Operation monitoring method and device of energy internet marketing service system

Abstract

The invention discloses an operation monitoring method and device of an energy internet marketing service system, and relates to the technical field of internet. According to the main technical scheme, the method comprises the steps of obtaining target index data according to a preset frequency, wherein the target index data is used for representing index data related to system operation and business application in an energy internet marketing service system; whether each index in the target index data is an abnormal index deviating from a respective corresponding dynamic baseline is judged, the dynamic baseline is a normal index range obtained after historical data corresponding to each index in the target index data is subjected to periodic clustering analysis, and the normal index range is periodically and dynamically changed; if yes, generating alarm information corresponding to the abnormal index; and determining a specified abnormal case matched with the alarm information in the knowledge graph database, and executing operation and maintenance measures in the specified abnormal case. The main purpose of the invention is to improve the accuracy and efficiency of monitoring the operation of an energy internet marketing service system.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to an operation monitoring method and device for an energy Internet marketing service system. Background Art

[0002] With the rapid development of energy internet, the role of marketing service system in the power industry is becoming increasingly significant. It not only supports the efficient operation of the energy market, but also provides customers with personalized and intelligent service experience. However, as a complex IT architecture, the marketing service system faces many challenges, including but not limited to system performance bottlenecks, data security threats, business continuity assurance, and the ability to respond quickly to emergencies. Especially in the energy internet environment, the system needs to process massive amounts of data, support high-concurrency business requests, and ensure data security and service stability, which puts higher requirements on the system's operation monitoring.

[0003] At present, traditional operation monitoring methods often rely on static threshold alarms and wait for operation and maintenance personnel to manually perform system maintenance. However, in the face of the ever-changing operating environment of the energy Internet marketing service system due to diverse business application scenarios, the use of static thresholds often cannot accurately reflect the actual operation of the system, which is not only prone to false alarms or missed alarms, but also increases the difficulty of operation and maintenance by manual operation and maintenance personnel, thereby affecting the accuracy and efficiency of the operation monitoring of the energy Internet marketing service system. Summary of the invention

[0004] In view of the above problems, the present application provides an operation monitoring method and device for an energy Internet marketing service system, the main purpose of which is to improve the accuracy and efficiency of operation monitoring of the energy Internet marketing service system.

[0005] In order to solve the above technical problems, this application proposes the following solutions:

[0006] In a first aspect, the present application provides an operation monitoring method of an energy internet marketing service system, the method comprising:

[0007] Acquire target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system;

[0008] Determine whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline, where the dynamic baseline is a normal indicator range obtained after cluster analysis of historical data corresponding to each indicator in the target indicator data;

[0009] If yes, generate warning information corresponding to the abnormal indicator;

[0010] Determine in the knowledge graph library a specified abnormal case that matches the alarm information, and execute the operation and maintenance measures in the specified abnormal case.

[0011] In a second aspect, the present application provides an operation monitoring device for an energy internet marketing service system, the device comprising:

[0012] A first acquisition unit, configured to acquire target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system;

[0013] A judgment unit, used to judge whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline, where the dynamic baseline is a normal indicator range obtained after cluster analysis of historical data corresponding to each indicator in the target indicator data;

[0014] A generating unit, configured to generate warning information corresponding to the abnormal indicator if yes;

[0015] A processing unit is used to determine a specified abnormal case matching the alarm information in the knowledge graph library and execute operation and maintenance measures in the specified abnormal case.

[0016] In order to achieve the above-mentioned purpose, according to the third aspect of the present application, a storage medium is provided, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the operation monitoring method of the energy Internet marketing service system of the above-mentioned first aspect.

[0017] In order to achieve the above-mentioned purpose, according to the fourth aspect of the present application, a processor is provided, which is used to run a program, wherein when the program is running, the operation monitoring method of the energy Internet marketing service system of the above-mentioned first aspect is executed.

[0018] By means of the above technical scheme, the present application provides an operation monitoring method and device for an energy Internet marketing service system. When it is necessary to monitor the operation of the energy Internet marketing service system, target indicator data is obtained according to a preset frequency. The target indicator data is used to characterize the indicator data related to system operation and business applications in the energy Internet marketing service system, and it is judged whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline. The dynamic baseline is the normal indicator range obtained after periodic clustering analysis of the historical data corresponding to each indicator in the target indicator data, that is, the normal indicator range changes periodically and dynamically. If so, an alarm information corresponding to the abnormal indicator is generated, and a specified abnormal case matching the alarm information is determined in the knowledge graph library, and the operation and maintenance measures in the specified abnormal case are executed. Through the technical solution provided by the present application, the dynamic baseline obtained by periodic cluster analysis can more accurately reflect the normal indicator range of the system under different operating environments. After obtaining the indicator data related to the system operation and business applications, each indicator is compared with its own dynamic baseline, which effectively improves the accuracy of abnormal indicator detection. When the system detects an abnormal indicator, it can not only generate an alarm message to prompt relevant personnel, but also automatically search for matching abnormal cases from the knowledge graph library and take corresponding operation and maintenance measures, which greatly reduces the difficulty of operation and maintenance, shortens the operation and maintenance time, and improves the self-repair ability of the system, thereby improving the accuracy and efficiency of the operation monitoring of the energy Internet marketing service system.

