Android device remote state monitoring and intelligent operation and maintenance system

Abstract

The invention relates to the technical field of state recognition, in particular to an Android device remote state monitoring and intelligent operation and maintenance system which comprises an event trigger analysis module, a state feature classification module, a state section plotting module, a state fragment packaging module and a state level response module. In the method, a state path set is constructed through time label alignment of broadcast and thread events, an access source mark and a network return parameter are combined to generate a multi-dimensional state label sequence, a thread scheduling track and a memory block are mapped to form a state section structure, and an active boundary area is positioned in combination with power consumption change. Path numbers and permission information are combined, screened and packaged into a structured state unit, response level zones are divided through the number depth and the repetition rate, and complete restoration of behavior paths and accurate recognition of state nodes under the scenes of concurrent calling, complex event chains and the like are supported. And the granularity of terminal state analysis, the traceability continuity and the hierarchical adaptation capability of operation and maintenance response are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of state recognition, in particular to an Android device remote state monitoring and intelligent operation and maintenance system. BACKGROUND

[0002] The technical field of state recognition mainly involves the structured perception and state classification of data such as resource state, behavior process, and execution logic generated by information system terminals during operation, covering system running state collection, system-level event judgment, resource index combination analysis, behavior trigger condition recognition, and remote discrimination mechanism construction, which is an important support foundation for realizing terminal abnormality perception, intelligent control, and remote collaborative management. It is widely used in the monitoring and operation and maintenance system of Android terminal devices in enterprise-level scenarios such as industrial control, intelligent retail, logistics and warehousing, education and medical treatment, to meet the core scenario needs of device state real-time recognition, risk early warning triggering, and distributed operation and maintenance response. Among them, the traditional Android device remote state monitoring and intelligent operation and maintenance system refers to a remote management method based on a central platform control architecture, which configures a basic monitoring agent on the device side, collects terminal running parameters according to a preset polling period or a single trigger event logic. This kind of system usually reads basic performance parameters such as CPU usage, memory free ratio, battery level reading, and network connection state value, and uploads the above parameters to the backend platform by relying on standard communication protocols such as SNMP and MQTT or custom interface protocols, and then generates remote control strategies according to abnormal value setting rules or system task lists by the platform.

[0003] The existing technology lacks a coherent recognition mechanism for state paths in the event processing process, cannot establish a multi-dimensional label classification system, the linkage relationship between events is not fully analyzed, the thread activity and memory mapping lack dynamic mapping structure support, causing the behavior section boundary to be blurred, the path number and permission combination to be unstructured management, it is difficult to track the call relationship and permission change path, the state output result lacks clear level division, it does not have the comprehensive analysis ability of behavior depth and frequency, in the environment of high-frequency mutation of event flow and rapid splitting of path evolution, the response delay, strategy matching deviation and state trace distortion are often caused by state fragmentation and shallow recognition granularity. SUMMARY

[0004] In order to solve the technical problems existing in the prior art, an Android device remote state monitoring and intelligent operation and maintenance system is provided in the embodiments of the present application. The technical solution is as follows:

[0005] On the one hand, an Android device remote state monitoring and intelligent operation and maintenance system is provided, which comprises:

[0006] The event trigger analysis module acquires broadcast receiving codes, stack writing, thread activity, network exception, application access record, matches broadcast and thread time label, extracts first trigger to continuous call path, removes interference to build traceable sequence, and forms state starting fragment set;

[0007] The state feature classification module extracts network return identification and source mark based on the state starting fragment set, reorganizes to establish a matching table, merges stack continuous distribution interval, compares broadcast and access path, and generates state classification label sequence;

[0008] The state section mapping module extracts thread scheduling track, memory mapping and power consumption chain according to the state classification label sequence, combines scheduling times and partition block address, locates power consumption intensive change point and judges active interval, and generates state active section atlas;

[0009] The state fragment packaging module extracts call path number, source mark, permission field from the state active section atlas, and encapsulates into a package after path cross comparison and uniqueness screening, adds boundary identification fragment, and forms state closed fragment chain group.

[0010] As a further scheme of the application, the state starting fragment set includes broadcast trigger time point, thread call starting label, continuous record path identification, and interference path filtering mark, the state classification label sequence includes network return type, source mark category, stack distribution interval identification, and broadcast path corresponding label, the state active section atlas includes thread scheduling section number, memory mapping block address, and power consumption change point identification, and the state closed fragment chain group includes path number set, behavior and permission matching group, and boundary identification fragment.

[0011] As a further scheme of the application, the power consumption intensive change point and the judgment of the active interval refer to locating the point whose change frequency exceeds the set threshold in the power consumption point change chain, and judging whether the point is in the continuous active section in the thread scheduling track.

[0012] The boundary identification fragment refers to a structured information fragment used for identifying the start and end positions of the state fragment, which is generated based on the boundary features of path number and permission field.

[0013] As a further scheme of the application, the event trigger analysis module includes:

[0014] The information extraction sub-module acquires thread log, stack record, network state and application access data based on broadcast receiving code, compares broadcast and thread start time according to time, extracts corresponding interval information, and generates synchronization information set;

[0015] The path matching submodule calls the synchronization information set, extracts an access path between broadcasting and thread starting and stack records, filters out paths not meeting a call number threshold, classifies and compares stack information, and generates a matching path set;

[0016] The state construction submodule judges path intensity according to the matching path set, extracts abnormal connections and path frequencies, generates a path sequence meeting a condition after normalization processing, and establishes a state starting segment set.

[0017] As a further scheme of the present application, the state feature classification module comprises:

[0018] The identifier extraction submodule extracts network return identifiers and source markers in a network connection abnormal value and access record combination based on the state starting segment set, arranges the source markers according to time sequence, performs an elimination operation on records with missing fields, and generates a source identifier combination set;

[0019] The source reconstruction submodule calls the source markers in the source identifier combination set, splits field contents according to a character hierarchical structure, groups fields with the same first part identifier together for splicing, establishes an index for the splicing result, and establishes a source matching mapping table;

[0020] The label generation submodule extracts and analyzes whether a continuous distribution interval formed by stack write density before and after an access pointer meets a continuous interval density requirement according to path mapping relationships in the source matching mapping table, compares broadcast content fields in a continuous path, extracts label indexes of a comparison matching position, and generates a state classification label sequence.

