Neural Network is set with two hidden layers, each containing 128 Long Short-Term Memory Units. Each Long Short-Term Memory Unit contains three gating structures: a forget gate, an input gate, and an output gate.

4. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S5, generating dynamic weight parameters, further includes: Dynamic weight parameters are generated using an exponentially weighted moving average algorithm, and a time decay factor is set. The time decay factor The value ranges from 0.85 to 0.95; Set the length of the sliding window, where the length of the sliding window is 10. For each feature dimension, the original weight coefficients are calculated based on the behavioral pattern evolution trend vector over the past 10 time windows, and the softmax function is used to map the original weight coefficient vector into a normalized weight vector. The updated user profile vector is generated by fusing the static user profile vector with the current behavior pattern evolution trend vector, which is weighted by the normalized weight vector.

5. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S4, determining the image update trigger condition, also includes calculating the deviation metric: The deviation metric is calculated by fusing cosine similarity and Mahalanobis distance. The calculation formula is: in, This represents the final deviation measurement. This represents the weighting coefficient of the first item, with a default value of 0.4; This represents the weighting coefficient for the Mahalanobis distance, with a default value of 0.6, and satisfies... ; This represents the current behavioral pattern evolution trend vector obtained from step S3; Represents the historical profile vector of a user stored in the profile system; The cosine similarity between the current behavioral pattern evolution trend vector and the historical profile vector; Represents cosine distance; The Mahalanobis distance represents the distribution between the current behavioral pattern evolution trend vector and the historical profile vector.

6. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S3, identifying the evolution trend of behavioral patterns, further includes: A multi-scale time window is set to cover behavioral patterns of different granularities. The multi-scale time window includes a short-period window, a long-period window, and a mixed-period window. The duration of the short-cycle window is set to 1 hour; The duration of the long-cycle window is set to 24 hours or 168 hours. The hybrid periodic window uses a sliding step method to dynamically adjust the window length. The sliding step length is one-tenth of the current window duration, and adjacent windows maintain a 50% time overlap.

7. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S2, collecting user behavior trajectory data, further includes: A lightweight log collection agent is deployed on the user terminal. The lightweight log collection agent assembles the captured operation events into log messages and sends them to a distributed message queue cluster. The distributed message queue cluster adopts a partitioning mechanism, using the hash value of the user identifier as the partition key for routing; Multiple parallel consumption instances are deployed on the consumer side of the distributed message queue cluster. These parallel consumption instances will effectively record and write data to the memory cache layer and the distributed file system. The memory cache layer adopts a key-value pair storage structure and is divided into a hot data area and a warm data area; The hot data area stores behavioral trajectory data within the last 5 minutes and uses an LRU (Least Recently Used) elimination strategy, while the warm data area stores behavioral trajectory data within the last hour and uses an LFU (Least Recently Used) elimination strategy.

8. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S5, generating dynamic weight parameters, also includes: Set the weight coefficient for static images The static image weight coefficient The value of is related to the update strategy triggered in step S4; When a slight deviation from the update strategy is triggered, the static image weight coefficient It is 0.8; When the moderate deviation update strategy is triggered, the static portrait weight coefficient It is 0.5; When a severe deviation from the update strategy is triggered, the static image weight coefficient It is 0.2; Updated user profile vector The Dimensional components The calculation is as follows: in, This represents the updated user profile vector; The dimension number representing the user profile vector; This indicates that the updated user profile vector is at the 1st position. Components in the dimension; This represents the static image weighting coefficient; The static user profile vector is represented at the th... Components in the dimension; This represents the normalized weight vector obtained after normalization by the softmax function at the th... Values ​​on the dimension; The vector representing the current behavioral pattern evolution trend is at the th... The value that can be taken on the dimension.

9. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S1, which involves constructing a static user profile vector, further includes: The feature dimensions extracted from operations and maintenance personnel include technical skill level, professional certification qualifications, historical task completion rate, and average response time; The feature dimensions extracted from the IT equipment of the operation and maintenance object include hardware model and specifications, runtime parameters, failure frequency and performance indicator baseline; The feature dimensions extracted from the IT systems of the operation and maintenance objects include system architecture level, service dependency relationship, data flow path and disaster recovery backup configuration; For the entity types of operation and maintenance personnel, IT equipment, and IT system, respectively, the comprehensive distance between any two samples within the same entity type is calculated based on the original feature matrix corresponding to each entity type. The comprehensive distance is a distance metric that combines Euclidean distance and Pearson correlation coefficient. Preset adjustment coefficient The two distances are weighted and fused to obtain the comprehensive distance. The calculation formula is: in, Represents any two samples within the same entity type and The combined distance between them; This represents the weight that balances the contributions of Euclidean distance and Pearson correlation coefficient distance, and its value is 0.

6. Indicates sample and samples The Euclidean distance between them; This represents the distance metric derived from the Pearson correlation coefficient. , Indicates sample and samples Pearson correlation coefficients across each feature dimension.

10. The IT operation and maintenance service management method based on big data according to claim 1, characterized in that, Step S6, which outputs to the reinforcement learning scheduling engine, further includes: The standardized interface is defined using the remote procedure call protocol and supports batch push mode and incremental update mode for image vectors; The output interface module uses a binary serialization format to encode the user profile vector, keeping the data size of a single serialized user profile vector within 2KB. The interface response latency of the output interface module is less than 50 milliseconds; The processing flow of the reinforcement learning scheduling engine server includes five stages: request parsing, permission verification, user profile query, vector assembly, and serialization encoding. Each stage is equipped with an independent timeout control and circuit breaker mechanism.

Images