Data early warning system and early warning method

Abstract

The invention discloses a data early warning system and an early warning method. According to the data early warning system and method, a user is supported to customize and set a risk parameter SQL statement and an early warning rule SQL statement in advance; therefore, different intermediate risk parameter tables and early warning rules can be generated according to different requirements and use scenes; then, data monitoring can be carried out based on the generated risk parameter table; and finally, abnormal data can be screened out from the monitored data according to a self-defined early warning rule, and data early warning is carried out. Therefore, the method has universality and high efficiency, can meet business requirements which change at any time, and does not need to perform system development and customization again when the requirements are changed, so that not only is the complexity of early warning rule customization reduced, but also the early warning efficiency can be improved; therefore, the method is very suitable for large-scale application and popularization.

Description

Technical Field

[0001] The present invention belongs to the technical field of data monitoring, and in particular relates to a data early warning system and an early warning method. Background Art

[0002] At present, software business systems or regulatory systems in various industries need to provide early warnings for specific businesses. The indicators and rules for early warnings are different and change with business changes and the ideas of users. Among them, when monitoring system business, most of the existing methods are to achieve data monitoring and early warning through customized or semi-customized early warning rule development, and there is no early warning system that can be used for software businesses in all walks of life. Based on this, the above-mentioned existing technologies have the following deficiencies: when the demand changes, the early warning system needs to be re-developed and customized, which is not only time-consuming and labor-intensive, but also cannot be flexibly changed with changes in business or management rules, and cannot meet customers' complex early warning needs. Therefore, how to provide an early warning system that can be used for software businesses in all walks of life has become an urgent problem to be solved. Summary of the invention

[0003] The purpose of the present invention is to provide a data early warning system and an early warning method to solve the problems in the prior art that when the demand changes, the early warning system needs to be redeveloped and customized, which is time-consuming and labor-intensive, and cannot meet the complex early warning needs of customers.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] In a first aspect, a data early warning system is provided, comprising:

[0006] An early warning rule module, wherein the early warning rule module is configured with a visual editing interface, and is used to receive a risk parameter SQL statement input by a user when the visual editing interface responds to the first human-computer interaction, and to construct a risk parameter table based on the risk parameter SQL statement, wherein the risk parameter table stores the target to be monitored;

[0007] An early warning rule module is used to generate a data monitoring scheduling task based on the risk parameter table, so as to collect the operating data of the target to be monitored in the risk parameter table from the system to be monitored based on the data monitoring scheduling task, and store the collected operating data in a query database, wherein the query database also stores an early warning rule SQL statement, and the early warning rule SQL statement is obtained when the visual editing interface responds to the second human-computer interaction;

[0008] A query module, used to extract the early warning rule SQL statement from the query database, to filter out abnormal data from the operation data of the target to be monitored in the query database based on the early warning rule SQL statement, and to send the abnormal data to the early warning push module;

[0009] The early warning push module is used to receive the abnormal data sent by the query module and push the abnormal data to the monitoring terminal to complete the data early warning of the target to be monitored.

[0010] Based on the above disclosed content, the data early warning system provided by the present invention is provided with an early warning rule module and a query module, wherein the early warning rule module is configured with a visual editing interface, which is used to obtain the risk parameter SQL statement and the early warning rule SQL statement input by the user when the visual editing interface responds to human-computer interaction; in this way, the present invention is equivalent to providing a custom configuration interface for risk parameters and early warning rules, so that users can customize the risk parameters and early warning rules based on SQL statements; at the same time, after receiving the risk parameter SQL statement input by the user, the present invention will construct a risk parameter table containing the target to be monitored, and generate a data monitoring scheduling task based on this; then, based on the data monitoring scheduling task, the operating data of the target to be monitored can be collected from the system to be monitored and stored; finally, the query module can filter out abnormal data from the stored operating data based on the pre-set early warning rule SQL statement, and send it to the early warning push module, so that the early warning push module sends the abnormal data to the monitoring terminal, thereby realizing data early warning of the target to be monitored.

[0011] Through the above design, the data early warning system provided by the present invention supports users to customize risk parameter SQL statements and early warning rule SQL statements in advance; in this way, different intermediate risk parameter tables and early warning rules can be generated according to different needs and usage scenarios; then, data monitoring can be performed based on the generated risk parameter table; finally, abnormal data can be screened out from the monitored data according to the customized early warning rules, and data early warning can be performed; therefore, the present invention has versatility and high efficiency, can meet business needs that change at any time, and when the needs change, there is no need to re-develop and customize the system, based on this, not only the complexity of early warning rule customization is reduced, but also the efficiency of early warning can be improved; therefore, it is very suitable for large-scale application and promotion.

