Service anomaly detection method based on AI

Abstract

The invention relates to an AI-based service anomaly detection method, and belongs to the technical field of data processing. Comprising the following steps: acquiring runtime data of a production environment, including service layer data, hardware layer data, network layer data and link layer data; supplementing the collected data, carrying out classified marking on data information, and defining a hierarchical relationship among the data; sending the data to an AI model, carrying out correlation analysis through a time dimension and a space dimension, and carrying out link analysis; the AI large model updates the knowledge graph and generates the model according to each operation and maintenance; and displaying the fault knowledge graph by using a graphical front end. According to the AI-based service anomaly detection method provided by the invention, multi-dimensional data are comprehensively collected and correlation analysis is carried out, so that rapid positioning of a fault is realized. The fault discovery time is greatly shortened through the real-time detection capability, and the fault processing efficiency is further improved through incremental updating and intelligent optimization of the knowledge graph.

Description

Technical Field

[0001] The present invention relates to an AI-based business anomaly detection method, belonging to the technical field of data processing. Background Art

[0002] During the operation of the business in the production environment, it is inevitable to encounter some failures. Due to the diversity of the production environment, it is a very complex task to locate the cause of the failure when it occurs, which requires a long time and a lot of manpower to troubleshoot the problem. With the deepening of the enterprise digital transformation, the business systems in the production environment show highly complex and diverse characteristics. The existing technologies have the following prominent problems in dealing with business anomaly detection: Traditional monitoring systems usually collect data from the business layer, hardware layer, network layer, and link layer in a fragmented manner, lacking the ability to perform cross-dimensional data correlation analysis, resulting in the need for manual integration of multi-system data during fault location, with low efficiency; Existing log analysis tools rely on manual rule matching and are difficult to detect potential anomalies in real time. According to statistics, 78% of business interruption events cannot be automatically identified within 15 minutes after occurrence, and the average mean time to recovery exceeds 4 hours; Moreover, the factory environment is even more highly complex, where the equipment, processes, and procedures are intertwined, forming a huge system. In this system, there are intricate connections among business data, hardware data, network data, and link data. However, the existing detection means often can only monitor data in a single dimension and are difficult to comprehensively reflect the overall situation of the factory environment. Summary of the Invention

[0003] The present invention provides an AI-based business anomaly detection method to solve the problems of multi-source data isolation and fault diagnosis lag in the existing technology.

[0004] The present invention provides an AI-based business anomaly detection method, which includes the following steps: 6): Obtain the runtime data of the production environment through the monitoring system and the log system, including business layer data, hardware layer data, network layer data, and link layer data; 7): Supplement the collected data, classify and label the data information, and define the hierarchical relationship between the data; 8): Send the supplemented data to the AI model for correlation analysis through the time dimension and the space dimension, and perform link analysis; 9): The AI large model updates the knowledge graph and generates the model according to each operation and maintenance operation; 10) Use a graphical front end to display the knowledge graph of the root cause of the failure.

[0005] Preferably, the data collected in step 1) includes the service call success rate, service call duration, and service call times. Among them, the number of service calls is identified and counted by analyzing network traffic data; the data sampling rate of the collected data is calculated; a standardized template file is created, which contains all necessary fields, and a hash table is used to record the processed log entries, and the integrity of the data fields is verified through a data quality assessment model; By tracing the specific path of the data packet, analyzing the detailed situation of the network link, observing the change of the round-trip time, verifying the stability and consistency of the network state, improving the accuracy of the data, comprehensively analyzing the obtained data, and identifying bottlenecks, nodes with high latency or potential fault points in the network.

[0006] Preferably, in step 2), the data tags are divided into service, server, network, and link. The order from bottom to top is link, network, server, and service. According to the attributes and sources of the data items, their tag ownership is automatically determined, and a model containing four levels of link, network, server, and service is constructed to calculate the weights of each level.

[0007] Preferably, in step 3), all data is converted into a unified format and data cleaning is performed, and a comprehensive knowledge graph containing multi-dimensional information such as devices, networks, and services is constructed through the data.

[0008] Preferably, in step 4), by extracting fault entities and solution entities from the operation and maintenance data, adding them as new fault entities to the knowledge graph, realizing the incremental update of the knowledge graph through change detection, change extraction, and graph update, constructing an online learning framework for updating the parameters of the model, establishing a feedback mechanism, and flowing the operation and maintenance results and manual verification data back to the model.

