Cooperative monitoring system and method for digital transformation process

By constructing a relationship model based on process mining algorithms and multimodal anomaly detection, the problems of data silos and crude early warning in the process of digital transformation have been solved, enabling accurate risk identification and response, forming closed-loop management, and improving the enterprise's digital transformation capabilities.

CN121616248APending Publication Date: 2026-03-06HANG LUNG HIGHWAY CONSULTING (YINGJIANG) CO LTD
View PDF 0 Cites 0 Cited by

Patent Information

Application Number
CN202511745892.2
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-11-26
Publication Date
2026-03-06

AI Technical Summary

Technical Problem

Existing technologies suffer from problems such as data silos, rigid models, insufficient assessment of collaboration, and crude anomaly warnings during digital transformation, making it difficult to accurately identify key dependencies and provide intelligent and precise early warnings and responses.

Method used

A relational model based on process mining algorithms is constructed. Through digital verification scoring and collaboration calculation, multimodal anomaly detection is carried out by combining rule, statistics and machine learning models to generate hierarchical early warning signals. The model is then optimized through work order management and knowledge base.

Benefits of technology

It enables multi-level correlation analysis of business processes, accurately identifies potential risks, improves response efficiency and decision-making quality, forms a closed loop from passive alarm to proactive risk management, and enhances the enterprise's control over the digital transformation process.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN121616248A_ABST
    Figure CN121616248A_ABST
Patent Text Reader

Abstract

The invention discloses a collaborative monitoring system and method for a digital transformation process, and the method comprises the steps: obtaining all data, needing digital transformation, of an enterprise, and dividing the data into production data, operation data and support data; constructing a'relation model 'reflecting real business logic; generating a quantitative'digital verification score 'for evaluating the matching degree of the model and actual operation; when the digital verification score exceeds a preset threshold value, judging that the business process model passes verification; at the moment, the system enters a collaborative monitoring stage, and starts to calculate the collaborative degree between the business activities so as to quantify the collaborative closeness degree between the activities; the system carries out continuous anomaly analysis on real-time service data flow, and carries out accurate positioning and diffusion early warning on potential risks. The method has the advantages that the crossing from passive alarm to active risk management is realized, and the control force and the anti-risk capability of an enterprise on a digital transformation process are greatly enhanced.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention relates to the field of digital technology, and in particular to a collaborative monitoring system and method for digital transformation processes. Background Technology

[0002] With the deepening of digital transformation, enterprises face increasingly complex business processes and massive amounts of heterogeneous data. Traditional monitoring methods are often limited to static monitoring of single indicators or local processes, which has obvious limitations: First, data silos are serious, with data from different systems such as production, operations, and support lacking effective integration and correlation analysis, making it difficult to form a global view; second, models are rigid and have poor adaptability, with pre-set business process models mostly based on experience or static assumptions, failing to dynamically reflect the complex changes in actual business, leading to a disconnect between models and reality; third, there is insufficient assessment of collaboration, with existing technologies struggling to quantify the degree of collaboration between different business activities and failing to accurately identify key dependencies; finally, anomaly warnings are crude, with traditional anomaly detection usually targeting only isolated anomalies, lacking intelligent prediction of the chain reactions and scope of impact that anomalies may trigger, resulting in low value of warning information and delayed response.

[0003] While existing technologies have attempted improvements through process mining and other methods, shortcomings remain in the intelligence, precision, and closed-loop management of anomaly warnings. Most current solutions remain at the rudimentary stage of "alarming upon problem detection," failing to analyze the impact scope in conjunction with activity coordination, and lacking advanced functions such as warning grading, targeted push notifications, handling suggestions, and feedback optimization. These solutions cannot meet the urgent needs of enterprises for refined, intelligent, and closed-loop management of their digital transformation processes. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a collaborative monitoring system and method for digital transformation process.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] A collaborative monitoring method for digital transformation processes, comprising:

[0007] Acquire all data that the enterprise needs to undergo digital transformation, and categorize it into three main types based on business attributes: production data, operational data, and support data.

[0008] Digital transformation is driven by actual business processes; by applying pre-set process mining algorithms, the inherent relationships between various types of data are analyzed, and a "relationship model" reflecting the real business logic is constructed accordingly.

