Enterprise business application operation and maintenance situation awareness system

Abstract

The invention discloses an enterprise business application operation and maintenance situation awareness system, and belongs to the technical field of business operation and maintenance, and the system specifically comprises a business topology construction module which is used for collecting inter-service call logs in real time through a data collection agent disposed on a business application server; the exception propagation analysis module is used for receiving the real-time dependency relationship graph generated by the service topology construction module, and the dependency relationship graph is stored in a graph database in a digraph structure; the visual display module is used for reading the current topological state and the anomaly analysis result from the graph database, nodes and edges are rendered by adopting a force-oriented layout algorithm, the node radius is in direct proportion to the resource occupancy rate, and the edge width is in inverse proportion to the calling success rate; according to the invention, efficient perception and accurate presentation of the operation and maintenance situation of the enterprise business application are realized, and the operation and maintenance efficiency and decision accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of business operation and maintenance technology, and in particular to an enterprise business application operation and maintenance situation awareness system. Background Art

[0002] As enterprises advance their digital transformation, business application systems are becoming increasingly complex, with intricate inter-service call relationships. Traditional operations and maintenance methods are no longer able to meet enterprises' needs for efficient business application system operations. In enterprise business application operations and maintenance scenarios, operations and maintenance personnel need to understand the system's operating status in real time and quickly locate the root cause of faults to ensure business continuity and stability.

[0003] Currently, in the field of enterprise business application operations and maintenance, a common practice is to deploy data collection tools on business application servers to collect log data. Log analysis systems then process this data to extract information about inter-service calls and initially construct a business topology. Some enterprises use simple graphical interfaces to display the business topology, presenting inter-service call links as nodes and edges. Others utilize basic anomaly detection algorithms to monitor business application operational data and trigger alerts when abnormal indicators are detected.

[0004] However, existing enterprise business application operations and maintenance solutions have significant limitations. Traditional data collection methods struggle to comprehensively and accurately capture complete information about inter-service calls, are inadequate for processing encrypted communications, and lack standardized processing for collected log data. The lack of effective anomaly propagation analysis mechanisms makes it difficult to quickly locate the root cause of anomalies and assess their impact. Summary of the Invention

[0005] The purpose of this invention is to provide an enterprise business application operation and maintenance situation awareness system to solve the following technical problems:

[0006] Traditional data collection methods struggle to comprehensively and accurately capture complete information about service calls, are inadequate for processing encrypted communications, and lack standardized processing of collected log data. They also lack effective mechanisms for analyzing the spread of anomalies.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] Enterprise business application operation and maintenance situation awareness system, including:

[0009] A business topology building module is used to collect inter-service call logs in real time through a data collection agent deployed on a business application server. The call logs contain the caller application identifier, the callee application identifier, the request timestamp, and the response status code.

[0010] An exception propagation analysis module is used to receive the real-time dependency graph generated by the business topology construction module, wherein the dependency graph is stored in a graph database as a directed graph structure, wherein node attributes include application deployment location and resource occupancy rate, and edge attributes include average response time and call success rate;

[0011] The visualization display module is used to read the current topology status and anomaly analysis results from the graph database, and uses a force-directed layout algorithm to render nodes and edges. The node radius is proportional to the resource occupancy rate, and the edge width is inversely proportional to the call success rate.

[0012] As a further solution of the present invention: in the business topology building module, the data acquisition agent works specifically as follows:

[0013] Inject a log interception component during the container startup phase of the business application. The interception component hijacks all cross-process communication requests, records the complete URL path and header information for HTTP requests, and records the service name and method signature for RPC calls;

[0014] Log data is asynchronously transmitted to the processing cluster via a message queue. The processing cluster aggregates the call logs according to a preset time window. The time window is automatically adjusted based on business peak hours. When the aggregation results are written to the graph database, an incremental update of the dependency graph is triggered.

[0015] When a newly deployed application instance is detected, the node set of the graph database is automatically expanded, and potential dependency edges are pre-generated by analyzing the registry information of the instance.

[0016] As a further solution of the present invention: the hijacking processing of the communication request by the log interception component includes:

[0017] Generate a globally unique tracing identifier for each distributed request. This identifier is transparently transmitted between nodes in the call chain, and the complete propagation path is recorded in the log.

[0018] When decrypting encrypted communications, only necessary metadata fields are extracted, without decoding business-sensitive data. The extracted metadata includes protocol type, payload size, and compression format.

