A dispatch automation system operation and maintenance exception index recommendation method and system

Abstract

The application discloses a dispatching automation system operation and maintenance abnormal index recommendation method and system, the method comprises the following steps: calculating the correlation between operation and maintenance indexes to obtain a dispatching automation system operation and maintenance index correlation matrix; and detecting a current operation and maintenance abnormal index according to the continuity of abnormal data in time; using the dispatching automation system operation and maintenance index correlation matrix to calculate the abnormal score of the operation and maintenance abnormal index; and filtering and sorting the abnormal score to give a recommended abnormality. The method can effectively eliminate false positives of a single index at a single time point, accurately identify operation and maintenance index abnormalities of server nodes in a power grid dispatching automation system, and reduce the cost of operation and maintenance personnel in processing massive abnormal alarms.

Description

Technical Field

[0001] This invention belongs to the field of power system automation technology, and in particular to a method and system for recommending abnormal operation and maintenance indicators of a dispatch automation system. Background Technology

[0002] With the evolution of scheduling automation system architecture and the application of numerous new technologies such as cloud computing, big data, and artificial intelligence, the internal complexity of current scheduling automation systems is increasing, leading to greater challenges in operation and maintenance. Traditional manual operation and maintenance is no longer sufficient to support the maintenance needs of hundreds of servers. Therefore, intelligent operation and maintenance of scheduling automation systems is an urgent task that needs to be addressed. Anomaly detection of operational metrics is a crucial direction for intelligent operation and maintenance of scheduling automation systems. Intelligent anomaly detection aims to use algorithms to automatically, in real-time, and accurately identify anomalies from monitoring data, providing a foundation for subsequent system diagnosis and self-healing.

[0003] Due to the difficulty in annotating operational data and the need for real-time and rapid detection of operational data anomalies, the industry currently relies primarily on unsupervised anomaly detection algorithms for system operational metrics. Unsupervised anomaly detection for operational metrics involves checking the most recent data point for each operational metric on each machine within the system. By analyzing and calculating the data, it identifies whether the latest data point is isolated relative to previous points, classifying these isolated points as anomalies. Unsupervised anomaly detection provides an anomaly ranking or score for the detected data points, based on the distance between samples or the density of sample points. However, the operational data of automated scheduling systems contains a large amount of data jitter and spikes, which can easily lead to a large number of false alarms in unsupervised anomaly detection. An excessively high false alarm rate can cause excessive interference for operational personnel, ultimately rendering intelligent operational maintenance unusable and generating a large number of alarm messages, making it difficult for alarm personnel to accurately locate the fault. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for recommending anomaly indicators in the operation and maintenance of a dispatch automation system, which solves the problem of high false alarms in existing single-indicator unsupervised anomaly detection methods, reduces the false alarm rate, and ensures the safe and stable operation of the power grid dispatch automation system.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] This invention provides a method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system, including:

[0007] Obtain the sequence of operation and maintenance indicators for a preset time length based on the current time from each server node of the scheduling automation system;

[0008] The data sequences of each operation and maintenance indicator for the preset time length are split to obtain subsequences of each operation and maintenance indicator;

[0009] Anomaly detection is performed on the subsequences of each of the operation and maintenance indicators to identify the operation and maintenance anomalies at the current moment.

[0010] The abnormal score of the operation and maintenance abnormality index at the current moment is calculated based on the correlation matrix of the operation and maintenance index of the scheduling automation system at the current moment.

[0011] Based on the anomaly scores of the current operation and maintenance anomaly indicators, anomaly indicators are recommended for the current time.

[0012] Furthermore, the operation and maintenance metrics for each server node include operation and maintenance metric categories: server node load, CPU, disk, memory, file handles, and network; each operation and maintenance metric category contains multiple operation and maintenance metrics under that category.

[0013] Furthermore, the sampling interval for the operation and maintenance indicators is 1 minute.

[0014] Furthermore, the acquisition of the operation and maintenance indicator data sequence of each server node in the scheduling automation system, with the current time as the reference and a preset time length, includes:

[0015] Extract the current operation and maintenance index data of each server node from the time series database of the information management area of ​​the dispatch automation system;

[0016] For each server node, select the operation and maintenance indicator data within the previous time window T2 minutes based on the current time to form an operation and maintenance indicator data sequence.

[0017] Furthermore, the time window T2 is set to 30 minutes.

