Internet hospital system monitoring method, equipment, storage medium and program product

Abstract

The embodiment of the present invention provides an Internet hospital system monitoring method, device, storage medium and program product, which collects business log data of the Internet hospital system and adds the business log data to the message queue; obtains the target index according to the business log data in the message queue through the stream processing engine; determines whether the Internet hospital system has an abnormality according to the target index and the preset alarm rules; if it is determined that the Internet hospital system has an abnormality, an alarm message is sent to the user terminal. The embodiment of the present invention collects the business log data of the Internet hospital system, parses and processes the business log data to obtain the target index, builds a unified monitoring index system, realizes unified monitoring of different Internet hospitals connected to the Internet hospital system, determines whether the Internet hospital system has an abnormality based on the target index and the preset alarm rules, and discovers the potential abnormalities of the Internet hospital system, so as to timely alarm and recover from the abnormality.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of Internet technology, and in particular to an Internet hospital system monitoring method, device, storage medium and program product. Background Art

[0002] With the rapid development and expansion of Internet hospitals, the business needs of Internet hospitals are increasing day by day. More and more hospitals or institutions are entering the Internet hospital system platform, and the sources of Internet hospital system traffic are also increasing. It makes it very important to ensure the normal operation of the Internet hospital system without failure under such huge traffic. Therefore, monitoring of the Internet hospital system is becoming more and more important.

[0003] At present, the monitoring of Internet hospital systems usually involves monitoring the availability of various Internet hospital interfaces, including monitoring the number of interface calls and call delays. Since the Internet hospital system is connected to different Internet hospitals, various abnormal conditions may occur. Monitoring the availability of interfaces alone cannot effectively locate, trace, and warn of abnormal conditions. Summary of the invention

[0004] The embodiments of the present invention provide an Internet hospital system monitoring method, device, storage medium and program product to achieve effective monitoring of the Internet hospital system and alarm of abnormal situations.

[0005] In a first aspect, an embodiment of the present invention provides an Internet hospital system monitoring method, comprising:

[0006] Collecting business log data of the Internet hospital system and adding the business log data to the message queue;

[0007] Use the stream processing engine to obtain target indicators based on the business log data in the message queue;

[0008] According to the target indicators and preset alarm rules, determine whether there is an abnormality in the Internet hospital system;

[0009] If it is determined that there is an abnormality in the Internet hospital system, an alarm message will be sent to the user terminal.

[0010] In a second aspect, an embodiment of the present invention provides an Internet hospital system monitoring device, including:

[0011] A collection module, used to collect business log data of the Internet hospital system and add the business log data to the message queue;

[0012] The stream processing module is used to obtain target indicators based on the business log data in the message queue through the stream processing engine;

[0013] The risk control module is used to determine whether there is an abnormality in the Internet hospital system based on the target indicators and preset alarm rules;

[0014] The alarm module is used to send an alarm message to the user terminal if it is determined that there is an abnormality in the Internet hospital system.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, including: at least one processor; and a memory;

[0016] The memory stores computer-executable instructions;

[0017] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to the first aspect.

[0018] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the method described in the first aspect is implemented.

[0019] In a fifth aspect, an embodiment of the present invention provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the method described in the first aspect.

[0020] The Internet hospital system monitoring method, device, storage medium and program product provided by the embodiment of the present invention collects the business log data of the Internet hospital system and adds the business log data to the message queue; obtains the target index according to the business log data in the message queue through the stream processing engine; judges whether the Internet hospital system has abnormalities according to the target index and the preset alarm rules; if it is determined that the Internet hospital system has abnormalities, an alarm message is sent to the user terminal. The embodiment of the present invention collects the business log data of the Internet hospital system, parses and processes the business log data to obtain the target index, and constructs a unified monitoring index system to achieve unified monitoring of different Internet hospitals connected to the Internet hospital system, and then judges whether the Internet hospital system has abnormalities based on the target index and the preset alarm rules, and can discover potential abnormalities in the Internet hospital system to facilitate timely alarms and recovery of abnormalities. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0022] Figure 1 A schematic diagram of an Internet hospital system provided by an embodiment of the present invention;

[0023] Figure 2A flow chart of an Internet hospital system monitoring method provided by an embodiment of the present invention;

[0024] Figure 3 A flow chart of an Internet hospital system monitoring method provided by another embodiment of the present invention;

[0025] Figure 4 A flow chart of an Internet hospital system monitoring method provided by another embodiment of the present invention;

[0026] Figure 5 A block diagram of an Internet hospital system monitoring device provided by an embodiment of the present invention;

[0027] Figure 6 A block diagram of an electronic device provided by an embodiment of the present invention.

