AI-Based Operations Management System

Abstract

The present invention relates to an AI-based operation management system. Specifically, the invention relates to a system that collects and stores operational status data, performance data, event and log data in real time from network equipment, servers, and security equipment, and analyzes the collected data based on artificial intelligence to provide equipment status monitoring, anomaly detection, fault diagnosis, cause analysis, and recommended measures. Furthermore, it performs scheduled and immediate inspections based on inspection items and thresholds for each equipment type, and enables the verification of new anomalies, status changes, completed actions, and the status of action progress by comparing and analyzing inspection results with previous ones. In addition, it automatically generates inspection reports reflecting analysis results and action status, providing integrated support for the inspection, diagnosis, and reporting tasks of the information system. The present invention goes beyond simple equipment status monitoring to analyze collected operational data, determine the status and abnormal signs of equipment, diagnose the causes and impacts of failures, and suggest appropriate recommended measures. It is characterized by providing an AI-based diagnostic and operational management system that improves the stability, speed, and efficiency of information system operations through this process.

Description

Technology Field

[0001] The present invention relates to an AI-based operation management system.

[0002] Specifically, the invention relates to a system that collects and stores operational status data, performance data, event and log data in real time from network equipment, servers, and security equipment, and analyzes the collected data based on artificial intelligence to provide equipment status monitoring, anomaly detection, fault diagnosis, cause analysis, and recommended measures.

[0003] Furthermore, it performs scheduled and immediate inspections based on inspection items and thresholds for each equipment type, and enables the verification of new anomalies, status changes, completed actions, and the status of action progress by comparing and analyzing inspection results with previous ones. In addition, it automatically generates inspection reports reflecting analysis results and action status, providing integrated support for the inspection, diagnosis, and reporting tasks of the information system.

[0004] The present invention goes beyond simple equipment status monitoring to analyze collected operational data, determine the status and abnormal signs of equipment, diagnose the causes and impacts of failures, and suggest appropriate recommended measures. It is characterized by providing an AI-based diagnostic and operational management system that improves the stability, speed, and efficiency of information system operations through this process. Background Technology

[0006] As the scale of information systems expands and the types and number of servers, network equipment, and security equipment increase, the importance of integrated status checks and operational management for the stable operation of information systems is growing.

[0007] Servers generate operational data such as CPU, memory, disk, process, and service status, while network equipment generates data including interface utilization, traffic, packet loss, errors, and equipment status. Additionally, security equipment such as firewalls, intrusion detection systems, and intrusion prevention systems continuously generates resource utilization, sessions, traffic, events, and log data.

[0008] Such operational data is generated in different formats depending on the type of equipment, manufacturer, operating system, and communication method. Therefore, administrators must collect and manage equipment-specific operational data using Simple Network Management Protocol (SNMP), system logs (Syslog), agents, Application Programming Interfaces (APIs), and individual management tools.

[0009] Conventionally, the status and performance of equipment were monitored using network management systems (NMS), server management systems (SMS), integrated security management systems (ESM), and individual equipment management tools.

[0010] The network management system monitors the connection status of network equipment, interface utilization, traffic, and the occurrence of errors, while the server management system checks the server's CPU, memory, disk, process, and service status. The integrated security management system collects and analyzes events and logs generated by security equipment to detect security threats or potential breaches.

[0011] However, these conventional management systems often manage networks, servers, and security equipment separately, making it difficult to comprehensively analyze operational data collected from different devices. Furthermore, it is difficult to identify correlations between abnormal signs in individual devices and changes in the status of other equipment, which limits the ability to quickly determine the causes and impacts of failures.

[0012] Conventional monitoring systems primarily utilize a method of triggering an alarm when a threshold pre-set by the administrator is exceeded. However, if the status of equipment is determined solely by whether a threshold is exceeded at a single point in time, unnecessary alarms may be generated even for temporary increases in usage. Conversely, abnormal signs that show a continuous increase over a certain period or recurrence without reaching a threshold may not be identified in a timely manner.

[0013] Furthermore, if the same threshold is applied uniformly without sufficiently considering the equipment's type, purpose, performance, and operating environment, there is a possibility that a normal state may be misidentified as an abnormal state, or that an abnormal state requiring action may be deemed normal. As a result, administrators must individually check multiple alerts, which can consume significant time and effort to sift through valid information related to actual failures.

[0014] Traditional information system inspections are often performed by administrators directly checking equipment-specific management screens or collected data, and manually recording inspection results in separate documents or spreadsheets. This approach presents a problem: as the number of equipment to be inspected increases, the repetitive tasks of verification and data entry grow, raising the risk of omissions or data entry errors.

[0015] In particular, to perform daily, weekly, and monthly inspections, inspection targets and items must be managed on a periodic basis, and previous and current inspection results must be compared to verify the occurrence of new anomalies, status changes, and the completion or progress of corrective actions. However, conventional systems have limitations in processing these tasks continuously because functions for monitoring, inspection, fault diagnosis, action management, and report generation are separated.

[0016] Furthermore, even when an abnormal condition is detected, administrators must determine the cause of the failure by individually examining performance data, events, and logs from various systems. Analysis results and response levels may vary depending on the experience and proficiency of the personnel in charge, and there is also a problem in that the causes and history of corrective actions for similar past failures are not systematically utilized.

[0017] Recently, technologies utilizing time-series analysis, statistical analysis, and artificial intelligence are being employed to analyze trends and recurring patterns in operational data and to detect abnormal signs that deviate from normal conditions. However, relying solely on simple anomaly detection results makes it difficult to comprehensively determine the equipment where the anomaly occurred, relevant inspection items, the cause, the scope of impact, and the necessary corrective measures.