[0019] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0021] Figure 1 A flow chart of an operation monitoring method of an energy Internet marketing service system provided by an embodiment of the present application is shown;

[0022] Figure 2 A flow chart of another operation monitoring method of an energy Internet marketing service system provided in an embodiment of the present application is shown;

[0023] Figure 3A block diagram showing the composition of an operation monitoring device of an energy Internet marketing service system provided by an embodiment of the present application is shown;

[0024] Figure 4 A block diagram showing the composition of another operation monitoring device of an energy Internet marketing service system provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0025] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0026] At present, traditional operation monitoring methods often rely on static threshold alarms and wait for operation and maintenance personnel to manually perform system maintenance. However, in the face of the ever-changing operating environment of the energy Internet marketing service system due to diverse business application scenarios, the use of static thresholds often cannot accurately reflect the actual operation of the system, which is not only prone to false alarms or missed alarms, but also increases the difficulty of operation and maintenance by manual operation and maintenance personnel, thereby affecting the accuracy and efficiency of the operation monitoring of the energy Internet marketing service system.

[0027] Based on the above problems, Figure 1 As shown, the embodiment of the present application provides an operation monitoring method of an energy internet marketing service system, by which the accuracy and efficiency of the operation monitoring of the energy internet marketing service system can be improved, and the specific execution steps include at least 101-104:

[0028] 101. Obtain target indicator data according to the preset frequency.

[0029] Among them, the target indicator data is used to characterize the indicator data related to system operation and business applications in the energy Internet marketing service system.

[0030] It should be noted that in this embodiment, the energy Internet marketing service system is a comprehensive system that integrates a variety of advanced technologies and services. The system includes the following core components: customer service business platform, marketing business service, customer Internet of Things application center, front-end application, capability aggregation platform, operation management platform, operation and maintenance monitoring platform, business connection platform and service connection platform, etc. It is used to enhance the marketing and service capabilities of energy enterprises.

[0031] In this step, the preset frequency can be set according to the business needs of the system and the system load, such as once every minute, every 5 minutes or every hour, to ensure the timeliness of the target indicator data while avoiding excessive pressure on the system. The energy Internet marketing service system is a complex technical architecture that contains a variety of different components, each of which is responsible for specific functions and services. Therefore, key performance indicators (KPIs) can be collected from various components of the energy Internet marketing service system. Specifically, it consists of two parts: one is the system operation indicator data that focuses on the health status and performance of the system itself, and the other is the business application indicator data that focuses on measuring the efficiency, effectiveness and customer satisfaction of business processes. System operation indicator data include but are not limited to system availability, response time, throughput, resource utilization (CPU, memory, disk and network bandwidth usage), etc., while business application indicator data include but are not limited to customer activity, transaction success rate, customer service response time, customer satisfaction score, marketing campaign effect, etc. These data can be obtained through system logs, API interfaces, monitoring tools or other data collection methods.

[0032] In addition, in order to visually observe the status of system operation and business applications, corresponding graphical pages can be set for target indicator data to display each indicator data.

[0033] 102. Determine whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline.

[0034] The dynamic baseline is the normal indicator range obtained after periodic cluster analysis of the historical data corresponding to each indicator in the target indicator data, and the normal indicator range changes dynamically.

[0035] In this step, since each indicator in the target indicator data is determined, the historical data of each indicator can be obtained accordingly, and specifically, the historical data of the most recent period can be used as a preset period, such as the past month or week. According to the data characteristics and indicator type, a suitable clustering algorithm is selected, including but not limited to K-means, DBSCAN or hierarchical clustering, etc., by clustering the historical data, clusters of different usage patterns are identified, wherein each cluster represents a typical behavior pattern of the indicator in a specific time period, and the behavior characteristics of the indicator under normal conditions are identified according to the center point or representative value of each cluster, and the normal indicator range of each indicator, i.e., the dynamic baseline, is determined according to the behavior characteristics of each indicator. By periodically performing the above clustering analysis, the normal indicator range obtained by each indicator each time can be dynamically changed, and the dynamic baseline can change over time, so that the dynamic baseline can more accurately reflect the normal indicator range of the system under different operating environments.

[0036] Each indicator in the target indicator data is compared with its corresponding dynamic baseline. If it deviates from the dynamic baseline, it means that the indicator is not within the corresponding normal indicator range, which means that the indicator may be abnormal. Therefore, the indicator is defined as an abnormal indicator. If there is no abnormal indicator, wait for new target indicator data collected at a preset frequency. If there is an abnormal indicator, execute step 103.

[0037] 103. Generate warning information corresponding to the abnormal indicator.

[0038] In this step, when an abnormal indicator is detected, the system generates an alarm containing detailed information, and the alarm information includes at least the alarm source, alarm title, alarm level and alarm time. Among them, the alarm source refers to the specific system component or service that generates the abnormal indicator, the alarm title refers to a concise description of the abnormal situation, the alarm level refers to the level divided according to the severity of the abnormality, such as minor, important or urgent, and the alarm time refers to the specific time point when the abnormality occurs, that is, the time point when the indicator is collected. Specifically, one or more standardized alarm information templates can be set in advance to ensure that all alarm information contains the necessary information mentioned above. In order to enable the operation and maintenance team or relevant responsible persons to be aware of the system abnormalities in a timely manner, the alarm information can be sent to the operation and maintenance team or relevant responsible persons by email, text message, enterprise instant messaging software, etc. at the same time as the alarm information is generated.

[0039] 104. Determine the specified abnormal case that matches the alarm information in the knowledge graph library, and execute the operation and maintenance measures in the specified abnormal case.