[0028] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0029] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0030] With the rapid development and expansion of Internet hospitals, the business needs of Internet hospitals are increasing day by day. More and more hospitals or institutions are entering the Internet hospital system platform, and the sources of Internet hospital system traffic are also increasing. It makes it very important to ensure the normal operation of the Internet hospital system without failure under such huge traffic. Therefore, monitoring of the Internet hospital system is becoming more and more important.

[0031] At present, the monitoring of Internet hospital systems usually involves monitoring the availability of interfaces in various Internet hospitals, including monitoring the number of interface calls and call delays, but not monitoring business data, ignoring the value of monitoring business data. The Internet hospital system is connected to different Internet hospitals, and various abnormal conditions may occur, especially the monitoring data log formats of various Internet hospitals are not unified, and the links cannot be tracked. There is no unified monitoring, no unified indicator system, and no scientific and objective measurement of the health of the system. It is impossible to effectively locate, trace and warn of various abnormal conditions in different Internet hospitals connected to the Internet hospital system by simply monitoring the availability of interfaces.

[0032] In response to the above technical problems, an embodiment of the present invention provides a method for monitoring an Internet hospital system, which collects business log data from different Internet hospitals connected to the Internet hospital system and adds the business log data to a message queue; obtains target indicators based on the business log data in the message queue through a stream processing engine, and builds a unified measurement system through the target indicators to scientifically and objectively measure the health of the system; further, based on the target indicators and preset alarm rules, it can be determined whether there is an abnormality in the Internet hospital system; if it is determined that there is an abnormality in the Internet hospital system, an alarm message is sent to the user terminal so that the user can promptly discover and locate the abnormality and recover from the abnormality.

[0033] The Internet hospital system monitoring method provided by the embodiment of the present invention is applied to Figure 1 The Internet hospital system shown in FIG. 1 is connected to a plurality of different Internet hospitals, that is, the backend server 102 of the Internet hospital system is connected to the servers 101 of each Internet hospital, and the backend server 102 of the Internet hospital system can collect business log data from the servers 101 of each Internet hospital. The system architecture of the backend server 102 is as follows: Figure 1 As shown in the dotted box in , the data collection unit collects business log data and adds the business log data to the message queue; the stream processing engine obtains the target index based on the business log data in the message queue; and then the risk control measurement platform determines whether the Internet hospital system is abnormal based on the target index and the preset alarm rules; if it is determined that the Internet hospital system is abnormal, the notification center can send an alarm message to the user terminal. The target index obtained by the stream processing engine can be stored in the database, and the risk control measurement platform can obtain the target index from the database in real time or at a fixed time, and then determine whether the Internet hospital system is abnormal based on the target index and the preset alarm rules.

[0034] The following specific embodiments are used to describe in detail the technical solutions of the present invention and how the technical solutions of the present application solve the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0035] Figure 2 This is a flow chart of the Internet hospital system monitoring method provided by an embodiment of the present invention. This embodiment provides an Internet hospital system monitoring method, the execution subject of which is an electronic device such as a server. The specific steps of the Internet hospital system monitoring method are as follows:

[0036] S201. Collect business log data of the Internet hospital system and add the business log data to a message queue.

[0037] In this embodiment, the Internet hospital system is connected to multiple different Internet hospitals, that is, the background server of the Internet hospital system is connected to the server and other service-side devices of each Internet hospital. In order to avoid the inconsistency of the data format of each Internet hospital, this embodiment can collect the required business log data of each Internet hospital in a unified format from the server of each Internet hospital. Specifically, it can be collected through embedding points, or collected from the business logs of each Internet hospital, or collected from the business database of each Internet hospital. The business log data includes but is not limited to data in business processes such as triage, consultation, prescription, and drug purchase.