[0019] When a call timeout or retry behavior is detected, the exception type is marked in the log and the number of retries is recorded. The exception types include network jitter, service unavailability, and load overload.

[0020] As a further solution of the present invention: the dependency graph processing flow of the abnormal propagation analysis module is as follows:

[0021] Regularly scan the edge attribute data in the graph database. When the call success rate of an edge continuously drops below the set threshold, mark the edge as unstable.

[0022] Perform source tracing analysis on unstable edges, find all call edges that share the same callee, and calculate the comprehensive health index of these edges;

[0023] When the comprehensive health index is lower than the warning line, a topology update instruction is sent to the visualization display module. The update instruction contains a list of identifications of affected nodes and a recommended visualization emphasis method.

[0024] As a further solution of the present invention: the calculation method of the comprehensive health index is:

[0025] The variance of the success rates of all call records within the time window is selected as the basic stability metric. The sliding average of the CPU and memory usage of the called party's resources is superimposed. The call path length is introduced as a decay factor to perform weighted correction on the health of indirect dependencies. The final indicator value is normalized to a score between 0 and 1 through a three-layer feedforward neural network model.

[0026] As a further solution of the present invention: in the visualization display module, topology update specifically includes:

[0027] Establish an incremental topology update channel. When the graph database detects a change in node or edge attributes, it generates a binary message package containing the change type and change data. The message package is distributed to each visualization client via a message queue. After parsing, the client compares the version number of the local topology map and only applies the data blocks with the updated version. A smooth transition animation is implemented for node status changes. The intermediate value of the attribute is calculated through an interpolation algorithm, and the node color and size are gradually updated within a set time interval. A fade-in and fade-out effect is used for newly added or deleted topology elements, and the duration is inversely proportional to the complexity of the current topology map. Establish an update conflict detection mechanism. When multiple clients modify the same topology element at the same time, the change with the latest timestamp will prevail, and a version conflict prompt will be displayed on the interface.

[0028] As a further solution of the present invention: in the visualization display module, the force-directed layout algorithm optimization strategy includes:

[0029] The charge force parameters are dynamically adjusted according to the strength of the call relationship between nodes. The stronger the relationship, the smaller the repulsive force between nodes. Additional spring force is applied to edges in abnormal states to keep them in a straight line in the layout for easy observation. When the user focuses on a specific node, the position of the node and its first-degree neighbors is temporarily frozen, while the remaining nodes continue to move according to the physical model. During the layout process, node overlap is detected in real time, and radial diffusion force is applied to the nodes in the overlapping area.

[0030] As a further solution of the present invention: in the visualization display module, the rendering optimization method further includes:

[0031] WebGL technology is used to achieve efficient drawing of large-scale nodes. The geometric data of each node includes position, color and status mark. A viewport-related detail level model is established. When the zoom level is lower than the threshold, only the node skeleton is rendered. After exceeding the threshold, the complete topology information is gradually loaded. When implementing the trajectory playback function for historical abnormal paths, a double buffering mechanism is used to ensure animation smoothness. The front buffer calculates the next frame data while the back buffer renders the current frame.

[0032] As a further solution of the present invention: in the service topology building module, collecting logs specifically includes:

[0033] Lightweight probes are automatically injected when business applications are deployed. The probes obtain inter-service call information by intercepting network layer data packets, including source IP address, target IP address, protocol type and message size. For environments using a service mesh architecture, enhanced call link data is collected directly from the sidecar agent, including complete request header information and tracking identifiers. The collected raw logs are cleaned and standardized in real time by the stream processing engine. The cleaning rules include removing heartbeat detection traffic, merging duplicate request records, and supplementing missing timestamp fields. The standardized log records are stored in the distributed file system according to the preset partitioning strategy. The partition key is composed of the call time and service name to ensure that the call records of the same service are continuously distributed on the physical storage.

[0034] As a further solution of the present invention: in the abnormal propagation analysis module, the graph database specifically includes:

[0035] An attribute graph model is used to store the dependencies between business applications. The primary key of a node is jointly generated by the computer room number and container ID where the application is deployed. The attributes of the edge include detailed performance indicators of the most recent calls. When establishing a graph index, both node and edge attributes are considered, and a materialized view is established for the call path of frequently queried queries. When executing anomaly propagation analysis queries, the abnormal node is first quickly located through the index, and then the breadth-first search algorithm is used to traverse the downstream dependency chain, and the path weight is dynamically calculated during the traversal process. For ultra-large-scale topology graphs, a sharded storage strategy is implemented, with each shard corresponding to a business domain, and cross-shard queries are coordinated and executed through the federated query engine.

