Early warning method and system for operation and maintenance delivery abnormal event based on cloud platform

Abstract

The invention discloses an operation and maintenance delivery abnormal event early warning method and system based on a cloud platform, and relates to the technical field of event early warning. The method comprises the steps of collecting a real-time operation data set of an operation and maintenance delivery link, performing multi-dimensional analysis based on the real-time operation data set, and constructing a multi-dimensional monitoring data set; performing context correlation analysis on the multi-dimensional monitoring data set, and constructing dynamic baseline parameters; deviation degree calculation is carried out on the real-time operation data set, a data deviation value is generated to trigger the cloud platform to carry out abnormal event judgment of operation and maintenance delivery, and an abnormal judgment result is obtained; performing event association according to an abnormality judgment result, determining an abnormality risk level, synchronizing the abnormality risk level to a cloud platform for tracing, generating a multi-level early warning instruction, and pushing the multi-level early warning instruction to a target terminal for graded warning. The technical problem that early warning of the operation and maintenance delivery event is not accurate and timely enough in the prior art is solved, and the technical effect of improving the accuracy and timeliness of early warning of the abnormal event is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of event early warning, in particular to an operation and maintenance delivery abnormal event early warning method and system based on a cloud platform. BACKGROUND

[0002] In the construction and operation process of modern information systems, operation and maintenance delivery, as an important link to ensure the stable operation of the system and service quality, its efficiency and reliability are increasingly valued. With the increasing complexity of system architecture and the growing diversity of business, the operation and maintenance delivery process is facing challenges such as many tasks, long links, large data volume, and the occurrence of abnormal events is becoming more and more frequent. The existing operation and maintenance event early warning mechanism relies on fixed thresholds or single-dimensional indicators for judgment, which is difficult to timely perceive potential risks in complex scenarios, and has problems such as early warning lag, high false alarm rate, and lack of risk classification, which affects the operation and maintenance response efficiency and service guarantee capability. SUMMARY

[0003] The present application provides an operation and maintenance delivery abnormal event early warning method and system based on a cloud platform, which solves the technical problem of inaccurate and timely operation and maintenance delivery event early warning in the prior art.

[0004] In a first aspect, the present application provides an operation and maintenance delivery abnormal event early warning method based on a cloud platform, which comprises: Collecting a real-time running data set of an operation and maintenance delivery link, performing multi-dimensional analysis based on the real-time running data set, and constructing a multi-dimensional monitoring data set; performing context correlation analysis on the multi-dimensional monitoring data set, and constructing a dynamic baseline parameter; calculating the deviation degree of the real-time running data set based on the dynamic baseline parameter, generating a data deviation value to trigger the cloud platform to determine an abnormal event of operation and maintenance delivery, and obtaining an abnormal determination result; performing event correlation according to the abnormal determination result, determining an abnormal risk level, synchronizing the abnormal risk level to the cloud platform for tracing, generating a multi-level early warning instruction, and pushing the multi-level early warning instruction to a target terminal for hierarchical alarm.

[0005] In a second aspect, the present application provides an operation and maintenance delivery abnormal event early warning system based on a cloud platform, which comprises: Data acquisition module: collects real-time operation data sets of the operation and maintenance delivery link, performs multi-dimensional analysis based on the real-time operation data sets, and constructs a multi-dimensional monitoring data set; association analysis module: performs context association analysis on the multi-dimensional monitoring data sets and constructs dynamic baseline parameters; judgment module: calculates the deviation of the real-time operation data sets based on the dynamic baseline parameters, generates data deviation values ​​to trigger the cloud platform to perform abnormal event judgment on operation and maintenance delivery, and obtains abnormal judgment results; early warning module: performs event correlation according to the abnormal judgment results, determines the abnormal risk level, synchronizes the abnormal risk level to the cloud platform for tracing, generates multi-level early warning instructions, and pushes the multi-level early warning instructions to the target terminal for graded alarms.

[0006] One or more technical solutions provided in this application have at least the following technical effects or advantages: First, the real-time operation data set of the operation and maintenance delivery link is collected, and a multi-dimensional analysis is performed based on the real-time operation data set to construct a multi-dimensional monitoring data set. Next, a context association analysis is performed on the multi-dimensional monitoring data set to construct dynamic baseline parameters. Then, the deviation of the real-time operation data set is calculated based on the dynamic baseline parameters, and the data deviation value is generated to trigger the cloud platform to perform abnormal event judgment for operation and maintenance delivery, and obtain the abnormal judgment result. Finally, according to the abnormal judgment result, event correlation is performed to determine the abnormal risk level, and the abnormal risk level is synchronized to the cloud platform for tracing, and a multi-level warning instruction is generated. The multi-level warning instruction is pushed to the target terminal for graded alarm. The technical problem of insufficient accuracy and timeliness of operation and maintenance delivery event warning in the existing technology is solved, and the technical effect of improving the accuracy and timeliness of abnormal event warning is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0008] Figure 1 A flowchart of a method for warning abnormal events in operation and maintenance delivery based on a cloud platform provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of the cloud platform-based operation and maintenance delivery abnormal event warning system provided in an embodiment of the present application.

[0009] Description of the accompanying drawings: data collection module 11, correlation analysis module 12, determination module 13, early warning module 14. DETAILED DESCRIPTION

[0010] The application provides a cloud platform-based operation and maintenance delivery exception event early warning method and system, which solves the technical problem of inaccurate and timely operation and maintenance delivery event early warning in the prior art.

[0011] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the application.

[0012] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server comprising a series of steps or units does not have to be limited to the clearly listed steps or units, but can include other steps or modules that are not clearly listed or inherent to the process, method, product or device.

[0013] Embodiment one, as shown in the application provides a cloud platform-based operation and maintenance delivery exception event early warning method, wherein the method comprises: Figure 1 collecting real-time running data sets of operation and maintenance delivery links, performing multi-dimensional analysis based on the real-time running data sets, and constructing multi-dimensional monitoring data sets.

[0014] The operation and maintenance delivery link refers to a data transmission and operation process covering multiple stages of resource configuration, task scheduling, service deployment, monitoring management, etc. By collecting real-time running data of each key node in the operation and maintenance delivery link, real-time running data sets are obtained; then the real-time running data sets are cleaned, denoised and standardized, and analyzed in time dimension and space dimension to obtain multi-dimensional monitoring data sets.