[0038] Optionally, the business log data of each Internet hospital can be collected in a preset log format through the software development kit (SDK) preset in the server-side equipment of each Internet hospital in the Internet hospital system. As the business log data of the Internet hospital system, the SDK can be used to more conveniently implement the point-of-sale, and the collected business log data can be in a unified log format, which is convenient for monitoring the Internet hospital system. Among them, SDK is a java application, which is embedded in each Internet hospital business system through Maven dependency. The business system calls the SDK method to pass in the business log data that needs to be reported for monitoring, and the SDK data will asynchronously send the data to the message queue for storage.

[0039] Business log data is added to the message queue for caching. The message queue is an important channel for full-link data transmission. It is usually necessary to pay attention to the backlog, number of connections, number of queues, etc. to determine whether the message queue is operating normally.

[0040] In addition, the background server of the Internet hospital system can also be monitored and buried, and the background server system log data can be sent to the performance monitoring platform in real time or at a scheduled time to monitor system parameters such as the number of interface calls and call delay. When system parameters such as the number of interface calls and call delay are abnormal, an alarm will be directly issued, that is, an alarm message will be sent to the user terminal.

[0041] S202: Obtain target indicators based on business log data in the message queue through the stream processing engine.

[0042] In this embodiment, the business log data in the message queue is consumed and processed by the stream processing engine. Optionally, the stream processing engine can be a Flink engine or other engines. The stream processing engine is the key to full-link consumption and data parsing. The stability of the stream processing engine is related to whether there is data backlog in the message queue and the accuracy of downstream data.

[0043] In this embodiment, the target indicator can be obtained through the stream processing engine. Optionally, the target indicator includes a target business indicator and / or a target system indicator.

[0044] Among them, the target business indicators may include but are not limited to the number of consultation orders, the number of payment orders, the number of triage orders, the number of orders dispatched but not received, the number of user cancellation orders, the number of prescription orders, the payment conversion rate, the prescription conversion rate and other measurement indicators. The system fluctuations can be measured later on a year-on-year or month-on-month basis. In this embodiment, the business log data in the message queue can be parsed by the stream processing engine, the target field in the business log data can be obtained, and the value of the target field can be determined as the target business indicator. That is, in this embodiment, the value of the field corresponding to the target business indicator can be directly parsed from the business log data by the stream processing engine.

[0045] The target system indicators may include but are not limited to indicators for measuring whether the transaction flow is abnormal, indicators for measuring abnormal cheating, indicators for measuring abnormal server performance, etc. In this embodiment, the business log data in the message queue can be parsed by the stream processing engine to obtain the target field in the business log data, and the target system indicators are obtained according to the value of the target field and the preset algorithm, wherein the preset algorithm is an algorithm for obtaining the target system indicators, and the preset algorithm can be some statistical algorithms, such as using a statistical algorithm to count the transaction flow for a period of time, or some target system indicators need to perform certain operations on multiple data, which can be achieved through specific preset algorithms, and examples are not given here one by one.

[0046] This embodiment establishes a unified monitoring and measurement indicator system for Internet hospitals based on target indicators, which facilitates the unification of caliber and enables monitoring of different Internet hospitals.

[0047] S203. Determine whether there is any abnormality in the Internet hospital system based on the target indicators and preset alarm rules.

[0048] In this embodiment, after the target indicator is obtained, it can be determined whether there is an abnormality in the Internet hospital system based on the target indicator and the preset alarm rules, so as to detect the abnormality in time and issue a timely alarm.

[0049] In an optional embodiment, for the above-mentioned target business indicators, the target business indicators are compared with the historical business indicators, and whether the Internet hospital system is abnormal is determined based on the comparison results. For example, for the number of consultation orders, the number of consultation orders in the same period last year or last month can be obtained based on the historical number of consultation orders, and then the number of consultation orders this month can be compared with the number of consultation orders in the same period last year (year-on-year), or the number of consultation orders this month can be compared with the number of consultation orders in the previous month (month-on-month), so as to determine whether the number of consultation orders is abnormal, and then determine whether the Internet hospital system is abnormal.

[0050] In another optional embodiment, for the target system indicator, the target system indicator is input into the corresponding preset abnormality judgment model, and the preset abnormality judgment model is used to judge whether the Internet hospital system has an abnormality. In this embodiment, at least one preset abnormality judgment model can be pre-configured, and then the target system indicator is input into the corresponding preset abnormality judgment model, and the preset abnormality judgment model is used to judge whether the Internet hospital system has an abnormality.