[0009] Based on this relationship model, a pre-set "business process model" is constructed or calibrated, and the model is digitally verified to generate a quantitative "digital verification score" to evaluate the degree of matching between the model and actual operation.

[0010] When the digital verification score exceeds the preset threshold, the business process model is deemed to have passed verification. At this point, the system enters the collaborative monitoring phase and begins to calculate the degree of collaboration between various business activities in order to quantify the closeness of cooperation between activities.

[0011] The system performs continuous anomaly analysis on real-time business data streams. Once an anomaly is identified, it not only marks the anomaly data itself, but also marks related activity data with a coherence degree higher than a set threshold, based on pre-calculated coherence. This generates a comprehensive early warning signal, enabling precise location and early warning of potential risks.

[0012] The continuous anomaly analysis of real-time business data streams includes: integrating rule engines, statistical models, and machine learning models to perform multimodal detection on real-time data streams to identify potential anomalies; the early warning signals include: classifying early warning signals into at least three levels based on the severity and scope of the anomalies, and pushing early warning signals of different levels to the corresponding responsible entities.

[0013] As a preferred embodiment of the present invention, dividing the warning signal into at least three levels specifically includes:

[0014] Blue alert: corresponds to a low-risk anomaly, and will only be recorded by the system or the relevant operators will be notified.

[0015] Yellow alert: This corresponds to a medium-risk abnormality and will be sent to the direct person in charge and team leader.

[0016] Red alert: This corresponds to a high-risk anomaly and is pushed to senior management and the emergency response team, triggering the pre-set emergency plan.

[0017] As a preferred technical solution of the present invention, the targeted push is based on resource information and corporate organizational structure associated with abnormal activities, and the warning signal is accurately sent to the most relevant responsible persons.

[0018] As a preferred embodiment of the present invention, the warning signal includes at least one of the following information:

[0019] Exception types and descriptions;

[0020] Impact range map generated based on synergy analysis;

[0021] Preliminary root cause suggestions generated based on historical data or rule bases;

[0022] Recommended handling suggestions or standard operating procedures (SOPs).

[0023] As a preferred embodiment of the present invention, after generating the warning signal, the method further includes:

[0024] The warning will be automatically generated as a task order to be processed and assigned to the designated person in charge;

[0025] Track the processing status of task orders within the system;

[0026] After the problem is resolved, the system verifies the effectiveness of the anomaly elimination and closes the work order.

[0027] As a preferred embodiment of the present invention, it further includes:

[0028] Store resolved exception cases, their handling processes, and results in the knowledge base;

[0029] Receive feedback on false alarms or unreasonable rules, and iteratively optimize the anomaly detection model or adjust relevant rules based on the feedback information.

[0030] Meanwhile, the present invention also provides a collaborative monitoring system for the digital transformation process, as detailed below:

[0031] A collaborative monitoring system for digital transformation processes, used to implement the method described above, includes:

[0032] Data acquisition module: Acquires all data that needs to be digitally transformed, and divides the data into production data, operational data and support data according to business level;

[0033] Model building module: Performs digital transformation according to actual business processes, mines and analyzes data relationships according to preset process algorithms, and builds relationship models based on data relationships;

[0034] Model Validation Module: Constructs a business process model based on the relational model, performs digital validation on the business process model, and generates a digital validation score;

[0035] Collaborative computing module: When the digital verification score is greater than the preset digital verification score threshold, the business process model passes verification and the degree of collaboration between activities is calculated;

[0036] Anomaly warning module: Performs anomaly analysis on real-time data stream. When an anomaly is detected, it marks the data of the abnormal data and the activities with a correlation greater than a threshold and generates an early warning signal.

[0037] The anomaly warning module further includes:

[0038] A multimodal anomaly detection unit is used to integrate rule engines, statistical models, and machine learning models to detect real-time data streams.

[0039] The early warning classification and push unit is used to push early warning signals to the corresponding responsible entities according to the level of abnormality.

[0040] As a preferred embodiment of the present invention, the system further includes:

[0041] The work order management module is used to generate task work orders from alerts, track the processing status, and verify the resolution effect.

