Cloud computing analysis method, device, equipment and storage medium for SaaS system

Abstract

The present invention provides a cloud computing analysis method, device, equipment and storage medium for a SaaS system, wherein the method includes: performing distributed log collection and preprocessing on cloud computing nodes, generating standardized log data, and establishing a centralized log aggregation index to obtain the full system log. The full system log is input into a real-time analysis model to generate an abnormal behavior report, and a hierarchical storage strategy is planned for the log and report to form a query structure. Based on the structure, a data lineage relationship graph is determined to generate a user profile. Based on the abnormal behavior report and the user profile, the allocation of computing resources is planned, a multi-cloud collaborative elastic computing cluster is constructed, and real-time monitoring and fault detection are performed on the cluster to generate a cluster health status report. The system is analyzed and evaluated through a multi-dimensional indicator system. The method improves the performance and efficiency of the system through distributed log collection, multi-dimensional real-time analysis, dynamic resource scheduling and the construction of a multi-dimensional indicator system.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing analysis, and in particular to a cloud computing analysis method, apparatus, device, and storage medium for a SaaS system. Background Art

[0002] With the widespread adoption of cloud computing technology, more and more enterprises are choosing to use Software as a Service (SaaS) systems to manage and operate their businesses. The flexibility and scalability of SaaS systems make them significantly advantageous in meeting diverse business needs. However, with the continuous growth in user scale and data volume, SaaS system management and performance optimization face numerous challenges. In particular, in distributed cloud computing environments, how to effectively collect and process large amounts of system log data, and how to use this data to perform anomaly detection, resource scheduling, user behavior analysis, and system performance evaluation, have become critical issues in cloud computing platform operations.

[0003] Traditional SaaS system log analysis methods often rely on a single data source or simply perform simple log storage and retrieval. This approach often struggles to cope with the high concurrency and large-scale data processing demands of complex distributed cloud computing environments, resulting in low log data utilization, difficulty in timely detection of system anomalies, and inefficient resource scheduling. Furthermore, traditional methods often lack in-depth analysis of user operation patterns and the construction of behavioral profiles, making it difficult to provide accurate user behavior predictions and system performance optimization recommendations.

[0004] To address these issues, the industry has begun exploring how to build efficient log collection, data processing, and analysis frameworks within cloud computing environments. By introducing distributed log collection, centralized log aggregation, multi-dimensional analysis models, and dynamic resource scheduling strategies, the system's log data utilization and analysis accuracy can be significantly improved. However, in practical applications, these technologies still face challenges such as high data processing complexity, slow resource scheduling response, and a lack of a systematic indicator evaluation system. Summary of the Invention

[0005] The main purpose of this invention is to solve the technical problems of existing SaaS systems, such as high complexity in cloud computing analysis data processing, untimely resource scheduling response, and lack of a systematic indicator evaluation system;

[0006] A first aspect of the present invention provides a cloud computing analysis method for a SaaS system, the cloud computing analysis method for a SaaS system comprising:

[0007] Perform distributed log collection and data preprocessing on the cloud computing nodes of the SaaS system to obtain standardized log data, and establish a centralized log aggregation index based on the standardized log data to obtain a queryable full system log;

[0008] An abnormal behavior report is obtained by inputting a preset multi-dimensional real-time analysis model according to the full system log, and a hierarchical storage strategy is planned for the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure;

[0009] Determine a data lineage relationship graph of the standardized log data based on the hierarchical query optimization structure, and determine a user operation mode based on the queryable full system log, abnormal behavior report, and data lineage relationship graph to obtain a user profile;

[0010] Based on the abnormal behavior report and user profile, dynamically allocate computing resources to obtain a resource scheduling strategy, and build a multi-cloud collaborative computing framework based on the resource scheduling strategy to obtain an elastic computing cluster;

[0011] The elastic computing cluster is monitored and fault detected in real time to obtain a cluster health status report. Based on the full system log, abnormal behavior report, user profile and cluster health status report, a multi-dimensional KPI indicator system is constructed to analyze and evaluate the SaaS system through the multi-dimensional KPI indicator system.