[0015] Further, collecting real-time running data sets of operation and maintenance delivery links, performing multi-dimensional analysis based on the real-time running data sets, and constructing multi-dimensional monitoring data sets, the method comprises: traversing a cloud platform to extract operation and maintenance delivery links for operation and maintenance delivery node identification, determining a plurality of target nodes; deploying a distributed probe cluster based on the plurality of target nodes, collecting real-time running data sets of the operation and maintenance delivery links through the distributed probe cluster, obtaining real-time running data sets; taking a delivery pipeline event as a reference time axis, performing spatio-temporal alignment of global event synchronization on the real-time running data sets, obtaining a spatio-temporal alignment result; performing dynamic multi-dimensional analysis based on the spatio-temporal alignment result, obtaining an analysis feature matrix, slicing and storing the analysis feature matrix according to delivery stages, and obtaining the multi-dimensional monitoring data sets.

[0016] ​By traversing the operation and delivery task execution process deployed on the cloud platform, key operation and delivery nodes in each task link are identified and extracted. Specifically, by analyzing the delivery pipeline configuration file (such as CI / CD configuration, container orchestration definition, automation script, etc.) and combining the actual running log and metadata, all functional units involved in delivery execution are uniquely identified, thereby determining multiple target nodes. Each target node can be represented as a logical processing unit, such as a build node, a deployment node, a test node, and an online node.

[0017] Based on the identified multiple target nodes, a distributed probe cluster is deployed in the host environment where the nodes are located. The probe cluster is composed of multiple probe units and adopts an edge collection + center aggregation architecture, which can collect the running state data of the target nodes in the operation and delivery process in real time to form a real-time running data set. The real-time running data set includes but is not limited to CPU utilization, memory occupation, disk and network I / O, container or service state, execution time, error log, upstream and downstream communication delay, and other key indicators. All collected data is aggregated to the monitoring center of the cloud platform after preliminary encoding locally.

[0018] To ensure the consistency of cross-node data on the time axis, the system takes the key events in the delivery pipeline (such as task creation, build start, test execution, deployment trigger, etc.) as the reference time axis to synchronize all the running data collected by the nodes globally. Specifically, through a unified event timestamp mechanism and link identification, the data of different nodes in the same event chain are time-sequentially matched, and the time dislocation caused by system clock deviation or delay is eliminated, thereby obtaining the spatio-temporally aligned real-time data set.

[0019] The system performs dynamic multi-dimensional analysis based on the spatio-temporal alignment result. Specifically, the system takes a certain time interval as a sliding window to perform sharding processing on the data stream, extracts multiple structured running indicators in each sliding window, and constructs an analysis feature vector; the feature vectors from different nodes are classified according to the delivery stage (such as the build stage, the deployment stage, the test stage, etc.) and combined into a feature matrix to form an analysis feature matrix reflecting the current delivery state. Finally, the system stores the analysis feature matrix according to the delivery stage to form a phased monitoring data subset, and each subset is indexed by timestamp, node identification, and indicator type to form a unified data model, i.e., a multi-dimensional monitoring data set.

[0020] Further, based on the spatio-temporal alignment result, dynamic multi-dimensional analysis is performed to obtain an analysis feature matrix, and the analysis feature matrix is stored by slicing according to the delivery stage to obtain the multi-dimensional monitoring data set. The method comprises: The spatiotemporal alignment result is traversed to extract a monitoring data stream, a sliding window is used to perform data segmentation on the monitoring data stream, and a time slice dataset is generated; multi-dimensional topology perception is performed based on the time slice dataset, and an analysis feature matrix is constructed; the delivery stage is introduced, delivery stage metadata is determined according to the delivery stage, the analysis feature matrix is dimensionally sliced and reorganized according to the delivery stage metadata, the reorganization result is stored, and a stage feature data cube is constructed; and the stage feature data cube is added to the multi-dimensional monitoring dataset.

[0021] The system traverses the spatiotemporal alignment result of the operation and maintenance delivery data, extracts a monitoring data stream therefrom, and the monitoring data stream covers various types of index data in the delivery process, including resource usage, service status, log events, network communication, and information in multiple dimensions. The system uses a sliding window mechanism to continuously segment the monitoring data stream. Specifically, the window length and sliding step parameters are set, the monitoring data is divided into a plurality of continuous time slices in the time sequence dimension, and a time slice dataset with a time label is formed.

[0022] The system performs a multi-dimensional topology perception operation based on the time slice dataset, so as to fuse the interaction relationship and structural features in different data dimensions. Specifically, first, the feature information of the nodes and indexes is extracted from the time slice dataset, and a standardized feature vector is generated through statistical, aggregation, and normalization methods; then, the relationship between the nodes in terms of data dependency, message transmission, and business call is analyzed, a feature topology graph is constructed, and a structural matrix of topology perception between the nodes is formed; finally, the system integrates the topology enhanced feature vectors generated in each window, and constructs an analysis feature matrix reflecting the correlation of multi-node, multi-index, and multi-stage features.

[0023] By introducing predefined operation and maintenance delivery stage identifiers (such as “code construction”, “container deployment”, “automatic testing”, “service online”, etc.), the analysis feature matrix is sliced and reorganized according to the delivery stage. Specifically, first, according to the time interval to which each feature vector belongs and the role information of the node from which it is generated, the delivery stage to which it belongs is determined; then, based on the delivery stage metadata, a dimension mapping rule is constructed, the analysis feature matrix is sliced and reorganized according to the “stage-time-index-node” dimensions, and a structured stage feature data cube is formed.

[0024] The plurality of stage feature data cubes constructed are uniformly encoded and persistently stored, and are added to the multi-dimensional monitoring dataset according to an indexing mechanism (such as stage identifier, timestamp, node label, etc.).

[0025] The multi-dimensional monitoring dataset is subjected to context association analysis, and a dynamic baseline parameter is constructed.