[0042] The knowledge base module is used to store resolved exception cases and SOPs;

[0043] The model optimization module is used to receive feedback and iteratively optimize the anomaly detection model and rules.

[0044] The above technical solution has the following advantages:

[0045] This invention provides a collaborative monitoring system and method for digital transformation processes. By constructing a data-driven dynamic model and intelligent early warning mechanism, it effectively solves many problems in existing technologies. Through process mining algorithms, it automatically analyzes multi-source heterogeneous event logs to construct a "relationship model" containing causal and parallel relationships, breaking down data silos and achieving multi-level, panoramic correlation analysis of business processes. A "digital verification scoring" mechanism is introduced to quantitatively evaluate the matching degree between the preset business process model and actual operating data. When the score is below a threshold, model deviations can be detected in a timely manner, driving dynamic model updates and significantly improving the accuracy and adaptability of the process model. An innovative path weight-based collaborative degree calculation method is proposed, considering not only direct correlations but also comprehensively evaluating the universality of indirect paths, fully quantifying the degree of collaboration between business activities, and providing precise basis for optimizing resource allocation and process design. The system integrates rule, statistics, and machine learning models for multimodal anomaly detection and innovatively incorporates "collaboration degree" analysis into the early warning mechanism to accurately locate the potential impact range of anomalies. Through early warning grading (blue / yellow / red) and targeted push notifications, it ensures that information efficiently reaches responsible parties. The early warning information includes impact maps, root cause suggestions, and remedial plans, significantly improving response efficiency. Ultimately, through work order management, effect verification, and knowledge accumulation, a complete closed loop of "monitoring-early warning-response-optimization" is formed, achieving a leap from passive alarm to proactive risk management, and greatly enhancing the enterprise's control and risk resistance in the digital transformation process. Attached Figure Description

[0046] Figure 1 This is a flowchart of the method in this invention; Detailed Implementation

[0047] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings. It should be noted that these descriptions are for the purpose of aiding understanding the present invention, but do not constitute a limitation thereof. Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0048] Example 1

[0049] A collaborative monitoring method for digital transformation processes, as shown in the appendix. Figure 1 As shown, it includes:

[0050] Acquire all data that the enterprise needs to undergo digital transformation, and categorize it into three main types based on business attributes: production data, operational data, and support data.

[0051] Digital transformation is driven by actual business processes; by applying pre-set process mining algorithms, the inherent relationships between various types of data are analyzed, and a "relationship model" reflecting the real business logic is constructed accordingly.

[0052] Based on this relationship model, a pre-set "business process model" is constructed or calibrated, and the model is digitally verified to generate a quantitative "digital verification score" to evaluate the degree of matching between the model and actual operation.

[0053] When the digital verification score exceeds the preset threshold, the business process model is deemed to have passed verification. At this point, the system enters the collaborative monitoring phase and begins to calculate the degree of collaboration between various business activities in order to quantify the closeness of cooperation between activities.

[0054] The system performs continuous anomaly analysis on real-time business data streams. Once an anomaly is identified, it not only marks the anomaly data itself, but also marks related activity data with a coherence degree higher than a set threshold, based on pre-calculated coherence. This generates a comprehensive early warning signal, enabling precise location and early warning of potential risks.

[0055] The continuous anomaly analysis of real-time business data streams includes: integrating rule engines, statistical models, and machine learning models to perform multimodal detection on real-time data streams to identify potential anomalies; the early warning signals include: classifying early warning signals into at least three levels based on the severity and scope of the anomalies, and pushing early warning signals of different levels to the corresponding responsible entities.

[0056] In this embodiment, dividing the warning signal into at least three levels specifically includes:

[0057] Blue alert: corresponds to a low-risk anomaly, and will only be recorded by the system or the relevant operators will be notified.

[0058] Yellow alert: This corresponds to a medium-risk abnormality and will be sent to the direct person in charge and team leader.

[0059] Red alert: This corresponds to a high-risk anomaly and is pushed to senior management and the emergency response team, triggering the pre-set emergency plan.

[0060] In this embodiment, the targeted push is based on resource information and corporate organizational structure associated with abnormal activities, and the warning signal is accurately sent to the most relevant responsible persons.