[0051] Optionally, the preset anomaly judgment model includes at least one of the following: a transaction flow anomaly detection model, a grabbing order cheating model, a medical and patient violation risk control model, and a doctor service anomaly detection model.

[0052] In this embodiment, the transaction flow anomaly detection model can be used to detect whether there is transaction flow anomaly in the Internet hospital system based on the target system indicators; the order grabbing anti-cheating model can be used to detect whether there is order grabbing cheating in the Internet hospital system based on the target system indicators; the doctor-patient violation risk control model can be used to detect whether there are doctor violations or patient violations in the Internet hospital system based on the target system indicators, such as patients maliciously grabbing coupons, patients harassing doctors, etc.; the doctor service anomaly detection model can be used to detect whether there is a doctor's failure to provide normal service in the Internet hospital system based on the target system indicators. The above-mentioned abnormal judgment model can adopt any algorithm model that can realize its function, and it is not limited here. This embodiment realizes business anti-fraud and doctor-patient risk control management by detecting abnormal behaviors such as traffic anomalies, illegal operations of patients and doctors, and provides a one-stop full-process automated decision-making service.

[0053] Optionally, after obtaining the target index according to the business log data in the message queue through the stream processing engine in S202, the target index can also be stored in the database, wherein, optionally, the ClickHouse (a column storage database) database can be used, which has excellent read and write performance, but the disadvantage of the ClickHouse database is that it does not support slightly higher concurrency, so when writing data, write as many batches as possible, generally 200,000 to 1 million per batch, and it is necessary to minimize the query frequency. Of course, other databases, such as HBase data, can also be used in this embodiment.

[0054] Furthermore, when judging whether there is an abnormality in the Internet hospital system based on the target indicators and preset alarm rules, the target indicators can be obtained from the database in real time or periodically, and judging whether there is an abnormality in the Internet hospital system based on the target indicators and preset alarm rules.

[0055] S204. If it is determined that there is an abnormality in the Internet hospital system, an alarm message is sent to the user terminal.

[0056] In this embodiment, after determining that an abnormality exists in the Internet hospital system, an alarm message can be sent to user terminals such as management personnel and business personnel. The sending method is not limited to email, text message, instant messaging, etc. In addition, the alarm message can be sent in real time or at a scheduled time. The alarm message prompts the user that an abnormality exists in the Internet hospital system, so that the user can troubleshoot the problem and recover from the abnormality in the Internet hospital system.

[0057] The Internet hospital system monitoring method provided in this embodiment collects the business log data of the Internet hospital system and adds the business log data to the message queue; obtains the target index according to the business log data in the message queue through the stream processing engine; judges whether the Internet hospital system has abnormalities according to the target index and the preset alarm rules; if it is determined that the Internet hospital system has abnormalities, an alarm message is sent to the user terminal. This embodiment collects the business log data of the Internet hospital system, parses and processes the business log data to obtain target indicators, builds a unified monitoring indicator system, and realizes unified monitoring of different Internet hospitals connected to the Internet hospital system. It can then judge whether the Internet hospital system has abnormalities based on the target indicators and the preset alarm rules, and can discover potential abnormalities in the Internet hospital system so as to issue timely alarms and recover from the abnormalities.

[0058] Based on any of the above embodiments, Figure 3 As shown, after determining that an abnormality exists in the Internet hospital system in S204, the following steps may also be included:

[0059] S301, analyzing abnormal points of the Internet hospital system, and sending the analysis results to the user terminal for display;

[0060] S302, receiving a first query instruction of a problem location knowledge base sent by the user terminal according to the analysis result, wherein the problem location knowledge base includes a plurality of preset problem location step information;

[0061] S303: Send problem locating step information corresponding to the analysis result to the user terminal according to the first query instruction, so that the user can locate the problem according to the preset problem locating step information.

[0062] In this embodiment, after determining that an abnormality exists in the Internet hospital system, an abnormal point analysis can be performed on the Internet hospital system, and the analysis dimensions include but are not limited to: the number of system abnormalities, parameter abnormality detection, upstream and downstream interface call rates, database CPU, and database hard disk usage. Furthermore, the analysis results can be sent to the user terminal for display, and multi-dimensional analysis visualization can be performed, which is conducive to intuitive and rapid observation of data fluctuations and can quickly locate problems.