[0012] In a possible design, the early warning rule module is used to send the risk parameter SQL statement to the query module;

[0013] A query module is used to perform feasibility verification on the risk parameter SQL statement, and after the feasibility verification passes, generate a first verification result for visual display, so that the user can feedback the parameter table construction instruction to the query module;

[0014] The query module is further used to receive a parameter table construction instruction and send the parameter table construction instruction to the early warning rule module;

[0015] The early warning rule module is also used to construct the risk parameter table based on the risk parameter SQL statement after receiving the parameter table construction instruction.

[0016] In a possible design, the query database includes: a personal database, a public database and a Hive database, wherein the personal database stores historical query data of a single user, the public database stores historical query data of multiple users, and the Hive database stores all query data;

[0017] A query module, configured to perform a data query in the personal database based on the risk parameter SQL statement, obtain a first query result, and determine whether the first query result is empty;

[0018] If yes, the query module is used to perform a data query in the public database based on the risk parameter SQL statement to obtain a second query result, and determine whether the second query result is empty;

[0019] If yes, the query module is used to perform data query in the Hive database based on the risk parameter SQL statement to obtain a third query result, and determine whether the third query result is empty;

[0020] If not, the query module is used to determine whether the risk parameter SQL statement passes the feasibility check, and uses the third query result as the first check result for visual display.

[0021] In a possible design, if the query module determines that the third query result is empty, it determines that the risk parameter SQL statement has not passed the feasibility check, and generates a risk parameter SQL statement error prompt message for visual display.

[0022] In one possible design, the query module includes: a query interface unit and a query unit;

[0023] An early warning rule module, used for sending the risk parameter SQL statement to the query interface unit;

[0024] A query interface unit, configured to perform a security check on the risk parameter SQL statement, and after the security check passes, parse the risk parameter SQL statement to obtain a first parsing result, and send the first parsing result to the query unit;

[0025] The query unit is used to perform feasibility verification on the risk parameter SQL statement according to the first analysis result, and after the feasibility verification passes, generate the first verification result for visual display.

[0026] In a possible design, the warning rule module is further used to receive the warning rule SQL statement input by the user when the visual editing interface responds to the second human-computer interaction, and send the warning rule SQL statement to the query module;

[0027] A query module is used to perform statement verification processing on the early warning rule SQL statement, and after the statement verification passes, generate a second verification result for visual display, so that after the visual display, the user can feedback the rule confirmation instruction to the query module;

[0028] The query module is used to receive the rule confirmation instruction and store the warning rule SQL statement in the query database after receiving the rule confirmation instruction.

[0029] In one possible design, the query module includes: a query interface unit and a query unit;

[0030] An early warning rule module, used for sending the early warning rule SQL statement to the query interface unit;

[0031] A query interface unit, used to perform a security check on the early warning rule SQL statement, and after the security check passes, parse the early warning rule SQL statement to obtain a second parsing result, and send the second parsing result to the query unit;

[0032] The query unit is used to perform statement verification processing on the warning rule SQL statement according to the second analysis result, and after the statement verification processing passes, generate the second verification result for visual display.

[0033] In a possible design, the query database includes: a personal database, a public database and a Hive database, and the early warning rule module is used to store the collected operating data in the personal database, the public database and the Hive database;

[0034] The query module is used to query data from the personal database based on the early warning rule SQL statement to obtain a fourth query result and determine whether the fourth query result is empty;

[0035] If yes, the query module is used to query data from the public database based on the warning rule SQL statement to obtain a fifth query result, and determine whether the fifth query result is empty;

[0036] If yes, the query module is used to query data from the Hive database based on the warning rule SQL statement to obtain a sixth query result, and determine whether the sixth query result is empty;

[0037] If not, the query module performs data screening on the sixth query result to obtain abnormal data, and determines whether the abnormal data is the data for which warning has been issued;

[0038] If not, the abnormal data is sent to the early warning push module.

[0039] In a possible design, after the early warning rule module constructs the risk parameter table based on the risk parameter SQL statement, it is also used to store the risk parameter table in the risk parameter library.