[0018] Therefore, it is necessary to comprehensively collect and store various operational data generated from network equipment, servers, and security equipment, check the status based on equipment-specific inspection items and thresholds, and analyze data change trends and interrelationships using artificial intelligence.

[0019] In addition, integrated diagnostic and operational management technology is required that, when abnormal signs are detected, analyzes relevant operational data and historical records to diagnose the cause and impact of the failure, provides recommended measures based on the diagnosis results, and automatically generates an inspection report including inspection results and the status of corrective actions.

[0020] Accordingly, there is a need for an AI-based operations management system that goes beyond simple equipment status monitoring and threshold-based alerts to comprehensively analyze operational data from network equipment, servers, and security devices, and supports the understanding of equipment status, tracking of anomalies, diagnosis of failure causes, and systematization of operational tasks. Prior art literature

[0022] Registered Patent Publication No. 10-1113615 (Registered Feb. 01, 2012) Registered Patent Publication No. 10-0748246 (Registered Aug. 03, 2007) Registered Patent Publication No. 10-2225040 (Registered Mar. 03, 2021) Registered Patent Publication No. 10-2900850 (Registered Dec. 11, 2025) The problem to be solved

[0023] The objective of the present invention is to provide a system that collects and stores operational status data, performance data, event and log data in real time from network equipment, servers, and security equipment, and analyzes the collected data based on artificial intelligence to provide equipment status monitoring, detection of abnormal signs, diagnosis of failures, cause analysis, and recommended measures.

[0025] Another objective of the present invention is to perform scheduled and immediate inspections based on inspection items and thresholds for each equipment type, and to verify the occurrence of new anomalies, status changes, completed actions, and the status of action progress by comparing and analyzing inspection results with previous inspection results. In addition, it automatically generates inspection reports reflecting analysis results and action status to provide integrated support for the inspection, diagnosis, and reporting tasks of an information system.

[0026] Accordingly, the present invention goes beyond simple equipment status monitoring to analyze collected operational data, determine the status and abnormal signs of equipment, diagnose the causes and impacts of failures, and suggest appropriate recommended measures. Through this, the invention aims to provide an AI-based diagnostic and operational management system that improves the stability, speed, and efficiency of information system operations. means of solving the problem

[0028] The AI-based operation management system according to the present invention, devised to achieve the above objective, is an AI-based operation management system comprising an AI-based intelligent integrated operation platform;

[0029] The above AI-based intelligent integrated operation platform is,

[0030] It is characterized by comprising: a data collection unit that collects data from equipment including network equipment, servers, and security equipment; a data storage unit that stores the collected data; and a diagnostic inspection unit that performs a diagnostic inspection based on the data stored in the data storage unit.

[0032] At this time, the above data collection unit,

[0033] Collect data from network equipment using SNMP, Trap, and Syslog methods, but

[0034] It is characterized by collecting CPU, Memory, Interface, Traffic, and status information of network equipment using the SNMP method, collecting real-time failure events of network equipment using the Trap method, and collecting operation logs and events of network equipment using the Syslog method.

[0036] In addition, the data collection unit is characterized by collecting system metrics and logs from the server using the Telegraf method.

[0038] In addition, the data collection unit is characterized by collecting status information and performance information of the security equipment from the security equipment through the SNMP method.

[0040] In addition, the above diagnostic inspection unit is,

[0041] Check the resource usage of network equipment by examining CPU usage, memory usage, and network interface usage based on data collected via the SNMP collection method,

[0042] The above check of CPU usage is,

[0043] When the usage rate exceeds 70%, inspect it as a hazardous target, and when the usage rate exceeds 90%, inspect it as a critical hazardous target.

[0044] The above check of memory usage is,

[0045] When the usage rate exceeds 70%, it is inspected as a hazardous target, and when the usage rate exceeds 90%, it is inspected as a critical hazardous target, and

[0046] The check of the above network interface utilization is,

[0047] It is characterized by inspecting it as a hazardous target when it shows a usage rate of 70% or more, and inspecting it as a critical hazardous target when it shows a usage rate of 90% or more.

[0049] In addition, the above diagnostic inspection unit is,

[0050] Check the interface / module status and VLAN status based on data collected using SNMP and Trap collection methods, but

[0051] The check of the above interface / module status is,

[0052] It is characterized by checking the Down / Up status of each interface / Module and verifying whether there is an increase in CRC errors, identifying it as a risk target if a CRC error occurs, and identifying it as a critical risk target if an Interface Down is confirmed.

[0054] In addition, the above diagnostic inspection unit is,

[0055] Based on data collected using the Trap collection method and Syslog collection method, check for the occurrence of error logs related to hardware status, and inspect the logs,

[0056] It is characterized by checking for critical risk targets when Fail, Error, or Down logs occur.

[0058] In addition, the above diagnostic inspection unit is,

[0059] Based on data collected via the SNMP collection method, check the CPU usage by verifying the CPU resource usage of the security equipment process, and check the memory usage by verifying the memory resource usage of the security equipment process,

[0060] The above CPU usage rate is,

[0061] Inspect as a hazardous target at a usage rate of 70% or higher, and inspect as a critical hazardous target at a usage rate of 90% or higher,

[0062] The above memory usage rate is,

[0063] It is characterized by inspecting as a hazardous target at a usage rate of 75% or more, and inspecting as a critical hazardous target at a usage rate of 90% or more.

[0065] In addition, the above diagnostic inspection unit is,

[0066] Based on data collected via the SNMP collection method, check the connection status between the FLB and each component to verify the connections between the equipment,

[0067] It is characterized by checking for risk targets when Ping Loss is 1% or higher.