[0026] Specifically, first, based on the constructed multi-dimensional monitoring dataset, the analysis feature matrix is extracted, which contains the state features of each node in the operation and delivery chain in multiple dimensions such as time, space, and delivery stage. Then, through principal component dimension reduction technology, multiple key feature components are extracted from the analysis feature matrix, which can represent the main trend and pattern of the data. Next, the extracted key feature components are mapped into the feature space to construct multiple feature vectors, each corresponding to a key feature component, to capture the potential relationship between different features. On this basis, further spatial correlation analysis is carried out to construct a service dependency graph to reveal the dependency relationship between service nodes; at the same time, time correlation analysis is carried out to capture the long-range dependence parameters of the features to reflect the trend and periodicity of the features over time; in addition, cross-layer correlation analysis is also needed to obtain multiple feature mapping parameters to reveal the interaction between features at different levels (such as infrastructure layer, application layer, and business layer). Subsequently, according to the service dependency graph, the feature long-range dependence parameters and the multiple feature mapping parameters, context correlation analysis is carried out in time series to construct an enhanced feature matrix, which integrates spatial, temporal and cross-layer correlation information and can more comprehensively reflect the state of the operation and delivery chain. Finally, based on the enhanced feature matrix, hierarchical modeling is carried out to construct dynamic baseline parameters.

[0027] Further, the method for carrying out context correlation analysis on the multi-dimensional monitoring dataset to construct dynamic baseline parameters comprises: Based on the analysis feature matrix, principal component dimension reduction is carried out to extract multiple key feature components; based on the multiple key feature components, feature space mapping is carried out to construct multiple feature vectors, which have a corresponding relationship with the multiple key feature components; based on the multiple feature vectors, spatial correlation is carried out to construct a service dependency graph; based on the multiple feature vectors, time correlation is carried out to capture feature long-range dependence parameters; based on the multiple feature vectors, cross-layer correlation is carried out to obtain multiple feature mapping parameters; according to the service dependency graph, the feature long-range dependence parameters and the multiple feature mapping parameters, context correlation analysis is carried out in time series to construct an enhanced feature matrix; according to the enhanced feature matrix, hierarchical modeling is carried out to construct the dynamic baseline parameters.

[0028] Based on the analysis feature matrix in the multi-dimensional monitoring dataset, a dimension reduction method such as principal component analysis (PCA) is used to reduce the high-dimensional feature data, and multiple representative key feature components with high variance contribution rate are extracted.

[0029] For the extracted key feature components, feature space mapping operation is performed to map each key feature component into a corresponding feature vector. The feature vector retains the numerical properties of the feature component and its mutual relationship in the multi-dimensional space, ensuring the integrity and correspondence of the mapping process.

[0030] Based on multiple feature vectors, spatial correlation analysis is performed, the spatial similarity and interaction relationship between feature vectors are calculated, and a service dependency graph reflecting the dependency relationship between service nodes in the operation and delivery link is constructed. The service dependency graph reveals the calling link and business coupling relationship between nodes in the system, and is the core structure of context correlation analysis.

[0031] Based on the feature vector, time correlation analysis is performed to capture the long-range dependence parameters of the feature vector evolving over time. By modeling and analyzing the time series data, the feature trend and dynamic change in the key time window are identified to ensure that the baseline parameters have time sequence sensitivity to the historical and current running state.

[0032] In combination with multiple feature vectors, cross-level correlation analysis is carried out; feature mapping parameters of different levels (such as application layer, service layer, and resource layer) are used to mine the influence mechanism and feedback law between levels, and multi-dimensional, cross-level feature mapping parameters are obtained.

[0033] Based on the service dependency graph, long-range dependence parameters and cross-level feature mapping parameters, the system performs context correlation analysis according to the time sequence, fuses spatial, temporal and hierarchical information, and constructs an enhanced feature matrix that comprehensively reflects the multi-dimensional correlation relationship. This matrix can dynamically capture the complex feature interaction and change trend in the operation and delivery environment.

[0034] Relying on the enhanced feature matrix, a hierarchical modeling technology is used to combine historical data and real-time feedback to construct a dynamic baseline parameter. The dynamic baseline parameter not only accurately describes the multi-dimensional feature distribution under the current normal running state, but also automatically adjusts with the change of the operation and delivery environment, realizing real-time and adaptive baseline management.

[0035] Further, according to the service dependency graph, the feature long-range dependence parameter, and the multiple feature mapping parameters, context correlation analysis is performed according to the time sequence to construct an enhanced feature matrix. The method comprises: The service dependency graph is analyzed using a graph attention network to determine graph features, and a neighborhood feature is defined according to the graph features. The neighborhood features are aggregated for spatial enhancement to construct a spatial feature matrix. The feature long-range dependence parameter is analyzed through a multi-head self-attention mechanism to obtain time domain enhanced features, and a time series feature matrix is constructed according to the time domain enhanced features. The spatial feature matrix and the time series feature matrix are fused across dimensions based on the multiple feature mapping parameters to construct a joint matrix. The joint matrix is contextually correlated and enhanced according to the time sequence to construct the enhanced feature matrix.

[0036] Firstly, the service dependency graph is analyzed in depth using a graph attention network. The GAT model is used to automatically learn the importance weights of the nodes and the influence of the edges in the graph, and the graph features are extracted. Based on the graph features, the neighborhood feature set of each node is defined, representing the local structure information and context association of the node in the service dependency network. The defined neighborhood features are aggregated to fuse the feature information from the neighbor nodes, completing the spatial enhancement process. Through multi-layer graph convolution operations, a spatial feature matrix is constructed, which comprehensively reflects the local and global spatial correlation characteristics of the nodes, laying the foundation for subsequent spatio-temporal fusion. For the feature long-range dependence parameter, a multi-head self-attention mechanism is used for temporal analysis. The multi-head self-attention mechanism captures the dependency relationships and importance distribution in different time periods of the time series through parallel multi-head attention sub-layers, thereby obtaining time domain enhanced features with multiple perspectives and multiple scales. Based on this, a time series feature matrix reflecting the dynamic changes of the time series features is constructed. Combining multiple feature mapping parameters, the spatial feature matrix and the time series feature matrix are fused across dimensions, and the fusion process uses feature concatenation, weighted summation or deep neural network fusion strategy to effectively integrate spatial information and temporal information, generating a joint matrix containing rich spatio-temporal context information. Finally, the context association enhancement operation is performed on the joint matrix according to the time sequence, further strengthening the interaction and dynamic relationship between the spatio-temporal features in the joint matrix, improving the accuracy and robustness of the feature expression. After enhancement, an enhanced feature matrix is obtained.