[0040] In a second aspect, a data early warning method of the data early warning system based on the first aspect or any possible design of the first aspect is provided, wherein the method comprises:

[0041] When the visual editing interface responds to the first human-computer interaction, receiving a risk parameter SQL statement input by the user, and constructing a risk parameter table based on the risk parameter SQL statement, wherein the risk parameter table stores the target to be monitored;

[0042] Generate a data monitoring scheduling task based on the risk parameter table;

[0043] The data monitoring scheduling task is used to collect the operating data of the target to be monitored in the risk parameter table from the system to be monitored, and the collected operating data is stored in the query database, wherein the query database also stores the early warning rule SQL statement, and the early warning rule SQL statement is obtained when the visual editing interface responds to the second human-computer interaction;

[0044] Extracting the early warning rule SQL statement from the query database, and filtering out abnormal data from the operation data of the target to be monitored in the query database based on the early warning rule SQL statement;

[0045] The abnormal data is pushed to the monitoring terminal to complete the data early warning of the target to be monitored.

[0046] Beneficial effects:

[0047] (1) The data early warning system provided by the present invention supports users to customize risk parameter SQL statements and early warning rule SQL statements in advance; in this way, different intermediate risk parameter tables and early warning rules can be generated according to different needs and usage scenarios; then, data monitoring can be performed based on the generated risk parameter tables; finally, abnormal data can be screened out from the monitored data according to the customized early warning rules, and data early warnings can be performed; therefore, the present invention has universality and high efficiency, can meet business needs that change at any time, and when the needs change, there is no need to re-develop and customize the system, based on this, not only the complexity of early warning rule customization is reduced, but also the efficiency of early warning can be improved; therefore, it is very suitable for large-scale application and promotion. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of the architecture of a data early warning system provided by an embodiment of the present invention;

[0049] Figure 2 A flowchart of the steps of the data early warning method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0051] It should be understood that although the terms first, second, etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another unit. For example, a first unit can be referred to as a second unit, and similarly, a second unit can be referred to as a first unit without departing from the scope of the exemplary embodiments of the present invention.

[0052] It should be understood that the term "and / or" that may appear in this article is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" that may appear in this article describes another type of association object relationship, indicating that two relationships may exist. For example, A / and B can represent two situations: A exists alone, and A and B exist alone. In addition, the character " / " that may appear in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0053] Example:

[0054] See also Figure 1 As shown, the data warning system provided by this embodiment may include but is not limited to: a warning rule module, a query module and a warning push module; wherein, in actual use, the warning rule module is configured with a visual editing interface, which is used to provide users with customized risk parameters and warning rule setting paths, that is, users can customize the risk parameters and warning rules on the visual editing interface according to their own needs and usage scenarios, thereby generating corresponding risk parameter SQL statements and warning rule SQL statements; thus, this embodiment performs data warning based on this.

[0055] In specific applications, the early warning rule module is used to receive the risk parameter SQL statement input by the user when the visual editing interface responds to the first human-computer interaction, and construct a risk parameter table based on the risk parameter SQL statement, wherein, for example, the risk parameter SQL statement may include but is not limited to a defined target to be monitored (i.e., which data to be monitored, such as network speed, CPU occupancy, etc., of course, it is specifically set according to the actual usage scenario); in this way, after the risk parameter table is constructed, the target to be monitored is stored in the table; then, the early warning rule module is used to generate a data monitoring scheduling task based on the risk parameter table, so as to collect the operating data of the target to be monitored in the risk parameter table from the system to be monitored based on the data monitoring scheduling task, and store the collected operating data in the query database; in addition, in this embodiment, for example, after the risk parameter table is constructed based on the risk parameter SQL statement, the early warning rule module is also used to store the risk parameter table in the risk parameter library, so as to store the risk parameter table; based on this, the aforementioned data monitoring scheduling task can be used to collect the operating data of the target to be monitored in the system to be monitored on a regular or uninterrupted basis, thereby providing a data basis for subsequent data early warnings.

[0056] In this embodiment, the query database described in the example also stores an early warning rule SQL statement, and the early warning rule SQL statement is obtained when the visual editing interface responds to the second human-computer interaction; in this way, the early warning rule SQL statement is equivalent to being customized by the user according to the usage scenario (the setting process is described in detail below); based on this, business data monitoring and early warning can be carried out based on customized risk parameters and early warning rules.