[0012] Optionally, in a first implementation of the first aspect of the present invention, performing distributed log collection and data preprocessing on the cloud computing nodes of the SaaS system to obtain standardized log data, and establishing a centralized log aggregation index based on the standardized log data to obtain a queryable full system log includes:

[0013] Deploy lightweight log collection agents on the cloud computing nodes of the SaaS system to collect multi-source heterogeneous log data and obtain the original log stream;

[0014] Performing timestamp normalization and field extraction on the original log stream to obtain structured log data, and storing the structured log data in a preset distributed log storage cluster;

[0015] Index construction and optimization are performed on the structured log data in the distributed log storage cluster to obtain a full-text search index, and a distributed query engine is implemented based on the full-text search index to obtain a full amount of system logs that can be queried.

[0016] Optionally, in a second implementation of the first aspect of the present invention, the inputting of a preset multi-dimensional real-time analysis model based on the full system log to obtain an abnormal behavior report, and performing a hierarchical storage strategy planning for the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure includes:

[0017] Perform time window segmentation and multi-dimensional feature extraction on the full system log to obtain a real-time feature vector stream, and apply a pre-trained multi-dimensional real-time analysis model to the real-time feature vector stream to perform event clustering and correlation analysis to obtain an abnormal event map;

[0018] According to the abnormal event map, priority sorting and severity assessment are performed in combination with predefined business rules to obtain an abnormal behavior report;

[0019] Performing data lifecycle analysis on the full system logs and abnormal behavior reports to obtain an access frequency attenuation curve, and performing hot and cold stratification and storage medium matching on the full system logs and abnormal behavior reports based on the access frequency attenuation curve to obtain a multi-level storage solution;

[0020] According to the multi-level storage solution, the full system logs and abnormal behavior reports are compressed, encoded and stored in blocks to obtain a data storage structure, and based on the data storage structure, a distributed index and cache strategy is constructed to obtain a hierarchical query optimization structure.

[0021] Optionally, in a third implementation of the first aspect of the present invention, determining the data lineage relationship graph of the standardized log data based on the hierarchical query optimization structure, and determining the user operation mode based on the queryable full system log, abnormal behavior report, and data lineage relationship graph to obtain the user profile includes:

[0022] Applying a graph traversal algorithm to the hierarchical query optimization structure to trace the data flow path to obtain initial data dependency relationships, and performing topological sorting and cycle detection on the initial data dependency relationships to obtain a data lineage relationship graph of the standardized log data;

[0023] Performing session identification and behavior serialization processing on the full system log to obtain user operation time series data, and applying a sequence pattern mining algorithm based on the user operation time series data and abnormal behavior reports to obtain an initial user operation pattern;

[0024] Performing correlation analysis on the initial user operation pattern and the data lineage relationship graph to identify key data nodes and operation paths to obtain enhanced user operation patterns, constructing user behavior feature vectors based on the enhanced user operation patterns, and applying an unsupervised clustering algorithm to obtain user grouping results;

[0025] Perform multi-dimensional feature extraction and weight calculation on the user clustering results to obtain a user tag set, and apply a collaborative filtering algorithm based on the user tag set and historical interaction data to obtain an initial user profile;

[0026] Apply a time series analysis method to the initial user profile to identify user behavior trends and periodic patterns to obtain a user profile.

[0027] Optionally, in a fourth implementation of the first aspect of the present invention, dynamically allocating computing resources based on the abnormal behavior report and user profile to obtain a resource scheduling strategy, and constructing a multi-cloud collaborative computing framework based on the resource scheduling strategy to obtain an elastic computing cluster includes:

[0028] Based on the abnormal behavior report and user profile, a multi-dimensional prediction of the future load of the SaaS system is performed to obtain a resource demand prediction result;

[0029] Performing performance evaluation and utilization analysis on the existing computing resources of the SaaS system to obtain a resource status matrix, and applying a multi-objective optimization algorithm based on the resource status matrix and resource demand forecast results to perform resource allocation calculations and obtain a resource scheduling strategy;

[0030] According to the resource scheduling strategy, a distributed consistency protocol is applied to the SaaS system to build a cross-cloud resource collaboration mechanism to obtain a multi-cloud collaborative computing framework;

[0031] According to the multi-cloud collaborative computing framework, computing tasks are intelligently scheduled and load balanced to obtain an initial elastic computing cluster. A fault tolerance mechanism and an automatic expansion and contraction strategy are applied to the initial elastic computing cluster to perform real-time resource adjustment to obtain an elastic computing cluster.