[0063] Furthermore, users can query the problem location step information in the problem location knowledge base based on the analysis results. Users can step by step troubleshoot the problem according to the queried problem location step information, and then quickly locate the problem. Based on the problem location knowledge base, users who do not understand the business system can quickly locate the problem, reducing the maintenance threshold and cost. The problem location knowledge base may include different preset problem location step information, and users can query the problem location step information corresponding to the analysis results in a targeted manner based on the analysis results. The problem location knowledge base can be updated, and users upload the latest problem location steps to the problem location knowledge base.

[0064] Based on the above embodiment, the abnormal point analysis of the Internet hospital system includes:

[0065] If it is determined that there are multiple anomalies in the Internet hospital system, correlation analysis is performed on the multiple anomalies according to a preset correlation analysis model, and / or root cause analysis is performed on the multiple anomalies according to a preset root cause analysis model to determine the source of the anomalies among the multiple anomalies; and relevant information of the source of the anomaly is sent to the user terminal for display.

[0066] In this embodiment, considering that when an abnormality occurs in a certain link of the Internet hospital system, it may cause abnormalities in multiple subsequent links to trigger warnings, therefore, when it is determined that there are multiple abnormalities in the Internet hospital system, correlation analysis and / or root cause analysis can be performed on the multiple abnormalities to determine the source of the abnormalities in the multiple abnormalities, thereby facilitating users to quickly locate the source of the abnormalities in the case of multiple abnormalities, thereby solving the source of the abnormalities in a targeted manner, improving recovery efficiency, and saving labor costs. In this embodiment, correlation analysis can be performed on multiple abnormalities according to a preset correlation analysis model, wherein the preset correlation analysis model can be obtained through training; in addition, root cause analysis can be performed on multiple abnormalities according to a preset root cause analysis model, and analysis can be performed on the business process time series to discover nodes where problems occur in the business process time series. Similarly, the preset root cause analysis model can also be obtained through training.

[0067] After locating the problem, the located problem can be repaired, which may include interface repair, repair based on the problem repair knowledge base, and automatic repair.

[0068] Based on any of the above embodiments, optionally, Figure 4 As shown, the method may also include:

[0069] S401, receiving a second query instruction of a problem repair knowledge base sent by the user terminal according to a problem location result, wherein the problem repair knowledge base includes repair solutions for different problems;

[0070] S402: Send a repair solution corresponding to the problem locating result to the user terminal according to the second query instruction.

[0071] In this embodiment, a problem repair knowledge base may be provided, which includes repair solutions for different problems. The user may query the problem repair knowledge base according to the problem location result, obtain the corresponding repair solution, and then perform manual repair based on the repair solution.

[0072] Based on any of the above embodiments, optionally, the method may further include:

[0073] If the problem location result is that the Internet hospital system update failed, a backup cluster configured with the Internet hospital system before the update will be used to implement the Internet hospital system rollback.

[0074] In this embodiment, when the Internet hospital system is updated, including when any server cluster is updated, a backup cluster can be used to retain the old version of the system before the update. When an abnormal update failure occurs in the new version of the system in the updated service weapon cluster, the backup cluster of the Internet hospital system before the update can be used to take over and implement the Internet hospital system rollback, so as to maintain the normal operation of the Internet hospital system.

[0075] Based on any of the above embodiments, optionally, the method may further include:

[0076] If the problem location result is abnormal traffic, the Internet hospital system will be controlled to limit the abnormal traffic.

[0077] In this embodiment, when the problem location result is abnormal traffic, including abnormal traffic at any stage of the business process such as triage, consultation, prescription, and drug purchase, the Internet hospital system can be controlled to limit the abnormal traffic to prevent continued abnormal traffic and affect the stable operation of the system.

[0078] Based on any of the above embodiments, the method further includes:

[0079] The business log data and / or the target indicator are subjected to data preprocessing and feature extraction to obtain data features; and the preset abnormality judgment model is trained according to the data features.