[0061] In this embodiment, the warning signal includes at least one of the following:

[0062] Exception types and descriptions;

[0063] Impact range map generated based on synergy analysis;

[0064] Preliminary root cause suggestions generated based on historical data or rule bases;

[0065] Recommended handling suggestions or standard operating procedures (SOPs).

[0066] In this embodiment, after generating the warning signal, the method further includes:

[0067] The warning will be automatically generated as a task order to be processed and assigned to the designated person in charge;

[0068] Track the processing status of task orders within the system;

[0069] After the problem is resolved, the system verifies the effectiveness of the anomaly elimination and closes the work order.

[0070] This embodiment also includes:

[0071] Store resolved exception cases, their handling processes, and results in the knowledge base;

[0072] Receive feedback on false alarms or unreasonable rules, and iteratively optimize the anomaly detection model or adjust relevant rules based on the feedback information.

[0073] Example 2

[0074] A collaborative monitoring system for digital transformation processes, used to implement the method described above, includes:

[0075] Data acquisition module: Acquires all data that needs to be digitally transformed, and divides the data into production data, operational data and support data according to business level;

[0076] Model building module: Performs digital transformation according to actual business processes, mines and analyzes data relationships according to preset process algorithms, and builds relationship models based on data relationships;

[0077] Model Validation Module: Constructs a business process model based on the relational model, performs digital validation on the business process model, and generates a digital validation score;

[0078] Collaborative computing module: When the digital verification score is greater than the preset digital verification score threshold, the business process model passes verification and the degree of collaboration between activities is calculated;

[0079] Anomaly warning module: Performs anomaly analysis on real-time data stream. When an anomaly is detected, it marks the data of the abnormal data and the activities with a correlation greater than a threshold and generates an early warning signal.

[0080] The anomaly warning module further includes:

[0081] A multimodal anomaly detection unit is used to integrate rule engines, statistical models, and machine learning models to detect real-time data streams.

[0082] The early warning classification and push unit is used to push early warning signals to the corresponding responsible entities according to the level of abnormality.

[0083] In this embodiment, the system further includes:

[0084] The work order management module is used to generate task work orders from alerts, track the processing status, and verify the resolution effect.

[0085] The knowledge base module is used to store resolved exception cases and SOPs;

[0086] The model optimization module is used to receive feedback and iteratively optimize the anomaly detection model and rules.

[0087] Example 3

[0088] This embodiment provides a specific implementation of a collaborative monitoring system and method for digital transformation processes, using a supply chain digital transformation project of a large manufacturing enterprise as an example. The system aims to monitor the entire process from order receipt to product delivery in real time, ensuring the smooth progress of the transformation.

[0089] System Architecture and Module Deployment

[0090] This system is deployed on an enterprise private cloud platform and mainly consists of the following modules:

[0091] Data Acquisition Module: Collects data in real-time from ERP (Enterprise Resource Planning), MES (Manufacturing Execution System), WMS (Warehouse Management System), and CRM (Customer Relationship Management) systems via API interfaces and ETL tools. Data is categorized by business level into: production data (e.g., production work orders, equipment status), operational data (e.g., order information, logistics status), and support data (e.g., employee attendance, IT system logs).

[0092] Model building module: The improved HeuristicMiner algorithm is used as the preset process mining algorithm. It automatically extracts the activity set from the original event log, constructs the direct follow relationship matrix, and derives the causal, parallel and irrelevant relationship sets, and finally generates a Petri net-style relationship model.

[0093] Model Validation Module: This module uses the company's pre-designed "ideal supply chain process" as a business process model and performs alignment analysis with the relationship model obtained from the data mining above to calculate the digital validation score S_verify. The preset threshold is 0.85.

[0094] Collaborative Calculation Module: When S_verify > 0.85, the system considers the current process model valid and initiates collaboration degree calculation. The collaboration degree between any two activities is calculated using the formula C(a_i,a_j) = (1 / K)Σ(w_p), where the path weight w_p is calculated based on event instance data from the past 30 days.