[0032] Optionally, in a fifth implementation of the first aspect of the present invention, the performing of performance evaluation and utilization analysis on existing computing resources to obtain a resource status matrix, and applying a multi-objective optimization algorithm based on the resource status matrix and resource demand prediction results to perform resource allocation calculations to obtain a resource scheduling strategy includes:

[0033] Conduct multi-dimensional testing on existing computing resources to obtain a set of resource performance indicators, and construct a dynamic resource utilization curve based on the resource performance indicator set and historical load data;

[0034] Applying a time series decomposition algorithm to the dynamic resource utilization curve to extract trends, cycles, and random components from the dynamic resource utilization curve to obtain a resource utilization pattern, and constructing a multidimensional resource state vector based on the resource utilization pattern and a set of resource performance indicators to obtain a resource state matrix;

[0035] Performing a difference analysis on the resource status matrix and the resource demand forecast results to identify areas of resource surplus and shortage, obtaining a resource balance demand graph, and constructing a multi-objective optimization problem model based on the resource balance demand graph to obtain an optimization problem expression;

[0036] An improved genetic algorithm is applied to the optimization problem expression to perform multi-generation iterative optimization calculations to obtain a Pareto optimal solution set, and a resource scheduling strategy is generated based on the Pareto optimal solution set in combination with preset decision rules.

[0037] Optionally, in a sixth implementation of the first aspect of the present invention, real-time monitoring and fault detection are performed on the elastic computing cluster to obtain a cluster health status report, and a multi-dimensional KPI indicator system is constructed based on the full system log, abnormal behavior report, user profile, and cluster health status report. Analyzing and evaluating the SaaS system using the multi-dimensional KPI indicator system includes:

[0038] Deploy distributed probes on the elastic computing cluster to collect real-time performance indicators and resource utilization data to obtain raw monitoring data streams. Apply anomaly detection algorithms and fault diagnosis rules based on the raw monitoring data streams to perform real-time fault identification and location, and obtain a cluster health status report.

[0039] Perform data fusion and feature extraction on the full system logs, abnormal behavior reports, user portraits, and cluster health status reports to obtain a multi-source heterogeneous data feature set. Based on the multi-source heterogeneous data feature set, apply the analytic hierarchy process and Delphi method to construct a multi-level KPI indicator system;

[0040] Applying the Monte Carlo simulation method to the multi-level KPI indicator system, conducting large-scale data sampling and indicator sensitivity analysis, obtaining KPI fluctuation ranges and thresholds, and constructing an adaptive KPI evaluation benchmark based on the KPI fluctuation ranges and thresholds in combination with historical data;

[0041] The adaptive KPI evaluation benchmark is applied to the real-time operation data of the SaaS system to conduct multi-dimensional performance evaluation and health analysis to obtain a comprehensive system score.

[0042] A second aspect of the present invention provides a cloud computing analysis device for a SaaS system, the cloud computing analysis device for a SaaS system comprising:

[0043] The log processing module is used to perform distributed log collection and data preprocessing on the cloud computing nodes of the SaaS system to obtain standardized log data, and to establish a centralized log aggregation index based on the standardized log data to obtain a queryable full system log;

[0044] A query structure building module is used to obtain an abnormal behavior report based on the full system log input of a preset multi-dimensional real-time analysis model, and to plan a hierarchical storage strategy for the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure;

[0045] a graph structure construction module for determining a data lineage relationship graph of the standardized log data based on the hierarchical query optimization structure, and determining user operation patterns based on the queryable full system logs, abnormal behavior reports, and the data lineage relationship graph to obtain a user profile;

[0046] A computing cluster construction module is used to dynamically allocate computing resources based on the abnormal behavior report and user profile, obtain a resource scheduling strategy, and build a multi-cloud collaborative computing framework based on the resource scheduling strategy to obtain an elastic computing cluster;

[0047] An analysis and evaluation module is used to perform real-time monitoring and fault detection on the elastic computing cluster, obtain a cluster health status report, and build a multi-dimensional KPI indicator system based on the full system log, abnormal behavior report, user profile and cluster health status report, and analyze and evaluate the SaaS system through the multi-dimensional KPI indicator system.

[0048] A third aspect of the present invention provides a cloud computing analysis device for a SaaS system, comprising: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; the at least one processor calls the instructions in the memory so that the cloud computing analysis device of the SaaS system executes the steps of the above-mentioned cloud computing analysis method for the SaaS system.

[0049] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored therein, which, when executed on a computer, enables the computer to execute the steps of the above-mentioned cloud computing analysis method for the SaaS system.

