An operation monitoring method and device for an energy internet marketing service system

Abstract

The present application discloses an operation monitoring method and device for an energy internet marketing service system, and relates to the field of internet technology. The main technical solution of the present application is: obtaining target indicator data according to a preset frequency, the target indicator data is used to characterize the indicator data related to system operation and business applications in the energy internet marketing service system; judging whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline, the dynamic baseline is the normal indicator range obtained after periodic clustering analysis of the historical data corresponding to each indicator in the target indicator data, and the normal indicator range is periodically dynamic; if so, generating an alarm message corresponding to the abnormal indicator; determining the specified abnormal case that matches the alarm message in the knowledge graph library, and executing the operation and maintenance measures in the specified abnormal case. The main purpose is to improve the accuracy and efficiency of the operation monitoring of the energy internet marketing service system.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to an operation monitoring method and device for an energy Internet marketing service system. Background Art

[0002] With the rapid development of the Energy Internet, marketing service systems are playing an increasingly significant role in the power industry. They not only support the efficient operation of the energy market but also provide customers with a personalized, intelligent service experience. However, as a complex IT architecture, marketing service systems face numerous challenges, including but not limited to system performance bottlenecks, data security threats, ensuring business continuity, and the ability to rapidly respond to emergencies. In the Energy Internet environment, in particular, systems must process massive amounts of data and support highly concurrent business requests while ensuring data security and service stability. This places higher demands on system operation and monitoring.

[0003] Currently, traditional operational monitoring methods often rely on static threshold alarms and require manual system maintenance by operators. However, in the ever-changing operational environment of energy internet marketing service systems due to diverse business application scenarios, static thresholds often fail to accurately reflect the system's actual operational status. This not only easily leads to false alarms or missed alarms, but also increases the difficulty of manual maintenance by operators, thus affecting the accuracy and efficiency of operational monitoring of energy internet marketing service systems. Summary of the Invention

[0004] In view of the above problems, the present application provides an operation monitoring method and device for an energy internet marketing service system, the main purpose of which is to improve the accuracy and efficiency of operation monitoring of the energy internet marketing service system.

[0005] To solve the above technical problems, this application proposes the following solutions:

[0006] In a first aspect, the present application provides an operation monitoring method of an energy internet marketing service system, the method comprising:

[0007] Obtain target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system;

[0008] Determine whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline, where the dynamic baseline is a normal indicator range obtained after cluster analysis of historical data corresponding to each indicator in the target indicator data;

[0009] If so, generate an alarm message corresponding to the abnormal indicator;

[0010] Determine a specified abnormal case that matches the alarm information in the knowledge graph library, and execute the operation and maintenance measures in the specified abnormal case.

[0011] In a second aspect, the present application provides an operation monitoring device for an energy internet marketing service system, the device comprising:

[0012] A first acquisition unit is configured to acquire target indicator data according to a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system;

[0013] a judgment unit, configured to judge whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline, where the dynamic baseline is a normal indicator range obtained after cluster analysis of historical data corresponding to each indicator in the target indicator data;

[0014] a generating unit, configured to generate alarm information corresponding to the abnormal indicator if yes;

[0015] A processing unit is used to determine a specified abnormal case that matches the alarm information in the knowledge graph library and execute operation and maintenance measures in the specified abnormal case.

[0016] In order to achieve the above-mentioned purpose, according to the third aspect of the present application, a storage medium is provided, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the operation monitoring method of the energy Internet marketing service system of the above-mentioned first aspect.

[0017] In order to achieve the above-mentioned purpose, according to the fourth aspect of the present application, a processor is provided, which is used to run a program, wherein when the program is running, the operation monitoring method of the energy Internet marketing service system of the above-mentioned first aspect is executed.

[0018] By means of the above technical solution, the present application provides an operation monitoring method and device for an energy Internet marketing service system, which obtains target indicator data according to a preset frequency when the energy Internet marketing service system needs to be operated and monitored. The target indicator data is used to characterize the indicator data related to the system operation and business applications in the energy Internet marketing service system, and judges whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline. The dynamic baseline is the normal indicator range obtained after periodic clustering analysis of the historical data corresponding to each indicator in the target indicator data, that is, the normal indicator range changes periodically and dynamically. If so, an alarm information corresponding to the abnormal indicator is generated, and a specified abnormal case matching the alarm information is determined in the knowledge graph library, and the operation and maintenance measures in the specified abnormal case are executed. Through the technical solution provided by this application, the dynamic baseline obtained by periodic cluster analysis can more accurately reflect the normal indicator range of the system under different operating environments. After obtaining the indicator data related to system operation and business applications, each indicator is compared with its own dynamic baseline, which effectively improves the accuracy of abnormal indicator detection. When the system detects abnormal indicators, it can not only generate alarm information to prompt relevant personnel, but also automatically search for matching abnormal cases from the knowledge graph library and take corresponding operation and maintenance measures, which greatly reduces the difficulty of operation and maintenance, shortens the operation and maintenance time, and improves the self-repair ability of the system, thereby improving the accuracy and efficiency of operation monitoring of the energy Internet marketing service system.