[0095] Anomaly warning module: This is the core optimization part of this embodiment, and includes:

[0096] Multimodal anomaly detection unit: It integrates a rule-based engine (such as "alarm if order is not shipped within 48 hours"), a statistical 3σ principle (monitoring the standard deviation of the execution time of each activity), and an LSTM-based time series prediction model (predicting order delivery time, and considering it an anomaly if the actual time deviation is too large).

[0097] Early warning classification and push unit: Based on the severity of the anomaly and the scope of its impact, the early warning is divided into three levels: blue (low risk), yellow (medium risk), and red (high risk), and is pushed to relevant responsible persons through WeChat and email.

[0098] Work order management module: Integrates with the enterprise's ITSM (IT Service Management) system to automatically generate and process work orders.

[0099] Knowledge base module: Stores historical exception cases and standard handling procedures.

[0100] Model optimization module: Periodically analyzes false positive and false negative data to fine-tune the parameters of the anomaly detection model.

[0101] Specific processing procedures

[0102] 1. Daily Monitoring and Model Validation: The system continuously collects data. On a certain day, the model validation module calculates the current digital validation score S_verify=0.88, which is higher than the threshold of 0.85, indicating that the preset process model is still effective. Based on this, the collaborative calculation module calculates that activities such as "order approval" and "material procurement" and "production scheduling" have a high degree of synergy (>0.7).

[0103] 2. Anomaly Detection and Collaborative Analysis: Real-time system monitoring revealed a sudden and significant increase in the execution time of the "Material Procurement" activity, which the LSTM model predicted would be severely delayed. The multimodal detection unit comprehensively identified it as a "high-risk anomaly."

[0104] 3. Generate and push tiered alerts:

[0105] The early warning classification and push unit identified this as a high-risk anomaly, and the degree of coordination between activities such as "material procurement", "production scheduling" and "quality inspection" was greater than the threshold of 0.6.

[0106] The system generates a detailed red alert signal, which includes:

[0107] Anomaly description: "Severe delays have occurred in the material procurement process, which are expected to affect subsequent production."

[0108] Impact Scope Map: A visual representation of the highly synergistic impact chain from "Material Procurement" to "Production Scheduling" to "Quality Inspection" to "Product Delivery".

[0109] Root cause suggestion: "Initial analysis suggests it may be related to a delivery delay by supplier A."

[0110] Recommendation: "It is recommended to immediately contact Purchasing Manager Zhang San and Production Manager Li Si to activate the backup supplier plan."

[0111] The red alert was pushed to Zhang San, the purchasing manager, Li Si, the production manager, and Wang Wu, the supply chain director, and the emergency plan was automatically triggered.

[0112] 4. Closed-loop response and processing:

[0113] Purchasing manager Zhang San received an alert in WeChat Work. After clicking "Claim", the system automatically created a high-priority work order in the ITSM system.

[0114] Zhang San contacted the supplier to confirm the problem and initiated the backup supplier process. During the process, he updated the progress in the work order.

[0115] After the problem was resolved, he updated the work order status to "Resolved".

[0116] 5. Effectiveness Verification and Knowledge Accumulation:

[0117] The system continuously monitors the "material procurement" activity and confirms that its execution time has returned to normal.

[0118] After the work order management module verifies the effect, the work order will be automatically closed.

[0119] The model optimization module recorded this event. The knowledge base module stores the case of "Supplier A delay -> Material procurement delay" and the successful handling solution of "Activating the backup supplier" in the knowledge base for future reference.

[0120] 6. Continuous Optimization: One month later, system analysis revealed that due to adjustments in supply chain strategy, the new "rapid procurement" process was not covered by the old model, causing S_verify to drop to 0.80. The system issued a model update suggestion, prompting the business department to update the preset process model, thus achieving the system's self-evolution.

[0121] This embodiment demonstrates that the system not only accurately reflects actual business processes but also, through an intelligent, hierarchical, and closed-loop early warning mechanism, resolves potential production disruption crises at their inception. By precisely locating the scope of impact, providing handling suggestions, and achieving task closure, it significantly improves the enterprise's response speed and decision-making quality in dealing with sudden risks, fully demonstrating the significant advantages of this invention in enhancing the controllability and stability of the digital transformation process.

[0122] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and these variations still fall within the protection scope of the present invention.