[0040] In order to enable the system to respond and process automatically, past abnormal events or historical operation and maintenance records related to system operation and business applications in the energy Internet marketing service system can be obtained in advance, and corresponding abnormal cases can be extracted from them. The abnormal cases contain similar abnormal processing experience and solutions, and a corresponding knowledge graph library is built based on the abnormal cases. In addition, the abnormal cases can be supplemented by combining expert experience, technical documents and industry standards to make the coverage of abnormal cases in the knowledge graph library more comprehensive.

[0041] In this step, since the alarm information includes detailed information such as the alarm source, alarm title, alarm level and alarm time. Therefore, the alarm information can be parsed using natural language processing (NLP) technology, and the abnormal cases matching it can be retrieved from the knowledge graph library. Specifically, the matching degree between the alarm information and each abnormal case can be calculated. The matching degree can be determined by calculating the text similarity. On this basis, the matching degree can also be corrected in combination with the latest score of each abnormal case, the success rate of resolution, etc., and this embodiment is not limited to this. After determining the abnormal case that matches the alarm information, it can be used as a designated abnormal case. Since the designated abnormal case also contains a corresponding solution, the solution can be used as an operation and maintenance measure at this time, and the operation and maintenance measure can be automatically or semi-automatically executed. The operation and maintenance measure includes but is not limited to restarting the service, adjusting the configuration parameters, expanding the resources, running the diagnostic script, etc., to restore the normal operation of the system or the normal application of the business as soon as possible. If the corresponding specified abnormal case is not matched in the knowledge graph library, an operation and maintenance instruction corresponding to the alarm information is generated. The operation and maintenance instruction can send the alarm information to the operation and maintenance personnel for manual analysis, and can also search for relevant documents and technical information to find possible solutions.

[0042] Based on the above Figure 1 It can be seen from the implementation method that the operation monitoring method of an energy Internet marketing service system provided by the present application is to obtain target indicator data according to a preset frequency when it is necessary to perform operation monitoring on the energy Internet marketing service system. The target indicator data is used to characterize the indicator data related to system operation and business applications in the energy Internet marketing service system, and to judge whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline. The dynamic baseline is the normal indicator range obtained after clustering analysis of the historical data corresponding to each indicator in the target indicator data. If so, an alarm information corresponding to the abnormal indicator is generated, and a specified abnormal case matching the alarm information is determined in the knowledge graph library, and the operation and maintenance measures in the specified abnormal case are executed. Through the technical solution provided by the present application, the dynamic baseline obtained through cluster analysis can more accurately reflect the normal indicator range of the system under different operating environments. After obtaining the indicator data related to the system operation and business applications, each indicator is compared with its own dynamic baseline, which effectively improves the accuracy of abnormal indicator detection. When the system detects an abnormal indicator, it can not only generate an alarm message to prompt relevant personnel, but also automatically search for matching abnormal cases from the knowledge graph library and take corresponding operation and maintenance measures, which greatly reduces the difficulty of operation and maintenance, shortens the operation and maintenance time, and improves the self-repair ability of the system, thereby improving the accuracy and efficiency of the operation monitoring of the energy Internet marketing service system.

[0043] like Figure 2 As shown, the preferred embodiment of the present application is in the above Figure 1Based on this, a detailed description of the operation monitoring process of the energy internet marketing service system is given, and its specific steps include 201-208:

[0044] 201. Obtain historical data corresponding to each indicator in the target indicator data according to a preset period.

[0045] In this step, the preset period can be set according to the characteristics of each indicator and business needs, and can be specifically set according to the data volatility and business periodicity of each indicator to ensure that the historical data corresponding to each indicator is representative, such as weekly or monthly.

[0046] Collect indicator data related to system operation and business applications from system logs or databases on a periodic basis, that is, collect historical data of each indicator in the system operation indicator data and business application indicator data. The system operation indicator data includes but is not limited to system availability, response time, throughput, resource utilization (CPU, memory, disk and network bandwidth usage), etc., while the business application indicator data includes but is not limited to customer activity, transaction success rate, customer service response time, customer satisfaction score, marketing activity effect, etc.

[0047] 202. Use clustering algorithms to determine the usage patterns of various indicators in different time periods from historical data, and identify the behavioral characteristics of each indicator under normal operating conditions based on the usage patterns.

[0048] In this step, the collected historical data is standardized or normalized to eliminate the dimension effect so that different indicators can be compared on the same scale. Select an appropriate clustering algorithm according to the data characteristics and indicator type, such as K-means, DBSCAN or hierarchical clustering. Cluster the historical data to identify clusters with different usage patterns. Each cluster represents the typical behavior pattern of the indicator in a specific time period. Analyze the center point or representative value of each cluster to identify the behavior characteristics of the indicator under normal operating conditions. The behavior characteristics are used to characterize the statistical characteristics and patterns exhibited by each indicator under normal operating conditions.

[0049] For example, suppose that after multiple rounds of iterations of CPU usage, we get three clusters, each cluster represents a usage pattern, namely: low usage pattern, medium usage pattern and high usage pattern. Analyze the center point of each cluster and get the following results:

[0050] Cluster 1: The CPU usage at the center is 0.111, which represents a low usage pattern, usually occurring late at night to early morning.

[0051] Cluster 2: The CPU usage at the center is 0.444, which represents a usage pattern that usually occurs during the daytime on weekdays.