[0018] Furthermore, the data sequences of each operation and maintenance indicator for the preset time length are split into subsequences for each operation and maintenance indicator, including:

[0019] Select the latest three time-stamped data m from the operation and maintenance indicator data sequence t ,m t-1 ,m t-2 ,

[0020] The remaining data after removing the latest three time points from the operation and maintenance indicator data sequence are combined with the data from the three time points respectively to form three subsequences, as shown below:

[0021]

[0022]

[0023]

[0024] Among them, S m1 S m2 and S m3 Let m represent three subsequences respectively. t This represents the operation and maintenance metric data at the current time t, m t-j This represents the operation and maintenance indicator data for the j time steps prior to the current time step, where j = 1, 2, ..., T2.

[0025] Furthermore, after obtaining the subsequences of each operation and maintenance indicator, it also includes:

[0026] For each subsequence, first-order difference calculation is performed, and min-max normalization is used to map the operation and maintenance index data to the [0,1] interval to obtain the preprocessed subsequence.

[0027] Furthermore, anomaly detection is performed on the subsequences of each of the aforementioned operation and maintenance indicators to identify the operation and maintenance anomalies at the current moment, including:

[0028] Simultaneously, both the Laida criterion and the local anomaly factor algorithm are used to detect anomalies in each subsequence. If both methods detect the last data point of a subsequence as an anomaly, then the subsequence is considered anomaly.

[0029] If all three subsequences of an operation and maintenance indicator are detected as abnormal, then the operation and maintenance indicator is determined to be abnormal at the current moment and is considered an abnormal operation and maintenance indicator.

[0030] Furthermore, the calculation of the anomaly score of the current-time operation and maintenance anomaly index based on the correlation matrix of the current-time scheduling automation system operation and maintenance indexes includes:

[0031] Construct an operation and maintenance indicator matrix for each server node based on all operation and maintenance indicators for each server node.

[0032] Construct a correlation matrix of operation and maintenance indicators for each server node based on the operation and maintenance indicator matrix of each server node.

[0033] Construct a correlation matrix of operation and maintenance indicators for the scheduling automation system based on the correlation matrix of operation and maintenance indicators for each server node;

[0034] The anomaly scores for each anomaly indicator are calculated based on the correlation matrix of the operation and maintenance indicators of the scheduling automation system as follows:

[0035]

[0036] Among them, Score m Indicates the operation and maintenance anomaly indicator m t The abnormal score, n represents the operation and maintenance abnormality index m t The number of relevant operation and maintenance metrics, mi ′ Sgn(m) represents the i-th relevant operation and maintenance metric. i ′ ) represents the sign function, when m i ′ The value is 1 when it is an operational anomaly indicator, and 0 otherwise. NMI(m,m) i ′ ) represents the operation and maintenance indicator m and the operation and maintenance anomaly indicator m i ′ The correlation values ​​between them are obtained from the correlation matrix of the operation and maintenance indicators of the respective subsystems.

[0037] Furthermore, the step of constructing an operation and maintenance indicator matrix for each server node based on all operation and maintenance indicators of each server node includes:

[0038] Using operation and maintenance metrics under the same category as column vectors, construct an operation and maintenance metric matrix for each server node. For a single operation and maintenance metric, take the data within the time window T1 minutes from the current moment as the column vector.

[0039] Furthermore, the step of constructing a correlation matrix of operation and maintenance indicators for each server node based on the operation and maintenance indicator matrix of each server node includes:

[0040] Calculate the normalized mutual information between each pair of indicators in the operation and maintenance indicator matrix of each server node to obtain the correlation matrix of operation and maintenance indicators for each server node.

[0041] Furthermore, the step of constructing the operation and maintenance indicator correlation matrix of the scheduling automation system based on the operation and maintenance indicator correlation matrix of each server node includes:

[0042] The correlation matrix of operation and maintenance indicators of the scheduling automation system is obtained by summing and averaging the correlation matrices of operation and maintenance indicators calculated for each server node in the scheduling automation system.

[0043] Furthermore, after obtaining the correlation matrix of the operation and maintenance indicators of the scheduling automation system, it also includes,

[0044] For correlation values ​​in the correlation matrix of operation and maintenance indicators of the scheduling automation system that are lower than the set value 'a', set them to 0.

[0045] Furthermore, the setting value 'a' is set to 0.8.