[0037] Based on the dynamic baseline parameters, the deviation degree of the real-time running data set is calculated to generate a data deviation value trigger to determine abnormal events for operation and maintenance delivery by the cloud platform, and an abnormal determination result is obtained.

[0038] Specifically, first, the real-time running data set is sliced according to a preset time window to obtain running data segments with time continuity; then, the running data corresponding to each time slice is matched with the dynamic baseline parameters to extract a multi-dimensional running feature vector reflecting the current system running state; next, based on the dynamic baseline parameters, multi-dimensional deviation degree calculation is performed on the multiple running feature vectors, which can evaluate the difference between the current running features and the baseline model based on indicators such as Euclidean distance, Mahalanobis distance or KL divergence, to generate a deviation value matrix reflecting the abnormal deviation degree of different dimensions. Further, the deviation value matrix is weighted and fused with the influence coefficient of the operation and maintenance business to generate a comprehensive abnormal score, which not only reflects the abnormal degree at the technical level, but also considers the actual impact at the business level. Finally, the historical abnormal false alarm rate is introduced to dynamically correct the comprehensive abnormal score to reduce the risk of false positives. When the comprehensive abnormal score exceeds a preset threshold, the abnormal event determination mechanism of the cloud platform is triggered to generate an abnormal determination result.

[0039] Further, based on the dynamic baseline parameters, the deviation degree calculation is performed on the real-time operation data set to generate a data deviation value, triggering the cloud platform to determine an abnormal event of operation and maintenance delivery, obtain an abnormal determination result, and the method comprises: The real-time operation data set is sliced according to a time window, a plurality of slice data is matched with the dynamic baseline parameters, data extraction is performed when the plurality of slice data is matched with the dynamic baseline parameters, a plurality of operation feature vectors are obtained, multi-dimensional deviation calculation is performed on the plurality of operation feature vectors based on the dynamic baseline parameters, a deviation value matrix is obtained, operation and maintenance influence analysis is performed on the real-time operation data set, operation and maintenance business data is weighted calculated according to an influence coefficient, and operation and maintenance business influence weight is determined; the deviation value matrix is weighted fused based on the operation and maintenance business influence weight, a comprehensive abnormal score is generated; a historical abnormal false alarm rate is introduced, and the comprehensive abnormal score is dynamically determined according to the historical abnormal false alarm rate to generate the abnormal determination result.

[0040] Specifically, first, the real-time operation data set is sliced according to a preset time window strategy to form a plurality of operation data segments with time continuity. Each slice contains time series information of a plurality of operation indexes. Then, the system matches the data in each time slice with the dynamic baseline parameters of the corresponding stage one by one, filters out the data part consistent with the baseline structure through feature space comparison, extracts its key operation indexes, and constructs a high-dimensional operation feature vector set, which fully reflects the operation state characteristics of each node and each stage in the current operation link. Then, the dynamic baseline parameters are used as a control standard to perform multi-dimensional deviation degree calculation on each operation feature vector, and the calculation process includes horizontal index distribution comparison and vertical time sequence change comparison, and finally a deviation value matrix is formed. Each cell in the deviation value matrix represents the deviation degree of a specific operation index at a certain time, and the larger the value, the stronger the abnormality.

[0041] The system further introduces an operation and maintenance business influence analysis mechanism, calculates an influence coefficient by evaluating the influence of each feature on key business services, nodes and processes. Based on the influence coefficient, the deviation value matrix is weighted processed to obtain a comprehensive abnormal score fused with business influence, ensuring that the system not only identifies data deviation, but also reflects the influence intensity on the actual operation of the business.

[0042] Finally, to further reduce the probability of misjudgment, the system introduces a historical abnormal false alarm rate as a confidence adjustment factor. The confidence adjustment factor combines the current comprehensive abnormal score to dynamically correct the score result by using methods such as weighted adjustment or Bayesian correction. If the final score result exceeds the set abnormal threshold, an abnormal determination result is generated.

[0043] Further, based on the dynamic baseline parameters, multi-dimensional deviation calculation is performed on the plurality of operation feature vectors to obtain a deviation value matrix, and the method comprises: Through transverse analysis of the plurality of operation feature vectors by the dynamic baseline parameters, transverse distribution data is determined; through longitudinal analysis of the plurality of operation feature vectors by the dynamic baseline parameters, longitudinal time sequence change data is determined; based on the transverse distribution data combined with the longitudinal time sequence change data, topological correlation deviation calculation is performed to obtain a correlation deviation value; based on the correlation deviation value, a three-dimensional deviation tensor is constructed, and the three-dimensional deviation tensor is subjected to tensor compression decomposition to construct the deviation value matrix.

[0044] The dynamic baseline parameters are used to perform transverse analysis on the plurality of operation feature vectors. The transverse analysis refers to, in the same time slice, performing transverse statistics and modeling on the distribution of each node and each process module in different operation indexes (such as resource utilization rate, time delay, throughput, error rate, etc.), comparing with the preset feature distribution mode in the dynamic baseline parameters, identifying the deviation degree of the current system in the transverse index space, obtaining transverse distribution data, and reflecting the instantaneous abnormal degree among each feature dimension. For example, in a distributed system, whether the performance indexes such as CPU usage rate and memory occupation of each node deviate from the baseline expectation is compared, so as to identify abnormal points or abnormal areas in the spatial distribution.

[0045] The longitudinal analysis refers to performing sequence modeling on the operation state represented by each feature vector in the time dimension, extracting the trend information of each feature changing with time by using a sliding window or sequence aggregation, and performing difference comparison with the normal evolution track described in the dynamic baseline parameters, extracting longitudinal time sequence change data, and identifying abnormal behaviors of the operation state in the time dimension. For example, whether the network traffic of a certain node appears a sudden increase or continuously deviates from the baseline in a certain time period is observed, so as to identify abnormal patterns or periodic fluctuations in the time sequence.