[0080] In this embodiment, any model involved in the Internet hospital system monitoring method can be trained and optimized based on the acquired business log data and / or target indicators. Specifically, business log data and / or target indicators can be obtained from the database, and data preprocessing, including data cleaning and data processing, is performed, and then feature extraction is performed to obtain feature data. The feature data of the main data analysis, such as the prediction of the number of orders, the prediction of the length of consultation, etc., are data features. After the information of the extracted feature data is stored in the database, after the configuration is completed, the model can be trained on the DAS machine learning platform, and the trained model can be deployed online. At the same time, the training log is stored in the database, which can realize continuous training and optimization of the model to ensure the effect of the model.

[0081] Figure 5 The structure diagram of the Internet hospital system monitoring device provided by the embodiment of the present invention. The Internet hospital system monitoring device provided by this embodiment can execute the processing flow provided by the method embodiment, such as Figure 5 As shown, the Internet hospital system monitoring device 500 includes a collection module 501, a flow processing module 502, a risk control module 503, and an alarm module 504.

[0082] The collection module 501 is used to collect the business log data of the Internet hospital system and add the business log data to the message queue;

[0083] A stream processing module 502 is used to obtain target indicators according to the business log data in the message queue through a stream processing engine;

[0084] The risk control module 503 is used to determine whether there is an abnormality in the Internet hospital system according to the target indicators and preset alarm rules;

[0085] The alarm module 504 is used to send an alarm message to the user terminal if it is determined that there is an abnormality in the Internet hospital system.

[0086] Based on any of the above embodiments, the target indicator includes a target business indicator and / or a target system indicator;

[0087] When the stream processing module 502 obtains the target indicator according to the business log data in the message queue through the stream processing engine, it is used to:

[0088] Parsing the business log data in the message queue through the stream processing engine to obtain the target field in the business log data;

[0089] The value of the target field is determined as the target business indicator, or the target system indicator is obtained according to the value of the target field and a preset algorithm, wherein the preset algorithm is an algorithm for obtaining the target system indicator.

[0090] On the basis of any of the above embodiments, when the risk control module 503 determines whether there is an abnormality in the Internet hospital system according to the target indicator and the preset alarm rule, it is used to:

[0091] For the target business indicator, compare the target business indicator with the historical business indicator, and determine whether there is an abnormality in the Internet hospital system based on the comparison result; and / or

[0092] For the target system indicators, the target system indicators are input into the corresponding preset abnormality judgment model, and the preset abnormality judgment model is used to judge whether there is an abnormality in the Internet hospital system.

[0093] Based on any of the above embodiments, after the stream processing engine obtains the target indicator according to the business log data in the message queue, the stream processing module 502 is further used to:

[0094] Storing the target indicator in a database;

[0095] When the risk control module 503 determines whether there is an abnormality in the Internet hospital system according to the target indicator and the preset alarm rules, it is used to:

[0096] The target indicators are obtained from the database in real time or periodically, and based on the target indicators and preset alarm rules, it is determined whether there are any abnormalities in the Internet hospital system.

[0097] Based on any of the above embodiments, after determining that an abnormality exists in the Internet hospital system, the risk control module 503 is further used to:

[0098] Analyze the abnormal points of the Internet hospital system and send the analysis results to the user terminal for display;

[0099] Receiving a first query instruction of a problem location knowledge base sent by the user terminal according to the analysis result, wherein the problem location knowledge base includes a plurality of preset problem location step information;

[0100] The problem locating step information corresponding to the analysis result is sent to the user terminal according to the first query instruction, so that the user can locate the problem according to the preset problem locating step information.

[0101] Based on any of the above embodiments, when performing abnormal point analysis on the Internet hospital system, the risk control module 503 is used to:

[0102] If it is determined that there are multiple anomalies in the Internet hospital system, correlation analysis is performed on the multiple anomalies according to a preset correlation analysis model, and / or root cause analysis is performed on the multiple anomalies according to a preset root cause analysis model to determine the source of the anomalies among the multiple anomalies;

[0103] The relevant information of the abnormal source is sent to the user terminal for display.

[0104] Based on any of the above embodiments, the device further includes an abnormality repair module, which is used to:

[0105] receiving a second query instruction of a problem repair knowledge base sent by the user terminal according to the problem location result, wherein the problem repair knowledge base includes repair solutions for different problems;

[0106] A repair solution corresponding to the problem locating result is sent to the user terminal according to the second query instruction.