[0050] The cloud computing analysis method, device, equipment and storage medium of the above-mentioned SaaS system generates standardized log data by performing distributed log collection and preprocessing on cloud computing nodes, and establishes a centralized log aggregation index to obtain the full system log. The full system log is input into the real-time analysis model to generate an abnormal behavior report, and a hierarchical storage strategy is planned for the logs and reports to form a query structure. Based on this structure, a data lineage relationship diagram is determined to generate a user profile. Based on the abnormal behavior report and user profile, computing resource allocation is planned, a multi-cloud collaborative elastic computing cluster is constructed, and real-time monitoring and fault detection are performed on it to generate a cluster health status report. The system is analyzed and evaluated through a multi-dimensional indicator system. This method improves the performance and efficiency of the system through distributed log collection, multi-dimensional real-time analysis, dynamic resource scheduling and the construction of a multi-dimensional indicator system.

[0051] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or understood by practicing the present invention. The purposes and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0052] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of a first embodiment of a cloud computing analysis method for a SaaS system according to an embodiment of the present invention;

[0054] Figure 2 A schematic diagram of an embodiment of a cloud computing analysis device for a SaaS system according to an embodiment of the present invention;

[0055] Figure 3 Schematic diagram of an embodiment of a cloud computing analysis device of a SaaS system in an embodiment of the present invention. DETAILED DESCRIPTION

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0057] The terms "including," "having," and any variations thereof, as used in the embodiments of the present invention are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to the process, method, product, or device.

[0058] To facilitate understanding of this embodiment, a cloud computing analysis method for a SaaS system disclosed in an embodiment of the present invention is first introduced in detail. Figure 1 As shown, this method includes the following steps:

[0059] 101. Perform distributed log collection and data preprocessing on the cloud computing nodes of the SaaS system to obtain standardized log data, and establish a centralized log aggregation index based on the standardized log data to obtain a queryable full system log;

[0060] In one embodiment of the present invention, the distributed log collection and data preprocessing of the cloud computing nodes of the SaaS system to obtain standardized log data, and the establishment of a centralized log aggregation index based on the standardized log data to obtain a queryable full system log includes: deploying a lightweight log collection agent on the cloud computing nodes of the SaaS system to collect multi-source heterogeneous log data to obtain an original log stream; performing timestamp normalization and field extraction on the original log stream to obtain structured log data, and storing the structured log data in a preset distributed log storage cluster; indexing and optimizing the structured log data in the distributed log storage cluster to obtain a full-text retrieval index, and implementing a distributed query engine based on the full-text retrieval index to obtain a queryable full system log.

[0061] Specifically, a lightweight log collection agent is first deployed on each cloud computing node in the SaaS system. These agents are typically customized based on open-source tools such as Filebeat or Fluentd to accommodate different types of log sources. The agent is configured to listen to specific log files or data streams and can recognize a variety of log formats, including application server logs, database logs, and network device logs. During the collection process, the agent reads newly generated log entries in real time and packages them into small data packets to reduce network transmission burden. After receiving the raw log stream, the system performs preliminary preprocessing. The first step is timestamp normalization, which involves converting timestamps in different formats to a standard UTC time format to ensure that all log entries are temporally comparable and sortable. Next, field extraction is performed, using predefined regular expressions or parsing rules to extract key information from the unstructured log text, such as user ID, operation type, and IP address. This step converts the raw logs into a structured data format, typically JSON or a similar key-value pair structure. The structured log data is then transferred to a pre-configured distributed log storage cluster. This cluster is typically built on Elasticsearch or a similar distributed storage system for high availability and scalability. Data is automatically sharded and replicated during the write process to ensure data integrity and fast access. The storage cluster also implements data lifecycle management strategies, such as regularly archiving cold data to low-cost storage, to balance performance and cost. Structured log data stored in the cluster then enters the index building and optimization phase. The system creates an inverted index for each field, supporting full-text search and field-level queries. Various optimization techniques, such as index compression, text analyzer selection, and stop word filtering, are applied during the indexing process to improve search efficiency. Furthermore, a multi-level caching mechanism, including node-level and cluster-level caching, is established to accelerate access to hot data. Based on the optimized full-text search index, the system further implements a distributed query engine. This engine parses complex query statements and converts them into distributed execution plans. The query process leverages the characteristics of the index to quickly locate relevant data and execute it in parallel across multiple nodes. The query engine also implements intelligent result aggregation, performing preliminary aggregation on data nodes to reduce the amount of data transmitted over the network. Furthermore, the query engine integrates caching mechanisms and result reuse strategies to further improve query performance. To support large-scale concurrent queries, the query engine employs load balancing and request routing mechanisms. Incoming query requests are dynamically distributed to less-loaded nodes in the cluster. Furthermore, the query engine implements a query optimizer that automatically selects the optimal query plan based on data distribution and query patterns. For complex analytical queries, the system employs a phased execution strategy, quickly returning partial results before continuing to process them in the background, gradually refining the query results.