[0069] In addition, the above diagnostic inspection unit is,

[0070] Check the traffic status by examining the total traffic flowing into and processed by the security equipment based on the collected data, but

[0071] It is characterized by checking for a risk target when the interface usage rate is 70% or higher, and checking for a critical risk target when it is 90% or higher.

[0073] In addition, the above diagnostic inspection unit is,

[0074] Based on collected data, the total number of equipment sessions is checked to verify the session status, characterized by identifying it as a risk target at 80% or more of the maximum sessions and identifying it as a critical risk target at 95% or more.

[0076] In addition, the above diagnostic inspection unit is,

[0077] Perform a check on the server's CPU usage, but

[0078] It is characterized by inspecting it as a dangerous target when the CPU usage is 70% or higher, and inspecting it as a critical dangerous target when it is 90% or higher.

[0080] In addition, the above diagnostic inspection unit is,

[0081] Perform a check on the server's memory usage, but

[0082] Check memory usage by verifying memory usage,

[0083] It is characterized by checking as a risk target when memory usage is 75% or higher, and checking as a critical risk target when memory usage is 90% or higher.

[0085] In addition, the above diagnostic inspection unit is,

[0086] Check the Paging Space by verifying the available virtual memory usage of the server's memory, but,

[0087] It is characterized by making it subject to inspection when the swap usage rate is 50% or higher, and inspecting it as a critical risk target when it is 80% or higher.

[0089] In addition, the above diagnostic inspection unit is,

[0090] Check disk usage by checking the server's disk usage, but

[0091] It is characterized by making it a target for inspection when disk usage is 80% or more, and a target for critical risk when it is 95% or more.

[0093] In addition, the above diagnostic inspection unit is,

[0094] By checking the available virtual memory size of the server's disk, the Disk Swap usage rate is checked, and the check is characterized by checking for critical risk when the Swap Full is 90% or more.

[0096] In addition, the above diagnostic inspection unit is,

[0097] Check the server logs, but

[0098] The inspection of the above logs is performed by verifying the presence or absence of abnormalities in devices, instances, and services through various logs obtained from server operation, and

[0099] It is characterized by checking critical risk targets when Error, Fail, or Panic logs occur.

[0101] In addition, the above diagnostic inspection unit is,

[0102] Regarding the network of the above server, the network link status is checked by verifying whether the network connection status is normal, and is characterized by checking it as a critical risk target when the NIC Down occurs. Effects of the invention

[0104] According to the AI-based operation management system of the present invention, operational status data, performance data, event and log data are collected and stored in real time from network equipment, servers, and security equipment, and the collected data is analyzed based on artificial intelligence to provide equipment status monitoring, detection of abnormal signs, diagnosis of failures, cause analysis, and recommended measures.

[0105] Furthermore, the present invention performs scheduled and immediate inspections based on inspection items and thresholds for each equipment type, and enables verification of the occurrence of new anomalies, status changes, completed actions, and the status of action progress by comparing and analyzing inspection results with previous results. In addition, it automatically generates inspection reports reflecting analysis results and action status, thereby providing integrated support for the inspection, diagnosis, and reporting tasks of information systems.

[0106] Furthermore, the present invention goes beyond simple equipment status monitoring to analyze collected operational data, determine the status and abnormal signs of the equipment, diagnose the causes and impacts of failures, and suggest appropriate recommended measures. Through this, it is possible to provide an AI-based diagnostic and operational management system that improves the stability, speed, and efficiency of information system operations. Brief explanation of the drawing

[0108] Figure 1 illustrates an example of data collection, storage, and diagnostic inspection of an AI-based operation management system according to the present invention. Figure 2 shows the process of diagnostic inspection of an AI-based operation management system according to the present invention. Figure 3 shows an example of status monitoring of network equipment in an AI-based operation management system according to the present invention. Figure 4 shows an example of server status monitoring in an AI-based operation management system according to the present invention. Figure 5 shows an example of status monitoring of security equipment in an AI-based operation management system according to the present invention. Figure 6 illustrates a checklist of an AI-based operation management system according to the present invention. FIGS. 7 and 8 illustrate an interface for setting thresholds on an inspection screen of an AI-based operation management system according to the present invention, where FIG. 7 shows an example of a server inspection item and threshold setting, and FIG. 8 shows an example of a network equipment inspection item and threshold setting. Figure 9 shows an example of a reservation setting for an inspection of an AI-based operation management system according to the present invention. Specific details for implementing the invention

[0109] Terms and words used in this specification and claims should not be interpreted as being limited to their ordinary or dictionary meanings, but should be interpreted in a meaning and concept consistent with the technical spirit of the invention, based on the principle that the inventor can appropriately define the concept of the terms to best describe his invention.

[0111] Therefore, the embodiments described in this specification and the configurations illustrated in the drawings are merely the most preferred embodiments of the present invention and do not represent all of the technical ideas of the present invention; thus, it should be understood that various equivalents and modifications that can replace them may exist at the time of filing this application.

[0113] Before proceeding with the following description with reference to the drawings, it should be noted that matters not necessary to reveal the gist of the invention, namely known configurations that a person skilled in the art with ordinary knowledge can obviously add, have not been illustrated or specifically described.

[0115] The present invention relates to an AI-based operation management system.

[0116] Specifically, the invention relates to a system that collects and stores operational status data, performance data, event and log data in real time from network equipment, servers, and security equipment, and analyzes the collected data based on artificial intelligence to provide equipment status monitoring, anomaly detection, fault diagnosis, cause analysis, and recommended measures.

[0117] Furthermore, it performs scheduled and immediate inspections based on inspection items and thresholds for each equipment type, and enables the verification of new anomalies, status changes, completed actions, and the status of action progress by comparing and analyzing inspection results with previous ones. In addition, it automatically generates inspection reports reflecting analysis results and action status, providing integrated support for the inspection, diagnosis, and reporting tasks of the information system.