[0046] The system jointly models the above-obtained transverse distribution data and longitudinal time series change data, constructs a deviation model for representing the topological relationship between indicators and time evolution, and performs topological correlation deviation calculation. Specifically, after obtaining the transverse distribution data, the system analyzes the synergistic relationship between multiple operation and maintenance indicators in the same time window, extracts the spatial topological structure of the system at the current time, and the spatial topological structure can be represented in the form of a correlation graph (such as mutual information graph, correlation coefficient graph, etc.) between features, revealing the coupling strength and dependency path between different indicators in the current running state. Combined with longitudinal time series change data, i.e., the historical evolution trajectory of each indicator at different times, long-term trends, periodic fluctuations, or sudden changes are extracted using time series decomposition (STL), trend detection algorithms (such as CUSUM). The system jointly embeds and models the above spatial topological structure and time evolution features; by constructing a joint feature graph across time and indicator dimensions, the synergistic strength between features in different dimensions is introduced into the graph, and the node state in the joint graph is represented and learned using graph convolution network (GCN), graph attention network (GAT), or multi-scale graph modeling method, to extract high-order topological correlation features. Finally, the node embedding feature vector learned by the joint graph is compared and analyzed with the dynamic baseline parameters, and the topological correlation deviation value of each feature point is calculated based on distance measurement (such as cosine similarity, Euclidean distance, Mahalanobis distance) or classification deviation function (such as KL divergence, deviation score function).

[0047] Based on these correlation deviation values, a three-dimensional deviation tensor is constructed, with the three dimensions corresponding to spatial nodes, time windows, and feature types, which can comprehensively describe the deviation state of the operation and maintenance delivery link in multiple dimensions. Then, tensor compression decomposition techniques such as Tucker decomposition or CP decomposition are used to reduce the high-dimensional deviation tensor to a low-dimensional deviation value matrix, while preserving the main deviation characteristics and reducing the computational complexity. The final deviation value matrix can intuitively show the deviation degree of each node, each time window, and each feature type, providing a strong quantitative basis for subsequent anomaly judgment.

[0048] According to the abnormality judgment result, the event correlation is performed, the abnormal risk level is determined, the abnormal risk level is synchronized to the cloud platform for tracing, the multi-level early warning instruction is generated, and the multi-level early warning instruction is pushed to the target terminal for hierarchical alarm.

[0049] After obtaining the abnormality determination result, the key features of the abnormal event, such as the type of abnormality, the time of occurrence, the scope of influence, etc., are identified by in-depth analysis of the abnormality determination result, and these features are compared with the historical abnormal event database. Through association rule mining or machine learning algorithm, the internal relationship between the current abnormal event and other potentially related events is analyzed to determine the spread risk, associated impact and possible chain reaction of the abnormal event. Based on this comprehensive analysis, the system automatically determines the abnormal risk level, which takes into account the severity of the abnormality, the scope of influence, the degree of urgency and the potential loss, etc. to reflect the risk level of the abnormal event in a quantitative form. Subsequently, the system synchronizes the determined abnormal risk level to the cloud platform, and uses the powerful computing power and data storage advantage of the cloud platform to perform traceability analysis on the abnormal event. By tracing the occurrence path, associated nodes and data flow of the abnormal event, the root cause of the abnormality is located, and the specific reason and responsible subject of the abnormality are determined to provide accurate guidance for subsequent abnormality handling.

[0050] After completing the traceability analysis, the system generates multi-level warning instructions according to the abnormal risk level. These warning instructions set corresponding warning levels, response measures and processing time limits according to different risk levels, ensuring that maintenance personnel at all levels can quickly take effective measures to handle abnormalities according to the urgency and importance of the instructions. Finally, the system pushes the generated multi-level warning instructions to the target terminal, such as the mobile device of the maintenance personnel, the monitoring large screen or the automated maintenance tool, etc., to realize hierarchical alarm. Through the hierarchical alarm mechanism, the system can ensure that high-risk abnormal events are responded and handled in a timely and efficient manner, while avoiding unnecessary interference to maintenance personnel caused by low-risk abnormal events, thereby improving the overall maintenance efficiency and system stability.

[0051] Further, the method for determining the abnormal risk level according to the abnormality determination result comprises: According to the abnormality determination result, the abnormality impact analysis is performed to determine the abnormality impact range; the historical abnormal event record log is called, and the abnormality determination result is associated with the historical abnormal event record log according to the abnormality impact range to generate an abnormal event chain; the abnormal event chain is traversed to perform abnormal propagation calculation to obtain an event abnormal propagation probability; the event association edge is constructed according to the event abnormal propagation probability, and the associated risk analysis is performed based on the event association edge to generate the abnormal risk level.

[0052] Firstly, the system performs abnormal influence analysis based on the analysis features, deviation values, involved indicators and influence service paths extracted in the abnormality determination result, identifies the spread range of the abnormality in the operation and delivery link, and determines the abnormal influence range, wherein the abnormal influence range includes a set of affected target nodes, possible paths of abnormal spread and historical response records, etc.; then, the historical abnormal event record logs recorded in advance in the abnormal event log library are called, which store the occurrence nodes, feature descriptions, propagation paths and final disposal results of various abnormal events, etc., according to the abnormal influence range, the current abnormality determination result is matched with the historical abnormal event record logs in semantic vector and time and space alignment, similar or associated historical events are determined, and an abnormal event chain is constructed, which reflects the continuity and evolution relationship of the abnormality and past abnormalities in time, space and semantic features. Next, each abnormal event node in the abnormal event chain is traversed, combined with the frequency of its occurrence in the delivery link, the associated influence factors and propagation paths before and after it, and based on the graph traversal algorithm or Bayesian probability model, the event chain is calculated for abnormal propagation to obtain the event abnormal propagation probability, which is used to quantify the possibility of a certain abnormal node inducing the abnormality of adjacent nodes. Based on the event abnormal propagation probability, the edge information in the event association graph is constructed to form the weighted event association edge. Further, the system performs risk analysis on the entire event chain based on the event association edge, through the indexes of propagation depth, transmission probability aggregation degree and center degree, combines the risk indexes of the current abnormal node and the cumulative weight of the transmission path, and uses weighted scoring or fuzzy reasoning to perform associated risk analysis, and finally generates an abnormal risk level, which is used to quantify the potential impact of the current abnormal event on the cloud platform operation and delivery system, and provides a basis for subsequent tracing, early warning and response.