[0019] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0021] Figure 1 A flow chart of an operation monitoring method of an energy internet marketing service system provided by an embodiment of the present application is shown;

[0022] Figure 2 A flow chart of an operation monitoring method of another energy internet marketing service system provided by an embodiment of the present application is shown;

[0023] Figure 3A block diagram showing the composition of an operation monitoring device of an energy internet marketing service system provided by an embodiment of the present application is shown;

[0024] Figure 4 A block diagram of the composition of an operation monitoring device of another energy Internet marketing service system provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0025] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0026] Currently, traditional operational monitoring methods often rely on static threshold alarms and require manual system maintenance by operators. However, in the ever-changing operational environment of energy internet marketing service systems due to diverse business application scenarios, static thresholds often fail to accurately reflect the system's actual operational status. This not only easily leads to false alarms or missed alarms, but also increases the difficulty of manual maintenance by operators, thus affecting the accuracy and efficiency of operational monitoring of energy internet marketing service systems.

[0027] Based on the above problems, Figure 1 As shown, the embodiment of the present application provides an operation monitoring method for an energy internet marketing service system, which can improve the accuracy and efficiency of the operation monitoring of the energy internet marketing service system. The specific execution steps include at least 101-104:

[0028] 101. Obtain target indicator data according to the preset frequency.

[0029] Among them, the target indicator data is used to represent the indicator data related to system operation and business applications in the energy Internet marketing service system.

[0030] It should be noted that in this embodiment, the Energy Internet Marketing Service System is a comprehensive system that integrates multiple advanced technologies and services. The system includes the following core components: a customer service platform, marketing services, a customer IoT application center, front-end applications, a capability aggregation platform, an operations management platform, an operations and maintenance monitoring platform, a business connection platform, and a service connection platform. It is used to enhance the marketing and service capabilities of energy companies.

[0031] In this step, the preset frequency can be set based on the system's business needs and system load, for example, every minute, every 5 minutes, or every hour, to ensure the timeliness of the target indicator data while avoiding excessive pressure on the system. The Energy Internet Marketing Service System is a complex technical architecture consisting of multiple different components, each responsible for specific functions and services. Therefore, key performance indicators (KPIs) can be collected from each component of the Energy Internet Marketing Service System. These KPIs consist of two parts: system operational indicator data that focuses on the health and performance of the system itself, and business application indicator data that focuses on measuring the efficiency, effectiveness, and customer satisfaction of business processes. System operational indicator data includes, but is not limited to, system availability, response time, throughput, and resource utilization (CPU, memory, disk, and network bandwidth usage). Business application indicator data includes, but is not limited to, customer activity, transaction success rate, customer service response time, customer satisfaction ratings, and marketing campaign effectiveness. This data can be obtained through system logs, API interfaces, monitoring tools, or other data collection methods.

[0032] In addition, in order to be able to visually observe the status performance of system operation and business applications, corresponding graphical pages can be set up for target indicator data to display various indicator data.

[0033] 102. Determine whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline.

[0034] The dynamic baseline is the normal indicator range obtained after periodic cluster analysis of the historical data corresponding to each indicator in the target indicator data. The normal indicator range changes dynamically.

[0035] In this step, since each indicator in the target indicator data is determined, the historical data of each indicator can be obtained accordingly. Specifically, the historical data of the most recent period can be used as a preset period, such as the past month or week. According to the data characteristics and indicator type, a suitable clustering algorithm is selected, including but not limited to K-means, DBSCAN or hierarchical clustering, etc. By clustering the historical data, clusters of different usage patterns are identified, wherein each cluster represents the typical behavior pattern of the indicator in a specific time period. According to the center point or representative value of each cluster, the behavior characteristics of the indicator under normal conditions are identified, and the normal indicator range of each indicator, i.e., the dynamic baseline, is determined based on the behavior characteristics of each indicator. By periodically performing the above clustering analysis, the normal indicator range obtained for each indicator can be dynamically changed, thereby enabling the dynamic baseline to change over time, so that the dynamic baseline can more accurately reflect the normal indicator range of the system under different operating environments.

[0036] Each indicator in the target indicator data is compared with its corresponding dynamic baseline. If it deviates from the dynamic baseline, it means that the indicator is not within its corresponding normal indicator range, which indicates that the indicator may be abnormal. Therefore, the indicator is defined as an abnormal indicator. If there is no abnormal indicator, wait for new target indicator data to be collected at a preset frequency. If there is an abnormal indicator, execute step 103.

[0037] 103. Generate alarm information corresponding to the abnormal indicator.

[0038] In this step, when an abnormal indicator is detected, the system generates an alarm containing detailed information, which includes at least the alarm source, alarm title, alarm level and alarm time. Among them, the alarm source refers to the specific system component or service that generates the abnormal indicator, the alarm title refers to a concise description of the abnormal situation, the alarm level refers to the level divided according to the severity of the abnormality, such as minor, important or urgent, and the alarm time refers to the specific time point when the abnormality occurs, that is, the time point when the indicator is collected. Specifically, one or more standardized alarm information templates can be set in advance to ensure that all alarm information contains the necessary information mentioned above. In order to enable the operation and maintenance team or relevant responsible persons to be aware of the existence of abnormalities in the system in a timely manner, the alarm information can be sent to the operation and maintenance team or relevant responsible persons by email, text message, enterprise instant messaging software, etc. at the same time as the alarm information is generated.

[0039] 104. Determine the specified abnormal case that matches the alarm information in the knowledge graph library, and execute the operation and maintenance measures in the specified abnormal case.

[0040] To enable the system to automatically respond and process, past abnormal events or historical operation and maintenance records related to system operations and business applications in the Energy Internet Marketing Service System can be obtained in advance. These records can then be used to extract relevant abnormal cases, which contain experience and solutions for handling similar abnormalities. A corresponding knowledge graph can then be constructed based on these abnormal cases. Furthermore, these abnormal cases can be supplemented with expert experience, technical documentation, and industry standards to provide a more comprehensive coverage of abnormal cases in the knowledge graph.