[0118] The present invention goes beyond simple equipment status monitoring to analyze collected operational data, determine the status and abnormal signs of equipment, diagnose the causes and impacts of failures, and suggest appropriate recommended measures. It is characterized by providing an AI-based diagnostic and operational management system that improves the stability, speed, and efficiency of information system operations through this process.

[0120] The AI-based operation management system according to the present invention includes an AI-based intelligent integrated operation platform.

[0121] Such an AI-based intelligent integrated operation platform refers to a platform that collects and analyzes operational data from networks, servers, and security equipment in real time to support AI-based status monitoring, anomaly detection, fault prediction, diagnosis, and the generation of inspection reports; such a platform can be constructed using virtual or physical means, such as separate hardware or software within the system, or servers.

[0123] This AI-based intelligent integrated operation platform includes: a data collection unit that collects data from existing operational target equipment (network equipment, servers, security equipment); a data storage unit that stores the collected data; and a diagnostic inspection unit that performs diagnostic inspections based on the data stored in the data storage unit.

[0124] Before proceeding with the explanation, when performing an inspection through the above-mentioned diagnostic inspection unit, an integrated equipment management screen is provided through an interface included in the diagnostic inspection unit to register and manage asset information of the equipment under inspection and to link with automatic inspection, AI analysis, and status management functions.

[0125] Refer to Figure 6 of the attached drawings for this.

[0126] Figure 6 illustrates a checklist of an AI-based operation management system according to the present invention.

[0127] That is, according to Figure 6 of the attached drawings, INNO Sys AI provides a function for managing inspection target equipment, which includes registering, viewing, and managing information on assets subject to inspection, such as servers, networks, and security equipment. At this time, the operator can manage information such as equipment name, equipment type, manufacturer, IP address, and operating status in an integrated manner, and performs functions such as automatic inspection, AI analysis, status monitoring, and report generation based on the registered equipment.

[0128] In this case, the above-mentioned INNO Sys AI refers to the operating platform described in the present invention, which is a brand reflecting part of the applicant's name. Therefore, there will be no confusion in understanding the present invention.

[0130] In addition, each piece of equipment is checked by determining whether a threshold is exceeded, and the threshold can be set by the user. An example of such a threshold setting screen can be referenced in Fig. 7 of the attached drawings.

[0131] FIGS. 7 and 8 illustrate an interface for setting thresholds on an inspection screen of an AI-based operation management system according to the present invention, where FIG. 7 shows an example of a server inspection item and threshold setting, and FIG. 8 shows an example of a network equipment inspection item and threshold setting.

[0133] According to Figures 7 and 8, the inspection policy and inspection item management functions of INNO Sys AI provide the ability to set inspection items and thresholds for each type of equipment, such as servers, networks, and security equipment. At this time, the operator (user) can set the collection method, warning threshold, risk threshold, and usage status for each inspection item, such as CPU, Memory, Disk, and Network, and the set policy is automatically applied when performing scheduled inspections and immediate inspections.

[0135] For the collection, storage, and diagnostic check of such data, refer to Fig. 1 of the attached drawings.

[0136] Figure 1 illustrates an example of data collection, storage, and diagnostic inspection of an AI-based operation management system according to the present invention.

[0138] In collecting data through the above-mentioned data collection unit, the network equipment adopts SNMP, Trap, and Syslog collection methods, and collects CPU, Memory, Interface, Traffic, and status information using the SNMP collection method.

[0139] In addition, real-time failure events are collected using the Trap collection method on network equipment, while operational logs and events are collected using the Syslog collection method.

[0141] In addition, the data collection unit collects system metrics and logs from the server through the Telegraf collection method.

[0142] In addition, the above data collection unit collects status and performance information from security equipment through the SNMP collection method.

[0144] Furthermore, storing data through the above-mentioned data storage unit enables long-term storage of performance data and real-time data processing through Time Series DB-based storage, and allows for support for time series analysis and provision based on AI training data.

[0145] This data storage unit serves as a metadata storage and enables the management of information regarding the above equipment, as well as settings and configuration information of collected data; policy information; and history management.

[0147] In addition, the items inspected through the aforementioned diagnostic inspection unit are based on the Ministry of the Interior and Safety’s Government-wide Information System Preventive Inspection Manual, and are as follows for network equipment, security equipment, and servers.

[0149] First, the inspection of network equipment is summarized in [Table 1] below.

[0150]

[0152] In other words, network equipment includes checking equipment resource utilization, hardware status, service status, and log status.

[0153] First, the resource utilization of the above equipment checks the CPU utilization, memory utilization, and network interface utilization based on data collected via the SNMP collection method.

[0154] The above CPU usage rate is used to check the CPU resource usage rate of network equipment such as routers and switches. At this time, the CPU usage rate is checked over a 5-minute average period, and if the usage rate is 70% or higher, it is checked as a risk target, and if the usage rate is 90% or higher, it is checked as a critical risk target.

[0156] In addition, the above memory usage rate is used to check the memory usage rate of network equipment such as routers and switches. At this time, if the memory usage rate is 70% or higher, it is inspected as a risk target, and if it is 90% or higher, it is inspected as a critical risk target.

[0158] In addition, the network interface usage rate mentioned above is used to check the usage status of network interfaces to identify network bottlenecks. This network interface usage rate checks the usage rate over a 5-minute average period, and if the interface usage rate is 70% or higher, it is identified as a risk target, and if it is 90% or higher, it is identified as a critical risk target.

[0160] In addition, hardware status checks the status of interfaces / modules and VLANs based on data collected using SNMP and Trap collection methods.