[0107] Based on any of the above embodiments, the abnormality repair module is further used to:

[0108] If the problem location result is that the Internet hospital system update failed, use the backup cluster configured with the Internet hospital system before the update to implement the Internet hospital system rollback; or

[0109] If the problem location result is abnormal traffic, the Internet hospital system will be controlled to limit the abnormal traffic.

[0110] Based on any of the above embodiments, the device further includes a training module, which is used to:

[0111] Performing data preprocessing and feature extraction on the business log data and / or the target indicator to obtain data features;

[0112] The preset abnormality judgment model is trained according to the data features.

[0113] Based on any of the above embodiments, the preset abnormality judgment model includes at least one of the following:

[0114] Transaction flow anomaly detection model, SLR cheating model, medical and patient violation risk control model, and doctor service anomaly detection model.

[0115] Based on any of the above embodiments, when collecting business log data of the Internet hospital system, the collection module 501 is used to:

[0116] By using the software development kit SDK embedded in the server-side equipment of each Internet hospital in the Internet hospital system, the business log data of each Internet hospital is collected in a preset log format.

[0117] The Internet hospital system monitoring device provided by the embodiment of the present invention can be specifically used to perform the above Figure 2-4 The specific functions of the provided method embodiment will not be repeated here.

[0118] The Internet hospital system monitoring device provided by the embodiment of the present invention collects the business log data of the Internet hospital system and adds the business log data to the message queue; obtains the target index according to the business log data in the message queue through the stream processing engine; judges whether there is an abnormality in the Internet hospital system according to the target index and the preset alarm rules; if it is determined that there is an abnormality in the Internet hospital system, an alarm message is sent to the user terminal. This embodiment collects the business log data of the Internet hospital system, parses and processes the business log data to obtain the target index, and builds a unified monitoring index system to achieve unified monitoring of different Internet hospitals connected to the Internet hospital system. It can then judge whether there is an abnormality in the Internet hospital system based on the target index and the preset alarm rules, and can discover potential abnormalities in the Internet hospital system so as to issue timely alarms and recover from the abnormalities.

[0119] Figure 6 The electronic device provided by the embodiment of the present invention can execute the processing flow provided by the Internet hospital system monitoring method embodiment, such as Figure 6 As shown, the electronic device 60 includes a memory 61, a processor 62, and a computer program; wherein the computer program is stored in the memory 61 and is configured to execute the Internet hospital system monitoring method described in the above embodiment by the processor 62. In addition, the electronic device 60 may also have a communication interface 63 for receiving instructions and transmitting data.

[0120] Figure 6 The electronic device of the illustrated embodiment can be used to execute the technical solution of the above-mentioned Internet hospital system monitoring method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0121] In addition, this embodiment also provides a computer-readable storage medium on which a computer program is stored. The computer program is executed by a processor to implement the Internet hospital system monitoring method described in the above embodiment.

[0122] In addition, this embodiment also provides a computer program product, including a computer program, and the computer program is executed by a processor to implement the Internet hospital system monitoring method described in the above embodiment.

[0123] In the several embodiments provided in the embodiments of the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0124] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0125] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0126] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0127] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0128] The above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the embodiments of the present invention are described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention.

[0129] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be regarded as exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0130] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for monitoring an Internet hospital system, characterized in that: include: Collecting business log data of the Internet hospital system and adding the business log data to the message queue; Use the stream processing engine to obtain target indicators based on the business log data in the message queue; According to the target indicators and preset alarm rules, determine whether there is an abnormality in the Internet hospital system; If it is determined that there is an abnormality in the Internet hospital system, an alarm message is sent to the user terminal; The target indicators include target business indicators and / or target system indicators; The method of obtaining the target indicator according to the business log data in the message queue through the stream processing engine includes: The business log data in the message queue is parsed by the stream processing engine to obtain the target field in the business log data; the stream processing engine is used to consume the business log data in the message queue; Determine the value of the target field as the target business indicator, or obtain the target system indicator according to the value of the target field and a preset algorithm, wherein the preset algorithm is an algorithm for obtaining the target system indicator; The determining whether the Internet hospital system has an abnormality according to the target indicator and the preset alarm rules includes: For the target business indicator, compare the target business indicator with the historical business indicator, and determine whether there is an abnormality in the Internet hospital system based on the comparison result; and / or For the target system indicator, the target system indicator is input into the corresponding preset abnormality judgment model, and the preset abnormality judgment model is used to judge whether there is an abnormality in the Internet hospital system; The preset abnormality judgment model includes at least one of the following: a transaction flow abnormality detection model, a grabbing order cheating model, a medical and patient violation risk control model, and a doctor service abnormality detection model.