[0062] 102. Obtain abnormal behavior reports based on the preset multi-dimensional real-time analysis model inputted from the full system logs. A tiered storage strategy is then planned for the full system logs and abnormal behavior reports to obtain a tiered query optimization structure.

[0063] In one embodiment of the present invention, the abnormal behavior report is obtained by inputting a preset multi-dimensional real-time analysis model according to the full system log, and a hierarchical storage strategy is planned for the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure, including: time window segmentation and multi-dimensional feature extraction of the full system log to obtain a real-time feature vector stream, and applying a pre-trained multi-dimensional real-time analysis model to the real-time feature vector stream to perform event clustering and correlation analysis to obtain an abnormal event map; according to the abnormal event map, priority sorting and severity assessment are performed in combination with predefined business rules to obtain an abnormal behavior report; data lifecycle analysis is performed on the full system log and the abnormal behavior report to obtain an access frequency attenuation curve, and according to the access frequency attenuation curve, the full system log and the abnormal behavior report are subjected to cold and hot stratification and storage medium matching to obtain a multi-level storage solution; according to the multi-level storage solution, the full system log and the abnormal behavior report are compressed and encoded and stored in blocks to obtain a data storage structure, and according to the data storage structure, a distributed index and cache strategy are constructed to obtain a hierarchical query optimization structure.

[0064] Specifically, the system first performs time window segmentation and multi-dimensional feature extraction on the entire system log. The system first segments the continuous log stream into discrete time windows according to predefined time intervals (such as 5 minutes or 1 hour). For the log data within each time window, the system applies a series of feature extraction algorithms, including but not limited to statistical features (such as log volume and error rate), text features (such as keyword frequency and semantic vectors), and performance metrics (such as response time and resource utilization). These features are combined into high-dimensional vectors, forming a real-time feature vector stream. The system then inputs this real-time feature vector stream into a pre-trained multi-dimensional real-time analysis model. This model is typically based on deep learning architectures such as long short-term memory networks (LSTMs) or variational autoencoders (VAEs), which can capture complex patterns in time series data. When processing the feature vectors, the model considers both the data in the current time window and historical data to identify anomalous patterns. The anomaly score output by the model triggers an event clustering algorithm, such as DBSCAN or hierarchical clustering, to group similar anomalous events together. Next, the system applies association analysis algorithms, such as frequent pattern mining or causal reasoning, to explore potential connections between different abnormal events. This process ultimately generates an abnormal event graph, where nodes represent abnormal events and edges represent the relationships between events. After generating the abnormal event graph, the system evaluates the events in the graph based on predefined business rules. These rules, typically developed by domain experts, include definitions of severity for different types of anomalies and criteria for assessing business impact. The system uses these rules to calculate a priority score and severity level for each abnormal event. The evaluation also considers factors such as the duration of the anomaly, the scope of impact, and connectivity within the graph. Finally, the system generates a structured abnormal behavior report containing detailed information, priority, severity, and recommended actions for each abnormal event. Next, the system performs data lifecycle analysis on all system logs and abnormal behavior reports. This step involves analyzing historical data access patterns and calculating data access frequency over different time periods. Through statistical analysis of large amounts of historical data, the system develops an access frequency decay curve, which describes the changing probability of data being accessed over time. Based on this curve, the system formulates a hot and cold tiered storage strategy. Typically, recent and frequently accessed data (hot data) is stored on high-performance storage devices such as solid-state drives (SSDs) or memory. Older and less frequently accessed data (warm data) may be stored on standard hard drives. Infrequently accessed historical data (cold data) may be archived to low-cost object storage or tape libraries. The system compresses and encodes all system logs and abnormal behavior reports and stores them in blocks based on a multi-tiered storage solution. For hot data, the system can use lightweight compression algorithms such as LZ4 or Snappy to save storage space while maintaining fast decompression speeds.For cold data, algorithms with higher compression ratios, such as GZIP or LZMA, can be used. The data is divided into fixed-size blocks, and each block is attached with metadata information, including the time range, the type of events contained, etc. This block partitioning strategy facilitates parallel processing and quick location of data for a specific time period. Finally, the system builds a distributed index and cache strategy based on this data storage structure. The index structure adopts a multi-level design, including block-level index, time index, and event type index. These indexes are distributed on different nodes in the cluster, and load balancing is ensured through algorithms such as consistent hashing. The system also implements an intelligent caching strategy to cache frequently accessed data blocks and index information in memory. The cache strategy will be adjusted dynamically to optimize the cache content based on real-time access patterns and system load conditions.