[0041] In this step, since the alarm information includes detailed information such as the alarm source, alarm title, alarm level and alarm time. Therefore, the alarm information can be parsed using natural language processing (NLP) technology, and the abnormal cases that match it can be retrieved from the knowledge graph library. Specifically, the matching degree between the alarm information and each abnormal case can be calculated. The matching degree can be determined by calculating the text similarity. On this basis, the matching degree can also be corrected in combination with the latest score, solution success rate, etc. of each abnormal case. This embodiment does not limit this. After determining the abnormal case that matches the alarm information, it can be used as a designated abnormal case. Since the designated abnormal case also contains the corresponding solution, the solution can be used as an operation and maintenance measure at this time, and the operation and maintenance measure can be automatically or semi-automatically executed. The operation and maintenance measure includes but is not limited to restarting the service, adjusting configuration parameters, expanding resources, running diagnostic scripts, etc., to restore the normal operation of the system or the normal application of the business as soon as possible. If the corresponding specified abnormal case is not matched in the knowledge graph library, an operation and maintenance instruction corresponding to the alarm information will be generated. The operation and maintenance instruction can send the alarm information to the operation and maintenance personnel for manual analysis, and can also search for relevant documents and technical information to find possible solutions.

[0042] Based on the above Figure 1 It can be seen from the implementation method that the operation monitoring method of an energy Internet marketing service system provided by the present application is to obtain target indicator data according to a preset frequency when the operation monitoring of the energy Internet marketing service system is required. The target indicator data is used to characterize the indicator data related to the system operation and business applications in the energy Internet marketing service system, and to judge whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline. The dynamic baseline is the normal indicator range obtained after cluster analysis of the historical data corresponding to each indicator in the target indicator data. If so, an alarm information corresponding to the abnormal indicator is generated, and a specified abnormal case matching the alarm information is determined in the knowledge graph library, and the operation and maintenance measures in the specified abnormal case are executed. Through the technical solution provided by this application, the dynamic baseline obtained through cluster analysis can more accurately reflect the normal indicator range of the system under different operating environments. After obtaining indicator data related to system operation and business applications, each indicator is compared with its own dynamic baseline, which effectively improves the accuracy of abnormal indicator detection. When the system detects abnormal indicators, it can not only generate alarm information to prompt relevant personnel, but also automatically search for matching abnormal cases from the knowledge graph library and take corresponding operation and maintenance measures, which greatly reduces the difficulty of operation and maintenance, shortens the operation and maintenance time, and improves the self-repair ability of the system, thereby improving the accuracy and efficiency of operation monitoring of the energy Internet marketing service system.

[0043] like Figure 2 As shown, the preferred embodiment of the present application is in the above Figure 1Based on this, a detailed description of the operation monitoring process of the energy internet marketing service system is given, and its specific steps include 201-208:

[0044] 201. Obtain historical data corresponding to each indicator in the target indicator data according to a preset period.

[0045] In this step, the preset period can be set according to the characteristics of each indicator and business needs, and can be set specifically according to the data volatility and business periodicity of each indicator to ensure that the historical data corresponding to each indicator is representative, such as weekly or monthly.

[0046] Periodically collect indicator data related to system operation and business applications from system logs or databases, that is, collect historical data of each indicator in system operation indicator data and business application indicator data. System operation indicator data includes but is not limited to system availability, response time, throughput, resource utilization (CPU, memory, disk and network bandwidth usage), etc., while business application indicator data includes but is not limited to customer activity, transaction success rate, customer service response time, customer satisfaction score, marketing campaign effectiveness, etc.

[0047] 202. Use clustering algorithms to determine the usage patterns of various indicators in different time periods from historical data, and identify the behavioral characteristics of each indicator under normal operating conditions based on the usage patterns.

[0048] In this step, the collected historical data is standardized or normalized to eliminate dimensionality effects and enable comparison of different indicators on the same scale. An appropriate clustering algorithm, such as K-means, DBSCAN, or hierarchical clustering, is selected based on the data characteristics and indicator type. The historical data is clustered to identify clusters with different usage patterns. Each cluster represents the typical behavior pattern of the indicator within a specific time period. The center point or representative value of each cluster is analyzed to identify the behavioral characteristics of the indicator under normal operating conditions. These behavioral characteristics are used to characterize the statistical characteristics and patterns exhibited by each indicator under normal operating conditions.

[0049] For example, suppose that after multiple rounds of iterations of CPU usage, we obtain three clusters, each representing a usage pattern: low usage pattern, medium usage pattern, and high usage pattern. Analyzing the center point of each cluster yields the following results:

[0050] Cluster 1: The CPU usage at the center is 0.111, representing a low usage pattern, typically occurring late at night to early morning.

[0051] Cluster 2: The CPU usage at the center is 0.444, which represents a typical usage pattern, typically occurring during daytime on weekdays.

[0052] Cluster 3: The CPU usage at the center is 0.778, representing a high usage pattern that typically occurs during peak hours on weekdays.

[0053] Based on the above results, the behavioral characteristics of CPU usage under normal operating conditions are identified:

[0054] During the late night and early morning hours, CPU usage is usually low, around 10%;

[0055] During the daytime on weekdays, CPU usage will increase to around 40%;

[0056] During peak hours on weekdays, CPU usage can spike to around 70%.