[0021] As a further scheme of the present application, the state section plotting module comprises:

[0022] The trajectory combination submodule extracts scheduling trajectories of a running thread set in an Android device, a memory space slice mapping graph, and a power consumption point change chain based on the state classification label sequence, combines scheduling numbers in the scheduling trajectories and partition block addresses in the mapping graph according to time sequence, and generates a trajectory mapping data set;

[0023] The point identification submodule calls the scheduling numbers and partition block addresses in the trajectory mapping data set, locates points with power consumption frequency characteristic values exceeding a power consumption change threshold, and judges whether the points correspond to active sections in thread scheduling trajectories, to obtain an active point index group;

[0024] The graph construction submodule extracts continuous section information in the trajectory mapping according to the correspondence between points in the active point index group and thread scheduling partitions, and maps and compares active states of multiple sections with the label sequence, to establish a state active section graph.

[0025] As a further scheme of the present application, the state fragment packaging module comprises:

[0026] The field extraction submodule collects the call path number, behavior source marker and permission registration field in each section based on the state active section atlas, performs field layer comparison on the execution content between the call path numbers, identifies the difference and repetition of the instruction sequence, and generates a path number cross group;

[0027] The structure construction submodule calls the path data in the path number cross group, combines and splices the behavior source marker and permission registration field corresponding to each path, judges whether the field combination is unique in the current section, filters out the repeated markers and sorts the combined fields, and establishes a field combination encapsulation body;

[0028] The content combination submodule adds the boundary identification fragment corresponding to the section according to the screening result in the field combination encapsulation body, splices the boundary field and the content of the combination body in order, extracts the positioning information of the field in the path sequence and unifies the number, and establishes a state closed fragment chain group.

[0029] As a further scheme of the present application, the system further comprises:

[0030] The state level response module extracts the permission field, source marker and path number in the state closed fragment chain group, generates an associated sequence, counts the path repetition rate and arranges it according to the depth level, distinguishes the trigger level strip, and generates a remote state monitoring and intelligent operation result.

[0031] As a further scheme of the present application, the remote state monitoring and intelligent operation result comprises a permission field sequence, a source marker order structure, and a path number level classification.

[0032] As a further scheme of the present application, the state level response module comprises:

[0033] The order generation submodule extracts the permission field value and the source marker content based on the state closed fragment chain group, combines the arrangement order of the source marker according to the character length of the permission field, and time sorts the arrangement sequence to establish an associated order sequence;

[0034] The repetition judgment submodule calls the source marker sequence in the associated order sequence, counts the frequency of the call path number in each fragment chain, constructs a frequency matrix according to the number of occurrences, and marks the first occurrence position of the path number in the sequence to generate a path repetition distribution value;

[0035] The hierarchical extraction sub-module sorts and classifies paths from low to high according to the frequency and position depth level in the path repetition distribution value, combines and analyzes the corresponding permissions and labels in each type of path, distinguishes different hierarchical sections, and establishes remote state monitoring and intelligent operation and maintenance results.

[0036] The technical scheme provided by the embodiment of the application has at least the following beneficial effects:

[0037] The state path set is constructed by aligning the time tags of the broadcast and thread events, the multi-dimensional state label sequence is generated by combining the access source label and network return parameter, the state section structure is formed by the thread scheduling trajectory and memory block mapping, the active boundary area is located by combining the power consumption change, the structured state unit is packaged by combining the path number and permission information, and the response hierarchical zone is divided by combining the number depth and repetition rate, so that the behavior path is completely restored and the state node is accurately identified in the concurrent call and complex event chain scenarios, and the granularity of terminal state analysis, the continuity of traceability and the hierarchical adaptation capability of operation and maintenance response are significantly improved. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical scheme in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0039] Figure 1 It is a schematic diagram of an Android device remote state monitoring and intelligent operation and maintenance system provided by the embodiment of the application;

[0040] Figure 2 It is a system framework schematic diagram of the application;

[0041] Figure 3 It is an event trigger analysis module flow chart in the application;

[0042] Figure 4 It is a state feature classification module flow chart in the application;

[0043] Figure 5 It is a state section plotting module flow chart in the application;

[0044] Figure 6 It is a state fragment packaging module flow chart in the application;

[0045] Figure 7 It is a state level response module flow chart in the application. DETAILED DESCRIPTION

[0046] The technical solutions in the present application will be described below with reference to the drawings.

[0047] In the embodiments of the present application, the words such as "example", "for example" are used to represent an example, illustration or description. Any embodiment or design scheme described as "example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the word "example" is intended to present the concept in a specific manner. In addition, in the embodiments of the present application, the meaning expressed by "and / or" can be both, or can be one of the two.

[0048] In the embodiments of the present application, "image" and "picture" can be used interchangeably at times, and it should be pointed out that the meanings expressed are consistent when the distinction is not emphasized. "Of", "corresponding" and "corresponding" can be used interchangeably at times, and it should be pointed out that the meanings expressed are consistent when the distinction is not emphasized.

[0049] In the embodiments of the present application, sometimes the subscript such as W1 can be written in the form of non-subscript such as W1, and the meanings expressed are consistent when the distinction is not emphasized.

[0050] In order to make the technical problems, technical solutions and advantages to be solved by the present application more clear, the following will be described in detail with reference to the drawings and specific embodiments.

[0051] The embodiments of the present application provide an Android device remote state monitoring and intelligent operation and maintenance system, as shown in Figures 1-2 The Android device remote state monitoring and intelligent operation and maintenance system schematic diagram, the system comprises:

[0052] The event trigger analysis module obtains five types of information on the Android device, including broadcast receiving code, stack writing record, thread activity, network connection abnormal value and application access record, matches the time tags corresponding to the broadcast receiving code and the thread activity, extracts all record paths between the first broadcast trigger and the continuous thread call, constructs a traceable sequence after screening out the interference paths, and obtains a state starting segment set;

[0053] The state feature classification module extracts the network return identifier and the source marker in the network connection abnormal value and the access record combination according to the state starting segment set, reorganizes the source marker to establish a matching table, merges the continuous distribution intervals formed before and after the access pointer according to the stack writing density, and then performs a comparison operation on the broadcast content in the continuous access path to generate a state classification tag sequence;

[0054] The state segment plotting module extracts the scheduling trajectory, memory space slice mapping map, and power consumption point change chain of the running thread set in the Android device based on the state classification label sequence. It combines the number of scheduling segments in the thread trajectory with the partition block address in the mapping map, locates the power consumption points with dense changes, and determines whether the points belong to the active range of the thread trajectory, generating a state active segment map.