2. The method according to claim 1, characterized in that After obtaining the target indicator according to the business log data in the message queue through the stream processing engine, it also includes: Storing the target indicator in a database; The determining whether the Internet hospital system has an abnormality according to the target indicator and the preset alarm rules includes: The target indicators are obtained from the database in real time or periodically, and based on the target indicators and preset alarm rules, it is determined whether there are any abnormalities in the Internet hospital system.

3. The method according to claim 1, characterized in that After determining that an abnormality exists in the Internet hospital system, the method further includes: Analyze the abnormal points of the Internet hospital system and send the analysis results to the user terminal for display; Receiving a first query instruction of a problem location knowledge base sent by the user terminal according to the analysis result, wherein the problem location knowledge base includes a plurality of preset problem location step information; The problem locating step information corresponding to the analysis result is sent to the user terminal according to the first query instruction, so that the user can locate the problem according to the preset problem locating step information.

4. The method according to claim 3, characterized in that The abnormal point analysis of the Internet hospital system includes: If it is determined that there are multiple anomalies in the Internet hospital system, correlation analysis is performed on the multiple anomalies according to a preset correlation analysis model, and / or root cause analysis is performed on the multiple anomalies according to a preset root cause analysis model to determine the source of the anomalies among the multiple anomalies; The relevant information of the abnormal source is sent to the user terminal for display.

5. The method according to claim 3, characterized in that: The method further comprises: receiving a second query instruction of a problem repair knowledge base sent by the user terminal according to the problem location result, wherein the problem repair knowledge base includes repair solutions for different problems; A repair solution corresponding to the problem locating result is sent to the user terminal according to the second query instruction.

6. The method according to claim 3, characterized in that The method further comprises: If the problem location result is that the Internet hospital system update failed, use the backup cluster configured with the Internet hospital system before the update to implement the Internet hospital system rollback; or If the problem location result is abnormal traffic, the Internet hospital system will be controlled to limit the abnormal traffic.

7. The method according to claim 1, characterized in that The method further comprises: Performing data preprocessing and feature extraction on the business log data and / or the target indicator to obtain data features; The preset abnormality judgment model is trained according to the data features.

8. The method according to claim 1, characterized in that The business log data collected from the Internet hospital system includes: By using the software development kit SDK embedded in the server-side equipment of each Internet hospital in the Internet hospital system, the business log data of each Internet hospital is collected in a preset log format.

9. An Internet hospital system monitoring device, characterized in that: include: A collection module, used to collect business log data of the Internet hospital system and add the business log data to the message queue; A stream processing module, used to obtain target indicators according to the business log data in the message queue through a stream processing engine; the stream processing engine is used to perform consumption processing on the business log data in the message queue; The risk control module is used to determine whether there is an abnormality in the Internet hospital system based on the target indicators and preset alarm rules; An alarm module is used to send an alarm message to a user terminal if it is determined that there is an abnormality in the Internet hospital system; The target indicators include target business indicators and / or target system indicators; When the stream processing module obtains the target indicator according to the business log data in the message queue through the stream processing engine, it is used to: Parsing the business log data in the message queue through the stream processing engine to obtain the target field in the business log data; Determine the value of the target field as the target business indicator, or obtain the target system indicator according to the value of the target field and a preset algorithm, wherein the preset algorithm is an algorithm for obtaining the target system indicator; The risk control module is specifically used to compare the target business indicator with the historical business indicator, and judge whether the Internet hospital system has an abnormality according to the comparison result; and / or for the target system indicator, input the target system indicator into the corresponding preset abnormality judgment model, and judge whether the Internet hospital system has an abnormality through the preset abnormality judgment model; The preset abnormality judgment model includes at least one of the following: a transaction flow abnormality detection model, a grabbing order cheating model, a medical and patient violation risk control model, and a doctor service abnormality detection model.

10. An electronic device, characterized in that: include: at least one processor; and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 8 is implemented.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images