[0161] At this time, the interface / module status check involves verifying the down / up status of each interface / module and checking for an increase in CRC errors; if a CRC error occurs, it is checked as a risk target, and if an interface is confirmed to be in a down state—such as the interface stopping—it is checked as a critical risk target.

[0163] In addition, the service check performs a check to verify the status of each LB based on data collected by the SNMP collection method and the Trap collection method, and to verify the status of the Mac / Arp Table based on data collected by the SNMP collection method.

[0164] First, each LB status check involves checking the load balancing status and the real server Health-Check status. If a real server down is detected, it is checked as a critical risk target.

[0165] In addition, the above check of the Mac / Arp Table status is to verify whether the Mac / Arp Table is normal. If the table usage rate is 80% or higher, it is checked as a risk target, and if an overflow occurs, it is checked as a critical risk target.

[0167] In addition, service checks can examine the status of routing tables based on data collected via SNMP and Syslog methods; this involves verifying the normality of Static, OSPF, and BGP routing tables. During this process, routes are identified as high-risk targets if route flapping occurs, and as critical risk targets if a neighbor goes down.

[0169] In addition, service checks can verify the STP status based on data collected via SNMP, Trap, and Syslog collection methods; this STP status check prevents loop structures and verifies smooth communication through STP configuration.

[0170] At this time, if an excessive Topology Change occurs, it is checked as a risk target, and if a Loop occurs, it is checked as a critical risk target.

[0172] In addition, service checks can verify the redundancy configuration status based on data collected via SNMP and Trap collection methods. This redundancy configuration status check verifies the failover status, identifying it as a risk target in the event of an HA failover and identifying it as a critical risk target in the event of a standby down.

[0174] Meanwhile, the above service inspection naturally involves collecting ping data and verifying the communication status with specific equipment to confirm whether normal communication is possible.

[0175] However, regarding normal communication, check for a risk target with a Ping Loss of 1% or more, and check for a critical risk target with a Ping Loss of 5% or more.

[0177] Log inspection involves checking for the occurrence of error logs (Fail, Error, Warning, Stop, Down) related to hardware status based on data collected through Trap and Syslog collection methods.

[0178] This is checked as a critical risk target when Fail, Error, or Down logs occur.

[0180] Meanwhile, the inspection of security equipment through the diagnostic inspection unit of the present invention is illustrated in [Table 2].

[0181]

[0183] First, the inspection of the security equipment checks the CPU usage by verifying the CPU resource utilization of the security equipment process based on data collected via the SNMP collection method, and checks the memory usage by verifying the memory resource utilization of the security equipment process.

[0184] At this time, based on the 5-minute average value, CPU usage is checked as a risk target at a usage rate of 70% or higher, and as a critical risk target at a usage rate of 90% or higher.

[0185] In addition, based on the 5-minute average value, memory usage is checked as a risk target at a usage rate of 75% or higher, and as a critical risk target at a usage rate of 90% or higher.

[0187] In addition, based on data collected via SNMP, the connection status between the FLB and each component is checked to verify the connection between the devices. This check is performed to identify a risk condition if the Ping Loss is 1% or higher.

[0189] In addition, in the service area of ​​the security equipment, the traffic status can be checked by examining the total traffic and status flowing into and processed by the security equipment based on the collected data, and it is checked as a risk target when the interface usage rate is 70% or higher, and as a critical risk target when it is 90% or higher.

[0190] In addition, the session status is checked by verifying the total number of equipment sessions based on the collected data; it is identified as a risk target when the session volume exceeds 80% of the maximum session volume, and as a critical risk target when it exceeds 95% (5-minute average).

[0191] In addition, based on the collected data, the interface can be inspected by checking the error and drop rates of the user interface. This involves identifying it as a risk target when the error rate is 1% or higher, and identifying it as a risk target if the error rate persists and drops continue to occur.

[0192] In addition, based on the collected data, the status of each interface, Ping Loss, and CRC Error can be checked to inspect the status of the equipment's module. This allows for identifying it as a risk target when a CRC Error occurs, and as a critical risk target when Ping Loss is 5% or higher.

[0194] In addition, the inspection items for the server of the inspection and diagnosis department are exemplified in [Table 3].

[0195]

[0197] Server inspections are conducted by checking the server's CPU, memory, disk, kernel, logs, cluster, network, and OS (operating system) based on data collected via Telegraf and Syslog collection methods.

[0199] First, the CPU checks the CPU usage rate and the status of physical cores (Online / Offline). At this time, the CPU checks for a risk target if the usage rate is 70% or higher during a 5-minute average, and checks for a critical risk target if it is 90% or higher.

[0201] Memory is checked by verifying memory usage, and if the average over 5 minutes is 75% or higher, it is checked as a hazardous target, and if it is 90% or higher, it is checked as a critical hazardous target.

[0202] In addition, the memory status is checked by verifying whether the allocated memory is properly recognized, and this is checked as a critical risk in the event of an error.

[0203] In addition, memory is checked by verifying the available virtual memory usage rate (used when determining memory shortage if the value is high), and the Paging Space is checked if the Swap usage rate is 50% or higher, and if it is 80% or higher, it is checked as a critical risk target.

[0205] Next, the disk is checked for file system usage through a file system (disk) usage check. If the usage is 80% or higher, it is considered a target for inspection, and if it is 95% or higher, it is considered a critical risk target.

[0206] In addition, the Disk Swap usage rate can be checked by verifying the available virtual memory size (using the hard disk as memory to increase the capacity of insufficient memory, and checking the size of virtual memory used and available), and if it is 90% or more of Swap Full, it is checked as a critical risk.

[0207] In addition, the disks are checked for the normality of disk redundancy through a check on the RAID configuration and State status (Ok / Maintenance), and this check is performed as a critical risk in the event of RAID Degradation.