[0053] Further, the abnormal risk level is synchronized to the cloud platform for tracing, and a multi-level early warning instruction is generated, the method comprising: Based on the abnormal risk level, a causal reasoning is performed, a root cause positioning label is determined according to the reasoning result, the abnormal event chain is split to determine a plurality of sub-nodes, the smart contract is called through the cloud platform according to the root cause positioning label, the plurality of sub-nodes are traversed according to the smart contract for tracing to determine an abnormal tracing path, and the abnormal tracing path is associated to the historical disposal knowledge base to formulate the multi-level early warning instruction.

[0054] After generating the abnormal risk level, the system synchronizes the risk level to the cloud platform as a triggering condition for traceability analysis; based on the abnormal risk level as input for causal analysis, the system performs causal reasoning through techniques such as causal diagram model, Bayesian network or structured causal model (SCM) to identify the causal path highly related to the current abnormal risk level, and then determines the possible root cause of the abnormality and marks the root cause positioning label, which indicates the node type, occurrence location and abnormal pattern of the potential root cause. After determining the root cause positioning label, the system structurally splits the previously constructed abnormal event chain into multiple sub-nodes based on the occurrence time sequence, module and propagation path of the events, and each sub-node corresponds to a traceable abnormal event unit.

[0055] The system calls the pre-deployed smart contract through the smart contract engine of the cloud platform, with the root cause positioning label as the retrieval condition. The smart contract includes the standard traceability process, correlation and operation logic definition for different types of abnormalities. Based on the execution logic of the smart contract, the system automatically traverses the multiple sub-nodes, combines their timestamps, service dependency relationships and abnormal transmission probabilities, and performs multi-hop abnormal chain backtracking to determine the complete abnormal traceability path, which represents the reasoning link from the current abnormal state back to the potential root cause event. Further, the system matches the above abnormal traceability path with the historical disposal knowledge base in the cloud platform, which has pre-set standard response strategies, intervention measures and level classification information for various abnormal scenarios. Combined with the risk level, business importance and propagation trend of the nodes involved in the abnormal traceability path, the system formulates multi-level early warning instructions with differentiated response strategies. The multi-level early warning instructions encapsulate different levels of alarm content according to the pre-set format, including root cause events, affected services, suggested operations and response priorities, and finally push the multi-level early warning instructions to the target terminal, supporting hierarchical alarm, layered intervention and closed-loop control based on abnormal levels.

[0056] In summary, the embodiments of the present application have at least the following technical effects: First, real-time operation data sets of the operation and maintenance delivery link are collected, and multi-dimensional analysis is performed based on the real-time operation data sets to construct multi-dimensional monitoring data sets. Then, context correlation analysis is performed on the multi-dimensional monitoring data sets to construct dynamic baseline parameters. Then, deviation degree calculation is performed on the real-time operation data sets based on the dynamic baseline parameters to generate data deviation values to trigger the cloud platform to determine abnormal events of operation and maintenance delivery and obtain abnormal determination results. Finally, event correlation is performed according to the abnormal determination results to determine the abnormal risk level, synchronize the abnormal risk level to the cloud platform for traceability, generate multi-level early warning instructions, and push the multi-level early warning instructions to the target terminal for hierarchical alarm. The technical problem of inaccurate and timely event warning in the prior art is solved, and the technical effects of improving the accuracy and timeliness of abnormal event warning are achieved.

[0057] Embodiment two, based on the same inventive concept as the preceding embodiment of the cloud platform-based operation and delivery exception event early warning method, as Figure 2 shown, the present application provides a cloud platform-based operation and delivery exception event early warning system, wherein the system comprises: The data collection module 11 collects a real-time running data set of the operation and delivery link, performs multi-dimensional analysis based on the real-time running data set, and constructs a multi-dimensional monitoring data set. The correlation analysis module 12 performs context correlation analysis on the multi-dimensional monitoring data set and constructs a dynamic baseline parameter. The determination module 13 calculates the deviation of the real-time running data set based on the dynamic baseline parameter, generates a data deviation value, triggers the cloud platform to determine the operation and delivery exception event, and obtains an exception determination result. The early warning module 14 performs event correlation according to the exception determination result, determines the abnormal risk level, synchronizes the abnormal risk level to the cloud platform for tracing, generates a multi-level early warning instruction, and pushes the multi-level early warning instruction to the target terminal for hierarchical alarm.

[0058] Further, the data collection module 11 is configured to execute the following method: Iterate through the cloud platform to extract the operation and delivery link for operation and delivery node identification, determine a plurality of target nodes, deploy a distributed probe cluster based on the plurality of target nodes, collect the operation and delivery link in real time through the distributed probe cluster, and obtain a real-time running data set. Take the delivery pipeline event as a reference time axis, perform spatio-temporal alignment of the real-time running data set for global event synchronization, and obtain a spatio-temporal alignment result. Perform dynamic multi-dimensional analysis based on the spatio-temporal alignment result, obtain an analysis feature matrix, slice store the analysis feature matrix according to the delivery stage, and obtain the multi-dimensional monitoring data set.

[0059] Further, the data collection module 11 is configured to execute the following method: Iterate through the spatio-temporal alignment result to extract the monitoring data stream, perform data segmentation on the monitoring data stream using a sliding window, and generate a time slice data set. Perform multi-dimensional topology perception based on the time slice data set, construct an analysis feature matrix, introduce the delivery stage, determine delivery stage metadata according to the delivery stage, perform dimension slicing and reorganization of the analysis feature matrix according to the delivery stage metadata, store the reorganization result, construct a stage feature data cube, and add the stage feature data cube to the multi-dimensional monitoring data set.