[0057] Specifically, in this embodiment, the query module and the warning push module are used to perform data warning, and the process is as follows:

[0058] The query module is used to extract the early warning rule SQL statement from the query database, so as to screen out abnormal data from the operation data of the target to be monitored in the query database based on the early warning rule SQL statement, and send the abnormal data to the early warning push module; and the early warning push module is used to receive the abnormal data sent by the query module, and push the abnormal data to the monitoring terminal to complete the data early warning of the target to be monitored; in this embodiment, the screening of abnormal data is implemented according to the early warning rule. For example, if the early warning rule is to alarm when the CPU occupancy rate is higher than the threshold, then the operation data with the CPU occupancy rate higher than the threshold is regarded as abnormal data. Of course, when the early warning rules are different, the screening of abnormal data also changes accordingly, and examples are not given one by one here.

[0059] Through the above-mentioned design, the data early warning system provided by this implementation is universal and efficient, can meet the business needs that change at any time, and supports users to customize the intermediate risk parameter table in advance and self-develop SQL early warning rules. In this way, it can not only reduce the complexity of early warning rule customization, but also improve the efficiency of early warning.

[0060] In a possible design, this embodiment discloses a specific method for constructing a risk parameter table, as shown below:

[0061] In specific applications, after receiving the risk parameter SQL statement, the early warning rule module will first send the risk parameter SQL statement to the query module; the query module is used to perform a feasibility check on the risk parameter SQL statement, and after the feasibility check is passed, generate a first check result for visual display, so that the user can feedback the parameter table construction instruction to the query module; then, the query module is also used to receive the parameter table construction instruction, and send the parameter table construction instruction to the early warning rule module; the early warning rule module is used to construct the risk parameter table based on the risk parameter SQL statement after receiving the parameter table construction instruction.

[0062] In this embodiment, the feasibility check of the risk parameter SQL statement is to determine whether the risk parameter SQL statement is written correctly. In this way, after the feasibility check, the reliability of the constructed risk parameter table can be guaranteed.

[0063] Optionally, the query database includes: a personal database, a public database and a Hive database, wherein the personal database stores historical query data of a single user, the public database stores historical query data of multiple users, and the Hive database stores all query data, that is, the personal database stores data corresponding to a single user, the public database stores data of multiple users, and the Hive database includes multiple source databases, which store all queried data; therefore, the data range of the personal database is smaller than that of the public database, and the data range of the public database is smaller than that of the Hive database; based on this, this embodiment performs feasibility verification of risk parameter SQL statements based on the way statements query data in various databases.

[0064] In the specific implementation, the feasibility verification process is:

[0065] The query module is used to perform data query in the personal database based on the risk parameter SQL statement, obtain a first query result, and determine whether the first query result is empty; in this embodiment, the data query based on the risk parameter SQL statement is to query the historical data corresponding to the target to be monitored in the risk parameter SQL statement in the historical query data of a single user in the personal database; in this way, a feasibility check can be performed based on the query result; wherein, if the first query result is empty, it is necessary to query in the public database, otherwise, if the first query result is not empty, the first query result is directly used as the first verification result for visual display to prompt the user that the verification is passed, so as to input the parameter table construction instruction, and then construct a risk parameter table based on the instruction.

[0066] Among them, the query process in the public database is: if the first query result is empty, the query module is used to perform data query in the public database based on the risk parameter SQL statement, obtain the second query result, and determine whether the second query result is empty; in this embodiment, if the second query result is not empty, at this time, the second query result is directly used as the first verification result for visual display to prompt the user that the verification has passed.

[0067] Similarly, if the second query result is empty, the query module is used to perform data query in the Hive database based on the risk parameter SQL statement, obtain a third query result, and determine whether the third query result is empty; similarly, if the third query result is not empty, the query module is used to determine that the risk parameter SQL statement passes the feasibility check, and uses the third query result as the first check result for visual display; otherwise, it is determined that the risk parameter SQL statement fails the feasibility check, and generates a risk parameter SQL statement error prompt message for visual display to prompt the user that the statement is incorrect and needs to be re-entered.