[0208] In addition, the disk performs a check on disk recognition status through a Disk Status: Unknown / Drive not available check, and this check is performed to treat it as a critical risk target in the event of normal errors such as Disk Unknown / Not Available.

[0209] In addition, the disk performs a Disk I / O check (checking for Soft Errors, Hard Errors, Transport Errors, and Iowait delays), and checks for a risk condition if the I / O Wait is 20% or more, and a critical risk condition if a Disk Error occurs.

[0210] In addition, the disk can check the I-Node usage rate, and check it as a risk target when the I-Node usage rate is 80% or higher, and check it as a critical risk target when it is 95% or higher.

[0212] In addition, the server kernel can perform kernel parameter checks to verify whether default settings for kernel parameters are applied, a check designed to prevent service and OS failures. Such checks are triggered to identify risk targets if there is a discrepancy with the reference values.

[0214] In addition, server logs are inspected to check for device, instance, and service anomalies through various logs, including system, kernel, memory, and I / O errors. This ensures that the occurrence of Error, Fail, or Panic logs is treated as a critical risk factor for inspection.

[0216] In addition, the server cluster is configured to check the cluster daemon status through a check for cluster normality (cluster daemon maintenance / offline check), and to identify it as a critical risk target in the event of an offline or maintenance occurrence.

[0217] In addition, the cluster checks the status of the shared volume by verifying the Read / Write status and the mount status (File System State On, HSM Server Not Responding), and checks for critical risks in the event of a mount failure or HSM not responding.

[0219] The network of the above server checks the network link status by checking whether the network connection status is normal (checking STATE Up, Down, and Unknown status for each NIC), and checks it as a critical risk target in the event of a NIC Down.

[0220] In addition, the server network performs NIC redundancy checks through NIC redundancy (IPMP) and Daemon status checks (STATE Down / Up, ACTIVE No / Yes, GROUPNAME status), and checks for critical risks when there is no Active NIC.

[0221] In addition, the server network performs a Ping Loss check through a Network communication status check (Ping test with the Default Router), which checks for a risk target if the Ping Loss is 1% or higher, and checks for a critical risk target if it is 5% or higher.

[0223] In addition, the OS of the above server performs a Path redundancy check by verifying the normality of Multipath redundancy (confirming the CONNECTED status), and checks for critical risks in the event of a Path Disconnected occurrence.

[0224] In addition, the above OS performs an HBA connection status check by verifying the normality of the HBA connection (State Online, Current Speed), and checks it as a critical risk target if HBA goes offline.

[0226] In addition, the AI-based intelligent integrated operation platform according to the present invention further includes an AI linkage unit for performing AI-based functions.

[0227] This AI integration unit includes a monitoring module that enables real-time monitoring by linking with the aforementioned inspection and diagnosis unit to check the equipment status in real time, track changes in equipment performance, monitor the status of failures, and provide these results to an integrated dashboard. This monitoring module can function by learning to check the equipment status and make judgments regarding performance changes through integration with an AI model.

[0228] That is, the AI ​​integration unit can analyze important events based on the information diagnosed by the inspection and diagnosis unit through the monitoring module and notify signs of failure in real time on the dashboard (status board), and furthermore, by providing a specific alarm or alarm unit to perform notification regarding abnormal pattern detection, it is possible to enable prediction-based advance notification.

[0230] To elaborate on this dashboard, it refers to an integrated operational management screen that visualizes AI analysis results and equipment status information based on collected operational data in a topology format, and provides real-time status management and anomaly detection.

[0231] This screen serves as an integrated dashboard for INNO Sys AI's real-time status management and operational status, collecting operational data from servers, networks, security equipment, and more to visually provide the overall system status.

[0232] In particular, it displays the connection relationships between equipment in the form of a topology map and provides real-time status, performance information, failure status, and risk levels for each piece of equipment based on AI analysis results.

[0233] Operators can monitor the operational status of the entire infrastructure on a single screen and, in the event of anomalies, immediately check detailed information about the relevant equipment and AI analysis results to enable a rapid response.

[0234] At this time, for an example of the dashboard, refer to Figures 3 to 5 of the attached drawings.

[0235] FIG. 3 shows an example of status monitoring of network equipment in an AI-based operation management system according to the present invention, FIG. 4 shows an example of status monitoring of a server in an AI-based operation management system according to the present invention, and FIG. 5 shows an example of status monitoring of security equipment in an AI-based operation management system according to the present invention.

[0237] In addition, the AI ​​integration unit further includes an anomaly detection module that is integrated with the monitoring module to detect anomalies based on normal patterns and to detect or detect threshold exceedances in advance. This anomaly detection module may be integrated with an AI model to predict the likelihood of failure through learning based on deep learning. Such prediction may be possible by detecting threshold exceedances in advance through the anomaly detection module. As such learning history accumulates, the anomaly detection module may be able to perform early (preliminary) analysis regarding performance degradation.

[0239] In addition, the AI ​​integration unit may further include a guide module that suggests a method of action based on information diagnosed by the inspection and diagnosis unit through an AI model.

[0240] These guide modules provide failure response guides for each piece of equipment, which can be achieved through AI learning. Accordingly, it is possible to recommend corrective measures based on expected causes, support operator decision-making, and further facilitate automated support for recurring failures.

[0242] The process of diagnostic inspection through this AI integration unit is explained through Figure 2 of the attached drawing.

[0243] Figure 2 shows the process of diagnostic inspection of an AI-based operation management system according to the present invention.

[0244] According to Figure 2 of the attached drawings, AI-based anomaly detection is performed through real-time monitoring, and the AI ​​provides guidance on measures ranging from prior prediction.