[0055] The state fragment packaging module is based on the active state segment map. It extracts the call path number, behavior source mark, and permission registration field from each segment. The execution content of the call path number is cross-compared, and the uniqueness of the combination of behavior source mark and permission field is screened. The three results are encapsulated into the pre-packaging structure. After adding the boundary recognition fragment, they are combined into the packaged content to obtain the state closed fragment chain group.

[0056] The status level response module extracts the permission field values, source marker content, and call path number combination from the status closed fragment chain group, generates a sequence by associating the permission fields and source markers in order, counts the repetition rate of call path numbers, and then judges the order based on the depth of the path number's occurrence position, integrates and distinguishes the trigger level strips, and generates remote status monitoring and intelligent operation and maintenance results.

[0057] The set of state start fragments includes broadcast trigger time point, thread call start label, continuous record path identifier, and interference path filtering mark. The state classification label sequence includes network return type, source label category, stack distribution interval identifier, and broadcast path corresponding label. The state active segment map includes thread scheduling segment number, memory mapping block address, and power change point identifier. The state closed segment chain group includes path number set, behavior and permission matching group, and boundary identification segment. The remote state monitoring and intelligent operation and maintenance results include permission field sequence, source label order structure, and path number level classification.

[0058] Specifically, such as Figure 2 , 3 As shown, the event trigger parsing module includes:

[0059] The information extraction submodule obtains thread logs, stack records, network status and application access data based on the broadcast reception code, compares the broadcast and thread start times by time, extracts information in the corresponding interval, and generates a set of synchronization information.

[0060] Based on the broadcast reception code, the broadcast reception code is decoded and parsed, and then matched one by one with the broadcast events registered in the operating system. The broadcast type and its bound event ID are determined by matching the event registration list. Then, all broadcast event trigger records in the system log are retrieved, and the first trigger time t1 of each broadcast is extracted. Next, the thread log is read, and thread creation records are scanned one by one. It is determined whether the start time of each thread falls within the time interval [t1-2 seconds, t1+2 seconds]. This time interval is set according to the device's CPU frequency. If the CPU frequency is 2GHz and the system average response interval is set to 2 seconds, this time range is applicable to most ordinary devices. The filtered thread information records include fields such as thread ID, creation time, parent thread ID, application package name, CPU core number, thread priority, and thread type. Simultaneously, the log behavior of each thread is extracted, such as memory access, file opening, and API calls. By clustering the thread IDs, threads with the same parent thread ID or belonging to the same application PID are grouped together as threads at different stages of the same operation chain. Then, the stack traces of these threads are obtained one by one, starting from the first function after the thread starts. The function call chain is unpacked sequentially, recording the name, location, parameter list, and return type of each function. System status parameters at the time of the function call are extracted, such as CPU utilization (calculated as 0%-100%), current memory usage (in MB), and I / O wait time (in ms). If CPU utilization exceeds 85%, function call time exceeds 800ms, or stack depth exceeds 120 levels during a function call, the thread is marked as a performance anomaly. Then, the network status log is parsed, extracting network connection type, connection stability, and DNS resolution within 2 seconds before and after the broadcast event. Data such as time and download bandwidth are collected. If the download bandwidth is below 100kbps and the network latency exceeds 1200ms, the network is considered unstable. Then, the application access behavior log is read. Based on the application to which the thread belongs, the number of file reads, network requests, and UI operation frequency of the application within this time period are counted. If the number of file reads exceeds 60 times / second and the number of network requests exceeds 100 times / second, the application is marked as a high-frequency access application. Finally, the broadcast event time is used as the center to structure and integrate all thread, stack, network, and access behavior data within a 2-second interval before and after the broadcast event time to form a complete set of synchronization information.

[0061] The path matching submodule calls the synchronization information set, extracts the access path and stack record between broadcast and thread startup, filters out paths that do not meet the call count threshold, classifies and compares the stack information, and generates a matching path set;

[0062] After obtaining the synchronization information set, using each broadcast event as a benchmark, the thread IDs closest to its time are traversed. The function call chain of each thread is traced and constructed, starting from the thread's startup function. The function name, call time, type of system resources used (e.g., file read / write, database access, network request), and return status are recorded according to the function call order to form the thread execution path. Frequency statistics are performed on all constructed paths. For example, if a function path A appears 18 times in all events, and the number of calls is less than 5, it is considered an atypical path and removed. This threshold of 5 is based on empirical statistics, considering that a path appearing less than 5 times in the sample cannot form a stable feature, and that a path coverage rate below 5% is significantly unrepresentative. Therefore, this value is set. After path filtering, the remaining paths are compared for function sequence consistency. During the comparison, it is required that the path contains... Paths are classified as similar only if the function call order and the called resources are consistent. Stack information associated with similar paths is digested and encoded by extracting a digest string generated from the function name combination. Byte differences are calculated for all path digests. If the difference rate is less than 15%, they are considered to have the same logical stack structure. If the difference rate is between 15% and 30%, it indicates that the paths are logically consistent but have execution differences, and they are marked as logically consistent but execution-different paths. Paths with obvious differences are classified separately. Then, based on the number of functions in each type of path, only paths with more than 4 function calls are retained, and the path must call at least two types of resources. For example, if a path B contains 5 functions, accessing the file system and the database, then the path is retained as a valid path. Finally, all paths that meet the frequency and structure requirements are combined to form a matching path set for subsequent state construction.

[0063] The state construction submodule determines the path density based on the matching path set, extracts abnormal connections and path frequencies, and generates a path sequence that meets the conditions after normalization, and establishes a set of state start fragments.