[0009] Preferably, in step 1), the drift of the data distribution of service data, hardware data, network data, and link data is detected; for each data set, it is divided into multiple windows according to the time series, the mean distribution characteristics of the data in each window are calculated, the data distribution characteristics of adjacent windows are compared, and whether there are differences is detected. If significant differences are detected, it is determined as data drift, the effectiveness of the new evaluation model is evaluated, and the model is considered to be retrained to adapt to the new data distribution.

[0010] Preferably, in step 1), preprocessing operations such as denoising and filtering are performed on the data to improve the accuracy of the Fourier transform, the data is preprocessed to improve the accuracy of the Fourier transform, the signal is decomposed into smaller sub-signals, butterfly operations are performed on each sub-signal to obtain intermediate results, periodic components are searched in the spectrogram according to the intermediate results, and the periodic change pattern of the data is determined according to the periodic components.

[0011] Preferably, in step 7), a fast Fourier transform is performed on each sub-signal to convert it from the time domain to the frequency domain. A reference frequency or frequency range is selected, and phase adjustment and amplitude scaling are performed on each sub-signal to align it with the reference frequency or frequency range. During the butterfly operation, intermediate results are extracted, and the intermediate results include complex number arrays after each stage of the butterfly operation. The temperature sensor moves at multiple points in the factory through a roller screw.

[0012] Preferably, in step 1), it also includes the analysis of the temporal stationarity of the collected service data, hardware data, network data, and link data. For the service data, hardware data, network data, and link data, time series diagrams are respectively plotted to observe the overall trend and fluctuation of the data, determine whether there is a unit root in the data sequence, and perform an ADF test on each data set according to the time series. According to the test results, it is judged whether the data meets the requirements of temporal stationarity. If the data is not stationary, differential processing is used for processing.

[0013] Preferably, in step 1), it also includes eliminating the linear trend in the data through first-order differencing, performing a unit root test on the differenced sequence to determine whether the differential processing effectively eliminates the non-stationarity of the data, and plotting the differenced sequence diagram to observe the differenced sequence diagram.

[0014] Advantages of the present invention: The present invention provides an AI-based business anomaly detection method. By comprehensively collecting runtime data in the production environment, including multi-dimensional data such as the business layer, hardware layer, network layer, and link layer, it realizes the correlation analysis of cross-dimensional data, significantly improves the efficiency and accuracy of fault location, reduces the cumbersome process of manually integrating multi-system data. Compared with traditional log analysis tools that rely on manual rule matching, the present invention uses an AI model for real-time anomaly detection. By constructing a comprehensive knowledge graph containing multi-dimensional information such as devices, networks, and businesses, it can identify and warn of potential business anomalies in real time, greatly shortening the fault discovery time, improving the reliability and stability of the system, and can update the knowledge graph and generate models according to each operation and maintenance operation. By extracting fault entities and solution entities from operation and maintenance data and adding them as new fault entities to the knowledge graph, incremental update of the knowledge graph is achieved. In addition, by constructing an online learning framework, the AI model can learn from each operation and maintenance operation and continuously optimize its fault prediction and processing capabilities. During the data collection and processing process, preprocessing operations such as data denoising and filtering, as well as spectrum analysis technology, are introduced to improve the accuracy and reliability of the data. Through spectrum analysis, the periodic change patterns of the data can be detected, providing more comprehensive information support for fault troubleshooting. Time series stationarity analysis and data drift detection are performed on the collected business data, hardware data, network data, and link data. By plotting time series diagrams, performing ADF tests, and differential processing, the non-stationarity of the data sequence can be accurately detected and transformed into a stationary sequence through differential processing. At the same time, through data drift detection, changes in the data distribution can be monitored in real time to ensure the adaptability and accuracy of the model to new data. A graphical front-end is used to display the knowledge graph of the root cause of the fault, enabling operation and maintenance personnel to quickly query historical data and intuitively observe data correlations, which not only improves the operation and maintenance efficiency but also helps operation and maintenance personnel better understand the system operation status and the causes of faults. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a schematic flowchart of an AI-based business anomaly detection method of the present invention.

[0016] Figure 2 It is a schematic diagram of the device structure of an AI-based business anomaly detection method of the present invention.