[0245] In addition, it performs notifications by analyzing the history of abnormalities resulting from exceeding the equipment's threshold.

[0247] Meanwhile, the above-described AI-based intelligent integrated operation platform is linked to the inspection and diagnosis unit by including a reservation interface that enables a user to make a reservation for an inspection when performing an inspection through the inspection and diagnosis unit described above.

[0248] Refer to Figure 9 of the attached drawings for the interface that appears on the screen during such reservation checks.

[0249] FIG. 9 shows an example of a reservation setting for an inspection of an AI-based operation management system according to the present invention. FIG. 9 shows a schedule-based inspection management screen that sets the inspection cycle and execution time for each equipment type, performs automatic inspections according to a reserved schedule, and saves and analyzes the results.

[0250] According to Figure 9 of the attached drawings, the scheduled inspection management function of INNO Sys AI supports automatically performing inspections by registering inspection schedules for servers, networks, security equipment, etc. in advance.

[0251] Operators can set inspection cycles and execution times for each equipment type on a daily, weekly, or monthly basis, and the system automatically performs inspections according to the set schedule and saves and analyzes the results.

[0253] Figure 10 illustrates an interface for immediate inspection.

[0254] FIG. 10 illustrates an example of an immediate inspection during an inspection of an AI-based operation management system according to the present invention. FIG. 10 shows an immediate inspection screen in which an operator selects equipment to be inspected and inspection items to perform a real-time inspection, and performs status analysis and AI diagnosis based on collected data.

[0255] In Figure 10 of the attached drawings, the immediate inspection function of INNO Sys AI supports an operator in performing a real-time inspection by selecting a specific piece of equipment or type of equipment.

[0256] Accordingly, the present invention can perform an immediate inspection when necessary, separate from scheduled inspections, and analyzes the status based on set inspection items and thresholds and provides results.

[0258] Accordingly, the present invention allows for the selective performance of scheduled inspections and immediate inspections, wherein the configured inspection is performed automatically to determine whether a threshold is exceeded. Furthermore, the analyzed results are displayed and made known through a dashboard, and the analyzed results may also be provided in the form of a report.

[0259] For these examples, refer to [Table 4].

[0260]

[0262] In particular, regarding the generation of the report, the report may include an inspection result report; fault diagnosis information, operational analysis information, statistical information by equipment, and AI analysis result information. Refer to [Table 5] for this.

[0263]

[0265] Meanwhile, the inspection result screen displayed upon completion of the inspection as described above is exemplified in Fig. 11 of the attached drawings.

[0266] FIG. 11 shows an example of a result screen following an inspection of an AI-based operation management system according to the present invention. Specifically, FIG. 11 shows an inspection result management screen that integrates and manages the results of automatic and immediate inspections, and allows for status analysis and inspection history viewing for each piece of equipment.

[0267] According to Figure 11 of the attached drawings, the inspection result inquiry function of INNO Sys AI supports integrated inquiry of scheduled inspection and immediate inspection results and analysis of equipment status.

[0268] Therefore, it visually provides the status of normal, warning, and danger results regarding the inspection, and allows for continuous management of the operational status by checking the inspection history and detailed results for each piece of equipment.

[0270] On the other hand, a report management screen that automatically generates a standardized report based on inspection results and AI analysis results according to the generation of the report described above, and provides a generation history and download function, can be referenced in Fig. 12 of the attached drawings.

[0271] Figure 12 shows an example of a report management screen of an AI-based operation management system according to the present invention.

[0272] According to Figure 12 of the attached drawings, the report management function of INNO Sys AI supports viewing, downloading, and managing reports generated based on inspection and diagnostic results. That is, it generates standardized reports by reflecting automatic inspection and AI analysis results, and allows for integrated management of the generation history and status.

[0274] Furthermore, the generated report may be displayed as shown in Fig. 13 of the attached drawings, and may include a diagnostic report by an AI model. As shown in Fig. 13 of the attached drawings, the AI ​​comprehensively analyzes inspection results, performance data, and event logs to display an intelligent analysis report screen that provides abnormal signs, risk levels, cause analysis, and priority actions.

[0275] FIG. 13 shows an example of a report of an AI-based operation management system according to the present invention.

[0276] That is, Figure 13 of the attached drawings is the AI ​​analysis report function of INNO Sys AI, which provides a comprehensive analysis of abnormal signs, risk levels, major events, and recommended actions by AI based on inspection results and operational data.

[0277] In other words, going beyond simply providing status information, AI supports operators' decision-making by analyzing failure potential, abnormal patterns, major causes, and priority actions.

[0279] According to the AI-based operation management system of the present invention configured as described above, operational status data, performance data, event and log data are collected and stored in real time from network equipment, servers, and security equipment, and the collected data is analyzed based on artificial intelligence to provide equipment status monitoring, detection of abnormal signs, diagnosis of failures, cause analysis, and recommended measures.

[0280] Furthermore, the present invention performs scheduled and immediate inspections based on inspection items and thresholds for each equipment type, and enables verification of the occurrence of new anomalies, status changes, completed actions, and the status of action progress by comparing and analyzing inspection results with previous results. In addition, it automatically generates inspection reports reflecting analysis results and action status, thereby providing integrated support for the inspection, diagnosis, and reporting tasks of information systems.

[0281] Furthermore, the present invention goes beyond simple equipment status monitoring to analyze collected operational data, determine the status and abnormal signs of the equipment, diagnose the causes and impacts of failures, and suggest appropriate recommended measures. Through this, it is possible to provide an AI-based diagnostic and operational management system that improves the stability, speed, and efficiency of information system operations.