[0060] Further, the correlation analysis module 12 is configured to execute the following method: perform principal component dimension reduction based on the analysis feature matrix, extract a plurality of key feature components; perform feature space mapping according to the plurality of key feature components, construct a plurality of feature vectors, and the plurality of feature vectors have a corresponding relationship with the plurality of key feature components; perform spatial correlation based on the plurality of feature vectors, and construct a service dependency graph; perform time correlation based on the plurality of feature vectors, and capture feature long-range dependency parameters; perform cross-layer correlation based on the plurality of feature vectors, and obtain a plurality of feature mapping parameters; perform context correlation analysis according to the service dependency graph, the feature long-range dependency parameters, and the plurality of feature mapping parameters in a time sequence, and construct an enhanced feature matrix; perform hierarchical modeling according to the enhanced feature matrix, and construct the dynamic baseline parameters.

[0061] Further, the correlation analysis module 12 is configured to perform the following method: The graph attention network is used to analyze the service dependency graph, determine graph features, define neighborhood features according to the graph features, aggregate the neighborhood features for spatial enhancement, construct a spatial feature matrix, analyze the feature long-range dependency parameters through the multi-head self-attention mechanism, obtain time domain enhanced features, construct a time sequence feature matrix according to the time domain enhanced features, perform cross-dimension fusion on the spatial feature matrix and the time sequence feature matrix based on the plurality of feature mapping parameters, construct a joint matrix, and perform context correlation enhancement on the joint matrix according to the time sequence to construct the enhanced feature matrix.

[0062] Further, the determination module 13 is configured to perform the following method: The real-time running data set is sliced according to a time window, a plurality of sliced data are matched with the dynamic baseline parameters, data extraction is performed when the plurality of sliced data are matched with the dynamic baseline parameters, a plurality of running feature vectors are obtained, multi-dimensional deviation calculation is performed on the plurality of running feature vectors based on the dynamic baseline parameters, a deviation value matrix is obtained, operation and maintenance influence analysis is performed on the real-time running data set, operation and maintenance business data are weighted calculated according to an influence coefficient, operation and maintenance business influence weights are determined, the deviation value matrix is weighted fused based on the operation and maintenance business influence weights, a comprehensive abnormal score is generated, a historical abnormal false alarm rate is introduced, and the comprehensive abnormal score is combined with the historical abnormal false alarm rate to perform dynamic determination, and the abnormal determination result is generated.

[0063] Further, the determination module 13 is configured to perform the following method: The dynamic baseline parameters are used to analyze the multiple operation feature vectors in a horizontal direction to determine horizontal distribution data, and the dynamic baseline parameters are used to analyze the multiple operation feature vectors in a vertical direction to determine vertical time sequence change data; topological correlation deviation calculation is performed based on the horizontal distribution data combined with the vertical time sequence change data to obtain a correlation deviation value; and a three-dimensional deviation tensor is constructed based on the correlation deviation value, and the three-dimensional deviation tensor is decomposed by tensor compression to construct the deviation value matrix.

[0064] Further, the early warning module 14 is configured to perform the following method: According to the abnormality determination result, abnormality influence analysis is performed to determine an abnormality influence range; historical abnormality event record logs are called, and the abnormality determination result is associated with the historical abnormality event record logs according to the abnormality influence range to generate an abnormality event chain; abnormality propagation calculation is performed by traversing the abnormality event chain to obtain an event abnormality transmission probability; an event correlation edge is constructed according to the event abnormality transmission probability, and correlation risk analysis is performed based on the event correlation edge to generate the abnormality risk level.

[0065] Further, the early warning module 14 is configured to perform the following method: Based on the abnormality risk level, causal reasoning is performed, and a root cause positioning label is determined according to a reasoning result; the abnormality event chain is split to determine multiple child nodes; an intelligent contract is called through a cloud platform according to the root cause positioning label, and the multiple child nodes are traversed according to the intelligent contract to determine an abnormality traceability path; the abnormality traceability path is associated to a historical treatment knowledge base to formulate the multiple-level early warning instructions.

[0066] It should be noted that the above sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The above describes a specific embodiment of the present application. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or can be advantageous.

[0067] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0068] The specification and drawings are, of course, subject to various interpretations and should not be viewed in any limiting sense. It will be understood that various modifications and changes can be made to the application disclosed without departing from the scope thereof. Accordingly, you are to understand that there is no intention, either express or implied, that any of the described embodiments of the application is more efficient or effective than any of the other possible embodiments. It is therefore intended to cover in the appended claims all such changes and modifications that fall within the scope of the application.

Claims

1. A cloud platform-based operation and maintenance delivery abnormal event warning method, characterized in that: The method comprises: Collect real-time operation data sets of the operation and maintenance delivery link, perform multi-dimensional analysis based on the real-time operation data sets, and construct a multi-dimensional monitoring data set; Performing contextual analysis on the multi-dimensional monitoring data set to construct dynamic baseline parameters; Calculating the deviation of the real-time operation data set based on the dynamic baseline parameters, generating a data deviation value to trigger the cloud platform to perform abnormal event determination for operation and maintenance delivery, and obtaining an abnormality determination result; Event association is performed according to the abnormality determination result to determine the abnormality risk level, the abnormality risk level is synchronized to the cloud platform for tracing, a multi-level warning instruction is generated, and the multi-level warning instruction is pushed to the target terminal for graded alarm.

2. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 1, characterized in that: Collecting a real-time operation data set of the operation and maintenance delivery link, performing multi-dimensional analysis based on the real-time operation data set, and constructing a multi-dimensional monitoring data set, the method includes: Traverse the cloud platform to extract the operation and maintenance delivery link to identify the operation and maintenance delivery node and determine multiple target nodes; Deploy a distributed probe cluster based on the multiple target nodes, and collect data on the operation and maintenance delivery link in real time through the distributed probe cluster to obtain a real-time operation data set; Using the delivery pipeline event as a reference time axis, performing spatiotemporal alignment of the real-time running data set for global event synchronization to obtain a spatiotemporal alignment result; Dynamic multi-dimensional analysis is performed based on the spatiotemporal alignment result to obtain an analysis feature matrix, and the analysis feature matrix is ​​sliced ​​and stored according to the delivery stage to obtain the multi-dimensional monitoring data set.

3. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 2, characterized in that: Performing dynamic multidimensional analysis based on the spatiotemporal alignment result to obtain an analysis feature matrix, slicing and storing the analysis feature matrix according to the delivery stage to obtain the multidimensional monitoring data set, the method comprising: Traversing the spatiotemporal alignment results to extract monitoring data streams, performing data segmentation on the monitoring data streams using a sliding window to generate a time slice data set; Perform multi-dimensional topology perception based on the time slice data set and construct an analysis feature matrix; Introducing the delivery stage, determining delivery stage metadata according to the delivery stage, dimensionally slicing and reorganizing the analysis feature matrix according to the delivery stage metadata, storing the reorganization results, and constructing a stage feature data cube; The stage feature data cube is added to the multi-dimensional monitoring data set.

4. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 3, characterized in that: Performing contextual analysis on the multi-dimensional monitoring data set to construct dynamic baseline parameters, the method comprising: Performing principal component dimensionality reduction based on the analysis feature matrix to extract multiple key feature components; Performing feature space mapping according to the multiple key feature components to construct multiple feature vectors, wherein the multiple feature vectors correspond to the multiple key feature components; Performing spatial association based on the multiple feature vectors to construct a service dependency graph; Performing temporal correlation based on the plurality of feature vectors to capture feature long-range dependency parameters; Perform cross-layer correlation based on the multiple feature vectors to obtain multiple feature mapping parameters; Performing context association analysis according to the service dependency graph, the feature long-range dependency parameters, and the plurality of feature mapping parameters in a time series to construct an enhanced feature matrix; Hierarchical modeling is performed according to the enhanced feature matrix to construct the dynamic baseline parameters.

5. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 4, characterized in that: Performing context association analysis according to a time series based on the service dependency graph, the feature long-range dependency parameters, and the plurality of feature mapping parameters to construct an enhanced feature matrix, the method comprising: Analyzing the service dependency graph using a graph attention network to determine graph features, and defining neighborhood features based on the graph features; Aggregating the neighborhood features for spatial enhancement and constructing a spatial feature matrix; The long-range dependency parameters of the features are analyzed through a multi-head self-attention mechanism to obtain time-domain enhanced features, and a time series feature matrix is ​​constructed based on the time-domain enhanced features; Based on the multiple feature mapping parameters, the spatial feature matrix and the temporal feature matrix are cross-dimensionally fused to construct a joint matrix; The joint matrix is ​​context-enhanced according to the time series to construct the enhanced feature matrix.

6. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 1, characterized in that: The method of calculating the deviation of the real-time operation data set based on the dynamic baseline parameter, generating a data deviation value to trigger the cloud platform to perform abnormal event determination for operation and maintenance delivery, and obtaining an abnormality determination result includes: Slicing the real-time operation data set according to a time window, matching multiple slice data with the dynamic baseline parameters, and performing data extraction when the multiple slice data match the dynamic baseline parameters to obtain multiple operation feature vectors; Performing multi-dimensional deviation calculation on the plurality of operating characteristic vectors based on the dynamic baseline parameters to obtain a deviation value matrix; Performing an operation and maintenance impact analysis on the real-time operation data set, performing weighted calculation on the operation and maintenance business data according to the impact coefficient, and determining the operation and maintenance business impact weight; Performing weighted fusion on the deviation value matrix based on the operation and maintenance business impact weight to generate a comprehensive anomaly score; The historical anomaly false alarm rate is introduced, and a dynamic judgment is performed based on the historical anomaly false alarm rate and the comprehensive anomaly score to generate the anomaly judgment result.

7. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 6, characterized in that: Performing multi-dimensional deviation calculation on the plurality of operating characteristic vectors based on the dynamic baseline parameters to obtain a deviation value matrix, the method comprising: Performing a horizontal analysis on the plurality of operating characteristic vectors using the dynamic baseline parameters to determine horizontal distribution data; Performing longitudinal analysis on the plurality of operating characteristic vectors using the dynamic baseline parameters to determine longitudinal time series change data; Performing a topological correlation deviation calculation based on the horizontal distribution data in combination with the vertical time series change data to obtain a correlation deviation value; A three-dimensional deviation tensor is constructed based on the associated deviation values, and the three-dimensional deviation tensor is subjected to tensor compression decomposition to construct the deviation value matrix.

8. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 1, characterized in that: According to the abnormality determination result, event correlation is performed to determine the abnormality risk level, and the method includes: Performing abnormal impact analysis based on the abnormality determination result to determine the abnormality impact range; Retrieving a historical abnormal event record log, and correlating the abnormality determination result with the historical abnormal event record log according to the abnormal impact range to generate an abnormal event chain; Traversing the abnormal event chain to perform abnormal propagation calculation and obtain the abnormal transmission probability of the event; An event correlation edge is constructed according to the event abnormality transmission probability, and an association risk analysis is performed based on the event correlation edge to generate the abnormality risk level.

9. The cloud platform-based operation and maintenance delivery abnormal event early warning method according to claim 8, characterized in that: The abnormal risk level is synchronized to the cloud platform for tracing and generating multi-level warning instructions. The method includes: Perform causal reasoning based on the abnormal risk level and determine the root cause location label according to the reasoning result; Splitting the abnormal event chain to determine multiple sub-nodes; Retrieving the smart contract according to the root cause location tag through the cloud platform, tracing the multiple sub-nodes according to the smart contract, and determining the abnormal tracing path; The abnormality tracing path is associated with the historical disposal knowledge base to formulate the multi-level warning instructions.

10. The cloud platform-based operation and maintenance delivery abnormal event warning system is characterized by: A system for implementing the cloud platform-based operation and maintenance delivery abnormal event warning method according to any one of claims 1 to 9, comprising: Data collection module: collects real-time operation data sets of the operation and maintenance delivery link, performs multi-dimensional analysis based on the real-time operation data sets, and constructs a multi-dimensional monitoring data set; Correlation analysis module: performs context correlation analysis on the multi-dimensional monitoring data set to construct dynamic baseline parameters; Determination module: Calculates the deviation of the real-time operation data set based on the dynamic baseline parameters, generates a data deviation value to trigger the cloud platform to perform abnormal event determination for operation and maintenance delivery, and obtains an abnormality determination result; Early warning module: associate events according to the abnormal judgment results, determine the abnormal risk level, synchronize the abnormal risk level to the cloud platform for tracing, generate multi-level early warning instructions, and push the multi-level early warning instructions to the target terminal for graded alarms.

Images