Claims

1. A method for collaborative monitoring of a digital transformation process, characterized in that, Comprise: Acquire all data that needs to be digitized, and divide it into production data, operational data and support data according to business attributes; Promote digitization based on actual business processes; analyze the internal relationship between various data through the application of preset process mining algorithms, and build a "relationship model" reflecting the real business logic; Based on the relationship model, build or calibrate the preset "business process model", and conduct digital verification on the model to generate a quantitative "digital verification score" to assess the matching degree of the model with the actual operation; When the digital verification score exceeds the preset threshold, the business process model verification is passed; at this time, the system enters the collaborative monitoring stage and starts to calculate the synergy degree between activities to quantify the collaboration tightness between activities; The system conducts continuous anomaly analysis on real-time business data flow; once an abnormal event is identified, not only the abnormal data itself is marked, but also the related activity data with a synergy degree higher than the set threshold is marked, and a comprehensive early warning signal is finally generated to realize accurate positioning and spread warning of potential risks; Among them, the continuous anomaly analysis on real-time business data flow includes: multi-modal detection of real-time data flow by fusing rule engine, statistical model and machine learning model to identify potential anomalies; the early warning signal includes: dividing the early warning signal into at least three levels according to the severity and impact range of the anomaly, and pushing the early warning signal of different levels to the corresponding responsible subject.

2. The method of claim 1, wherein, The early warning signal is divided into at least three levels, which specifically includes: Blue warning: corresponding to low-risk anomaly, only system record or notification to relevant operators; Yellow warning: corresponding to medium-risk anomaly, pushed to the direct responsible person and team supervisor; Red warning: corresponding to high-risk anomaly, pushed to senior managers and emergency team, and trigger the preset emergency plan.

3. A method of collaborative monitoring of a digital transformation process according to claim 1 or 2, characterized in that, The directional push is based on the resource information associated with the abnormal activity and the enterprise organizational structure to accurately send the early warning signal to the most relevant responsible person.

4. A method of collaborative monitoring of a digital transformation process according to any of claims 1-3, characterized in that, The early warning signal contains at least one of the following information: Abnormal type and description; Impact range map generated based on synergy degree analysis; Preliminary root cause suggestion based on historical data or rule base; Recommended treatment suggestion or standard operation procedure (SOP).

5. A method of collaborative monitoring of a digital transformation process according to any of claims 1-4, characterized in that, After generating the early warning signal, it also includes: Automatically generate the early warning as a to-be-processed task order and assign it to the designated responsible person; Track the processing status of the task order in the system; After the problem is solved, the system verifies the anomaly elimination effect and closes the order.

6. The method of collaborative monitoring of a digital transformation process according to claim 5, wherein, It also includes: Store the solved anomaly cases and their processing process and results in the knowledge base; Receive feedback on false positives or unreasonable rules, and iteratively optimize the anomaly detection model or adjust the related rules based on the feedback information.

7. A digital transformation process collaborative monitoring system for implementing the method of any one of claims 1 to 6, characterized in that, Comprise: Data acquisition module: acquire all data that needs to be digitized, and divide the data into production data, operational data and support data according to business levels; The model construction module: according to the actual business process, the data relationship is analyzed according to the preset process mining algorithm, and the relationship model is constructed according to the data relationship; The model verification module: according to the relationship model, the business process model is constructed, the digital verification of the business process model is carried out, and the digital verification score is generated; The collaborative calculation module: when the digital verification score is greater than the preset digital verification score threshold, the business process model verification passes, and the collaboration degree between activities is calculated; The abnormal early warning module: abnormal analysis is carried out on the real-time data stream, when the abnormality is identified, the abnormal data and the data of the activities with the collaboration degree greater than the threshold are marked, and the early warning signal is generated; The abnormal early warning module further includes: A multi-modal anomaly detection unit for fusing rule engines, statistical models and machine learning models to detect real-time data streams; An early warning grading and pushing unit for directing early warning signals to corresponding responsible subjects according to the abnormality level.

8. The system of claim 7, wherein, The system further includes: A work order management module for generating early warning task work orders, tracking processing status and verifying solution effect; A knowledge base module for storing solved abnormal cases and SOPs; A model optimization module for receiving feedback and iteratively optimizing the anomaly detection model and rules.