[0017] In the figure: 1, ball screw; 2, sensor. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0019] Embodiment 1: The present invention provides an AI-based business anomaly detection method, which includes: 1): Obtain runtime data of the production environment through the monitoring system and the logging system, including business layer data, hardware layer data, network layer data, and link layer data; 11): Use an agent or the open-source SkyWalking to collect the operation data of the business. The agent realizes data collection through bytecode enhancement. The collected data includes the business call success rate, business call duration, and business call times. Among them, by analyzing the network traffic data, identify and count the number of business calls; Calculate the data sampling rate for the collected data to ensure data representativeness while reducing overhead. The specific formula is as follows:

[0020] Where: : Is the dynamically adjusted sampling rate; : Is the sampling rate adjustment factor, used to adjust the sensitivity of the sampling rate to changes in business volume and system load; : Is the current business volume, which can be the number of requests, the number of transactions, or other metrics for measuring business volume; : Is the maximum value of the business volume or a preset threshold; : Is the weight factor of the impact of business volume on the sampling rate; : Is the current system load, which can be the CPU usage rate, the memory occupancy rate, or other metrics for measuring system load; : Is the maximum value of the system load or a preset threshold; : Is the weight factor of the impact of system load on the sampling rate; : Is the basic sampling rate, that is, the sampling rate when there is no business volume or system load pressure; When the business volume approaches the maximum value Approaches 1; When the system load approaches the maximum value Approaches 1; 12) Obtain server and network logs by configuring the syslog service. It should be set according to requirements to capture logs of specific facilities and severity levels. Create a standardized template file. The standardized template file contains all required fields, and use a hash table to record the processed log entries to avoid duplication, remove invalid data, and perform integrity verification on the data fields through a data quality assessment model. The specific formula is as follows:

[0021] Wherein: ϵ: Error rate; n: The number of errors in the log entries; N: The total number of log entries; The lower the error rate ϵ, the higher the accuracy of the log data;

[0022] Wherein: CI: Consistency index; m: The number of inconsistencies in the log entries; k: The total number of comparisons made; Consistency index The higher the value, the better the consistency of the log data;

[0023] Wherein: TI: Timeliness index; a: The age of the oldest log entry, i.e., the difference between the current time and the timestamp of the log entry; A: The maximum allowed age, the longest time that a log entry is considered to be still valid or of reference value;

[0024] Wherein: DQEM: Data quality evaluation model; w1: The weight of accuracy; ϵ: Error rate; CI: Consistency index; CI: Consistency index; w2: The weight of the integrity index; II: Integrity index; w3: The weight of timeliness; TI: Timeliness index 13) Use the ping and traceroute commands to obtain network link - related data. Specifically, use the ping command to test network connectivity to ensure that the network is basically reachable. Then use the traceroute command to trace the specific path of the data packet, analyze the detailed situation of the network link, compare the results of multiple ping commands, observe the change in round - trip time, verify the stability and consistency of the network status, and improve the accuracy of the data. At the same time, compare the results of the traceroute command, check whether the paths are consistent, analyze whether there are routing changes or abnormal nodes, comprehensively analyze the data obtained by ping and traceroute, and identify bottlenecks, nodes with high latency, or potential fault points in the network.

[0025] 2): Supplement the collected data, supplement data such as device name, device IP, MAC address, service - affiliated IP, service port number, service protocol type, network routing information, etc., and classify and tag the supplemented data information and define the hierarchical relationship between the data. The data tags are divided into business, server, network, and link. The order from the bottom layer to the top layer is link, network, server, business; 21) Collect the device name, IP address, MAC address, and routing information through system commands (such as the hostname and ip addr commands in Linux, and the hostname and ipconfig commands in Windows), and obtain the service IP, port number, and protocol type from the service registration center; 22) Automatically determine the label attribution according to the attributes and sources of the data items, Business: Data related to business logic and application services, including service - affiliated IP, service port number, service protocol type; Server: Data related to server hardware, operating system, and service processes, including device name, device IP; Network: Data related to network transmission and routing, including IP address, routing information; Link: Data related to physical links and network interfaces, including MAC address; The link layer is the bottom layer, providing physical connections and link - state information. The network layer is based on the link layer, providing IP routing and network - transmission services. The server layer runs application services and depends on the network layer for communication. The business layer is the top layer, providing specific business logic and application services; Build a model containing four levels: link, network, server, and business, determine the relative importance between the elements of each level, and then use the AHP method to calculate the weights of each level. The specific formula is as follows:

[0026] Where Meet the following conditions: > 0 (all elements are positive); = (the matrix is reciprocal); = 1 (the diagonal elements are 1 because the importance of any element compared to itself is 1) If the decision maker believes that element 1 is slightly more important than element 2, then it can be set that = 3 (indicating that the importance of element 1 is 3 times that of element 2), and correspondingly, =

[0027] 3) Send the supplemented and completed data to the AI model for correlation analysis through the time dimension and the space dimension. The supplemented data can also be used for link analysis. When an exception occurs at the business layer, the server where the business is located can be associated through data such as IP address, port, and protocol, and whether there is an exception in the network where it is located. When the data calculation is completed, the analysis results can be archived and a knowledge graph can be generated based on a large amount of historical data. When a new fault occurs, the knowledge graph can be queried to help lock the fault range and the possible causes of the fault. The operation and maintenance personnel can significantly reduce the time for troubleshooting; 31) Ensure that the collected data covers all necessary dimensions, including device name, IP, MAC, business IP, port, protocol, route, etc., and has been classified, labeled, and hierarchically sorted; 32) Convert all data into a unified format, and perform data cleaning, removing duplicate data, handling missing values, and correcting incorrect data to ensure data consistency and accuracy; 33) Conduct analysis through the AI model in the time dimension and the space dimension (the AI model here is an existing model and will not be elaborated here); 34) Build a comprehensive knowledge graph containing multi-dimensional information such as devices, networks, and businesses to provide comprehensive support for troubleshooting; 4) Generate a knowledge graph for operation and maintenance based on the analyzed fault correlation results. By analyzing historical fault solutions, new knowledge nodes are automatically generated to enrich the knowledge graph. The AI large model learns new solutions from each operation and maintenance operation and updates the knowledge graph and the generated model; 41) Extract fault entities and solution entities from the new operation and maintenance data to generate new knowledge nodes. When a new device model or abnormal performance characteristics are detected, they are added to the knowledge graph as new fault entities; 42) Regularly obtain the updated information of the existing entities in the knowledge graph, and achieve incremental update of the knowledge graph through change detection, change extraction, and graph update; 42) Build an online learning framework to enable the AI model to learn from each operation and maintenance operation, using the characteristics and results of the task as new training data to update the model parameters; 43) Establish a feedback mechanism to feed back the operation and maintenance results and manual verification data into the model for incremental update and performance improvement of the model to improve its accuracy; 5) Use a graphical front-end to display the knowledge graph of the root cause of the failure, and historical data saved in the knowledge graph can be quickly queried. Operation and maintenance personnel can more intuitively observe the relevance of the data in the knowledge graph.

[0028] During use, collect metrics such as business call success rate, duration, and number of times through Agent or SkyWalking, dynamically adjust the sampling rate, configure the syslog service to obtain server and network logs, clean the data through a standardized template and data quality assessment model, use the ping and traceroute commands to test connectivity and trace the path, analyze latency and abnormal nodes, obtain information such as device name, IP, MAC, service port, and protocol for data supplementation, and label according to four levels: business, server, network, and link. By using the AHP (Analytic Hierarchy Process) to construct a hierarchical weight matrix to determine the importance of each level, input the cleaned data into the AI model for analysis in the time dimension and space dimension, associate the server and network where the abnormal business is located through information such as IP, port, and protocol to locate the root cause of the failure, integrate multi-dimensional data such as devices, networks, and services to construct a comprehensive knowledge graph to support fault troubleshooting, archive the analysis results, continuously optimize the knowledge graph based on historical data, extract fault entities and solutions from the re-operated data and add new nodes; regularly detect and update the existing entity information, use the operation and maintenance task characteristics and results as new training data to optimize the AI model parameters, feed back the operation and maintenance results and manual verification data to the model to continuously improve the detection accuracy, and display the knowledge graph through the front-end interface to intuitively present the data relevance and support quick query of historical fault cases and solutions.