[0036] Beneficial effects of the present invention:

[0037] The present invention injects a log interception component into the data collection agent in the business topology construction module during the container startup phase to achieve comprehensive real-time collection of service call logs, and combines message queues and automatically adjusted time window aggregation calculations to ensure the dynamic update of business topology relationships; the abnormal propagation analysis module is based on the graph database of the attribute graph model, uses success rate threshold judgment and comprehensive health index calculation, and combines success rate variance, resource utilization, call path length and neural network normalization to perform traceability analysis, accurately locate the root cause of the abnormality and evaluate the impact range; the visualization display module adopts an optimized force-directed layout algorithm, dynamically adjusts the charge force according to the strength of the call relationship between nodes, applies spring force to abnormal edges, combines WebGL rendering technology and incremental topology update mechanism, and intuitively presents complex business relationships and abnormal states through smooth transition animation and update conflict detection. The above key technical features effectively solve the problems of incomplete data collection, static business topology, inaccurate abnormal analysis and poor visualization effect in existing solutions, realize efficient perception and accurate presentation of enterprise business application operation and maintenance status, and improve operation and maintenance efficiency and decision-making accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The present invention will be further described below with reference to the accompanying drawings.

[0039] Figure 1 It is a schematic diagram of the system workflow of the present invention;

[0040] Figure 2 Schematic diagram of the workflow of the abnormal propagation analysis module of the present invention;

[0041] Figure 3 It is a schematic diagram of the workflow of the visual display module of the present invention. DETAILED DESCRIPTION

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0043] See also Figure 1-Figure 3 As shown, the present invention is an enterprise business application operation and maintenance situation awareness system, including:

[0044] The business topology building module deploys a data collection agent to the business application server to collect inter-service call logs in real time. The log data contains key information such as the caller application ID, the callee application ID, the request timestamp, and the response status code. The data collection agent injects a log interception component during the startup phase of the business application container. This component hijacks cross-process communication requests, records the full URL path and header information for HTTP requests, and records the service name and method signature for RPC calls. The collected log data is asynchronously transmitted to the processing cluster via a message queue. The cluster aggregates the call logs according to a preset time window that can be automatically adjusted according to business peak periods. The calculation results are written to the graph database, triggering an incremental update of the dependency graph. When a newly deployed application instance is detected, the graph database node set is automatically expanded, and potential dependency edges are pre-generated based on the instance registration center information.

[0045] The anomaly propagation analysis module receives the real-time dependency graph generated by the business topology construction module, which is stored in a graph database as a directed graph. The graph database uses an attributed graph model, where node attributes record information such as application deployment location and resource utilization, and edge attributes store metrics such as average response time and call success rate. The module regularly scans edge attribute data in the graph database. When the call success rate of an edge continuously decreases and exceeds a set threshold, it is marked as unstable. A traceability analysis is performed on unstable edges, identifying all call edges that share the same callee. The impact of the anomaly is assessed by calculating the variance of the fusion success rate, the sliding average of the callee's resource CPU and memory utilization, and the call path length attenuation factor, and then normalizing the overall health index using a three-layer feedforward neural network model. When the overall health index falls below the warning line, a topology update instruction containing a list of affected node identifiers and a recommended visualization emphasis method is sent to the visualization display module.

[0046] The visualization module reads the current topology state and anomaly analysis results from the graph database and renders nodes and edges using a force-directed layout algorithm. The node radius is proportional to resource utilization, while the edge width is inversely proportional to the call success rate. During the layout algorithm's execution, the charge force parameters are dynamically adjusted based on the strength of the call relationships between nodes. Additional spring force is applied to edges in an anomaly state to maintain their straightness. When the user focuses on a specific node, the node and its first-degree neighbors are frozen, while the remaining nodes continue to move. Node overlap is detected and handled in real time, with radial diffusion forces applied to nodes in the overlapping area. Furthermore, the module uses WebGL technology for efficient rendering of large-scale nodes, establishes a viewport-dependent level-of-detail model, and adjusts rendering content based on zoom level. For historical anomaly paths, a double-buffering mechanism is used to enable trajectory playback. For topology updates, an incremental update channel is established. When graph database properties change, binary message packets are generated and distributed to clients via a message queue. After parsing and comparing version numbers, the client applies only the updated data blocks. Smooth transition animations are used for node state changes, and fade-in and fade-out effects are applied for added or deleted topological elements. An update conflict detection mechanism is also implemented to handle conflicting modifications by multiple clients.