[0064] Based on the matching path set generated in the previous stage, the thread distribution of each type of path is analyzed one by one. The occurrence frequency of each path in all threads is counted. For example, if path C occurs 35 times and the total number of threads is 50, the path density is 0.7, which is greater than the set threshold of 0.5. Therefore, it is identified as a high-density path. This density threshold of 0.5 is derived from the median level of the operating data of various types of devices, which ensures that the selected paths are representative while avoiding excessive coverage of path data. After the path density is counted, the occurrence frequency of each path within a 10-second time window is extracted. If the number of times a path occurs in a certain second is greater than the average number of times the path occurs plus 10%, that is, if it occurs an average of 5 times per second and reaches 6 times in a certain second, it is considered a frequency mutation, which is used to further identify abnormal connections. The judgment criteria are: whether the network response time corresponding to the thread involved in the path exceeds 1000ms and whether the signal strength is lower than -85dBm. Only two conditions are required. If all conditions are met, the path is marked as having a network anomaly. Stack anomaly paths are also identified. If the function call sequence in a path contains more than 130 call stack levels or more than 12 nested call structures, the path is marked as having a stack structure anomaly. Next, the frequency, density, and resource access count of each path are normalized and mapped to the range [0, 1]. After normalization, a weighted average is used to calculate the path score. For example, if a path has a normalized frequency of 0.8, a density of 0.6, and a resource access count of 0.7, with corresponding weights of 0.4, 0.3, and 0.3, its score is 0.74. This score is higher than the set effective path threshold of 0.7, therefore it is selected as an effective path. This score threshold is set based on the distribution observation of multiple sample paths to ensure that the retained paths are significantly representative of the data. Finally, the paths with high scores are sorted chronologically, and the time points of the starting functions of each path are extracted to form a set of state starting segments.

[0065] Specifically, such as Figure 2 , 4 As shown, the state feature classification module includes:

[0066] The identifier extraction submodule extracts the network return identifier and source marker from the combination of network connection anomaly values ​​and access records based on the set of state start fragments. It sorts the source markers according to time sequence, removes records with missing fields, and generates a set of source identifier combinations.

[0067] Based on the set of state start segments, the start timestamp and path identifier number of each segment are read sequentially. Network connection logs and access logs recorded during the duration of that path are obtained. For each record in the network connection log, fields such as status code, response time, target IP address, and source application name are extracted. Records with status codes of 400, 401, 403, 404, 500, 502, and 504 are selected as abnormal connection items. The status code set is chosen as the HTTP common error status set, based on the error distribution commonly observed in device connection stability testing. Using the timestamps of these abnormal items as the key index, access record combinations within a similar time range (±500ms) are retrieved. Network return identifier fields (such as Response-ID, X-Request-ID, etc.) and source marker fields (such as URL domain name, calling module, interface entry function name, etc.) are extracted from these combinations. Finally, integrity checks are performed on the source marker fields. The process includes checks for field non-emptyness, valid format, and illegal characters. Illegal characters are defined as non-standard URI characters such as "#", "@", "!", and "space". If a field is an empty string, less than 3 characters long, or contains any of the above illegal characters, it is considered an invalid record. For example, if a source tag is "@null" or only contains ":80", the record will be removed. The removal process directly removes the data from the access record set and does not include it in subsequent analysis. The retained source tag records are sorted in ascending order based on their time field. If multiple records with the same source tag but different times exist during the sorting process, all entries must be retained and timestamped for subsequent tracing. The sorted source tags are then aggregated by path number. The aggregation method is to merge source tags with the same path number to form source fragment groups. Finally, a set of source tags containing valid source tags, network return identifiers, path numbers, and sorting time fields is formed.

[0068] The source reconstruction submodule calls the source tags in the source identifier combination set, splits the field content according to the character hierarchy structure, and then groups the fields with the same header identifier together for concatenation. It then creates an index for the concatenation results and establishes a source matching mapping table.

[0069] The system retrieves the source tag fields from the source identifier combination set and performs character-level decomposition on each source tag. Decomposition is based on standard delimiters, including " / ", ".", and ":". First, URLs, API paths, and module names are split into several sub-fields. For example, "api.data.example.com / user / getInfo" will be split into "api", "data", "example", "com", "user", and "getInfo". Each level of field is recorded in its hierarchical position within the source path and its corresponding path number. After all fields are decomposed, each group of fields is categorized based on its first decomposed field. For example, records with multiple source fields whose first field is "api" will be grouped together. After grouping, the fields within the same group are concatenated hierarchically, following the original hierarchical order. For example, the field sequence "api", "data", and "info" will be concatenated as "a". If redundant or duplicate fields occur during the concatenation operation, such as the structure "data / data / info", only one layer of redundant fields is retained, ultimately forming a structured source path. Each concatenated source path is assigned a unique index number, and its original field source path number is recorded. Next, an index mapping table is established between the concatenated fields and the original fields. The table records parameters such as the structured source path, the concatenated path number, the original source identifier number, and the field level depth. If multiple concatenated fields have similar structures but different header identifiers, corresponding entries are generated separately. For example, "api / user / login" and "svc / user / login" have the same intermediate path, but are still considered independent source paths because their header fields are different. The source matching mapping table is established on this basis. Each mapping record contains information such as the original path number, the structured path number, the concatenation structure, and the content of the field components, which are used for subsequent tag positioning and path recognition operations.

[0070] The tag generation submodule extracts and analyzes whether the continuous distribution intervals formed before and after the access pointer in the stack write density meet the continuous interval density requirements based on the path mapping relationship in the source matching mapping table. It also compares the broadcast content field in the continuous path, extracts the tag index of the matching position, and generates a status classification tag sequence.

[0071] Based on the path number correspondence recorded in the source matching mapping table, the stack behavior log associated with each path record is extracted one by one. Fields such as function name, call time, write offset, and memory address are read from each stack write record. The distribution of stack write behavior within ±1 second before and after the current access pointer's time point is statistically analyzed. This 2-second window is divided into 20 consecutive sub-intervals (each interval 100ms), and the number of writes within each sub-interval is counted. If four or more consecutive sub-intervals show a write count of ≥4 times, the region is determined to be a dense stack write interval. This density threshold of ≥4 writes per 100ms is calculated based on the average stack write rate of high-load threads, combined with the high-frequency IO thread stack data in the experimental data. The write peak distribution is set so that if a path has more than 5 write operations in each interval from t=5.0s to t=5.4s, the segment is identified as a dense region. In the identified continuous paths, the broadcast event fields (such as event content, broadcast ID, broadcast module, etc.) associated with each path are compared. The broadcast fields are compared at the position level by character. The source path is scanned to see if it contains a substring that completely matches the broadcast field. If the match is successful, the index number of the current source path and the position index of the broadcast field are recorded. Multiple matching positions are sorted by time and the index numbers are extracted to form a tag index table. Finally, a set of status classification tag sequences is generated. Each record in this sequence is associated with a dense write interval, the source path number and the broadcast field matching index, and is sorted by path time.