[0046] Furthermore, based on the anomaly scores of the current operation and maintenance anomaly indicators, recommendations for anomaly indicators at the current moment are made, including:

[0047] Select operation and maintenance anomaly indicators with anomaly scores higher than the preset threshold, and sort them from highest to lowest anomaly score as the recommended anomaly indicators for the current time.

[0048] Furthermore, the preset threshold for the score is selected as 0.5.

[0049] This invention also provides a system for recommending anomaly indicators in the operation and maintenance of a scheduling automation system, used to implement the aforementioned method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system. The system includes:

[0050] The data acquisition module is used to acquire the data sequence of various operation and maintenance indicators for a preset time length based on the current time from each server node of the scheduling automation system.

[0051] The sequence splitting module is used to split the data sequence of each operation and maintenance indicator of the preset time length to obtain the subsequence of each operation and maintenance indicator.

[0052] An anomaly detection module is used to perform anomaly detection on the subsequences of each of the operation and maintenance indicators, and to identify the operation and maintenance anomaly indicators at the current moment.

[0053] The anomaly score calculation module is used to calculate the anomaly score of the operation and maintenance anomaly index at the current time based on the correlation matrix of the operation and maintenance indexes of the scheduling automation system at the current time.

[0054] The abnormal indicator recommendation module is used to recommend abnormal indicators for the current time based on the abnormal scores of the operation and maintenance abnormal indicators at the current time.

[0055] The beneficial effects of this invention are as follows:

[0056] This invention provides a method for recommending anomaly indicators in the operation and maintenance of a dispatch automation system. Using the load, CPU, disk, memory, file handles, and network of each server node in the dispatch automation system as operation and maintenance indicators, the method selects and breaks them down into subsequences of operation and maintenance indicators. Simultaneously, it employs the Laida criterion and the local anomaly factor algorithm to detect anomalies in these subsequences, identifying and recommending anomaly indicators. This method effectively eliminates false alarms for single indicators at a single time point, accurately identifies anomalies in the operation and maintenance indicators of server nodes in the power grid dispatch automation system, and reduces the cost for operation and maintenance personnel to handle massive amounts of anomaly alarms. Attached Figure Description

[0057] Figure 1 The flowchart illustrates the method for recommending abnormal operation and maintenance indicators for the scheduling automation system provided by this invention. Detailed Implementation

[0058] The present invention will now be further described. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0059] The present invention provides a method for recommending abnormal indicators in the operation and maintenance of a dispatching automation system. Refer to Figure 1 , including:

[0060] Obtain the operation and maintenance index data sequences of a preset time length based on the current moment in each server node of the dispatching automation system;

[0061] Respectively split the obtained operation and maintenance index data sequences of the preset time length to obtain subsequences of each operation and maintenance index;

[0062] Respectively perform abnormal detection on the subsequences of each operation and maintenance index to identify the operation and maintenance abnormal indicators at the current moment;

[0063] Calculate the abnormal scores of the operation and maintenance abnormal indicators at the current moment based on the operation and maintenance index correlation matrix of the dispatching automation system;

[0064] Recommend abnormal indicators at the current moment based on the abnormal scores of the operation and maintenance abnormal indicators.

[0065] In the present invention, the operation and maintenance indicators of each server node include multiple categories such as server node load, cpu, disk, memory, file handle, and network; each operation and maintenance index category contains multiple operation and maintenance indicators to be detected under this category.

[0066] It should be noted that the dispatching automation system is divided into a production control area and an information management area, and there are multiple server nodes in each area. The operation and maintenance indicators of the server nodes in the production control area need to be transmitted across isolation to the information management area and stored in the time series database of the information management area.

[0067] In an embodiment of the present invention, relevant operation and maintenance index collection agents are deployed on each server node in the dispatching automation system to collect the operation and maintenance index data of each server node, and the sampling interval is 1 minute.

[0068] The format of the operation and maintenance index data collection is as follows:

[0069] {

[0070] "category": "memory",

[0071] "cmdb_id": "host1",

[0072] "sub_system": "FXJC",

[0073] "domain": "Area Ⅰ",

[0074] "name": "system.mem.free",

[0075] “unit”:“MB”,

[0076] "description": "Remaining memory"

[0077] “value”:4096

[0078] }

[0079] Here, category describes the category of this operation and maintenance metric. cmdb_id describes the server node name of this operation and maintenance metric, sub_system describes the subsystem identifier to which this server node belongs, domain describes the partition identifier to which this server node belongs, name describes the operation and maintenance metric name, unit describes the unit of operation and maintenance metric, description describes the meaning of operation and maintenance metric, and value describes the value of operation and maintenance metric.