[0052] Cluster 3: The CPU usage at the center is 0.778, representing a high usage pattern that typically occurs during peak hours on weekdays.

[0053] Based on the above results, the behavior characteristics of CPU usage under normal operating conditions are identified:

[0054] During the late night and early morning hours, CPU usage is usually low, around 10%;

[0055] During the daytime on weekdays, CPU usage will increase to around 40%;

[0056] During peak hours on a weekday, CPU usage can spike to around 70%.

[0057] 203. Determine the normal indicator range corresponding to each indicator in different time periods based on the behavioral characteristics, and use the normal indicator range as a dynamic baseline.

[0058] According to the behavior characteristics identified in step 202, the behavior characteristics are used to characterize the statistical characteristics and patterns exhibited by each indicator under normal operating conditions. Through the statistical characteristics and patterns, the usage patterns corresponding to different time periods and the approximate numerical performance of each indicator under the usage pattern can be obtained, and the normal indicator range of each indicator in different time periods can be determined through the numerical performance. Specifically, the boundaries of the normal indicator range can be defined by calculating the mean, standard deviation, or quartiles for each indicator, and the determined normal indicator range is used as a dynamic baseline for subsequent real-time monitoring and anomaly detection of each indicator.

[0059] Since the system may encounter short-term fluctuations in actual operation, and such fluctuations do not necessarily mean real abnormalities at certain times, they may be natural variations under normal operating conditions. Therefore, in order to avoid false alarms caused by subsequent alarms being too sensitive and to ensure the accuracy of abnormal indicator detection, the corresponding fault tolerance margin can also be set according to the tolerance of each indicator in the system operation and business application process. The fault tolerance margin is used to add an additional fault tolerance interval on the basis of the normal indicator range, and the safety margin is used to characterize the maximum deviation of each indicator that the system can accept. The fault tolerance margin is superimposed on the original normal indicator range, so that the dynamic baseline of each indicator has a certain tolerance capacity. For example, assuming that the normal indicator range of CPU usage calculated based on historical data is 40%-60%, the fault tolerance margin is increased or decreased by 5% on this basis, that is, the final normal indicator range is 35%-65%. In this way, even if the CPU usage exceeds 60% or falls below 40% for a short time, the system will not immediately trigger an alarm.

[0060] When each indicator is not within the corresponding normal indicator range, it means that it has deviated from its corresponding dynamic baseline. At this time, such an indicator can be regarded as an abnormal indicator.

[0061] It should be noted that, for steps 201-203, since the historical data is acquired according to a preset period, that is, the dynamic baseline is updated according to a preset period, the dynamic baseline can accurately reflect the changes in the system operating environment and business requirements, thereby making the detection of abnormal indicators more accurate.

[0062] 204. Obtain target indicator data according to a preset frequency.

[0063] This step is combined with the description of step 101 in the above method, and the same contents are not repeated here.

[0064] 205. Obtain the collection time corresponding to each indicator in the target indicator data.

[0065] In this step, the collection time is the precise timestamp when each indicator and the preset frequency collect data. Since the collection of target indicator data is automatically completed by the monitoring tool or data collection system, it will also record the corresponding timestamp when recording each indicator data. Therefore, the collection time can be directly obtained when each indicator data is collected.

[0066] 206. Match the target time period in different time periods according to the collection time.

[0067] It can be seen from the above steps 201-203 that the dynamic baseline of each indicator is obtained by clustering analysis based on different time periods. Therefore, in this step, the target time period specifically refers to the time period in which the collection time is located in the different time periods corresponding to the dynamic baseline. The collection time corresponding to each indicator is matched with the different time periods predefined by the dynamic baseline, that is, the collection time is compared with the start and end time of the different time periods to determine the target time period, which can be processed specifically using a date and time function or a time series analysis tool. Exemplarily, assuming that the collection time is 7:30 am, through comparison, the collection time falls into the time period corresponding to 7:00 to 9:00 am (daily morning rush hour), then 7:00 to 9:00 am is used as the target time period, and the dynamic baseline corresponding to 7:00 to 9:00 am is used for comparison.

[0068] 207. Compare each indicator in the target indicator data with the dynamic baseline corresponding to each indicator in the target time period, and regard the indicator deviating from the dynamic baseline as an abnormal indicator.

[0069] In this step, after the dynamic baselines corresponding to each indicator are determined, since they represent the normal indicator range of each indicator in the target time period, the deviation can be determined by threshold comparison, or the degree of deviation can be quantified by statistical methods such as standard deviation, Z-score or percentile. If each indicator exceeds the normal range defined by its own dynamic baseline, the indicator is marked as an abnormal indicator.

[0070] 208. Generate warning information corresponding to the abnormal indicator.

[0071] This step is combined with the description of step 103 in the above method, and the same content is not repeated here. It should be noted that since the alarm information at least includes the alarm source, alarm title, alarm level and alarm time. Therefore, in the case of known abnormal indicators, the process of determining the alarm source, alarm title, alarm level and alarm time usually involves the following steps:

[0072] Alarm source: refers to the specific system component or service that generates the abnormal indicator. You can identify the specific component where the abnormality occurred through the logs in the monitoring system, system status reports, or specific monitoring tools. For example, if the abnormal indicator points to an increase in database response time, the alarm source may be "Database Server DB1".

[0073] Alarm title: refers to a concise description of the abnormal situation. It can be named based on the characteristics of the abnormal indicator and the preset title templates corresponding to different abnormal situations, such as "abnormal increase in database response time" or "CPU utilization exceeds the threshold".