[0072] Specifically, such as Figure 2 , 5 As shown, the state segment plotting module includes:

[0073] The trajectory combination submodule extracts the scheduling trajectory, memory space slice mapping map, and power consumption point change chain of the running thread set in the Android device based on the state classification label sequence. It combines the scheduling number in the scheduling trajectory with the partition block address in the mapping map in chronological order to generate a trajectory mapping dataset.

[0074] Based on the state classification label sequence, for each label index in the sequence corresponding to the time period, the scheduling trajectory of the currently running thread set is obtained by calling the scheduling log on the Android device. The ready time, execution time, and pause time of each thread in the scheduler are extracted, and information such as the core ID, priority, and application PID of the thread are recorded. At the same time, the memory space allocation log is obtained and a memory space slice mapping map is constructed. The memory block address, allocation time, and release time in the allocation event are extracted and recorded in slices by address range. For example, if thread A is scheduled 5 times between t=10s and t=12s, the corresponding memory partition allocation address is 0x7fa1xxxx, and the release time is t=12.5s, then the scheduling trajectory of this thread and the memory mapping interval form a trajectory segment. At the same time, the power consumption during this period is extracted from the system power consumption monitoring chain. The power consumption sampling data is recorded at a frequency of 100 times per second. The fields read are time point, current value, voltage value and corresponding thread activity tag. The data is arranged by time to form a chain of power consumption point changes. Then, using the tag index time as a reference point, the number of scheduling times in the scheduling trajectory is counted per second. For example, if thread A is scheduled 6 times in 1 second, the time slice is marked as a scheduling-intensive segment. Then, the segment is matched with the partition block address in the memory space slice sorted by time. For example, if the address segment 0x7fa100000x7fa1AFFF is frequently accessed at t=10s and t=12s, it is considered an active memory partition. All scheduling information and memory slices that are successfully matched by time are spliced ​​and combined in chronological order. Finally, the scheduling segment, memory partition block and power consumption point of each thread are merged into a set of data in the time dimension to form a trajectory mapping dataset.

[0075] The point identification submodule calls the scheduling count and partition block address in the trajectory mapping dataset to calculate the power consumption frequency characteristic value, locates the points that exceed the power consumption change threshold, and then determines whether the point corresponds to the active segment in the thread scheduling trajectory to obtain the active point index group.

[0076] The specific formula for calculating the power consumption frequency characteristic value is as follows:

[0077]

[0078] Among them, F w The power consumption frequency characteristic value represents N, the total number of calculation steps within the sampling interval represents j, the current sampling point number represents j′, and the previous sampling point number adjacent to the current point represents I. j I represents the current value of the current sampling point. j′ Δt represents the current value of the adjacent previous sampling point. j P represents the sampling time interval between the current number and the previous number. j P represents the thread power consumption sampling data recorded at the currently numbered point.j′ A represents the thread power consumption sampling data recorded at the previous numbered point, and A and B are the start and end numbers of the currently selected interval.

[0079] Parameter acquisition method and actual value description

[0080] The table below shows the real-time power consumption sampling data of a certain domestic Android device (8 cores, 2.0GHz, 3000mAh battery) during the test application scheduling. The data collection period is once every 10 milliseconds, and the sample consists of 4 time slices.

[0081] Table 1 Monitoring Table of Power Consumption and Equivalent Power Changes

[0082] Sample number j voltage U j (V) Current I j (A)] Power P j (W) time interval Δt j (s)] 1 3.85 0.312 1.515 0.01 2 3.87 0.342 1.578 0.01 3 3.80 0.330 1.530 0.01 4 3.81 0.302 1.485 0.01

[0083] As shown in Table 1, the voltage is obtained through the ADC module of the internal power management chip of the system, the current is estimated by the motherboard current detection module in combination with the external calibration model, and the power is the feedback data of the application layer system power consumption acquisition function.

[0084] Substitute the numerical values ​​into the formula for calculation.

[0085] Number of steps N = 3, numbering interval: j = 2, 3, 4, j′ = 1, 2, 3;

[0086] Calculate sequentially:

[0087] Group 1 (j=2, j'=1);

[0088] Equivalent power change:

[0089]

[0090] Power change rate:

[0091]

[0092] Total: 18.58;

[0093] Group 2 (j=3, j'=2);

[0094] Equivalent power change:

[0095]

[0096] Power change rate:

[0097]

[0098] Total: 11.8;

[0099] Group 3 (j=4, j'=3);

[0100] Equivalent power change:

[0101]

[0102] Power change rate:

[0103]

[0104] Total: 14.84;

[0105] Average value calculation:

[0106]

[0107] Threshold setting and explanation of the meaning of results

[0108] The threshold for identifying power consumption variation characteristics was set to 9.0. Based on the statistical distribution of the average thread's power consumption variation frequency under steady-state conditions, in 3000 samples, over 90% of the threads exhibited F... w It is distributed between 5.0 and 8.5.

[0109] The calculation yields: F w =15.07, which is much higher than the threshold, indicating that the current thread exhibits drastic power consumption fluctuations during the sampling period.

[0110] The result indicates that the time period corresponding to this thread is a power-sensitive, highly fluctuating region. It should be identified as an active point during the point identification process and written into the index group as a key reference point for subsequent path matching and structure mapping.

[0111] The graph construction submodule extracts continuous segment information in the trajectory mapping based on the correspondence between points in the active point index group and thread scheduling partitions, and maps and compares the active status of multiple segments with the label sequence to establish a state active segment graph.