[0047] In a preferred embodiment of the present invention, in the service topology building module, the data collection agent works as follows:

[0048] During the container startup phase of a business application, the system automatically injects a log interception component. This component plays a critical role, hijacking all cross-process communication requests. For HTTP requests, the log interception component accurately records the complete URL path and header information, which is crucial for subsequent analysis of the request's source, destination, and detailed characteristics. For RPC calls, the log interception component records the service name and method signature, helping to clarify the call relationships between different services.

[0049] The collected log data will be transmitted asynchronously via the message queue, which can avoid excessive impact on system performance during data transmission. After the message queue transfers the log data to the processing cluster, the processing cluster will aggregate and calculate the call logs according to the preset time window. It is worth noting that the division of the time window is not fixed, but is automatically adjusted according to the peak business period. During peak business periods, the system will narrow the time window to capture changes in calls between services more promptly; during business off-peak periods, the time window will be expanded accordingly to reduce unnecessary computing overhead. When the aggregation results are written to the graph database, it will trigger an incremental update of the dependency graph to ensure that the business topology can reflect the latest dependencies between services in real time.

[0050] When the system detects a newly deployed application instance, it automatically expands the graph database's node set. This is because the addition of a new application instance inevitably impacts the existing business topology. Simultaneously, the system pre-generates potential dependency edges by analyzing the instance's registry information. This registry information contains various configuration and dependency information about the application instance. By analyzing this information, the system can predict potential call relationships between the instance and other applications, providing more comprehensive information for subsequent anomaly analysis and situational awareness.

[0051] In a preferred embodiment of the present invention, the hijacking process of the communication request by the log interception component includes:

[0052] First, the log interception component generates a globally unique tracing identifier for each distributed request. This identifier is transparently transmitted between nodes in the call chain, and the complete propagation path is recorded in the log. By recording the tracing identifier and propagation path, operations and maintenance personnel can clearly understand the flow of each request throughout the entire system, which is very helpful for locating problems and analyzing system performance.

[0053] Secondly, when decrypting encrypted communications, the log interception component extracts only necessary metadata fields and does not decode sensitive business data. This ensures that critical information for analysis is obtained while protecting the security of business data. Extracted metadata includes protocol type, payload size, and compression format. This information can help operations personnel understand the basic characteristics and performance of communications.

[0054] Finally, when the log interception component detects a call timeout or retry, it marks the exception type and records the number of retries in the log. Exception types include network jitter, service unavailability, and load overload. By recording the exception type and retry count, operations and maintenance personnel can quickly determine the severity and possible causes of the problem and take appropriate measures to address it.

[0055] In another preferred embodiment of the present invention, the dependency graph processing flow of the exception propagation analysis module is as follows:

[0056] The module sets a fixed period and regularly scans the edge attribute data in the graph database. When it is detected that the call success rate of a certain edge drops by more than a preset threshold during the continuous monitoring period, the edge is immediately marked as unstable. For the edges marked as unstable, the module starts the traceability analysis process and finds the set of all calling edges that share the same callee by querying the graph database. Subsequently, the comprehensive health index is calculated for the edges in the set to evaluate the impact range and severity of the anomaly. If the calculated comprehensive health index is lower than the preset warning line, the module immediately sends a topology update instruction to the visualization display module. The instruction contains a list of identifications of the affected nodes and a recommended visualization emphasis method so that the visualization display module can present the anomaly in a timely manner.

[0057] In a preferred embodiment of the present invention, the comprehensive health index is calculated as follows:

[0058] First, the variance of the success rate of all call records within the time window is selected as the basic stability metric. This variance value reflects the degree of fluctuation of the call success rate in the time series. Secondly, the sliding average of the CPU and memory usage of the callee's resources is included in the calculation to measure the impact of the callee's resource load on the call health. Furthermore, the call path length is introduced as an attenuation factor to perform a weighted correction on the health of indirect dependencies, so that the farther the dependency is from the source of the anomaly, the lower the weight in the health calculation. Finally, the above multi-dimensional data is used as input and processed through a three-layer feedforward neural network model. The final indicator value is normalized to a score between 0 and 1, which is convenient for intuitively judging the health status of the dependency.