[0074] Alarm level: refers to the level divided according to the severity of abnormal indicators. Level setting is usually determined based on predefined rules, such as pre-defining the impact of each abnormal indicator on system operation or business application to set an association rule between the impact level and the alarm level. Exemplarily, the alarm levels are divided into minor, severe and urgent. When the impact level of a certain abnormal indicator is high, the corresponding alarm level can be severe or urgent.

[0075] Alarm time: The alarm time refers to the specific time point when the abnormal indicator is generated, that is, the time point when the indicator is collected. System monitoring tools usually automatically record the timestamp of the abnormality as part of the alarm information.

[0076] Regarding the description of the above alarm levels, since the alarm levels need to be determined by predefined rules, in order to ensure the rationality and accuracy of the alarm level determination. Before generating the alarm information corresponding to the abnormal indicator, the method also includes: calculating the system operation impact and / or business application impact corresponding to the abnormal indicator; determining the alarm level of the abnormal indicator in the preset impact level-level rule according to the system operation impact and / or business application impact; generating the alarm information corresponding to the abnormal indicator based on the alarm level.

[0077] In this step, the impact on system operation refers to the impact of abnormal indicators on system stability and performance. For example, an abnormal increase in CPU utilization may cause the system to respond more slowly, while insufficient disk space may cause system service interruptions. The impact on business applications refers to the impact of abnormal indicators on the efficiency, effectiveness and customer satisfaction of business processes. For example, increased latency in payment interfaces may affect transaction success rates, leading to decreased customer satisfaction.

[0078] Specifically, a set of evaluation frameworks can be established in advance to define which indicators are associated with which types of system or business impacts. A quantitative scoring system, such as 1-10, is set for each impact type. Specifically, a weight can be assigned to each impact type based on the contribution of different system or business components to the overall health status, and the final quantitative impact score can be obtained through weight calculation. The impact level-level rule is specifically a mapping table of the impact level quantitative score and the alarm level. For example, the alarm level corresponding to 1-4 points is minor, the alarm level corresponding to 5-7 is severe, and the alarm level corresponding to 8-10 is urgent. It should be noted that as time goes by and the business environment changes, the impact level-level rule needs to be reviewed and updated regularly.

[0079] For example, assuming that the CPU utilization of server 1 collected at 15:23:45 on August 4, 2024 is 85%, and the dynamic baseline of the CPU utilization in the target time period of 15:23:45 is 80%, the system will automatically trigger an alarm:

[0080] The monitoring tool identifies that the CPU usage on "Server 1" is abnormal, so the alarm source is "Server 1".

[0081] Title description: Generate a title based on the predefined title template: "The CPU utilization of server 1 has increased abnormally."

[0082] Level setting: If the pre-set rules indicate that the quantitative score of the impact of CPU utilization is 7 points, and 7 points belongs to the "serious" level alarm, then the alarm level will be set to "serious".

[0083] Time record: Since 15:23:45 on August 4, 2024 is the collection time of the CPU utilization of server 1, the collection time is the alarm time.

[0084] The resulting warning information may be as follows:

[0085] Alarm source: Server 1; Alarm title: The CPU utilization of Server 1 has increased abnormally; Alarm level: Severe; Alarm time: 2024-08-0415:23:45.

[0086] 209. Determine the specified abnormal case matching the alarm information in the knowledge graph library, and execute the operation and maintenance measures in the specified abnormal case.

[0087] This step is combined with the description of step 104 in the above method, and the same content will not be repeated here. It should be noted that the specific construction process of the knowledge graph is: obtaining historical operation and maintenance records; extracting abnormal cases from historical operation and maintenance records, and abnormal cases are used to characterize abnormal operation and maintenance cases related to system operation and business applications in the energy Internet marketing service system, and the abnormal cases include corresponding operation and maintenance measures; and constructing a knowledge graph library based on abnormal cases.

[0088] Among them, historical operation and maintenance records refer to all relevant records generated during the operation and maintenance of the energy Internet marketing service system, which may come from multiple sources, including but not limited to: system logs (log files of servers, applications, databases, etc.), work order systems (work orders that record the operation and maintenance personnel's handling of problems) and user feedback (feedback and reports from end users). After obtaining the historical operation and maintenance records, the operation and maintenance cases related to system operation and business applications are manually or automatically marked as abnormal cases, and their characteristics, such as occurrence time, duration, scope of impact, and final solution, are recorded. The cases are classified according to the abnormal type and solution for subsequent analysis and knowledge graph construction. Specifically, the key entities in each abnormal case are identified, such as system components, abnormal type, operation and maintenance measures, etc. A set of attributes is defined for each entity, such as the name of the component, the severity of the abnormality, the execution time of the measure, etc. Determine the association between entities, such as whether a certain abnormality is caused by a specific component, or whether a certain measure can effectively solve a certain type of abnormality. Use a knowledge graph construction tool (such as Neo4j, GraphDB, etc.) to convert entities, attributes, and relationships into a graph structure. Thus, the knowledge graph library in this embodiment is obtained.

[0089] When the knowledge graph library is constructed, the specified abnormal case matching the alarm information is determined in the knowledge graph library, and the specific execution process of executing the operation and maintenance measures in the specified abnormal case is: calculate the matching degree between the alarm information and each abnormal case in the knowledge graph library; determine whether there is an alternative abnormal case in the knowledge graph library with a matching degree higher than the preset matching degree threshold; if so, calculate the corrected matching degree corresponding to each alternative abnormal case, and use the alternative abnormal case with the highest corrected matching degree as the specified abnormal case matching the alarm information, and execute the operation and maintenance measures in the specified abnormal case; if not, generate the operation and maintenance instructions corresponding to the alarm information.