[0080] In one embodiment of the present invention, the data sequence of various operation and maintenance indicators of a preset time length based on the current time is obtained in a single server node of the scheduling automation system. The specific implementation process is as follows:

[0081] Extract the current time-series data of each operation and maintenance indicator of a single server node from the time-series database of the information management region;

[0082] The operation and maintenance indicator data within the time window T2 minutes prior to the current time are selected to form the operation and maintenance indicator data sequence.

[0083] Let m be the single-server node's single-operation and maintenance metric data at the current moment. t The operation and maintenance indicator data within the time window T2 minutes from the current moment are used to form the operation and maintenance indicator data sequence S. m , means as follows:

[0084]

[0085] Obtain the sequence of operation and maintenance metrics for all operation and maintenance metrics of the server node at the current moment.

[0086] As a preferred implementation, T2 = 30 minutes.

[0087] In one embodiment of the present invention, the acquired operation and maintenance indicator data sequences of a preset time length are split to obtain subsequences of each operation and maintenance indicator. The specific implementation process is as follows:

[0088] Select the latest three time-stamped data m from the operation and maintenance indicator data sequence t ,m t-1 ,m t-2 ,

[0089] The operation and maintenance indicator data sequence S m The remaining data after removing the data from the three most recent time points are combined with the data from the three time points respectively to form three subsequences, as shown below:

[0090]

[0091]

[0092]

[0093] In one embodiment of the present invention, it further includes,

[0094] For each obtained subsequence of operation and maintenance indicators, first-order difference calculation is performed, and min-max normalization is used to map the data to the [0,1] interval to obtain the preprocessed subsequence.

[0095] In one embodiment of the present invention, anomaly detection is performed on the subsequences of each operation and maintenance indicator to identify the abnormal operation and maintenance indicators at the current moment. The specific implementation process is as follows:

[0096] Simultaneously, both the Laida criterion (3σ criterion) and the Local Outlier Factor (LOF) algorithm are used to detect anomalies in each subsequence. If both methods detect the last point of a subsequence as an anomaly, then the subsequence is considered anomaly.

[0097] If all three subsequences of an operation and maintenance indicator are detected as abnormal, then the operation and maintenance indicator is determined to be abnormal at the current moment and is considered an abnormal operation and maintenance indicator.

[0098] Anomaly detection is performed on subsequences of all operation and maintenance metrics under each server node to identify all abnormal operation and maintenance metrics at the current moment.

[0099] In one embodiment of the present invention, the anomaly score of the current-time operation and maintenance anomaly index is calculated based on the correlation matrix of the current-time scheduling automation system operation and maintenance indexes. The specific implementation process is as follows:

[0100] Construct an operation and maintenance indicator matrix for each server node based on all operation and maintenance indicators for each server node.

[0101] Construct a correlation matrix of operation and maintenance indicators for each server node based on the operation and maintenance indicator matrix of each server node.

[0102] Construct a correlation matrix of operation and maintenance indicators for the scheduling automation system based on the correlation matrix of operation and maintenance indicators for each server node;

[0103] The anomaly scores for each anomaly indicator are calculated based on the correlation matrix of the operation and maintenance indicators of the scheduling automation system as follows:

[0104]

[0105] Among them, Score m Indicates the operation and maintenance anomaly indicator m t The abnormal score, n represents the operation and maintenance abnormality index m t The number of relevant operation and maintenance metrics, m i ′ Sgn(m) represents the i-th relevant operation and maintenance metric. i ′ ) represents the sign function, when m i ′ The value is 1 when it is an operational anomaly indicator, and 0 otherwise. NMI(m,m) i ′ ) represents the operation and maintenance indicator m and the operation and maintenance anomaly indicator m i ′ The correlation value between them is obtained from the correlation matrix of operation and maintenance indicators of the scheduling automation system.

[0106] In one embodiment of the present invention, operation and maintenance anomaly indicators with anomaly scores higher than a preset threshold are selected and sorted from high to low according to the anomaly scores, and are recommended as anomaly indicators at the current time.