[0029] Compared with the existing technology, the comprehensive runtime data of the production environment is obtained through the monitoring system and the log system, covering multiple dimensions such as the business layer, hardware layer, network layer and link layer, ensuring the integrity and accuracy of the data. The method of dynamically adjusting the sampling rate is adopted to effectively reduce the overhead of data processing while ensuring the representativeness of the data. The standardized templates and data quality assessment models are used to clean and evaluate the data quality, ensuring the accuracy and consistency of the data and improving the reliability of subsequent analysis. The collected data is finely labeled and hierarchically classified from the bottom link to the high-level business, making the data more orderly and easy to manage. A model including four levels of link, network, server and business is constructed, and the relative importance of elements at each level is determined. It provides a solid foundation for subsequent analysis. Through the correlation analysis of the time dimension and space dimension by AI model, the root cause of the fault can be accurately located, which improves the efficiency of troubleshooting. It integrates multi-dimensional data such as equipment, network, and business, and builds a comprehensive knowledge graph to provide comprehensive troubleshooting support for operation and maintenance personnel. The AI model can learn from each operation and maintenance operation, continuously optimize its fault prediction and processing capabilities, build an online learning framework, realize incremental updates of the model, and ensure the advancement and practicality of the model. Through the feedback mechanism, the operation and maintenance results and manual verification data are returned to the model, which further improves the accuracy of the model. Using the graphical front-end to display the knowledge graph of the root cause of the fault, operation and maintenance personnel can quickly query historical data and intuitively observe the data correlation.

[0030] Example 2: After obtaining business data, hardware data, network data and link data in Example 1, a method of dynamically adjusting the sampling rate is adopted, which effectively reduces the data processing overhead while ensuring the representativeness of the data. This example makes further improvements on the basis of the above example.

[0031] In step 1) also includes: 14): Detect data distribution drift for business data, hardware data, network data and link data; 141): For each data set, divide it into multiple windows according to the time series; 142): Calculate the mean distribution characteristics of the data in each window. The specific formula is as follows:

[0032] in: : mean;

[0033] : The number of data points in the window; : The value of each data point; 143): Compare the data distribution characteristics of adjacent windows to detect whether there are differences; 144): If a significant difference is detected, it is determined that data drift has occurred. For data drift, the effectiveness of the model needs to be re-evaluated, and the model may need to be retrained to adapt to the new data distribution; In some embodiments, by cleaning the new data, removing outliers and duplicate values, ensuring that the data format is consistent with the input format of the existing model, the new data is divided into a training set, a validation set, and a test set. The training set is used to train the model, the validation set is used to adjust the model parameters, and the test set is used to evaluate the model performance. Using randomly initialized parameters as a starting point, the model is trained using the training set data, the model parameters are adjusted to minimize the loss function, the loss function value and the validation set performance during the training process are monitored to ensure that the model is not overfitted or underfitted, the hyperparameters of the model are adjusted using the validation set data, and the performance of the new model is evaluated using the test set data. According to the evaluation results, regularization is increased to improve the model performance.

[0034] During use, detect data distribution drift for business data, hardware data, network data, and link data. Each data set is divided into multiple windows according to the time series, calculate the mean distribution characteristics of the data within each window, and compare the data distribution characteristics of adjacent windows to detect whether there are significant differences. After detecting data drift, re-evaluate the effectiveness of the existing model. According to the evaluation results, retrain the model to adapt to the new data distribution. When retraining the model, clean the new data, remove outliers and duplicate values, ensure that the data format is consistent with the model input format, divide the new data into a training set, a validation set, and a test set for subsequent model training, parameter adjustment, and performance evaluation. Use the training set data to train the model and adjust the model parameters to minimize the loss function. Monitor the loss function value and the validation set performance during the training process to ensure that the model is not overfitted or underfitted. Use the validation set data to adjust the hyperparameters of the model to improve the generalization ability of the model.

[0035] Compared with the prior art, by introducing data drift monitoring technology, the change of data distribution can be monitored in real time. When data drift is detected, the effectiveness of the model will be re-evaluated, and the model may be retrained to adapt to the new data distribution to ensure that the model can continuously maintain its adaptability and accuracy to new data.