[0057] 203. Determine the normal indicator range corresponding to each indicator in different time periods based on behavioral characteristics, and use the normal indicator range as a dynamic baseline.

[0058] Based on the behavioral characteristics identified in step 202, these behavioral characteristics are used to characterize the statistical characteristics and patterns exhibited by each indicator under normal operating conditions. Through these statistical characteristics and patterns, usage patterns corresponding to different time periods and the approximate numerical performance of each indicator under these usage patterns can be obtained. Based on these numerical performances, the normal indicator range for each indicator in different time periods can be determined. Specifically, the boundaries of the normal indicator range can be defined by calculating the mean, standard deviation, or quartiles for each indicator. The determined normal indicator range is used as a dynamic baseline for subsequent real-time monitoring and anomaly detection of each indicator.

[0059] Since systems may experience brief fluctuations during actual operation, these fluctuations may not necessarily indicate true anomalies but may simply be natural variations under normal operating conditions. Therefore, to avoid false alarms caused by overly sensitive subsequent alerts and ensure the accuracy of abnormal metric detection, a tolerance margin can be set based on the tolerance of each metric during system operation and business applications. This tolerance margin adds an additional tolerance interval to the normal metric range. The safety margin represents the maximum deviation the system can tolerate for each metric. Adding this tolerance margin to the original normal metric range creates a certain level of tolerance for each metric's dynamic baseline. For example, assuming the normal CPU usage range calculated based on historical data is 40%-60%, the tolerance margin is increased or decreased by 5%, bringing the final normal range to 35%-65%. This way, even if CPU usage briefly exceeds 60% or falls below 40%, the system won't immediately trigger an alert.

[0060] When each indicator is not within the corresponding normal indicator range, it means that it has deviated from its corresponding dynamic baseline. At this time, such an indicator can be regarded as an abnormal indicator.

[0061] It should be noted that, regarding steps 201-203, since historical data is acquired at a preset period, that is, the dynamic baseline is updated at a preset period, the dynamic baseline can accurately reflect changes in the system operating environment and business needs, thereby making the detection of abnormal indicators more accurate.

[0062] 204. Obtain target indicator data according to a preset frequency.

[0063] This step is combined with the description of step 101 in the above method, and the same content will not be repeated here.

[0064] 205. Obtain the collection time corresponding to each indicator in the target indicator data.

[0065] In this step, the collection time is the precise timestamp of each indicator's data collection at the preset frequency. Since target indicator data is collected automatically by a monitoring tool or data collection system, it also records the corresponding timestamp when recording each indicator's data. Therefore, the collection time is directly available when each indicator's data is collected.

[0066] 206. Match the target time period in different time periods according to the collection time.

[0067] As can be seen from the above steps 201-203, the dynamic baselines of various indicators are obtained by clustering analysis based on different time periods. Therefore, in this step, the target time period specifically refers to the time period in which the acquisition time is located in the different time periods corresponding to the dynamic baseline. The acquisition time corresponding to each indicator is matched with the different time periods predefined by the dynamic baseline, that is, the acquisition time is compared with the start and end time of the different time periods to determine the target time period, which can be processed specifically using a date and time function or a time series analysis tool. For example, assuming that the acquisition time is 7:30 am, by comparison, the acquisition time falls into the time period corresponding to 7:00 am to 9:00 am (daily morning rush hour), then 7:00 am to 9:00 am is used as the target time period, and the dynamic baseline corresponding to 7:00 am to 9:00 am is used for comparison.

[0068] 207. Compare each indicator in the target indicator data with the dynamic baseline corresponding to each indicator in the target time period, and treat the indicator that deviates from the dynamic baseline as an abnormal indicator.

[0069] In this step, after determining the dynamic baseline for each indicator, which represents the normal range for each indicator during the target time period, deviations can be determined by comparing thresholds. Statistical methods such as standard deviation, Z-score, or percentiles can also be used to quantify the degree of deviation. If a metric exceeds the normal range defined by its dynamic baseline, it is marked as abnormal.

[0070] 208. Generate alarm information corresponding to the abnormal indicator.

[0071] This step is combined with the description of step 103 in the above method, and the same content will not be repeated here. It should be noted that since the alarm information includes at least the alarm source, alarm title, alarm level and alarm time. Therefore, when the abnormal indicators are known, the process of determining the alarm source, alarm title, alarm level and alarm time usually involves the following steps:

[0072] Alarm source: This refers to the specific system component or service that generated the abnormal metric. You can identify the specific component where the abnormality occurred by monitoring system logs, system status reports, or specialized monitoring tools. For example, if the abnormal metric indicates an increase in database response time, the alarm source might be "Database Server DB1."

[0073] Alert title: A concise description of the abnormal situation. It can be named based on the characteristics of the abnormal indicator and preset title templates corresponding to different abnormal situations, such as "Abnormal increase in database response time" or "CPU utilization exceeds the threshold."

[0074] Alarm level: This refers to the level of severity of an abnormal indicator. Level settings are typically determined based on predefined rules. For example, the impact of each abnormal indicator on system operation or business application is predefined to establish a rule associating the impact level with the alarm level. For example, the alarm levels are divided into minor, severe, and urgent. When the impact level of an abnormal indicator is high, the corresponding alarm level may be severe or urgent.

[0075] Alarm time: The alarm time refers to the specific time when the abnormal indicator is generated, that is, the time when the indicator is collected. System monitoring tools usually automatically record the timestamp of the abnormality as part of the alarm information.