[0068] Based on the foregoing description, this embodiment is equivalent to performing data query based on the risk parameter SQL statement, starting from the database with the smallest data range. If the query result is empty, it jumps to the public database with a larger data range for query until the Hive database is queried. Among them, as long as the query result in any database is not empty, it means that the statement has passed the feasibility check. On the contrary, if the data corresponding to the risk parameter SQL statement cannot be queried in all databases, then it means that the statement is wrong and needs to be re-entered. Therefore, through the foregoing design, the reliability of the input risk parameter SQL statement can be guaranteed.

[0069] Further, one of the specific functional building units of the following public query module:

[0070] Optionally, the query module may include but is not limited to: a query interface unit and a query unit; wherein the early warning rule module is used to send the risk parameter SQL statement to the query interface unit; and the query interface unit is used to perform a security check on the risk parameter SQL statement, and after the security check passes, parse the risk parameter SQL statement to obtain a first parsing result, and send the first parsing result to the query unit; finally, the query unit is used to perform a feasibility check on the risk parameter SQL statement according to the first parsing result, and after the feasibility check passes, generate the first verification result for visual display.

[0071] In this embodiment, the aforementioned security check is taken as an example, which is the source check of the risk parameter SQL statement and the check of the data structure; wherein, if the source path is a legitimate system (a system whitelist can be set in advance) and the data structure is the same as the preset structure, then it is determined that the security check has passed; otherwise, it is determined that the security check has failed; similarly, parsing the SQL statement is equivalent to parsing the internal monitored target, and then the query unit can search for historical data corresponding to the monitored target in each database; of course, the query unit based on the first parsing result, the query process in each database, and the process of feasibility verification based on the query result have been explained above and will not be repeated here.

[0072] Based on this, after completing the description of the query module and the risk parameter table construction process, this embodiment provides a process for obtaining an early warning rule SQL statement, which can be but is not limited to the following:

[0073] In specific applications, the warning rule module is also used to receive the warning rule SQL statement input by the user when the visual editing interface responds to the second human-computer interaction, and send the warning rule SQL statement to the query module; then, the query module is used to perform statement verification on the warning rule SQL statement, and after the statement verification passes, generate a second verification result for visual display, so that after the visual display, the user can feedback the rule confirmation instruction to the query module; finally, the query module is used to receive the rule confirmation instruction, and after receiving the rule confirmation instruction, store the warning rule SQL statement in the query database; in this embodiment, the warning rule SQL statement is stored in the personal database.

[0074] In this embodiment, the verification process of the warning rule SQL statement is the same as that of the risk parameter SQL statement, that is, the warning rule module is first used to send the warning rule SQL statement to the query interface unit; then the query interface unit performs a security check on the warning rule SQL statement, and after the security check passes, parses the warning rule SQL statement to obtain a second parsing result, and sends the second parsing result to the query unit; finally, the query unit performs statement verification processing on the warning rule SQL statement according to the second parsing result, and after the statement verification processing passes, generates the second verification result for visual display, so that the user can feedback the rule confirmation instruction, so that the query unit can store the warning rule SQL statement after receiving the instruction.

[0075] In this embodiment, the SQL statement of the warning rule is still verified based on the data query method, and the process is as follows: the query unit performs data query in the historical query data of a single user in the personal database based on the second analysis result (i.e., the set warning rule) to obtain the seventh query result (i.e., determine whether abnormal data can be queried in the historical operation data based on the warning rule); wherein, if the seventh query result is empty, then a data query is performed in the public database to obtain an eighth query result; and if the eighth query result is empty, a data query is performed in the Hive database to obtain a ninth query result; optionally, if the ninth query result is not empty, then it means that the SQL statement of the warning rule has passed the statement verification and its statement is correctly written, otherwise, it means that the statement is wrong and an error prompt message needs to be output; of course, if the aforementioned seventh query result or the eighth query result is not empty, the corresponding result can also be directly visualized, so as to feedback to the user that the SQL statement of the warning rule is correct and can be stored so that the abnormal data warning can be performed based on the statement later.

[0076] Through the above design, the reliability of the warning rule SQL statement can be guaranteed, thereby improving the accuracy of data warning.