[0036] Embodiment 3: In Embodiment 2, monitor the data distribution drift of business data, hardware data, network data, and link data. However, the factory environment is often highly complex and is prone to being affected by internal periodic factors after a drift change. This embodiment makes further improvements based on the above embodiments; In step 1), it further includes: 15) Use spectrum analysis to detect the periodic changes in service data, hardware data, network data, and link data. Drive the sensor 2 to move through the ball screw 1; 151): For each data set, perform Fourier transform analysis according to the time series; 1511): Perform preprocessing operations such as denoising and filtering on the data to improve the accuracy of the Fourier transform; 1512): Decompose the signal into smaller sub-signals through recursion; 1513): Perform butterfly operations on each sub-signal to obtain intermediate results; In some embodiments, the sensor 2 and the acquisition device collect signals from all corners of the factory. These signals may include mechanical vibration, temperature, pressure, sound, etc. By performing denoising processing on the collected signals to eliminate the influence of external factors such as equipment noise and electromagnetic interference, the denoised signals are segmented into multiple sub-signals, each sub-signal corresponding to a specific area or device in the factory. Perform a fast Fourier transform on each sub-signal to convert it from the time domain to the frequency domain. Select a reference frequency or frequency range, perform phase adjustment and amplitude scaling on each sub-signal to align it with the reference frequency or frequency range. Perform addition or subtraction operations on the adjusted sub-signals to obtain a new signal combination. Repeat the above steps until all sub-signals have undergone butterfly operation processing. During the butterfly operation process, extract the intermediate results, and the intermediate results include the complex number arrays after each stage of the butterfly operation; 152): Find the periodic components in the spectrogram according to the intermediate results; 153): Determine the periodic change pattern of the data according to the periodic components; During use, the collected signals are denoised to eliminate the influence of external factors such as equipment noise and electromagnetic interference. The denoised signals are segmented into multiple sub-signals, with each sub-signal corresponding to a specific area or device in the factory. Each sub-signal is subjected to a fast Fourier transform to convert it from the time domain to the frequency domain. A reference frequency or frequency range is selected, and each sub-signal is phase-adjusted and amplitude-scaled to align it with the reference frequency or frequency range. The adjusted sub-signals are subjected to addition or subtraction operations to obtain a new signal combination. The signal is recursively decomposed into smaller sub-signals, and each sub-signal is subjected to a butterfly operation to obtain intermediate results. These intermediate results include the complex number arrays after each stage of the butterfly operation. Periodic components are searched for on the spectrogram based on the intermediate results to visually identify the characteristics of the periodic signals. Based on the periodic components found on the spectrogram, the periodic change pattern of the data is determined, as well as the extraction and analysis of parameters such as the frequency, amplitude, and phase of the periodic components. To ensure the accuracy of the data, the sensor 2 is driven by the ball screw 1 to move within the area to be monitored in the factory, covering a wider monitoring area, thereby collecting more data at different positions, which helps to more comprehensively understand the overall condition of the factory environment and reduce the deviation caused by data at a single position. By collecting data at different positions, it is easier to identify whether the periodic changes are prevalent throughout the factory or are only limited to specific areas, thereby increasing the diversity of the data and helping to more accurately determine the sources and influencing factors of the periodic changes, providing strong support for subsequent fault troubleshooting and performance optimization; Among them, the ball screw 1 drives the vibration sensor 2 to move from area A (near the motor group) of the production line to area B (the end of the conveyor belt). In area A, a strong amplitude peak appears at 50 Hz on the spectrogram, which is consistent with the rated speed frequency of the motor, showing a regular periodic signal. The intermediate result of the butterfly operation shows that the harmonic components (100 Hz, 150 Hz) are obvious, indicating the normal operation characteristics of the bearing; in area B, the main peak of the spectrum shifts to 47 Hz, and there is random high-frequency noise. The intermediate result of the butterfly operation shows an asymmetric phase distribution, suggesting abnormal vibration caused by periodic wear of the conveyor belt gear. By moving the sensor 2, the locality of the periodic change is found - the motor is periodically normal, while the conveyor belt is periodically abnormal and requires targeted maintenance; Among them, the temperature sensor 2 moves along the ball screw 1 from the furnace area to the cooling area. In the furnace area: The Fourier transform shows a 24-hour periodic fluctuation (amplitude ±10 °C), which matches the heating rhythm of the factory shift. After the sub-signal decomposition of the butterfly operation, the amplitude of the 8 Hz sub-signal is abnormal, corresponding to the periodic start-stop fault of the furnace fan; in the cooling area: The spectrum shows a short period of 2 hours (amplitude ±3 °C), which is consistent with the frequency of the cooling water circulation pump. The phase mutation point of the intermediate result coincides with the timestamp of the pump valve opening and closing log, verifying the controllability of the periodicity; Among them, the acoustic sensor 2 moves from above the stamping machine to the hydraulic station. Stamping machine position: The spectrogram shows the fundamental frequency of the 0.5 Hz impact sound (stamping cycle), but there are periodic absences in the 2 kHz sub-signal in the intermediate result of the butterfly operation (acoustic wave cancellation caused by the loose sound insulation cover). Hydraulic station position: The spectrum presents a continuous white noise background, but a 10 Hz periodic pressure release spike (safety valve action cycle) is extracted after recursive decomposition.