[0076] Regarding the description of the above alarm levels, since the alarm levels require predefined rules to determine, in order to ensure the rationality and accuracy of the alarm level determination. Before generating the alarm information corresponding to the abnormal indicator, the method also includes: calculating the system operation impact and / or business application impact corresponding to the abnormal indicator; determining the alarm level of the abnormal indicator in a preset impact level-level rule based on the system operation impact and / or business application impact; and generating the alarm information corresponding to the abnormal indicator based on the alarm level.

[0077] In this step, the impact on system operations refers to the effect of abnormal indicators on system stability and performance. For example, an abnormally high CPU utilization rate may cause system responsiveness to slow down, while insufficient disk space may cause system service interruptions. The impact on business applications refers to the impact of abnormal indicators on the efficiency and effectiveness of business processes, as well as customer satisfaction. For example, increased latency in payment interfaces may affect transaction success rates, leading to decreased customer satisfaction.

[0078] Specifically, a set of evaluation frameworks can be established in advance to define which indicators are associated with which types of system or business impacts. A quantitative scoring system, such as 1-10, is set for each impact type. Specifically, a weight can be assigned to each impact type based on the contribution of different system or business components to the overall health status, and the final quantitative impact score can be obtained through weight calculation. The impact level-level rule is specifically a mapping table between the impact level quantitative score and the alarm level. For example, the alarm level corresponding to 1-4 points is minor, the alarm level corresponding to 5-7 is severe, and the alarm level corresponding to 8-10 is urgent. It should be noted that as time goes by and the business environment changes, the impact level-level rule needs to be reviewed and updated regularly.

[0079] For example, assume that the CPU utilization of Server 1 collected at 15:23:45 on August 4, 2024, is 85%, and the dynamic baseline of CPU utilization in the target time period of 15:23:45 is 80%. At this time, the system will automatically trigger an alarm:

[0080] The monitoring tool identifies the abnormal CPU usage on Server 1, so the alarm source is Server 1.

[0081] Title description: Generate a title based on the predefined title template: "The CPU utilization of server 1 has increased abnormally."

[0082] Level setting: If the pre-set rules indicate that the quantitative score of the impact of CPU utilization is 7 points, and 7 points belongs to the "serious" level alarm, then the alarm level will be set to "serious".

[0083] Time record: Since 15:23:45 on August 4, 2024 is the collection time of the CPU utilization of server 1, this collection time is the alarm time.

[0084] The resulting warning message may be as follows:

[0085] Alarm source: Server 1; Alarm title: Abnormally high CPU utilization of server 1; Alarm level: Severe; Alarm time: 2024-08-04 15:23:45.

[0086] 209. Determine the specified abnormal case that matches the alarm information in the knowledge graph library, and execute the operation and maintenance measures in the specified abnormal case.

[0087] This step is combined with the description of step 104 in the above method, and the same content will not be repeated here. It should be noted that the specific process of constructing the knowledge graph is as follows: obtaining historical operation and maintenance records; extracting abnormal cases from the historical operation and maintenance records. Abnormal cases are used to represent abnormal operation and maintenance cases related to system operation and business applications in the energy internet marketing service system, and the abnormal cases include corresponding operation and maintenance measures; and constructing a knowledge graph library based on the abnormal cases.

[0088] Historical operation and maintenance records refer to all relevant records generated during the operation and maintenance of the energy internet marketing service system. These records may come from multiple sources, including but not limited to system logs (log files of servers, applications, databases, etc.), work order systems (recording work orders handled by operation and maintenance personnel), and user feedback (feedback and reports from end users). After obtaining historical operation and maintenance records, operation and maintenance cases related to system operation and business applications are manually or automatically marked as abnormal cases, and their characteristics, such as the time of occurrence, duration, scope of impact, and final solution, are recorded. Cases are classified according to abnormality type and solution to facilitate subsequent analysis and knowledge graph construction. Specifically, key entities in each abnormal case are identified, such as system components, abnormality types, and operation and maintenance measures. A set of attributes is defined for each entity, such as the component name, the severity of the abnormality, and the execution time of the measure. Associations between entities are determined, for example, whether a certain abnormality is caused by a specific component or whether a certain measure is effective in resolving a certain type of abnormality. Using a knowledge graph construction tool (such as Neo4j, GraphDB, etc.), entities, attributes, and relationships are converted into a graph structure. This results in the knowledge graph library of this embodiment.

[0089] When the knowledge graph library is constructed, the specific execution process of determining the designated abnormal case that matches the alarm information in the knowledge graph library and executing the operation and maintenance measures in the designated abnormal case is as follows: calculating the matching degree between the alarm information and each abnormal case in the knowledge graph library; judging whether there is an alternative abnormal case in the knowledge graph library with a matching degree higher than the preset matching degree threshold; if so, calculating the corrected matching degree corresponding to each alternative abnormal case, and taking the alternative abnormal case with the highest corrected matching degree as the designated abnormal case that matches the alarm information, and executing the operation and maintenance measures in the designated abnormal case; if not, generating the operation and maintenance instructions corresponding to the alarm information.

[0090] In this step, natural language processing (NLP) technology can be used to parse the alarm information to obtain the specific alarm source, alarm level, alarm title, and alarm time. The matching degree specifically refers to the textual similarity between the abnormal case and the alarm information, which can be calculated using similarity metrics such as cosine similarity, Jaccard similarity, and edit distance.