[0077] After obtaining the warning rule SQL statement and passing the statement verification, data warning can be carried out. The process is as follows:

[0078] In this embodiment, it has been explained above that the query database includes a personal database, a public database and a Hive database; therefore, after collecting the real-time operation data of the target to be monitored, the early warning rule module stores the collected operation data in the personal database, the public database and / or the Hive database. In this way, the aforementioned data early warning method is still carried out by performing data query, that is:

[0079] The query module is used to perform data query from the personal database based on the early warning rule SQL statement to obtain a fourth query result and determine whether the fourth query result is empty; wherein, if the fourth query result is empty, it means that there is no real-time operation data of the target to be monitored in the personal database. At this time, it is necessary to search in the public database, that is, if the fourth query result is empty, the query module performs data query from the public database based on the early warning rule SQL statement to obtain a fifth query result and determine whether the fifth query result is empty; similarly, if the fifth query result is empty, it is necessary to search in the Hive database, and the process is as follows: the query module performs data query from the Hive database based on the early warning rule SQL statement to obtain a sixth query result result, and determine whether the sixth query result is empty; in this embodiment, if the sixth query result is empty, it means that there is no real-time operating data of the target to be monitored. At this time, a prompt message of data collection error is output to prompt the user to reconfigure the early warning rules and risk parameters; on the contrary, if the sixth query result is not empty, it means that the real-time operating data of the target to be monitored is found; at this time, the abnormal data can be screened based on the early warning rules in the early warning rule SQL statement to obtain the abnormal data; finally, it can be determined whether the abnormal data is the data that has been warned; if the abnormal data is new data (no warning has been issued), then the abnormal data is sent to the early warning push module, so that the abnormal data is pushed through the early warning push module, thereby realizing the early warning of the abnormal data.

[0080] Of course, if the fourth query result or the fifth query result is not empty, then the abnormal data is directly screened, and the process is the same as the above description, which will not be repeated here.

[0081] Through the above detailed description of the data early warning system, the working process of the system is as follows:

[0082] First customize risk parameters and warning rules:

[0083] That is, the user customizes the risk parameter SQL statement in the visual editing interface and executes the query request, and the early warning rule module sends the SQL statement to the query interface unit; the query interface unit receives and parses the aforementioned risk parameter SQL statement and verifies the security of the SQL; then, after the verification is passed, the SQL statement is forwarded to the query unit for data query; then, the query unit sequentially queries data from the personal database, the public database and the Hive database, and when the historical data corresponding to the risk parameter SQL statement is queried from any database, the queried data is visually displayed to prompt the user that the risk parameter SQL statement is correctly written and can be used to construct the risk parameter table; finally, the early warning rule module converts the SQL statement into a table building statement, establishes a risk parameter table in the risk parameter library, and generates a scheduling task to regularly execute the scheduling task to update the operating data of the target to be monitored in the risk parameter table; of course, the definition process of the early warning rule is the same as the aforementioned risk parameter, which is to parse first, then verify, and then query the data, and when the data is queried from any database, the input early warning rule SQL statement is stored so that data warning can be performed based on it later.

[0084] Then, data collection can be performed, that is, according to the scheduling task, the real-time operation data of the target to be monitored is collected from the system to be monitored, and updated to the personal database, the public database and / or the Hive database.

[0085] Finally, data warning is performed, that is, the query interface unit obtains the warning rule SQL statement from the personal database, and performs analysis and security verification. After the verification is passed, the real-time operation data of the monitored target is queried from the personal database, the public database and the Hive database in turn according to the analyzed warning rule SQL statement, and when the data is queried from any database, the warning rules in the statement are used to filter out abnormal data from the queried data; finally, it is determined whether the abnormal data is data that has been warned, and if the abnormal data is not data that has been warned, the abnormal data is sent to the monitoring terminal to achieve data warning of the monitored target.

[0086] Therefore, through the above detailed explanation of the data early warning system, the present invention supports users to customize the risk parameter SQL statements and early warning rule SQL statements in advance; in this way, different intermediate risk parameter tables and early warning rules can be generated according to different needs and usage scenarios; then, data monitoring can be carried out based on the generated risk parameter tables; finally, abnormal data can be screened out from the monitored data according to the customized early warning rules, and data early warning can be carried out; therefore, the present invention has versatility and high efficiency, can meet the business needs that change at any time, and when the needs change, there is no need to re-develop and customize the system, based on this, not only the complexity of early warning rule customization is reduced, but also the efficiency of early warning can be improved; therefore, it is very suitable for large-scale application and promotion.

[0087] In one possible design, see Figure 2 As shown, the second aspect of this embodiment provides a data warning method based on the data warning system described in the first aspect of the embodiment, wherein the operation steps of the method may be but are not limited to the following steps S1 to S5.