[0112] Based on the thread scheduling partition identified by each point in the active point index group, the trajectory mapping dataset is parsed line by line to extract the scheduling cycle, active duration, associated memory block address, and time slice number of each thread. The scheduling behavior in the time slice where the active point is located is clustered. If a thread has active point markers in more than 3 consecutive time slices, then the time segment has strong continuity and is identified as a continuous segment. For example, if thread A has active scheduling and power consumption point records at t=3.0s, t=3.1s, and t=3.2s, then the segment [3.0s, 3.2s] is a valid continuous segment. After merging all valid segments by thread dimension, the associated tag index is obtained. The tag index is classified according to the state. The matching is performed on the tag sequence. The matching rules are time window alignment and source path consistency. That is, if the time period of a record in the tag sequence overlaps with a certain active segment by more than 50% and its source path number is consistent, then the tag is bound to the active segment. Then, a mapping and aggregation operation is performed on multiple active segments of each thread. The duration, memory address range and power consumption characteristics of multiple segments under the same tag index are merged and classified to form the state active graph nodes under the tag index. Each graph node records the state identifier, active segment time range, thread ID list, memory block set and average power consumption change frequency. All nodes are connected by edges according to the time sequence and the logical order of the tags to finally form a complete state active segment map.

[0113] Specifically, such as Figure 2 , 6 As shown, the state fragment packaging module includes:

[0114] The field extraction submodule is based on the active segment map. It collects the call path number, behavior source marker and permission registration field in each segment, performs field-level comparison of the execution content between call path numbers, identifies the differences and repetitions of instruction sequences, and generates path number cross groups.

[0115] First, based on the time period corresponding to each active thread in the graph, the call path number recorded in the system log for that thread is extracted. Each path number corresponds to a complete function call sequence. For example, the number "path 132" corresponds to the behavior trajectory of a thread between 3.1 seconds and 3.7 seconds. Simultaneously, the behavior source marker field and permission registration field corresponding to each path number are extracted. The behavior source marker field indicates the call path of the module to which the behavior belongs, such as "System Settings.Bluetooth Module.Transmission Service". The permission registration field indicates the system permissions required by this behavior path, such as "Read Location Information" or "Access SMS Records". Then, each pair of path numbers is grouped together, and the function sequences contained within them are read. Fields such as function name, parameter type, and module source are extracted layer by layer according to the function call order to form a field sequence. Finally, a layer-by-layer comparison operation is performed on the field sequences of the two paths to determine the same field level. The number of repeated fields (denoted as R) and the number of different fields (denoted as D) are used to determine the repetition rate. For example, if path number 132 and path number 140 each contain 25 function levels, and 21 of them are completely identical, the repetition rate is 84% ​​and the difference rate is 16%. If the repetition rate is greater than or equal to 70%, the two paths are considered to have highly similar structures. If the difference rate exceeds 30%, it indicates that the two paths have significant logical deviations. These two thresholds are set based on common threshold ranges obtained by statistically analyzing the distribution of repetition and difference rates from different types of path samples. Path numbers that meet the conditions of a repetition rate of not less than 70% and a difference rate of not more than 30% are grouped into the same cross group. Each group contains no fewer than 3 paths. For example, the repetition rates of paths 132, 140, and 144 are 84%, 76%, and 81%, and the difference rates are 16%, 24%, and 22%, respectively. These conditions are met, and they constitute path number cross group 1.

[0116] The structure construction submodule calls the path data in the path number cross group, combines and concatenates the behavior source tag and permission registration field corresponding to each path, determines whether the field combination is unique in the current segment, filters out duplicate tags, sorts the combined fields, and establishes a field combination encapsulation body.

[0117] The path information in the path number cross group is retrieved. The behavior source marker field and permission registration field for each path are read and concatenated. The concatenation order is module source first, followed by the permission field, connected by a "-". For example, if the source field is "Application Module.Multimedia.Transmission" and the permission field is "Write to External Storage", the concatenation result is "Application Module.Multimedia.Transmission-Write to External Storage". All concatenation results are written to a field combination list and associated with the path number and the corresponding active segment number to form a record item. Next, it is determined whether the field combination is unique within the same segment by counting the number of times the same concatenated field appears in that segment. If it appears more than once, it is considered a duplicate record. A uniqueness threshold of once is set, retaining only the first occurrence and discarding other entries. For example, a field "System Service Network..." If the field "Network Management - Access Network" appears three times in the current segment, only the first occurrence is retained, and the rest are deleted. After uniqueness filtering, the retained field combinations are sorted. The sorting rules are first classified by permission level, such as "Read SMS" as level 1, "Location Information" as level 2, and "Network Access" as level 3. Then, they are sorted by module level depth, which is determined by the number of "." in the field. For example, "System.Settings.Bluetooth" is level 3, and "System.Settings.Bluetooth.Service" is level 4. The sorting priority is set to 70% for permission level and 30% for module level. After sorting, each field combination is numbered, and finally, a field combination encapsulation body is formed. Each encapsulation body records the field content, permission level, module level, path number, and segment number. All field encapsulation bodies are written into the structure field table.

[0118] The content combination submodule adds boundary recognition segments corresponding to the sections based on the screened results in the field combination encapsulation body, splices the boundary fields and the content of the combination body in sequence, extracts the positioning information of the fields in the path sequence and assigns them uniform numbers, and establishes a state closed segment chain group.

[0119] Based on the content of the encapsulated fields in the structure field table, firstly, obtain the segment boundary time range in the state graph where each encapsulated field is located. The boundary time is defined as extending 200 milliseconds forward from the thread scheduling start time and extending 200 milliseconds backward from the end time. Within this boundary range, extract boundary identification fields from the system log, such as operation log fields like "thread start", "entry function call", and "log segment start". Arrange these boundary fields and concatenation fields in the field encapsulation in chronological order to form a field combination sequence. For example, if the starting boundary field is "thread start.main entry", and the concatenation field is "system service.Bluetooth transmission - write to external storage", then the combination result is "thread start.main entry". The command "-System Service.Bluetooth Transmission-Write to External Storage" is executed. Subsequently, a location operation is performed on each field in the field combination sequence in the call path. The location method is to scan the function sequence layer by layer and mark the function level and timestamp of the first occurrence of the field. For example, if the field "Bluetooth Transmission" first appears at the 5th level of the function call layer and the time is 4.3 seconds, the location is recorded as "5th level - 4.3 seconds". This location information is converted into a unified format number, such as "F001-5th level - 4.3 seconds". The location numbers of all fields are grouped and organized according to the path number and segment number to form a state field location chain. Finally, a state closed segment chain group is established. Each chain group contains the field combination sequence, boundary fields, location information in the path and number index.