[0090] In this step, natural language processing (NLP) technology can be used to parse the alarm information to obtain specific alarm sources, alarm levels, alarm titles, alarm times, etc. The matching degree specifically refers to the text similarity between the abnormal case and the alarm information, which can be calculated using similarity measurement methods such as cosine similarity, Jaccard similarity, and edit distance.

[0091] Since the abnormal cases in the knowledge graph library may also have a generally low matching degree with the alarm information, if the operation and maintenance measures in one of the abnormal cases are rashly used to solve the problem, it may not only fail to produce the corresponding effect, but may also cause the opposite effect of the abnormality. Therefore, in order to ensure that each alarm is solved by the operation and maintenance measures in the abnormal case with strong correspondence and to ensure the operation and maintenance effect, a reasonable matching degree threshold can be set according to historical data and business experience, and by comparing it with the matching degree of each abnormal case, the abnormal cases with high matching degree can be screened out as alternative abnormal cases. If such alternative abnormal cases exist, the corrected matching degree corresponding to each alternative abnormal case is calculated, and the corrected matching degree is obtained by correcting the original matching degree based on the latest score and solution success rate of each alternative abnormal case. The alternative abnormal case with the highest corrected matching degree is used as the designated abnormal case matching the alarm information, and the operation and maintenance measures in the designated abnormal case are executed. That is, the corresponding operation and maintenance script or workflow is called to automatically or manually execute the operation and maintenance measures, effectively improving the efficiency of operation and maintenance. If there is no alternative abnormal case, an operation and maintenance instruction corresponding to the alarm information is generated. The operation and maintenance instruction can be to send the alarm information to the operation and maintenance personnel for manual analysis, and can also search for relevant documents and technical information to find possible solutions.

[0092] Furthermore, in order to improve the accuracy and effectiveness of operation and maintenance and ensure the effect of operation and maintenance. Based on the above description of the corrected matching degree, the specific execution process of calculating the corrected matching degree corresponding to each of the alternative abnormal cases is as follows: the case quality corresponding to each alternative abnormal case is calculated according to the latest score and resolution success rate of each alternative abnormal case; the matching degree correction coefficient corresponding to each alternative abnormal case is determined based on the case quality; the matching degree of each alternative abnormal case is corrected using the matching degree correction coefficient to obtain the corrected matching degree of each alternative abnormal case.

[0093] In practical applications, the recency and success rate of abnormal cases are important indicators for measuring the quality of abnormal cases in the knowledge graph library, and they directly affect the applicability and effectiveness of the cases. Therefore, in order to select the best from the best, the original matching degree of each candidate abnormal case can be corrected according to its recency and success rate of resolution, and the specified abnormal case can be selected from the candidate abnormal cases according to the corrected matching degree, so that the selection of the specified abnormal case always takes into account the quality of the abnormal case.

[0094] It should be noted that, after each abnormal case is selected as a designated abnormal case, when the operation and maintenance measures are executed to solve the corresponding abnormality, the corresponding execution results are usually recorded. Therefore, by sorting out the execution result records, the corresponding resolution success rate of the abnormal case can be obtained, which specifically refers to the probability that the operation and maintenance measures provided in the abnormal case are successfully applied.

[0095] Exemplarily, the solution success rate may be calculated in any of the following two ways:

[0096] Historical execution result record analysis:

[0097] Collect the execution results of each exception case after it is applied. The execution results include whether the problem is successfully solved, the time required to solve the problem, whether additional intervention is required, etc.

[0098] Formula: Solution success rate = number of successfully solved cases / total number of application cases.

[0099] User feedback:

[0100] Feedback from maintenance personnel after the maintenance measures in application exception cases can be a simple success / failure mark or a detailed solution effect score.

[0101] Formula: Resolution success rate = number of successful feedbacks / total number of feedbacks.

[0102] When each abnormal case is updated to the knowledge graph library for the first time or is subsequently updated, the corresponding timestamp, i.e., the update time, will be recorded. The update time can be used to calculate the recency score of the abnormal case, which specifically refers to the quantitative score of the difference between the update time of the abnormal case and the current time.

[0103] For example, since a more recent update time means a newer abnormal case, the latest score can be calculated in any of the following three ways:

[0104] Time difference calculation:

[0105] Formula: Latest score = 1 / (current time - update time). The time difference can be days, hours, or any time unit. Using a score ensures that the closer the update time is to the current time, the higher the latest score.

[0106] Time window weighting:

[0107] Assign higher weights to the most recent update time, and gradually reduce the weights as the update time becomes more and more distant. For example, a time window can be set, and the anomaly cases within this window are considered the most recent, while the anomaly cases beyond the window are given lower weights.

[0108] Exponential decay:

[0109] An exponential function is used to calculate the weight of the time difference, and the weight decays exponentially as the time difference increases. This ensures that the most recent anomaly cases have the highest weight.