[0088] S1. When the visual editing interface responds to the first human-computer interaction, a risk parameter SQL statement input by the user is received, and a risk parameter table is constructed based on the risk parameter SQL statement, wherein the risk parameter table stores the target to be monitored.

[0089] S2. Generate a data monitoring scheduling task based on the risk parameter table.

[0090] S3. Use the data monitoring scheduling task to collect the operating data of the monitored target in the risk parameter table from the monitored system, and store the collected operating data in the query database, wherein the query database also stores the early warning rule SQL statement, and the early warning rule SQL statement is obtained when the visual editing interface responds to the second human-computer interaction.

[0091] S4. Extracting the early warning rule SQL statement from the query database, and based on the early warning rule SQL statement, screening out abnormal data from the operating data of the target to be monitored in the query database.

[0092] S5. Push the abnormal data to the monitoring terminal to complete the data warning for the target to be monitored.

[0093] The working process, working details and technical effects of the method provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0094] The third aspect of this embodiment provides an electronic device, comprising: a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the data warning method as described in the second aspect of the embodiment.

[0095] For example, the memory may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, first-in-first-out memory (FIFO) and / or first-in-last-out memory (FILO), etc. Specifically, the processor may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). At the same time, the processor may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state.

[0096] In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. For example, the processor may not be limited to a microprocessor of the STM32F105 series, a reduced instruction set computer (RISC) microprocessor, an X86 or other architecture processor, or a processor with an integrated embedded neural network processor (NPU); the transceiver may be, but is not limited to, a wireless fidelity (WIFI) wireless transceiver, a Bluetooth wireless transceiver, a general packet radio service technology (Genera l Packet Rad ioService, GPRS) wireless transceiver, a ZigBee protocol (a low-power LAN protocol based on the IEEE 802.15.4 standard, ZigBee) wireless transceiver, a 3G transceiver, a 4G transceiver and / or a 5G transceiver, etc. In addition, the device may also include, but is not limited to, a power module, a display screen and other necessary components.

[0097] The working process, working details and technical effects of the electronic device provided in this embodiment can be found in the second aspect of the embodiment and will not be described in detail here.

[0098] The fourth aspect of this embodiment provides a storage medium storing instructions including the data warning method described in the second aspect of the embodiment, that is, the storage medium stores instructions, and when the instructions are run on a computer, the data warning method described in the second aspect of the embodiment is executed.

[0099] The storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, a CD, a hard disk, a flash memory, a USB flash drive and / or a memory stick, etc. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0100] The working process, working details and technical effects of the storage medium provided in this embodiment can be found in the second aspect of the embodiment and will not be described in detail here.

[0101] A fifth aspect of this embodiment provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the data early warning method as described in the second aspect of the embodiment, wherein the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0102] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data early warning system, characterized in that: include: An early warning rule module, wherein the early warning rule module is configured with a visual editing interface, and is used to receive a risk parameter SQL statement input by a user when the visual editing interface responds to the first human-computer interaction, and construct a risk parameter table based on the risk parameter SQL statement, wherein the risk parameter table stores the target to be monitored; An early warning rule module is used to generate a data monitoring scheduling task based on the risk parameter table, so as to collect the operating data of the target to be monitored in the risk parameter table from the system to be monitored based on the data monitoring scheduling task, and store the collected operating data in a query database, wherein the query database also stores an early warning rule SQL statement, and the early warning rule SQL statement is obtained when the visual editing interface responds to the second human-computer interaction; A query module, used to extract the early warning rule SQL statement from the query database, to filter out abnormal data from the operation data of the target to be monitored in the query database based on the early warning rule SQL statement, and to send the abnormal data to the early warning push module; The early warning push module is used to receive the abnormal data sent by the query module and push the abnormal data to the monitoring terminal to complete the data early warning of the target to be monitored.

2. A data early warning system according to claim 1, characterized in that: An early warning rule module, used for sending the risk parameter SQL statement to the query module; A query module is used to perform feasibility verification on the risk parameter SQL statement, and after the feasibility verification passes, generate a first verification result for visual display, so that the user can feedback the parameter table construction instruction to the query module; The query module is further used to receive a parameter table construction instruction and send the parameter table construction instruction to the early warning rule module; The early warning rule module is also used to construct the risk parameter table based on the risk parameter SQL statement after receiving the parameter table construction instruction.