[0037] Compared with the prior art, by using the method of spectrum analysis, it is possible to detect the periodic changes in service data, hardware data, network data, and link data, so as to more accurately reflect the actual situation of the factory environment. Before performing Fourier transform analysis, preprocessing operations such as denoising and filtering are performed on the data to improve the accuracy of the Fourier transform. At the same time, by recursively decomposing the signal into smaller sub-signals and performing butterfly operations on each sub-signal, more refined intermediate results can be obtained, thereby enhancing the reliability of signal processing. By looking for periodic components on the spectrogram according to the intermediate results, the characteristics of periodic signals can be intuitively identified. This step helps to quickly locate and analyze the periodic changes in the factory environment, providing strong support for the subsequent introduction of data drift monitoring technology to ensure that the model can continuously maintain its adaptability and accuracy to new data.

[0038] Example 4: Detect the periodic changes in service data, hardware data, network data, and link data in Example 3. However, due to the high dynamics of the factory environment, only focusing on the periodicity of the data is likely to lead to misjudgments and decision-making mistakes. This example makes further improvements on the basis of the above example; In step 1), it further includes: 16): Analyze the time series stationarity of the collected service data, hardware data, network data, and link data; 161): Draw time series diagrams for service data, hardware data, network data, and link data respectively, and observe the overall trend and fluctuation of the data; 162): Determine whether there is a unit root in the data sequence; 163): Perform ADF tests on each data set according to the time series; 164): Judge whether the data meets the requirements of time series stationarity according to the test results; 165): If the data is not stationary, perform difference processing to achieve stationarity.

[0039] Then, perform ADF tests on the processed sequence until the sequence becomes stationary; In use, initially observe the time series graph to judge the degree of non-stationarity and trend type of the data. Use the ADF test method to judge whether there is a unit root in the data. Eliminate the linear trend in the data through first-order differencing. Conduct a unit root test on the differenced series to judge whether the differencing process effectively eliminates the non-stationarity of the data. Plot the differenced series graph and observe it to judge whether the differencing process changes the trend and volatility of the data, thereby eliminating the non-stationarity of the data and providing a basis for subsequent analysis and modeling.

[0040] Compared with the prior art, by plotting the time series graph, conducting the ADF test, and performing differencing processing, the non-stationarity of the data sequence can be accurately detected, and it can be transformed into a stationary sequence through differencing processing. This helps to improve the accuracy and reliability of subsequent data analysis. By real-time monitoring and adjusting the data stationarity, the effectiveness and adaptability of the model are ensured, and the high dynamics in the factory environment are overcome. Through the time series stationarity analysis of the data, the non-stationary components in the data can be eliminated, the quality of the input data can be improved, which helps to enhance the prediction ability and accuracy of the subsequent model, and thus helps the operation and maintenance personnel to better understand the operation status of the factory equipment and formulate more reasonable operation and maintenance strategies.

[0041] The above describes the present invention and its implementation manners. Such description is not restrictive. What is shown in the drawings is only one of the implementation manners of the present invention, and the actual structure is not limited thereto. Generally speaking, if those of ordinary skill in the art are inspired by it and without departing from the gist of the present invention creation, without creative design, the structural manners and embodiments similar to the technical solution should all fall within the protection scope of the present invention.