[0091] Because some anomaly cases in the knowledge graph may have a generally low match with the alert information, hastily applying the operational measures from a specific anomaly case may not only fail to produce the desired effect but may also have the opposite effect. Therefore, to ensure that each alert is addressed with the operational measures from a highly relevant anomaly case and to ensure effective operational management, a reasonable match threshold can be set based on historical data and business experience. This match threshold is then compared with the match of each anomaly case to select anomaly cases with high matching scores as candidate anomaly cases. If such candidate anomaly cases exist, a corrected matching score is calculated for each candidate anomaly case. This corrected matching score is obtained by modifying the original matching score based on the recency score and resolution success rate of each candidate anomaly case. The candidate anomaly case with the highest corrected matching score is designated as the designated anomaly case matching the alert information, and the operational measures from that designated anomaly case are executed. This means that the corresponding operational management script or workflow is invoked to automatically or manually execute the operational management measures, effectively improving operational management efficiency. If there is no alternative abnormal case, an operation and maintenance instruction corresponding to the alarm information is generated. The operation and maintenance instruction can send the alarm information to the operation and maintenance personnel for manual analysis, or search for relevant documents and technical information to find possible solutions.

[0092] Furthermore, in order to improve the accuracy and effectiveness of operation and maintenance and ensure the effect of operation and maintenance, based on the above description of the corrected matching degree, the specific execution process of calculating the corrected matching degree corresponding to each candidate abnormal case is as follows: calculating the case quality corresponding to each candidate abnormal case based on the recency score and resolution success rate of each candidate abnormal case; determining the matching degree correction coefficient corresponding to each candidate abnormal case based on the case quality; and using the matching degree correction coefficient to correct the matching degree of each candidate abnormal case to obtain the corrected matching degree of each candidate abnormal case.

[0093] In practical applications, the recency and resolution success rate of exception cases are important indicators for measuring the quality of exception cases in a knowledge graph, and both directly affect the applicability and effectiveness of the cases. Therefore, to select the best from the best, the original matching degree of each candidate exception case can be modified based on its recency and resolution success rate. The specified exception case is then selected from the candidate exception cases based on the modified matching degree, ensuring that the selection of the specified exception case always takes into account the quality of the exception case.

[0094] It should be noted that after each exception case is selected as a designated exception case, the corresponding execution results are usually recorded when the operation and maintenance measures are executed to resolve the corresponding exception. Therefore, by compiling the execution result records, the corresponding resolution success rate of the exception case can be obtained, which specifically refers to the probability that the operation and maintenance measures provided in the exception case are successfully applied.

[0095] For example, the solution success rate can be calculated in any of the following two ways:

[0096] Analysis of historical execution results records:

[0097] Collect the execution results of each exception case after it is applied. The execution results include whether the problem is successfully solved, the time required to solve the problem, whether additional intervention is required, etc.

[0098] Formula: Solution success rate = number of successfully solved cases / total number of application cases.

[0099] User feedback:

[0100] Feedback from operations personnel after implementing operational measures in application anomaly cases can be a simple success / failure mark or a detailed resolution effectiveness score.

[0101] Formula: Resolution success rate = number of successful feedbacks / total number of feedbacks.

[0102] When each abnormal case is updated to the knowledge graph library for the first time or when the abnormal case is updated subsequently, the corresponding timestamp, i.e., the update time, will be recorded. Based on the update time, the recency score of the abnormal case can be calculated, which specifically refers to the quantitative score of the difference between the update time of the abnormal case and the current time.

[0103] For example, since a more recent update time means a newer anomaly case, the recency score can be calculated in any of the following three ways:

[0104] Time difference calculation:

[0105] Formula: Recency score = 1 / (Current time - Update time). The time difference can be days, hours, or any other unit of time. Using a score ensures that the closer the update time is to the current time, the higher the recency score.

[0106] Time window weighting:

[0107] Assign higher weights to the most recent update time, and gradually reduce the weights as the update time becomes more distant. For example, a time window can be set, and anomalies within this window are considered the most recent, while anomalies outside the window are given lower weights.

[0108] Exponential decay:

[0109] An exponential function is used to calculate the weight of the time difference, and the weight decays exponentially as the time difference increases. This ensures that the most recent anomaly cases have the highest weight.

[0110] Based on the above, we can see that the recency score and resolution success rate of each candidate anomaly case have been determined. Based on these two factors, the matching correction coefficient corresponding to each candidate anomaly case can be calculated. Specifically, the higher the recency score and the higher the resolution success rate, the higher the case quality of the candidate anomaly case, and the higher the corresponding matching correction coefficient, and vice versa. Specifically, weights are assigned to the recency score and resolution success rate based on business needs and expert judgment. The weights indicate the relative importance of the recency score or resolution success rate in the final matching correction coefficient. The matching correction coefficient for each candidate anomaly case is obtained by weighted averaging, and combined with its original matching degree, the corrected matching degree can be calculated.

[0111] For example, assume that the original matching degree corresponding to a candidate abnormal case is M, A is its recency score, B is its resolution success rate, the weight of its recency score is Wnew, the weight of its resolution success rate is Wsol, and Wnew+Wsol=1.

[0112] Use weighted average: C = Wnew × A + Wsol × B, where C is the correction factor.

[0113] Corrected matching degree: M′=M×C, where M is the original matching degree.

[0114] Furthermore, as a response to the above Figure 1-2 The embodiment of the method shown in the embodiment of the present application provides an operation monitoring device for an energy internet marketing service system, which is used to improve the accuracy and efficiency of the operation monitoring of the energy internet marketing service system. The embodiment of the device corresponds to the aforementioned method embodiment. For ease of reading, this embodiment will no longer repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Specifically, Figure 3 As shown, the device includes:

[0115] The first acquisition unit 301 is configured to acquire target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system;

[0116] A determination unit 302 is configured to determine whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline. The dynamic baseline is a normal indicator range obtained after periodic cluster analysis of historical data corresponding to each indicator in the target indicator data. The normal indicator range changes dynamically and periodically.