[0110] Based on the above, we can know that the recency score and resolution success rate of each candidate abnormal case have been determined. At this time, the matching correction coefficient corresponding to each candidate abnormal case can be calculated based on the two. That is, the higher the recency score and the higher the resolution success rate, the higher the case quality representing the candidate abnormal case, and the higher the corresponding matching correction coefficient, and vice versa. Specifically, weights are assigned to the recency score and resolution success rate based on business needs and expert judgment. The weight indicates the relative importance of the recency score or resolution success rate in the final matching correction coefficient. The matching correction coefficient of each candidate abnormal case can be obtained by weighted average, and combined with its original matching degree, the corrected matching degree can be calculated.

[0111] Exemplarily, assume that the original matching degree corresponding to a candidate abnormal case is M, A is its recency score, B is its resolution success rate, the weight of its recency score is Wnew, the weight of its resolution success rate is Wsol, and Wnew+Wsol=1.

[0112] Use weighted average: C = Wnew × A + Wsol × B, where C is the correction factor.

[0113] Corrected matching degree: M′=M×C, where M is the original matching degree.

[0114] Furthermore, as a response to the above Figure 1-2 The implementation of the method embodiment shown in the figure, the embodiment of the present application provides an operation monitoring device for an energy internet marketing service system, which is used to improve the accuracy and efficiency of the operation monitoring of the energy internet marketing service system. The embodiment of the device corresponds to the aforementioned method embodiment. For ease of reading, this embodiment will no longer repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Specifically, Figure 3 As shown, the device comprises:

[0115] The first acquisition unit 301 is used to acquire target indicator data according to a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business application in the energy Internet marketing service system;

[0116] A judgment unit 302 is used to judge whether each indicator in the target indicator data is an abnormal indicator that deviates from the corresponding dynamic baseline, wherein the dynamic baseline is a normal indicator range obtained after periodic cluster analysis of the historical data corresponding to each indicator in the target indicator data, and the normal indicator range changes dynamically and periodically;

[0117] A generating unit 303 is used to generate warning information corresponding to the abnormal indicator if yes;

[0118] The processing unit 304 is used to determine a specified abnormal case matching the alarm information in the knowledge graph library, and execute the operation and maintenance measures in the specified abnormal case.

[0119] Further, such as Figure 4 As shown, the device also includes:

[0120] The second acquisition unit 305 is used to acquire the historical data corresponding to each indicator in the target indicator data according to a preset period before acquiring the target indicator data according to a preset frequency;

[0121] The identification unit 306 is used to determine the usage pattern of each indicator in different time periods from the historical data by using a clustering algorithm, and identify the behavior characteristics of each indicator under normal operating conditions according to the usage pattern;

[0122] The first determining unit 307 is configured to determine the normal indicator range corresponding to each indicator in different time periods based on the behavior characteristics, and use the normal indicator range as the dynamic baseline.

[0123] Further, such as Figure 4 As shown, the judging unit 302 includes:

[0124] An acquisition module 3021 is used to acquire the collection time corresponding to each indicator in the target indicator data;

[0125] A matching module 3022, configured to match a target time period in different time periods according to the acquisition time;

[0126] The comparison module 3023 is used to compare each indicator in the target indicator data with the dynamic baseline corresponding to each indicator in the target time period, and take the indicator deviating from the dynamic baseline as the abnormal indicator.

[0127] Further, such as Figure 4 As shown, the device also includes:

[0128] The third acquisition unit 308 is used to acquire historical operation and maintenance records before acquiring target indicator data at a preset frequency;

[0129] An extraction unit 309 is used to extract abnormal cases from the historical operation and maintenance records, wherein the abnormal cases are used to characterize abnormal operation and maintenance cases related to system operation and business application in the energy Internet marketing service system, and the abnormal cases include corresponding operation and maintenance measures;

[0130] The construction unit 310 is used to construct the knowledge graph library based on the multiple abnormal cases.

[0131] Further, such as Figure 4 As shown, the processing unit 304 includes:

[0132] The first calculation module 3041 is used to calculate the matching degree between the warning information and each abnormal case in the knowledge graph library;

[0133] A judgment module 3042 is used to judge whether there is a candidate abnormal case in the knowledge graph library whose matching degree is higher than a preset matching degree threshold;

[0134] The processing module 3043 is used to calculate the corrected matching degree corresponding to each candidate abnormal case if it exists, take the candidate abnormal case with the highest corrected matching degree as the designated abnormal case matching the alarm information, and execute the operation and maintenance measures in the designated abnormal case;

[0135] The generation module 3044 is used to generate an operation and maintenance instruction corresponding to the alarm information if it does not exist.

[0136] Further, such as Figure 4 As shown, the processing module 3043 is specifically used for:

[0137] Calculate the case quality corresponding to each of the candidate abnormal cases according to the latest score and resolution success rate of each of the candidate abnormal cases;

[0138] Determine a matching correction coefficient corresponding to each of the candidate abnormal cases based on the case quality;

[0139] The matching degree of each of the candidate abnormal cases is corrected using the matching degree correction coefficient to obtain the corrected matching degree of each of the candidate abnormal cases.

[0140] Further, such as Figure 4 As shown, the device also includes:

[0141] A calculation unit 311 is used to calculate the system operation impact degree and / or business application impact degree corresponding to the abnormal indicator before generating the alarm information corresponding to the abnormal indicator;

[0142] A second determining unit 312 is used to determine the alarm level of the abnormal indicator in a preset impact level-level rule according to the system operation impact level and / or the business application impact level;

[0143] The generating unit 303 is specifically configured to:

[0144] Generate alarm information corresponding to the abnormal indicator based on the alarm level.