[0065] 103. Determine the data lineage relationship diagram of standardized log data based on the hierarchical query optimization structure, and determine user operation patterns based on the queryable full system logs, abnormal behavior reports, and data lineage relationship diagram to obtain user profiles;

[0066] In one embodiment of the present invention, the data lineage relationship graph of the standardized log data is determined based on the hierarchical query optimization structure, and the user operation mode is determined based on the queryable full system log, abnormal behavior report and data lineage relationship graph, and the user portrait is obtained, which includes: applying a graph traversal algorithm to the hierarchical query optimization structure, tracing the data flow path, obtaining the initial data dependency relationship, and performing topological sorting and loop detection on the initial data dependency relationship to obtain the data lineage relationship graph of the standardized log data; performing session identification and behavior serialization processing on the full system log to obtain user operation time series data, and performing According to the report, a sequential pattern mining algorithm is applied to obtain the initial user operation pattern; the initial user operation pattern and the data lineage relationship diagram are associated with an analysis to identify key data nodes and operation paths to obtain an enhanced user operation pattern, and a user behavior feature vector is constructed based on the enhanced user operation pattern, and an unsupervised clustering algorithm is applied to obtain a user grouping result; multi-dimensional feature extraction and weight calculation are performed on the user grouping result to obtain a user tag set, and a collaborative filtering algorithm is applied based on the user tag set and historical interaction data to obtain an initial user portrait; a time series analysis method is applied to the initial user portrait to identify user behavior trends and periodic patterns to obtain a user portrait.

[0067] Specifically, the system first determines a data lineage graph for standardized log data based on a hierarchical query optimization structure. The system then applies graph traversal algorithms, such as depth-first search (DFS) or breadth-first search (BFS), to the hierarchical query optimization structure to trace the data's flow path through the system. This process involves analyzing the log data's sources, transformations, and storage locations to construct initial data dependencies. The system then topologically sorts these initial dependencies to ensure sequential data processing and performs loop detection to identify potential data cycles. Through these steps, the system ultimately generates a complete data lineage graph that clearly illustrates the dependencies and flow relationships between data. Next, the system identifies user operation patterns based on the queryable full system logs, abnormal behavior reports, and the newly generated data lineage graph. First, the system performs session identification on the full system logs, dividing user operation sessions by setting time thresholds or using specific session identifiers. Within each session, the system chronologically arranges user operations to form a behavior sequence, thereby generating time series data of user operations. The system then combines this time series data with abnormal behavior reports and applies sequential pattern mining algorithms, such as PrefixSpan or SPADE, to discover frequently occurring operation patterns and unusual operation sequences, thereby deriving initial user operation patterns. The system further performs correlation analysis between the initial user operation patterns and the data lineage graph. This step involves mapping user operation sequences onto the data lineage graph, identifying key data nodes involved in user operations and common operation paths. This allows the system to understand the impact of user operations on data flows and the correlations between different operations, thereby deriving enhanced user operation patterns. Based on this enhanced user operation pattern, the system constructs user behavior feature vectors, which contain information such as user operation frequency, operation sequence, and accessed data nodes. The system then applies unsupervised clustering algorithms, such as K-means or DBSCAN, to cluster these feature vectors and generate user clustering results. For the resulting user clustering results, the system performs multi-dimensional feature extraction and weight calculation. This process involves analyzing the unique characteristics of each user group, such as frequently used functions, operation habits, and data access patterns, and assigning weights to these features. This process results in a set of descriptive user labels. The system then combines these user tag sets with historical interaction data and applies collaborative filtering algorithms, such as user-based or item-based, to generate an initial user profile. This initial user profile captures the user's preferences, behavior patterns, and potential interests. Finally, the system applies time series analysis methods, such as the Autoregressive Integrated Moving Average (ARIMA) model or Prophet, to the initial user profile to identify long-term trends and cyclical patterns in user behavior.This step captures how user behavior changes over time, including seasonal patterns, differences between weekdays and weekends, and long-term behavioral evolution. By integrating information from these time dimensions, the system ultimately creates a comprehensive and dynamic user profile.