[0117] A generating unit 303 is configured to generate alarm information corresponding to the abnormal indicator if yes;

[0118] The processing unit 304 is used to determine a specified abnormal case that matches the alarm information in the knowledge graph library and execute the operation and maintenance measures in the specified abnormal case.

[0119] Further, such as Figure 4 As shown, the device also includes:

[0120] The second acquisition unit 305 is configured to acquire historical data corresponding to each indicator in the target indicator data according to a preset period before acquiring the target indicator data according to a preset frequency;

[0121] an identification unit 306 for determining, from the historical data, usage patterns of the indicators in different time periods using a clustering algorithm, and identifying, based on the usage patterns, behavioral characteristics of the indicators under normal operating conditions;

[0122] The first determining unit 307 is configured to determine a normal indicator range corresponding to each indicator in different time periods based on the behavior characteristics, and use the normal indicator range as the dynamic baseline.

[0123] Further, such as Figure 4 As shown, the judging unit 302 includes:

[0124] An acquisition module 3021 is used to obtain the collection time corresponding to each indicator in the target indicator data;

[0125] A matching module 3022 is configured to match a target time period in different time periods according to the acquisition time;

[0126] The comparison module 3023 is configured to compare each indicator in the target indicator data with the dynamic baseline corresponding to each indicator in the target time period, and to use the indicator that deviates from the dynamic baseline as the abnormal indicator.

[0127] Further, such as Figure 4 As shown, the device also includes:

[0128] The third acquisition unit 308 is used to acquire historical operation and maintenance records before acquiring target indicator data according to a preset frequency;

[0129] An extraction unit 309 is configured to extract abnormal cases from the historical operation and maintenance records, wherein the abnormal cases are used to represent abnormal operation and maintenance cases related to system operation and business applications in the energy internet marketing service system, and the abnormal cases include corresponding operation and maintenance measures;

[0130] The construction unit 310 is used to construct the knowledge graph library based on the multiple abnormal cases.

[0131] Further, such as Figure 4 As shown, the processing unit 304 includes:

[0132] A first calculation module 3041 is used to calculate the matching degree between the alarm information and each abnormal case in the knowledge graph library;

[0133] A judgment module 3042 is used to judge whether there is a candidate abnormal case in the knowledge graph library whose matching degree is higher than a preset matching degree threshold;

[0134] The processing module 3043 is configured to calculate the corrected matching degree corresponding to each candidate abnormal case, if any, and use the candidate abnormal case with the highest corrected matching degree as the designated abnormal case matching the alarm information, and execute the operation and maintenance measures in the designated abnormal case;

[0135] The generation module 3044 is used to generate an operation and maintenance instruction corresponding to the alarm information if it does not exist.

[0136] Further, such as Figure 4 As shown, the processing module 3043 is specifically used to:

[0137] Calculate the case quality corresponding to each candidate abnormal case according to the latest score and resolution success rate of each candidate abnormal case;

[0138] Determining a matching degree correction coefficient corresponding to each of the candidate abnormal cases based on the case quality;

[0139] The matching degree of each candidate abnormal case is corrected using the matching degree correction coefficient to obtain the corrected matching degree of each candidate abnormal case.

[0140] Further, such as Figure 4 As shown, the device also includes:

[0141] A calculation unit 311 is configured to calculate the system operation impact and / or business application impact corresponding to the abnormal indicator before generating the alarm information corresponding to the abnormal indicator;

[0142] A second determining unit 312 is configured to determine an alarm level of the abnormal indicator in a preset impact level-level rule according to the system operation impact level and / or the business application impact level;

[0143] The generating unit 303 is specifically configured to:

[0144] Generate alarm information corresponding to the abnormal indicator based on the alarm level.

[0145] Furthermore, the embodiment of the present application also provides a storage medium, which is used to store a computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the above Figure 1-2 The operation monitoring method of the energy Internet marketing service system described in.

[0146] Furthermore, the embodiment of the present application also provides a processor, which is used to run a program, wherein the program executes the above Figure 1-2 The operation monitoring method of the energy Internet marketing service system described in.

[0147] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0148] It is understood that the relevant features of the above methods and devices can be referenced to each other. In addition, the terms "first" and "second" in the above embodiments are used to distinguish between the embodiments, and do not represent the advantages and disadvantages of the embodiments.

[0149] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0150] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems may also be used together with the teachings herein. Based on the above description, it is apparent that the structure required for constructing such systems is suitable. In addition, the present application is not directed to any specific programming language. It should be understood that various programming languages may be utilized to implement the present application described herein, and the description of the specific languages above is provided for the purpose of disclosing the preferred embodiment of the present application.

[0151] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0152] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0153] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0156] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0157] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0158] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transit media), such as modulated data signals and carrier waves.