[0059] In another preferred embodiment of the present invention, in the visualization module, topology updating specifically includes:

[0060] The system establishes an incremental topology update channel. When the graph database detects a change in a node or edge attribute, it automatically generates a binary message packet containing the change type (addition, modification, deletion) and the change data. This message packet is distributed to each visualization client via a message queue. Upon receiving the message packet, the client parses the content and compares it with the locally stored topology version number. Only the updated data blocks are applied to avoid duplicate processing of already updated data.

[0061] For node status changes, the visualization module uses an interpolation algorithm to calculate intermediate attribute values. It then gradually updates node color and size within a set interval, creating a smooth transition animation effect that allows operators to intuitively perceive node status changes. For added or deleted topological elements, the module uses a fade-in / fade-out effect, with the duration of the effect inversely proportional to the complexity of the current topology. The more complex the topology, the shorter the fade-in / fade-out effect, reducing visual clutter.

[0062] At the same time, the module establishes an update conflict detection mechanism. When multiple clients modify the same topology element at the same time, the system performs the update based on the latest change in the timestamp and displays a version conflict prompt message on the interface to ensure the consistency and accuracy of the topology display.

[0063] In another preferred embodiment of the present invention, in the visualization display module, the force-directed layout algorithm optimization strategy includes:

[0064] The system dynamically adjusts the charge force parameters based on the strength of the call relationship between nodes, so that the repulsive force between nodes with stronger call relationship strength is smaller, thereby allowing closely connected nodes to be closer in the layout. For edges in an abnormal state, the system applies additional spring force to keep them in a straight line in the layout, making it easier for operation and maintenance personnel to quickly identify abnormal links. When a user focuses on a specific node, the position of the node and its first-degree neighbors will be temporarily frozen, while the remaining nodes continue to move according to the physical model, making it easier for users to concentrate on observing the target node and its directly related nodes. At the same time, during the layout process, the system detects node overlap in real time. Once overlap is found, it applies radial diffusion force to the nodes in the overlapping area to avoid node stacking and causing confusion in information display.

[0065] In a preferred embodiment of the present invention, in the visualization display module, the rendering optimization method further includes:

[0066] The module uses WebGL technology to efficiently render large-scale nodes. Each node's geometric data includes information such as position, color, and status markers. It also establishes a viewport-dependent level of detail model. When the zoom level falls below a set threshold, only the node skeleton is rendered to reduce the rendering load. When the zoom level exceeds the threshold, the complete topology information is gradually loaded to ensure detailed display. When replaying historical abnormal paths, a double buffering mechanism is used: the front buffer is used to calculate the next frame data, while the back buffer simultaneously renders the current frame, ensuring smooth animation operation.

[0067] In another preferred embodiment of the present invention, in the service topology building module, collecting logs specifically includes:

[0068] During the business application deployment phase, the system automatically injects lightweight probes, which intercept network layer data packets to obtain inter-service call information such as source IP address, destination IP address, protocol type, and message size. For environments that use a service mesh architecture, enhanced call link data containing complete request header information and tracking identifiers is collected directly from the sidecar agent. The collected raw logs enter the stream processing engine for real-time cleaning and standardization. Data quality is improved by rules such as removing heartbeat detection traffic, merging duplicate request records, and supplementing missing timestamp fields. The standardized log records are stored in the distributed file system according to the preset partitioning strategy, with the call time and service name forming the partition key to ensure that the call records of the same service are continuously distributed on the physical storage, facilitating subsequent rapid retrieval and analysis.

[0069] In another preferred embodiment of the present invention, in the anomaly propagation analysis module, the graph database specifically includes:

[0070] The graph database used by the anomaly propagation analysis module adopts an attribute graph model to store the dependencies between business applications. The node primary key is jointly generated by the computer room number and the container ID where the application is deployed, and the edge attributes record the detailed performance indicators of the most recent calls. When establishing the graph index, both node attributes and edge attributes are considered, and a materialized view is established for the frequently queried call path to accelerate query efficiency. When executing anomaly propagation analysis queries, the abnormal node is first quickly located through the index, and then the breadth-first search algorithm is used to traverse the downstream dependency chain. During the traversal process, the path weight is dynamically calculated to evaluate the scope of anomaly propagation and the degree of impact. For ultra-large-scale topological graphs, a sharded storage strategy is implemented, with each shard corresponding to a business domain. Cross-shard queries are coordinated and executed by the federated query engine to ensure query performance and data management efficiency under large-scale data.