[0068] 104. Based on abnormal behavior reports and user profiles, dynamically allocate computing resources and obtain resource scheduling strategies. Based on these strategies, a multi-cloud collaborative computing framework is constructed to obtain elastic computing clusters.

[0069] In one embodiment of the present invention, the dynamic allocation planning of computing resources is performed according to the abnormal behavior report and user portrait to obtain a resource scheduling strategy, and a multi-cloud collaborative computing framework is constructed based on the resource scheduling strategy to obtain an elastic computing cluster, including: performing multi-dimensional prediction of the future load of the SaaS system based on the abnormal behavior report and user portrait to obtain a resource demand prediction result; performing performance evaluation and utilization analysis on the existing computing resources of the SaaS system to obtain a resource status matrix, and applying a multi-objective optimization algorithm to perform resource allocation calculation based on the resource status matrix and resource demand prediction results to obtain a resource scheduling strategy; applying a distributed consistency protocol to the SaaS system based on the resource scheduling strategy to construct a cross-cloud resource collaboration mechanism to obtain a multi-cloud collaborative computing framework; based on the multi-cloud collaborative computing framework, intelligent scheduling and load balancing of computing tasks are performed to obtain an initial elastic computing cluster, and applying a fault tolerance mechanism and automatic scaling strategy to the initial elastic computing cluster to perform real-time resource adjustment to obtain an elastic computing cluster.

[0070] Specifically, the system first conducts in-depth analysis of abnormal behavior reports and user profiles to predict the future load of the SaaS system. The system first performs time series analysis on abnormal behavior reports to identify the occurrence patterns and periodicity of abnormal events. It then combines behavioral trend information from user profiles to build a multi-dimensional predictive model. This model can utilize machine learning algorithms such as LSTM (Long Short-Term Memory) or ARIMA (Autoregressive Integrated Moving Average) to factor in historical load data, user activity, and peak business periods to generate resource demand forecasts for the next period (e.g., the next 24 hours or a week). The forecasts include multiple dimensions such as CPU usage, memory usage, and network bandwidth requirements. The system then conducts a comprehensive performance evaluation and utilization analysis of the SaaS platform's existing computing resources to generate a resource status matrix. This matrix contains information such as the current performance metrics, historical utilization data, and available capacity for each computing node. The system combines the resource status matrix with the previously generated resource demand forecasts and applies a multi-objective optimization algorithm (such as genetic algorithm or particle swarm optimization) to perform resource allocation calculations. Optimization objectives typically include maximizing resource utilization, minimizing energy consumption, and balancing load distribution. The output of this process is a detailed resource scheduling policy that specifies how computing resources will be dynamically allocated and adjusted over future time periods. Based on this resource scheduling policy, the system begins building a multi-cloud collaborative computing framework. This process first involves abstracting and encapsulating resources from different cloud platforms (such as public, private, and hybrid cloud environments) to create a standardized resource pool. The system then applies a distributed consensus protocol, such as Raft or Paxos, to ensure consistent resource management and task scheduling across the multi-cloud environment. This protocol ensures that even in the event of network partitions or partial node failures, the entire system maintains consistent resource allocation and task execution status. In this way, the system establishes a cross-cloud resource coordination mechanism that uniformly manages and schedules computing resources distributed across different cloud platforms. Building on this multi-cloud collaborative computing framework, the system implements intelligent task scheduling and load balancing strategies. The scheduling algorithm considers multiple factors, including task priority, resource requirements, data location, and network latency, to allocate computing tasks to the most appropriate resource nodes. The load balancing mechanism monitors the load of each node in real time and dynamically adjusts task allocation to avoid local overload or idle resources. This process forms an initial elastic computing cluster that automatically adjusts computing resource allocation based on workload changes. To further enhance system reliability and adaptability, fault tolerance mechanisms and automatic scaling policies are applied to this initial elastic computing cluster. These fault tolerance mechanisms include real-time monitoring, fault detection, and automatic recovery. They enable rapid task redistribution in the event of node failure or network outage, ensuring service continuity. The automatic scaling policy dynamically adds or removes computing nodes based on real-time load conditions and predefined rules.For example, when the system detects a continuous increase in load, it automatically launches new compute instances; when the load decreases, it shuts down redundant nodes to save costs. This process is continuous and dynamic, with the system constantly evaluating current resource utilization and making real-time adjustments based on pre-set performance indicators and cost targets.