3. A data early warning system according to claim 2, characterized in that: The query database includes: a personal database, a public database and a Hive database, wherein the personal database stores historical query data of a single user, the public database stores historical query data of multiple users, and the Hive database stores all query data; A query module, configured to perform a data query in the personal database based on the risk parameter SQL statement, obtain a first query result, and determine whether the first query result is empty; If yes, the query module is used to perform a data query in the public database based on the risk parameter SQL statement to obtain a second query result, and determine whether the second query result is empty; If yes, the query module is used to perform data query in the Hive database based on the risk parameter SQL statement to obtain a third query result, and determine whether the third query result is empty; If not, the query module is used to determine whether the risk parameter SQL statement passes the feasibility check, and uses the third query result as the first check result for visual display.

4. A data early warning system according to claim 3, characterized in that: If the query module determines that the third query result is empty, it determines that the risk parameter SQL statement has not passed the feasibility check, and generates risk parameter SQL statement error prompt information for visual display.

5. A data early warning system according to claim 2, characterized in that: The query module includes: a query interface unit and a query unit; An early warning rule module, used for sending the risk parameter SQL statement to the query interface unit; A query interface unit, configured to perform a security check on the risk parameter SQL statement, and after the security check passes, parse the risk parameter SQL statement to obtain a first parsing result, and send the first parsing result to the query unit; The query unit is used to perform feasibility verification on the risk parameter SQL statement according to the first analysis result, and after the feasibility verification passes, generate the first verification result for visual display.

6. A data early warning system according to claim 1, characterized in that: The warning rule module is further configured to receive a warning rule SQL statement input by a user when the visual editing interface responds to the second human-computer interaction, and send the warning rule SQL statement to the query module; A query module is used to perform statement verification processing on the early warning rule SQL statement, and after the statement verification passes, generate a second verification result for visual display, so that after the visual display, the user can feedback the rule confirmation instruction to the query module; The query module is used to receive the rule confirmation instruction and store the warning rule SQL statement in the query database after receiving the rule confirmation instruction.

7. A data early warning system according to claim 6, characterized in that: The query module includes: a query interface unit and a query unit; An early warning rule module, used for sending the early warning rule SQL statement to the query interface unit; A query interface unit, used to perform a security check on the early warning rule SQL statement, and after the security check passes, parse the early warning rule SQL statement to obtain a second parsing result, and send the second parsing result to the query unit; The query unit is used to perform statement verification processing on the warning rule SQL statement according to the second analysis result, and after the statement verification processing passes, generate the second verification result for visual display.

8. A data early warning system according to claim 1, characterized in that: The query database includes: a personal database, a public database and a Hive database, and the early warning rule module is used to store the collected operating data in the personal database, the public database and the Hive database; The query module is used to query data from the personal database based on the warning rule SQL statement to obtain a fourth query result and determine whether the fourth query result is empty; If yes, the query module is used to query data from the public database based on the warning rule SQL statement to obtain a fifth query result, and determine whether the fifth query result is empty; If yes, the query module is used to query data from the Hive database based on the warning rule SQL statement to obtain a sixth query result, and determine whether the sixth query result is empty; If not, the query module performs data screening on the sixth query result to obtain abnormal data, and determines whether the abnormal data is the data for which warning has been issued; If not, the abnormal data is sent to the early warning push module.

9. A data early warning system according to claim 1, characterized in that: The early warning rule module is further used to store the risk parameter table in a risk parameter library after constructing the risk parameter table based on the risk parameter SQL statement.

10. A data early warning method based on the data early warning system according to any one of claims 1 to 9, characterized in that: include: When the visual editing interface responds to the first human-computer interaction, receiving a risk parameter SQL statement input by the user, and constructing a risk parameter table based on the risk parameter SQL statement, wherein the risk parameter table stores the target to be monitored; Generate a data monitoring scheduling task based on the risk parameter table; The data monitoring scheduling task is used to collect the operating data of the target to be monitored in the risk parameter table from the system to be monitored, and the collected operating data is stored in the query database, wherein the query database also stores the early warning rule SQL statement, and the early warning rule SQL statement is obtained when the visual editing interface responds to the second human-computer interaction; Extracting the early warning rule SQL statement from the query database, and filtering out abnormal data from the operation data of the target to be monitored in the query database based on the early warning rule SQL statement; The abnormal data is pushed to the monitoring terminal to complete the data early warning of the target to be monitored.

Images