[0120] Specifically, such as Figure 2 , 7 As shown, the status level response module includes:

[0121] The sequential generation submodule extracts the permission field values ​​and source tag content based on the state closed fragment chain group, combines the source tags in order according to the character length of the permission field, sorts the sequence by time, and establishes an associated sequential sequence.

[0122] Based on a state-closed fragment chain, the permission field values ​​and source tag contents recorded in each chain are read sequentially. The permission field values ​​represent system permissions accessed via the associated path in the chain, such as "Read Contacts," "Write to External Storage," and "Access Location Information." The source tag represents the module from which the action is invoked, such as "System.Settings.Bluetooth," "Application.Browser.Download Module," and "Service.Background.Data Synchronization." After extraction, the character length of each permission field is calculated. For example, "Read Contacts" is 6 Chinese characters, "Access Location Information" is 7 Chinese characters, and "Network Access" is 4 Chinese characters. Based on this character length, the source tags are reordered, with the shorter permission field appearing first. For example... The source tag corresponding to “Network Access” is placed before the source tag corresponding to “Access Location Information”. When multiple permission fields have the same length, they are sorted by the timestamp field in the chain group. The time sorting method is as follows: extract the start timestamp field in the chain group, and write the sorted source tag and its corresponding permission field as an association pair into the sequence. For example, “Network Access (4)” is bound to “Application.Browser.Download Module”, “Read Contacts (6)” is bound to “Service.Background.Data Synchronization”, and “Access Location Information (7)” is bound to “System.Settings.Bluetooth”. The sorting result is “Browser Download Module → Background Data Synchronization → Settings Bluetooth”. Finally, an association sequence is established. Each sequence records the sorting number, permission length, source module, start timestamp and path number index.

[0123] The duplicate judgment submodule calls the source marker sequence in the associated sequence, performs frequency statistics on the call path number in each fragment chain, calculates the frequency feature value of the path number, marks the first occurrence position of the path number in the sequence, and generates the path duplicate distribution value.

[0124] Formula for frequency characteristic value of path number:

[0125]

[0126] The overall calculation structure of the formula is as follows:

[0127] Summation symbol This represents the summation of the index values ​​of a path number across all its occurrences; subtraction operation. This is used to calculate the deviation between each occurrence of the call index and its average index in that path, combined with the external absolute value sign to remove the influence of the sign; multiplication. Combine the offset with the original index weight; square root item Used to compensate for the weight of the call location itself, preventing small index values ​​from being completely ignored in the weighting; the two parts of the numerator are formed by addition; the outer absolute value ensures that the result is non-negative; Λ in the denominator ab To determine the total number of occurrences, combine the summation terms. This is used for overall normalization and incorporates distance decay weights to ensure a comprehensive representation of different path numbers in terms of call frequency, distribution sparsity, and index bias.

[0128] Where, Φ ab X represents the frequency characteristic value of the b-th call path number in the a-th fragment chain. abc This represents the index value of the position of the b-th call path number in the c-th occurrence of the a-th fragment chain. Λ represents the average of all occurrence index values ​​of the b-th call path number in the a-th fragment chain. ab This represents the number of times the b-th call path number in the a-th fragment chain appears in the entire chain;

[0129] The parameter acquisition and quantization process is as follows:

[0130] In the actual system, by monitoring the module call logs and extracting the call path sequence, for the case where path number b=1, three calls were detected in a certain segment chain a=1, appearing at the 5th, 8th, and 12th positions of the call sequence, respectively.

[0131] X 111 =5,X 112 =8,X 113 =12;

[0132] The number of times it appears is:

[0133] Λ 11 =3;

[0134] The average call location is:

[0135]

[0136] Substitute the data into the formula and calculate item by item as follows:

[0137]

[0138] The denominator is:

[0139]

[0140] Final calculation results:

[0141]

[0142] Table 2 Path Location Index and Item Calculation Table

[0143]

[0144]

[0145] As shown in Table 2, the three position index values ​​and their calculation items are listed separately, and the sum of each item constitutes the total numerator value.

[0146] Regarding the "threshold" setting:

[0147] The frequency characteristic value judgment benchmark is set to θ = 10. This threshold is derived from the distribution analysis of historical call paths (sample mean 9.2, standard deviation 3.1, set as mean + 0.25σ). Therefore, the judgment criterion is:

[0148] If Φ ab >θ is considered a highly repetitive path;

[0149] The Φ calculated here 11 The value is approximately 26.39, which is far above the threshold, indicating that the distribution of this path number in the call chain is highly concentrated.

[0150] The advantage of the formula lies in the introduction of... Evaluate path call offset, Balance the impact of low index entries and use By introducing a sparsity adjustment mechanism, the frequency feature value can comprehensively reflect the number of times the path occurs, the degree of location concentration, and the breadth of the index, thereby enhancing the ability to distinguish path distribution patterns.

[0151] The level extraction submodule sorts and categorizes path numbers from low to high based on the frequency and location depth of the path repetition distribution values. It then combines and analyzes the corresponding permissions and tags in each type of path to distinguish differentiated level segments and establishes remote status monitoring and intelligent operation and maintenance results.

[0152] Path numbers are sorted and categorized based on frequency and position level in the path repetition distribution values. Frequency values ​​determine the path's activity level, and the initial position determines the path's response priority within the behavior sequence. The frequency classification criteria are as follows: ≥5 occurrences are Level 1, 34 occurrences are Level 2, and 12 occurrences are Level 3. This threshold is derived from the concentrated distribution of path call coverage density in the sample. Position level is based on the initial position: the first 5 positions are high priority, positions 6-10 are medium priority, and positions after 10 are low priority. Path numbers are combined and judged according to these two dimensions. For example, path "Path 110" with a frequency of 4 occurrences belongs to Level 2, and its initial position is the 3rd position, belonging to high priority, thus classifying it as a medium-high level combination. Subsequently, each level is further classified... The execution permission field and source field of the path number are compared. The number of permission field types and the number of source tag types in each level are extracted. If there is 1 source type and 3 permission types in a certain level, then there is a dense difference in permissions in that path level. This difference is recorded as "single source - diverse permissions". Conversely, if the permission fields are uniform but the source modules are different, it is marked as "fixed permissions - dispersed sources". All path level combinations and their analysis results are numbered and written into the level classification table. Finally, the remote status monitoring and intelligent operation and maintenance results are established. The result table records the path number, frequency level, location level, permission distribution structure, source distribution structure and number index for each path, which is used for subsequent behavior tracking and remote monitoring deployment.