[0159] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0160] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0161] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for monitoring the operation of an energy internet marketing service system, characterized in that: The method comprises: Obtain target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system; Determine whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline. The dynamic baseline is a normal indicator range obtained after periodic cluster analysis of historical data corresponding to each indicator in the target indicator data. The normal indicator range is periodically dynamic. If so, generate an alarm message corresponding to the abnormal indicator; Determine in the knowledge graph library the specified abnormal case that matches the alarm information, and execute the operation and maintenance measures in the specified abnormal case; Determine in the knowledge graph library the specified abnormal case that matches the alarm information, and execute the operation and maintenance measures in the specified abnormal case, including: Calculating the matching degree between the warning information and each of the abnormal cases in the knowledge graph library; Determine whether there is an alternative abnormal case in the knowledge graph library whose matching degree is higher than a preset matching degree threshold; If so, calculate the corrected matching degree corresponding to each candidate abnormal case, take the candidate abnormal case with the highest corrected matching degree as the designated abnormal case matching the alarm information, and execute the operation and maintenance measures in the designated abnormal case; If it does not exist, generate an operation and maintenance instruction corresponding to the alarm information; Calculating the corrected matching degree corresponding to each candidate abnormal case, including: The case quality of each candidate abnormal case is calculated based on the recency score and resolution success rate of each candidate abnormal case, where the recency score = 1 / (current time - update time) and the resolution success rate = number of successful feedbacks / total number of feedbacks. The feedback specifically refers to the feedback provided by the operation and maintenance personnel after applying the operation and maintenance measures in the abnormal case. Determining a matching degree correction coefficient corresponding to each of the candidate abnormal cases based on the case quality; The matching degree of each candidate abnormal case is corrected using the matching degree correction coefficient to obtain the corrected matching degree of each candidate abnormal case.

2. The method according to claim 1, characterized in that Before obtaining target indicator data at a preset frequency, the method further includes: Obtain historical data corresponding to each indicator in the target indicator data according to a preset period; Using a clustering algorithm to determine usage patterns of each indicator in different time periods from the historical data, and identifying behavioral characteristics of each indicator under normal operating conditions based on the usage patterns; Based on the behavioral characteristics, normal indicator ranges corresponding to the respective indicators in different time periods are determined, and the normal indicator ranges are used as the dynamic baselines.

3. The method according to claim 2, characterized in that Determining whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline includes: Obtaining the collection time corresponding to each indicator in the target indicator data; matching a target time period in different time periods according to the acquisition time; Each indicator in the target indicator data is compared with a dynamic baseline corresponding to each indicator in the target time period, and an indicator deviating from the dynamic baseline is regarded as the abnormal indicator.

4. The method according to claim 1, wherein Before obtaining target indicator data at a preset frequency, the method further includes: Obtain historical operation and maintenance records; Extracting abnormal cases from the historical operation and maintenance records, wherein the abnormal cases are used to characterize abnormal operation and maintenance cases related to system operation and business applications in the energy internet marketing service system, and the abnormal cases include corresponding operation and maintenance measures; The knowledge graph library is constructed based on multiple abnormal cases.

5. The method according to any one of claims 1 to 4, characterized in that Before generating the alarm information corresponding to the abnormal indicator, the method further includes: Calculate the degree of impact on system operation and / or business application corresponding to the abnormal indicator; Determining the alarm level of the abnormal indicator in a preset impact level-level rule according to the system operation impact level and / or the business application impact level; Generate alarm information corresponding to the abnormal indicator based on the alarm level.

6. An operation monitoring device for an energy internet marketing service system, characterized in that: The device comprises: A first acquisition unit is configured to acquire target indicator data at a preset frequency, wherein the target indicator data is used to represent indicator data related to system operation and business applications in the energy internet marketing service system; a judgment unit, configured to judge whether each indicator in the target indicator data is an abnormal indicator that deviates from its corresponding dynamic baseline, wherein the dynamic baseline is a normal indicator range obtained after periodic cluster analysis of historical data corresponding to each indicator in the target indicator data, and the normal indicator range is periodically and dynamically changing; a generating unit, configured to generate alarm information corresponding to the abnormal indicator if yes; A processing unit, configured to determine, in a knowledge graph library, a specified abnormal case that matches the alarm information, and execute an operation and maintenance measure in the specified abnormal case; The processing unit includes: A first calculation module is used to calculate the matching degree between the alarm information and each abnormal case in the knowledge graph library; A judgment module, configured to judge whether there is an alternative abnormal case in the knowledge graph library whose matching degree is higher than a preset matching degree threshold; a processing module configured to calculate the corrected matching degree corresponding to each candidate abnormal case, if any, and use the candidate abnormal case with the highest corrected matching degree as the designated abnormal case matching the alarm information, and execute the operation and maintenance measures in the designated abnormal case; A generation module, configured to generate an operation and maintenance instruction corresponding to the alarm information if the alarm does not exist; The processing module is specifically used to: The case quality of each candidate abnormal case is calculated based on the recency score and resolution success rate of each candidate abnormal case, where the recency score = 1 / (current time - update time) and the resolution success rate = number of successful feedbacks / total number of feedbacks. The feedback specifically refers to the feedback provided by the operation and maintenance personnel after applying the operation and maintenance measures in the abnormal case. Determining a matching degree correction coefficient corresponding to each of the candidate abnormal cases based on the case quality; The matching degree of each candidate abnormal case is corrected using the matching degree correction coefficient to obtain the corrected matching degree of each candidate abnormal case.

7. A storage medium, characterized in that: The storage medium includes a stored program, wherein, when the program is running, the device where the storage medium is located is controlled to execute the operation monitoring method of the energy Internet marketing service system according to any one of claims 1 to 5.

8. A processor, characterized in that: The processor is used to run a program, wherein the program, when running, executes the operation monitoring method of the energy Internet marketing service system according to any one of claims 1 to 5.

Images