[0283] The description above using the drawings describes only the main aspects of the present invention, and it is obvious that the present invention is not limited to the configuration of the drawings, as various designs are possible within the technical scope.

Claims

Claim 1 An AI-based operation management system comprising an AI-based intelligent integrated operation platform; wherein the AI-based intelligent integrated operation platform comprises: a data collection unit that collects data from equipment including network equipment, servers, and security equipment; a data storage unit that stores the collected data; and a diagnostic inspection unit that performs diagnostic inspections based on the data stored in the data storage unit. The data collection unit collects data from network equipment using SNMP, Trap, and Syslog methods, wherein the data collection unit collects CPU, Memory, Interface, Traffic, and status information of the network equipment using the SNMP method, collects real-time failure events of the network equipment using the Trap method, and collects operation logs and events of the network equipment using the Syslog method. The diagnostic inspection unit checks the resource utilization of the network equipment by checking CPU usage, memory usage, and network interface usage based on the data collected using the SNMP collection method. The CPU usage check is performed by identifying it as a risk target when it shows a usage rate of 70% or more, and identifying it as a critical risk target when it shows a usage rate of 90% or more. The memory usage check is performed by identifying it as a risk target when it shows a usage rate of 70% or more. An AI-based operation management system characterized by inspecting and inspecting as a critical risk target when a usage rate of 90% or more is observed, wherein the inspection of the network interface usage rate is characterized by inspecting as a risk target when a usage rate of 70% or more is observed and inspecting as a critical risk target when a usage rate of 90% or more is observed. Claim 2 The AI-based operation management system according to claim 1, wherein the data collection unit collects system metrics and logs of a server from a server via a telegraf method. Claim 3 The AI-based operation management system according to claim 1, wherein the data collection unit collects status information and performance information of security equipment from security equipment through an SNMP method. Claim 4 The AI-based operation management system according to claim 1, wherein the diagnostic inspection unit checks the interface / module status and VLAN status based on data collected by SNMP collection method and Trap collection method, and wherein the check of the interface / module status is characterized by checking each interface / module Down / Up status and verifying whether CRC error increases, checking as a risk target when a CRC error occurs, and checking as a critical risk target when Interface Down is confirmed. Claim 5 The AI-based operation management system according to claim 1, wherein the diagnostic inspection unit checks for the occurrence of error logs related to the hardware status based on data collected by the Trap collection method and the Syslog collection method, and checks the logs, and checks them as critical risk targets when Fail, Error, or Down logs occur. Claim 6 The AI-based operation management system according to claim 3, wherein the diagnostic inspection unit checks the CPU usage rate by verifying the CPU resource usage rate used by the security equipment process based on data collected by an SNMP collection method, and checks the memory usage rate by verifying the memory resource usage rate used by the security equipment process, wherein the CPU usage rate is checked as a risk target at a usage rate of 70% or more and is checked as a critical risk target at a usage rate of 90% or more, and the memory usage rate is checked as a risk target at a usage rate of 75% or more and is checked as a critical risk target at a usage rate of 90% or more. Claim 7 The AI-based operation management system according to claim 3, wherein the diagnostic inspection unit checks the connection status between FLB and each component based on data collected by the SNMP collection method, and checks the connection between equipment, and checks it as a risk target when the Ping Loss is 1% or more. Claim 8 The AI-based operation management system according to claim 3, wherein the diagnostic inspection unit inspects the total traffic and status flowing into and processed by the security equipment based on collected data to inspect the traffic status, and inspects it as a risk target when the interface usage rate is 70% or higher, and inspects it as a critical risk target when it is 90% or higher. Claim 9 The AI-based operation management system according to claim 3, wherein the diagnostic inspection unit checks the session status by verifying the total session volume of equipment based on collected data, characterized in that it checks for a risk target at 80% or more of the maximum session and checks for a critical risk target at 95% or more. Claim 10 The AI-based operation management system according to claim 2, wherein the diagnostic inspection unit performs a CPU usage rate inspection of a server, and inspects it as a risk target if the CPU usage rate is 70% or higher, and inspects it as a critical risk target if the CPU usage rate is 90% or higher. Claim 11 The AI-based operation management system according to claim 2, wherein the diagnostic inspection unit performs a memory usage rate inspection of a server, checks the memory usage rate by verifying the memory usage rate, inspects it as a risk target if the memory usage rate is 75% or higher, and inspects it as a critical risk target if the memory usage rate is 90% or higher. Claim 12 An AI-based operation management system according to claim 2, wherein the diagnostic inspection unit checks the Paging Space by verifying the available virtual memory usage rate of the server's memory, and designates it as a target for inspection when the Swap usage rate is 50% or higher, and designates it as a critical risk target when it is 80% or higher. Claim 13 The AI-based operation management system according to claim 2, wherein the diagnostic inspection unit checks disk usage by checking the disk usage of the server, and is characterized by classifying the disk usage as a target for inspection when it is 80% or more and classifying it as a critical risk target when it is 95% or more. Claim 14 An AI-based operation management system according to claim 2, wherein the diagnostic inspection unit checks the Disk Swap usage rate by verifying the available virtual memory size of the server's disk, and the inspection checks the case as a critical risk target when the Swap Full is 90% or more. Claim 15 The AI-based operation management system according to claim 2, wherein the diagnostic inspection unit inspects the server logs, and the inspection of the logs is performed by verifying the presence or absence of abnormalities in devices, instances, and services through various logs obtained from the operation of the server, and inspects them as critical risk targets when Error, Fail, or Panic logs occur. Claim 16 The AI-based operation management system according to claim 2, wherein the diagnostic inspection unit checks the network link status of the server network by checking whether the network connection status is normal, and checks it as a critical risk target when a NIC Down occurs. Claim 17 delete Claim 18 delete

Images