[0153] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A remote status monitoring and intelligent operation and maintenance system for Android devices, characterized in that, The system includes: The event trigger parsing module obtains broadcast reception codes, stack writes, thread activity, network exceptions, and application access records. It matches broadcast and thread time tags, extracts the path from the first trigger to continuous calls, removes interference, constructs a traceable sequence, and forms a set of state start fragments. The state feature classification module extracts network return identifiers and source tags based on the set of state start segments, reassembles and establishes a matching table, merges continuous distribution intervals of the stack, compares broadcast and access paths, and generates a state classification label sequence. The state segment plotting module extracts thread scheduling trajectory, memory mapping and power consumption chain based on the state classification label sequence, combines scheduling times and partition block addresses, locates power consumption dense change points and determines active intervals, and generates a state active segment map. The state fragment packaging module extracts the call path number, source marker, and permission field from the state active segment map, performs path cross-comparison and uniqueness screening, and then encapsulates them into a package, attaches boundary recognition fragments, and forms a state closed fragment chain group.

2. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 1, characterized in that: The set of state start segments includes broadcast trigger time point, thread call start tag, continuous record path identifier, and interference path filtering tag. The state classification tag sequence includes network return type, source tag category, stack distribution interval identifier, and broadcast path corresponding tag. The state active segment map includes thread scheduling segment number, memory mapping block address, and power consumption change point identifier. The state closed segment chain group includes path number set, behavior and permission matching group, and boundary identification segment.

3. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 1, characterized in that: The term "power consumption dense change point and determine active range" refers to locating points in the power consumption point change chain where the change frequency exceeds a set threshold, and determining whether the point is in a continuous active segment in the thread scheduling trajectory. The boundary recognition segment refers to a structured information segment used to identify the start and end positions of a state segment, which is generated based on the boundary features of the path number and the permission field.

4. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 1, characterized in that, The event trigger parsing module includes: The information extraction submodule obtains thread logs, stack records, network status and application access data based on the broadcast reception code, compares the broadcast and thread start times by time, extracts information in the corresponding interval, and generates a set of synchronization information. The path matching submodule calls the synchronization information set, extracts the access path and stack record between broadcast and thread startup, filters out paths that do not meet the call count threshold, classifies and compares the stack information, and generates a matching path set; The state construction submodule determines the path density based on the matching path set, extracts abnormal connections and path frequencies, generates a path sequence that meets the conditions after normalization, and establishes a set of state start segments.

5. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 1, characterized in that, The state feature classification module includes: The identifier extraction submodule extracts the network return identifier and source marker from the combination of network connection anomaly value and access record based on the set of state start fragments. It sorts the source markers according to time sequence, performs a removal operation on records with missing fields, and generates a set of source identifier combinations. The source reconstruction submodule calls the source tags in the source identifier combination set, splits the field content according to the character hierarchy structure, and then groups the fields with the same header identifier together for concatenation. It then establishes an index comparison for the concatenation results and establishes a source matching mapping table. The tag generation submodule extracts and analyzes whether the continuous distribution intervals formed before and after the access pointer in the stack write density meet the continuous interval density requirements based on the path mapping relationship in the source matching mapping table. It also compares the broadcast content field in the continuous path, extracts the tag index of the matching position, and generates a status classification tag sequence.

6. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 1, characterized in that, The status segment plotting module includes: Based on the state classification label sequence, the trajectory combination submodule extracts the scheduling trajectory, memory space slice mapping map and power consumption point change chain of the running thread set in the Android device, and combines the scheduling number in the scheduling trajectory and the partition block address in the mapping map in chronological order to generate trajectory mapping dataset. The point identification submodule calls the scheduling count and partition block address in the trajectory mapping dataset to locate points whose power consumption frequency characteristic value exceeds the power consumption change threshold, and then determines whether the point corresponds to an active segment in the thread scheduling trajectory to obtain an active point index group. The map construction submodule extracts continuous segment information in the trajectory mapping based on the correspondence between points in the active point index group and thread scheduling partitions, and maps and compares the active status of multiple segments with the label sequence to establish a map of active segments.

7. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 1, characterized in that, The state fragment packaging module includes: Based on the active segment map, the field extraction submodule collects the call path number, behavior source marker and permission registration field in each segment, performs field-level comparison of the execution content between call path numbers, identifies the differences and repetitions of instruction sequences, and generates path number cross groups. The structure construction submodule calls the path data in the path number cross group, combines and concatenates the behavior source mark and permission registration field corresponding to each path, determines whether the field combination is unique in the current segment, filters out duplicate marks and sorts the combined fields, and establishes a field combination encapsulation body; The content combination submodule, based on the screened results in the field combination encapsulation, adds the boundary recognition fragments corresponding to the segments, concatenates the boundary fields and the content of the combination in sequence, extracts the positioning information of the fields in the path sequence and assigns them uniform numbers, and establishes a state-closed fragment chain group.

8. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 1, characterized in that, The system also includes: The status level response module extracts the permission field, source tag and path number from the status closed fragment chain group, generates an association sequence, counts the path repetition rate and arranges them according to the depth level, distinguishes the trigger level stripes, and generates remote status monitoring and intelligent operation and maintenance results.

9. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 8, characterized in that: The results of remote status monitoring and intelligent operation and maintenance include a sequence of permission fields, a source tag order structure, and a path number level classification.

10. The Android device remote status monitoring and intelligent operation and maintenance system according to claim 8, characterized in that, The status level response module includes: The sequential generation submodule extracts the permission field value and source tag content based on the state closed fragment chain group, combines the source tags in order according to the character length of the permission field, sorts the arrangement sequence by time, and establishes an associated sequential sequence. The duplicate judgment submodule calls the source marker sequence in the associated sequence, performs frequency statistics on the call path number in each fragment chain, constructs a frequency matrix according to the number of times the number appears, marks the first occurrence position of the path number in the sequence, and generates path duplicate distribution value; The level extraction submodule sorts and categorizes the path numbers from low to high based on the frequency and location depth of the path repetition distribution values. It then combines and analyzes the corresponding permissions and tags in each path category to distinguish differentiated level segments and establish remote status monitoring and intelligent operation and maintenance results.

Images