Claims

1. An AI-based business anomaly detection method, characterized in that, Including the following steps: 1): Obtain the runtime data of the production environment through the monitoring system and the log system, including business layer data, hardware layer data, network layer data, and link layer data; 2): Supplement the collected data, classify and label the data information, and define the hierarchical relationship between the data; 3): Send the supplemented data to the AI model for correlation analysis through the time dimension and the space dimension, and conduct link analysis; 4): The AI large model updates the knowledge graph and generates the model according to each operation and maintenance operation; 5): Use a graphical front-end to display the knowledge graph of the root cause of the failure.

2. The method for detecting business anomalies based on AI according to claim 1, characterized in that: Among the steps 1), the collected data includes the business call success rate, business call duration, and business call times. Among them, by analyzing the network traffic data, identify and count the number of business calls; and calculate the data sampling rate of the collected data; create a standardized template file, which contains all required fields, and use a hash table to record the processed log entries, and perform integrity verification on the data fields through a data quality assessment model; By tracking the specific path of the data packet, analyze the detailed situation of the network link, observe the change of the round-trip time, verify the stability and consistency of the network state, improve the accuracy of the data, and conduct comprehensive analysis on the obtained data to identify the bottlenecks, nodes with high latency, or potential failure points in the network.

3. The method for detecting business anomalies based on AI according to claim 1, characterized in that: Among the steps 2), it includes dividing the data labels into business, server, network, and link. The order from the bottom layer to the top layer is link, network, server, and business. According to the attributes and sources of the data items, automatically determine their label ownership, and construct a model containing four levels of link, network, server, and business to calculate the weights of each level.

4. A method for detecting business anomalies based on AI according to claim 1, characterized in that: Among the steps 3), it includes converting all data into a unified format, and performing data cleaning, and constructing a comprehensive knowledge graph containing multi-dimensional information such as devices, networks, and businesses through the data.

5. The method for detecting business anomalies based on AI according to claim 1, characterized in that: Among the steps 4), it includes extracting the failure entity and the solution entity from the operation and maintenance data, adding them as new failure entities to the knowledge graph, realizing the incremental update of the knowledge graph through change detection, change extraction, and graph update, constructing an online learning framework for updating the model parameters, establishing a feedback mechanism, and flowing the operation and maintenance results and manual verification data back to the model.

6. The method for detecting business anomalies based on AI according to claim 1, characterized in that: Among the steps 1), it includes detecting the drift of the data distribution of the business data, hardware data, network data, and link data; for each data set, divide it into multiple windows according to the time series, calculate the mean distribution characteristics of the data within each window, compare the data distribution characteristics of adjacent windows, detect whether there are differences. If significant differences are detected, it is determined as data drift, evaluate the effectiveness of the new assessment model, and consider retraining the model to adapt to the new data distribution.

7. An AI-based business anomaly detection method according to claim 1, characterized in that: Step 1) includes preprocessing operations such as denoising and filtering the data to improve the accuracy of the Fourier transform, preprocessing the data to improve the accuracy of the Fourier transform, decomposing the signal into smaller sub-signals, performing butterfly operations on each sub-signal to obtain intermediate results, finding periodic components in the spectrogram based on the intermediate results, and determining the periodic change pattern of the data based on the periodic components.

8. An AI-based business anomaly detection method according to claim 1, wherein: In step 7), a fast Fourier transform is performed on each sub-signal to transform it from the time domain to the frequency domain. A reference frequency or frequency range is selected, and each sub-signal is phase-adjusted and amplitude-scaled to align it with the reference frequency or frequency range. During the butterfly operation, intermediate results are extracted, and the intermediate results include complex number arrays after each stage of the butterfly operation. The temperature sensor moves to multiple positions in the factory through a roller screw.

9. The method for detecting business anomalies based on AI according to claim 1, wherein: Step 1) also includes analyzing the time series stationarity of the collected business data, hardware data, network data, and link data. For business data, hardware data, network data, and link data, time series diagrams are respectively plotted to observe the overall trend and fluctuation of the data, determine whether there is a unit root in the data sequence, and perform an ADF test on each data set according to the time series. According to the test results, it is judged whether the data meets the requirements of time series stationarity. If the data is not stationary, differential processing is used for processing.

10. An AI-based business anomaly detection method according to claim 9, characterized in that: Step 1) also includes eliminating the linear trend in the data through first-order differencing, performing a unit root test on the differenced sequence to judge whether the differencing processing effectively eliminates the non-stationarity of the data, and plotting the differenced sequence diagram to observe the differenced sequence diagram.

Images