[0107] In this embodiment, an operation and maintenance indicator matrix is ​​constructed for each server node based on all operation and maintenance indicators of each server node, including:

[0108] In each server node, an operation and maintenance indicator matrix is ​​constructed using operation and maintenance indicators under the same operation and maintenance indicator category as column vectors.

[0109] For a single operation and maintenance metric m t The data within a time window T1 minutes preceding the current moment is used as the data for calculating the correlation matrix, i.e., the time range is [t-T1,t]. In this embodiment, T1 = 1440 minutes is chosen.

[0110] In this embodiment, a correlation matrix of operation and maintenance indicators for each server node is constructed based on the operation and maintenance indicator matrix of each server node, including:

[0111] Calculate the normalized mutual information between each pair of indicators in the operation and maintenance indicator matrix of each server node to obtain the correlation matrix of operation and maintenance indicators for each server node.

[0112] In this embodiment, the operation and maintenance indicator correlation matrix of the scheduling automation system is constructed based on the operation and maintenance indicator correlation matrix of each server node, including:

[0113] The correlation matrix of operation and maintenance indicators of the scheduling automation system is obtained by summing and averaging the correlation matrices of operation and maintenance indicators calculated for each server node in the scheduling automation system.

[0114] In this embodiment, it also includes,

[0115] Set a threshold a, a∈(0,1);

[0116] For values ​​below 'a' in the correlation matrix of operation and maintenance indicators of the scheduling automation system, it is assumed that the two corresponding operation and maintenance indicators are not related, and the corresponding values ​​are set to 0.

[0117] As a preferred implementation, a is set to 0.8.

[0118] As a preferred implementation, the preset score threshold is set to 0.5.

[0119] Based on the same inventive concept, the present invention also provides a scheduling automation system operation and maintenance anomaly indicator recommendation system, used to implement the above-mentioned scheduling automation system operation and maintenance anomaly indicator recommendation method, the system comprising:

[0120] The data acquisition module is used to acquire the data sequence of various operation and maintenance indicators for a preset time length based on the current time from each server node of the scheduling automation system.

[0121] The sequence splitting module is used to split the data sequence of each operation and maintenance indicator of the preset time length to obtain the subsequence of each operation and maintenance indicator.

[0122] An anomaly detection module is used to perform anomaly detection on the subsequences of each of the operation and maintenance indicators, and to identify the operation and maintenance anomaly indicators at the current moment.

[0123] The anomaly score calculation module is used to calculate the anomaly score of the operation and maintenance anomaly index at the current time based on the correlation matrix of the operation and maintenance indexes of the scheduling automation system at the current time.

[0124] The abnormal indicator recommendation module is used to recommend abnormal indicators for the current time based on the abnormal scores of the operation and maintenance abnormal indicators at the current time.

[0125] It is worth noting that the system embodiment corresponds to the above method embodiment. The implementation methods of the above method embodiments are all applicable to the system embodiment and can achieve the same or similar technical effects, so they will not be described in detail here.

[0126] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0128] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0129] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0130] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system, characterized in that, include: Obtain the data sequence of each operation and maintenance indicator for a preset time length based on the current time from each server node of the scheduling automation system; The data sequences of each operation and maintenance indicator for the preset time length are split into subsequences for each operation and maintenance indicator, including: Select the latest three time points of the operation and maintenance indicator data series , The remaining data after removing the latest three time points from the operation and maintenance indicator data sequence are combined with the data from the three time points respectively to form three subsequences, as shown below: ； ； ； in, , and These represent three subsequences. Indicates the current time Operation and maintenance metrics data, Indicates the time before the current moment Operation and maintenance metrics data at any given time. ; Anomaly detection is performed on the subsequences of each operation and maintenance indicator to identify the operation and maintenance anomaly indicator at the current time. This includes: simultaneously using the Laida criterion and the local anomaly factor algorithm to detect anomalies in each subsequence. If both methods detect that the last data point of a subsequence is an anomaly, then the subsequence is considered anomaly. If all three subsequences of an operation and maintenance indicator are detected as anomalies, then the operation and maintenance indicator at the current time is determined to be an anomaly indicator. Based on the correlation matrix of the current scheduling automation system's operation and maintenance indicators, calculate the anomaly scores of the current operation and maintenance anomaly indicators, including: Construct an operation and maintenance indicator matrix for each server node based on all operation and maintenance indicators for each server node. Construct a correlation matrix of operation and maintenance indicators for each server node based on the operation and maintenance indicator matrix of each server node. Construct a correlation matrix of operation and maintenance indicators for the scheduling automation system based on the correlation matrix of operation and maintenance indicators for each server node; The anomaly scores for each anomaly indicator are calculated based on the correlation matrix of the operation and maintenance indicators of the scheduling automation system as follows: ； in, Indicates operation and maintenance metrics data Abnormal scores, Indicates operation and maintenance metrics data The number of relevant operation and maintenance indicators Indicates the first A number of relevant operation and maintenance metrics Represents a sign function, when The value is 1 when it indicates an operational or maintenance anomaly; otherwise, it is 0. Representing the operation and maintenance metric m and the operation and maintenance metric The correlation values ​​between them are obtained from the correlation matrix of operation and maintenance indicators of the scheduling automation system; Based on the anomaly scores of the current operation and maintenance anomaly indicators, anomaly indicators are recommended for the current time.

2. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 1, characterized in that, The operational metrics for each server node include categories: server node load, CPU, disk, memory, file handles, and network; each category contains multiple operational metrics within that category.

3. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 2, characterized in that, The sampling interval for the operation and maintenance indicators is 1 minute.

4. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 2, characterized in that, After obtaining the subsequences of each operation and maintenance indicator, it also includes: For each subsequence, first-order difference calculation is performed, and min-max normalization is used to map the operation and maintenance index data to the [0,1] interval to obtain the preprocessed subsequence.

5. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 2, characterized in that, The step of constructing an operation and maintenance indicator matrix for each server node based on all operation and maintenance indicators of each server node includes: Using operational metrics under the same category as column vectors, construct an operational metric matrix for each server node. For a single operational metric, the matrix is ​​calculated from the current time step backward. Data within a minute is used as a column vector.

6. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 5, characterized in that, The step of constructing the correlation matrix of operation and maintenance indicators for each server node based on the operation and maintenance indicator matrix of each server node includes: Calculate the normalized mutual information between each pair of indicators in the operation and maintenance indicator matrix of each server node to obtain the correlation matrix of operation and maintenance indicators for each server node.

7. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 6, characterized in that, The construction of the operation and maintenance indicator correlation matrix of the scheduling automation system based on the operation and maintenance indicator correlation matrix of each server node includes: The correlation matrix of operation and maintenance indicators of the scheduling automation system is obtained by summing and averaging the correlation matrices of operation and maintenance indicators calculated for each server node in the scheduling automation system.

8. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 7, characterized in that, After obtaining the correlation matrix of operation and maintenance indicators of the scheduling automation system, it also includes: For the correlation matrix of operation and maintenance indicators of the scheduling automation system, the values ​​are below the set values. The correlation value is set to 0.

9. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 8, characterized in that, The setting value The value is 0.

8.

10. The method for recommending anomaly indicators in a scheduling automation system according to claim 2, characterized in that, Based on the anomaly scores of the current operation and maintenance anomaly indicators, recommendations for anomaly indicators at the current moment are made, including: Select operation and maintenance anomaly indicators with anomaly scores higher than the preset threshold, and sort them from highest to lowest anomaly score as the recommended anomaly indicators for the current time.

11. The method for recommending anomaly indicators in the operation and maintenance of a scheduling automation system according to claim 10, characterized in that, The preset threshold for the score is set to 0.

5.

12. A system for recommending anomaly indicators in the operation and maintenance of a scheduling automation system, characterized in that, The system is used to implement the method for recommending operation and maintenance anomaly indicators of a scheduling automation system according to any one of claims 1 to 11, the system comprising: The data acquisition module is used to acquire the data sequence of various operation and maintenance indicators for a preset time length based on the current time from each server node of the scheduling automation system. The sequence splitting module is used to split the data sequence of each operation and maintenance indicator of the preset time length to obtain the subsequence of each operation and maintenance indicator. An anomaly detection module is used to perform anomaly detection on the subsequences of each of the operation and maintenance indicators, and to identify the operation and maintenance anomaly indicators at the current moment. The anomaly score calculation module is used to calculate the anomaly score of the operation and maintenance anomaly index at the current time based on the correlation matrix of the operation and maintenance indexes of the scheduling automation system at the current time. The abnormal indicator recommendation module is used to recommend abnormal indicators for the current time based on the abnormal scores of the operation and maintenance abnormal indicators at the current time.

Images