[0071] The above is a detailed description of an embodiment of the present invention. However, the content described is only a preferred embodiment of the present invention and should not be considered to limit the scope of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. Enterprise business application operation and maintenance situation awareness system, characterized by: include: A business topology building module is used to collect inter-service call logs in real time through a data collection agent deployed on a business application server. The call logs contain the caller application identifier, the callee application identifier, the request timestamp, and the response status code. An exception propagation analysis module is used to receive the real-time dependency graph generated by the business topology construction module, wherein the dependency graph is stored in a graph database as a directed graph structure, wherein node attributes include application deployment location and resource occupancy rate, and edge attributes include average response time and call success rate; The visualization display module is used to read the current topology status and anomaly analysis results from the graph database, and uses a force-directed layout algorithm to render nodes and edges. The node radius is proportional to the resource occupancy rate, and the edge width is inversely proportional to the call success rate.

2. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the business topology building module, the data collection agent works as follows: Inject a log interception component during the container startup phase of the business application. The interception component hijacks all cross-process communication requests, records the complete URL path and header information for HTTP requests, and records the service name and method signature for RPC calls; Log data is asynchronously transmitted to the processing cluster via a message queue. The processing cluster aggregates the call logs according to a preset time window. The time window is automatically adjusted based on business peak hours. When the aggregation results are written to the graph database, an incremental update of the dependency graph is triggered. When a newly deployed application instance is detected, the node set of the graph database is automatically expanded, and potential dependency edges are pre-generated by analyzing the registry information of the instance.

3. The enterprise business application operation and maintenance situation awareness system according to claim 2, characterized in that: The hijacking process of the communication request by the log interception component includes: Generate a globally unique tracing identifier for each distributed request. This identifier is transparently transmitted between nodes in the call chain, and the complete propagation path is recorded in the log. When decrypting encrypted communications, only necessary metadata fields are extracted, without decoding business-sensitive data. The extracted metadata includes protocol type, payload size, and compression format. When a call timeout or retry behavior is detected, the exception type is marked in the log and the number of retries is recorded. The exception types include network jitter, service unavailability, and load overload.

4. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: The dependency graph processing flow of the exception propagation analysis module is as follows: Regularly scan the edge attribute data in the graph database. When the call success rate of an edge continuously drops below the set threshold, mark the edge as unstable. Perform source tracing analysis on unstable edges, find all call edges that share the same callee, and calculate the comprehensive health index of these edges; When the comprehensive health index is lower than the warning line, a topology update instruction is sent to the visualization display module. The update instruction contains a list of identifications of affected nodes and a recommended visualization emphasis method.

5. The enterprise business application operation and maintenance situation awareness system according to claim 4, characterized in that: The calculation method of the comprehensive health index is: The variance of the success rates of all call records within the time window is selected as the basic stability metric; The sliding average of the CPU and memory usage of the callee resources is superimposed; the call path length is introduced as a decay factor to perform weighted correction on the health of indirect dependencies; the final indicator value is normalized to a score between 0 and 1 through a three-layer feedforward neural network model.

6. The enterprise business application operation and maintenance situation awareness system according to claim 4, characterized in that: In the visualization module, topology update specifically includes: Establish an incremental topology update channel. When the graph database detects a change in node or edge attributes, it generates a binary message package containing the change type and change data. The message package is distributed to each visualization client via a message queue. After parsing, the client compares the version number of the local topology map and only applies the data blocks with the updated version. A smooth transition animation is implemented for node status changes. The intermediate value of the attribute is calculated through an interpolation algorithm, and the node color and size are gradually updated within a set time interval. A fade-in and fade-out effect is used for newly added or deleted topology elements, and the duration is inversely proportional to the complexity of the current topology map. Establish an update conflict detection mechanism. When multiple clients modify the same topology element at the same time, the change with the latest timestamp will prevail, and a version conflict prompt will be displayed on the interface.

7. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the visualization module, the force-directed layout algorithm optimization strategy includes: The charge force parameters are dynamically adjusted according to the strength of the call relationship between nodes. The stronger the relationship, the smaller the repulsive force between nodes. Additional spring force is applied to edges in abnormal states to keep them in a straight line in the layout for easy observation. When the user focuses on a specific node, the position of the node and its first-degree neighbors is temporarily frozen, while the remaining nodes continue to move according to the physical model. During the layout process, node overlap is detected in real time, and radial diffusion force is applied to the nodes in the overlapping area.

8. The enterprise business application operation and maintenance situation awareness system according to claim 7, characterized in that: In the visualization display module, the rendering optimization method further includes: WebGL technology is used to achieve efficient drawing of large-scale nodes. The geometric data of each node includes position, color and status mark. A viewport-related detail level model is established. When the zoom level is lower than the threshold, only the node skeleton is rendered. After exceeding the threshold, the complete topology information is gradually loaded. When implementing the trajectory playback function for historical abnormal paths, a double buffering mechanism is used to ensure animation smoothness. The front buffer calculates the next frame data while the back buffer renders the current frame.

9. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the business topology building module, collecting logs specifically includes: Lightweight probes are automatically injected when business applications are deployed. The probes obtain inter-service call information by intercepting network layer data packets, including source IP address, target IP address, protocol type and message size. For environments using a service mesh architecture, enhanced call link data is collected directly from the sidecar agent, including complete request header information and tracking identifiers. The collected raw logs are cleaned and standardized in real time by the stream processing engine. The cleaning rules include removing heartbeat detection traffic, merging duplicate request records, and supplementing missing timestamp fields. The standardized log records are stored in the distributed file system according to the preset partitioning strategy. The partition key is composed of the call time and service name to ensure that the call records of the same service are continuously distributed on the physical storage.

10. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the anomaly propagation analysis module, the graph database specifically includes: An attribute graph model is used to store the dependencies between business applications. The primary key of a node is jointly generated by the computer room number and container ID where the application is deployed. The attributes of the edge include detailed performance indicators of the most recent calls. When establishing a graph index, both node and edge attributes are considered, and a materialized view is established for the call path of frequently queried queries. When executing anomaly propagation analysis queries, the abnormal node is first quickly located through the index, and then the breadth-first search algorithm is used to traverse the downstream dependency chain, and the path weight is dynamically calculated during the traversal process. For ultra-large-scale topology graphs, a sharded storage strategy is implemented, with each shard corresponding to a business domain, and cross-shard queries are coordinated and executed through the federated query engine.

11. Enterprise business application operation and maintenance situation awareness system, characterized by: include: A business topology building module is used to collect inter-service call logs in real time through a data collection agent deployed on a business application server. The call logs contain the caller application identifier, the callee application identifier, the request timestamp, and the response status code. An exception propagation analysis module is used to receive the real-time dependency graph generated by the business topology construction module, wherein the dependency graph is stored in a graph database as a directed graph structure, wherein node attributes include application deployment location and resource occupancy rate, and edge attributes include average response time and call success rate; The visualization display module is used to read the current topology status and anomaly analysis results from the graph database, and uses a force-directed layout algorithm to render nodes and edges. The node radius is proportional to the resource occupancy rate, and the edge width is inversely proportional to the call success rate.

12. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the business topology building module, the data collection agent works as follows: Inject a log interception component during the container startup phase of the business application. The interception component hijacks all cross-process communication requests, records the complete URL path and header information for HTTP requests, and records the service name and method signature for RPC calls; Log data is asynchronously transmitted to the processing cluster via a message queue. The processing cluster aggregates the call logs according to a preset time window. The time window is automatically adjusted based on business peak hours. When the aggregation results are written to the graph database, an incremental update of the dependency graph is triggered. When a newly deployed application instance is detected, the node set of the graph database is automatically expanded, and potential dependency edges are pre-generated by analyzing the registry information of the instance.

13. The enterprise business application operation and maintenance situation awareness system according to claim 2, characterized in that: The hijacking process of the communication request by the log interception component includes: Generate a globally unique tracing identifier for each distributed request. This identifier is transparently transmitted between nodes in the call chain, and the complete propagation path is recorded in the log. When decrypting encrypted communications, only necessary metadata fields are extracted, without decoding business-sensitive data. The extracted metadata includes protocol type, payload size, and compression format. When a call timeout or retry behavior is detected, the exception type is marked in the log and the number of retries is recorded. The exception types include network jitter, service unavailability, and load overload.

14. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: The dependency graph processing flow of the exception propagation analysis module is as follows: Regularly scan the edge attribute data in the graph database. When the call success rate of an edge continuously drops below the set threshold, mark the edge as unstable. Perform source tracing analysis on unstable edges, find all call edges that share the same callee, and calculate the comprehensive health index of these edges; When the comprehensive health index is lower than the warning line, a topology update instruction is sent to the visualization display module. The update instruction contains a list of identifications of affected nodes and a recommended visualization emphasis method.

15. The enterprise business application operation and maintenance situation awareness system according to claim 4, characterized in that: The calculation method of the comprehensive health index is: The variance of the success rates of all call records within the time window is selected as the basic stability metric; The sliding average of the CPU and memory usage of the callee resources is superimposed; the call path length is introduced as a decay factor to perform weighted correction on the health of indirect dependencies; the final indicator value is normalized to a score between 0 and 1 through a three-layer feedforward neural network model.

16. The enterprise business application operation and maintenance situation awareness system according to claim 4, characterized in that: In the visualization module, topology update specifically includes: Establish an incremental topology update channel. When the graph database detects a change in node or edge attributes, it generates a binary message package containing the change type and change data. The message package is distributed to each visualization client via a message queue. After parsing, the client compares the version number of the local topology map and only applies the data blocks with the updated version. A smooth transition animation is implemented for node status changes. The intermediate value of the attribute is calculated through an interpolation algorithm, and the node color and size are gradually updated within a set time interval. A fade-in and fade-out effect is used for newly added or deleted topology elements, and the duration is inversely proportional to the complexity of the current topology map. Establish an update conflict detection mechanism. When multiple clients modify the same topology element at the same time, the change with the latest timestamp will prevail, and a version conflict prompt will be displayed on the interface.

17. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the visualization module, the force-directed layout algorithm optimization strategy includes: The charge force parameters are dynamically adjusted according to the strength of the call relationship between nodes. The stronger the relationship, the smaller the repulsive force between nodes. Additional spring force is applied to edges in abnormal states to keep them in a straight line in the layout for easy observation. When the user focuses on a specific node, the position of the node and its first-degree neighbors is temporarily frozen, while the remaining nodes continue to move according to the physical model. During the layout process, node overlap is detected in real time, and radial diffusion force is applied to the nodes in the overlapping area.

18. The enterprise business application operation and maintenance situation awareness system according to claim 7, characterized in that: In the visualization display module, the rendering optimization method further includes: WebGL technology is used to achieve efficient drawing of large-scale nodes. The geometric data of each node includes position, color and status mark. A viewport-related detail level model is established. When the zoom level is lower than the threshold, only the node skeleton is rendered. After exceeding the threshold, the complete topology information is gradually loaded. When implementing the trajectory playback function for historical abnormal paths, a double buffering mechanism is used to ensure animation smoothness. The front buffer calculates the next frame data while the back buffer renders the current frame.

19. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the business topology building module, collecting logs specifically includes: Lightweight probes are automatically injected when business applications are deployed. The probes obtain inter-service call information by intercepting network layer data packets, including source IP address, target IP address, protocol type and message size. For environments using a service mesh architecture, enhanced call link data is collected directly from the sidecar agent, including complete request header information and tracking identifiers. The collected raw logs are cleaned and standardized in real time by the stream processing engine. The cleaning rules include removing heartbeat detection traffic, merging duplicate request records, and supplementing missing timestamp fields. The standardized log records are stored in the distributed file system according to the preset partitioning strategy. The partition key is composed of the call time and service name to ensure that the call records of the same service are continuously distributed on the physical storage.

20. The enterprise business application operation and maintenance situation awareness system according to claim 1, characterized in that: In the anomaly propagation analysis module, the graph database specifically includes: An attribute graph model is used to store the dependencies between business applications. The primary key of a node is jointly generated by the computer room number and container ID where the application is deployed. The attributes of the edge include detailed performance indicators of the most recent calls. When establishing a graph index, both node and edge attributes are considered, and a materialized view is established for the call path of frequently queried queries. When executing anomaly propagation analysis queries, the abnormal node is first quickly located through the index, and then the breadth-first search algorithm is used to traverse the downstream dependency chain, and the path weight is dynamically calculated during the traversal process. For ultra-large-scale topology graphs, a sharded storage strategy is implemented, with each shard corresponding to a business domain, and cross-shard queries are coordinated and executed through the federated query engine.

Images