[0145] Furthermore, an embodiment of the present application further provides a storage medium, wherein the storage medium is used to store a computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the above Figure 1-2 The operation monitoring method of the energy Internet marketing service system described in.

[0146] Furthermore, the embodiment of the present application also provides a processor, the processor is used to run a program, wherein the program executes the above Figure 1-2 The operation monitoring method of the energy Internet marketing service system described in.

[0147] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0148] It is understandable that the related features in the above methods and devices can be referenced to each other. In addition, the "first", "second" and the like in the above embodiments are used to distinguish the embodiments, but do not represent the advantages and disadvantages of the embodiments.

[0149] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0150] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the application described herein, and the description of the specific language above is for the purpose of disclosing the best mode of implementation of the application.

[0151] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0152] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0153] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0156] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0157] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0158] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include transitory media such as modulated data signals and carrier waves.

[0159] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0160] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0161] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An operation monitoring method of an energy Internet marketing service system, characterized in that: The method comprises: Acquire target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system; Determine respectively whether each indicator in the target indicator data is an abnormal indicator that deviates from the corresponding dynamic baseline, wherein the dynamic baseline is a normal indicator range obtained after periodic cluster analysis of the historical data corresponding to each indicator in the target indicator data, and the normal indicator range changes dynamically and periodically; If yes, generate warning information corresponding to the abnormal indicator; Determine in the knowledge graph library a specified abnormal case that matches the alarm information, and execute the operation and maintenance measures in the specified abnormal case.

2. The method according to claim 1, characterized in that: Before obtaining the target indicator data at a preset frequency, the method further includes: Acquire historical data corresponding to each indicator in the target indicator data according to a preset period; Determine the usage pattern of each indicator in different time periods from the historical data using a clustering algorithm, and identify the behavior characteristics of each indicator under normal operating conditions based on the usage pattern; Based on the behavior characteristics, normal indicator ranges corresponding to the indicators in different time periods are determined, and the normal indicator ranges are used as the dynamic baseline.

3. The method according to claim 2, characterized in that Determining whether each indicator in the target indicator data is an abnormal indicator that deviates from the corresponding dynamic baseline includes: Obtaining the collection time corresponding to each indicator in the target indicator data; matching a target time period in different time periods according to the acquisition time; Each indicator in the target indicator data is compared with the dynamic baseline corresponding to each indicator in the target time period, and the indicator deviating from the dynamic baseline is taken as the abnormal indicator.

4. The method according to claim 1, characterized in that Before obtaining the target indicator data at a preset frequency, the method further includes: Obtain historical operation and maintenance records; Extracting abnormal cases from the historical operation and maintenance records, wherein the abnormal cases are used to characterize abnormal operation and maintenance cases related to system operation and business application in the energy internet marketing service system, and the abnormal cases include corresponding operation and maintenance measures; The knowledge graph library is constructed based on a plurality of the abnormal cases.

5. The method according to claim 4, characterized in that Determining a specified abnormal case matching the alarm information in the knowledge graph library, and executing an operation and maintenance measure in the specified abnormal case, including: Calculating the matching degree between the warning information and each of the abnormal cases in the knowledge graph library; Determine whether there is a candidate abnormal case in the knowledge graph library whose matching degree is higher than a preset matching degree threshold; If so, calculate the corrected matching degree corresponding to each candidate abnormal case, take the candidate abnormal case with the highest corrected matching degree as the designated abnormal case matching the alarm information, and execute the operation and maintenance measures in the designated abnormal case; If it does not exist, an operation and maintenance instruction corresponding to the alarm information is generated.

6. The method according to claim 5, characterized in that Calculating the corrected matching degree corresponding to each of the candidate abnormal cases, including: Calculate the case quality corresponding to each of the candidate abnormal cases according to the latest score and resolution success rate of each of the candidate abnormal cases; Determine a matching degree correction coefficient corresponding to each of the candidate abnormal cases based on the case quality; The matching degree of each of the candidate abnormal cases is corrected using the matching degree correction coefficient to obtain the corrected matching degree of each of the candidate abnormal cases.

7. The method according to any one of claims 1 to 6, characterized in that Before generating the alarm information corresponding to the abnormal indicator, the method further includes: Calculate the degree of impact on system operation and / or business application corresponding to the abnormal indicator; Determining the alarm level of the abnormal indicator in a preset impact level-level rule according to the impact level of the system operation and / or the impact level of the business application; Generate alarm information corresponding to the abnormal indicator based on the alarm level.

8. An operation monitoring device for an energy internet marketing service system, characterized in that: The device comprises: A first acquisition unit, configured to acquire target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system; A judgment unit, used to judge whether each indicator in the target indicator data is an abnormal indicator that deviates from the corresponding dynamic baseline, wherein the dynamic baseline is a normal indicator range obtained after periodic cluster analysis of the historical data corresponding to each indicator in the target indicator data, and the normal indicator range changes dynamically and periodically; A generating unit, configured to generate warning information corresponding to the abnormal indicator if yes; A processing unit is used to determine a specified abnormal case matching the alarm information in the knowledge graph library and execute operation and maintenance measures in the specified abnormal case.

9. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the operation monitoring method of the energy Internet marketing service system as described in any one of claims 1 to claim 7.

10. A processor, characterized in that: The processor is used to run a program, wherein when the program is run, the operation monitoring method of the energy Internet marketing service system as described in any one of claims 1 to claim 7 is executed.

Images