[0071] Furthermore, the performance evaluation and utilization analysis of existing computing resources are performed to obtain a resource status matrix, and a multi-objective optimization algorithm is applied based on the resource status matrix and resource demand prediction results to perform resource allocation calculations to obtain a resource scheduling strategy, including: performing multi-dimensional testing on existing computing resources to obtain a resource performance indicator set, and constructing a dynamic resource utilization curve based on the resource performance indicator set and historical load data; applying a time series decomposition algorithm to the dynamic resource utilization curve to extract trends, cycles and random components in the dynamic resource utilization curve to obtain a resource utilization pattern, and constructing a multi-dimensional resource status vector based on the resource utilization pattern and the resource performance indicator set to obtain a resource status matrix; performing difference analysis on the resource status matrix and resource demand prediction results to identify resource surplus and shortage areas to obtain a resource balance demand graph, and constructing a multi-objective optimization problem model based on the resource balance demand graph to obtain an optimization problem expression; applying an improved genetic algorithm to the optimization problem expression to perform multi-generation iterative optimization calculations to obtain a Pareto optimal solution set, and generating a resource scheduling strategy based on the Pareto optimal solution set in combination with preset decision rules.

[0072] Specifically, existing computing resources are first comprehensively tested across multiple dimensions. This testing process evaluates key metrics such as CPU performance, memory read / write speeds, storage I / O capabilities, and network throughput. Testing methods include running standardized benchmarks such as LINPACK for CPU testing, STREAM for memory testing, Iozone for storage testing, and Netperf for network performance testing. These test results are aggregated into a comprehensive set of resource performance metrics. Next, the system combines this set of resource performance metrics with historical load data to construct a dynamic resource utilization curve. Historical load data typically comes from system monitoring tools and contains information on resource usage over a period of time (such as several months or a year). The system uses time series analysis techniques, such as moving averages or exponential smoothing, to correlate historical data with current performance metrics, generating a curve that reflects dynamic resource usage. The resulting dynamic resource utilization curve is then applied to time series decomposition algorithms, such as STL (Seasonal and Trend Decomposition Using Loess) or X-12-ARIMA. These algorithms can decompose time series data into trend, cyclical, and random components. The trend component reflects the long-term direction of resource usage changes, the cyclical component reveals periodic patterns in resource usage (such as daily, weekly, or monthly patterns), and the random component represents unpredictable fluctuations. By analyzing these components, the system obtains detailed resource utilization patterns. The system then combines these patterns with a previously acquired set of resource performance indicators to construct a multidimensional resource state vector. This vector not only contains current resource performance data but also incorporates historical patterns and forecasted trends in resource usage. By applying this process to all computing resources, the system ultimately generates a comprehensive resource state matrix that provides a real-time snapshot of the entire computing environment and a forecast of future trends. Next, the system performs a difference analysis between the resource state matrix and the previously generated resource demand forecast. This process involves comparing the predicted resource demand with the currently available resources to identify areas of excess and shortage resources. The analysis results are visualized as a resource balance demand graph, which clearly shows which resource types need to be increased or decreased, and when and where. Based on the resource balance demand graph, the system constructs a multi-objective optimization problem model. This model considers multiple objectives, such as maximizing resource utilization, minimizing energy consumption, and ensuring quality of service. Each objective is expressed as a mathematical function and assigned a corresponding weight. The model also incorporates various constraints, such as total resource capacity and service-level agreement (SLA) requirements. These objectives and constraints together form a complex optimization problem. To solve this multi-objective optimization problem, the system applies a modified genetic algorithm. This algorithm mimics the biological evolution process, searching for the optimal solution through multiple generations of iterations.In each generation, the algorithm generates multiple candidate solutions (i.e., different resource allocation schemes), evaluates their fitness (i.e., the degree to which they meet various objectives), and then generates the next generation of solutions through selection, crossover, and mutation. This process repeats until the preset number of iterations is reached or a termination condition is met. After multiple generations of iterative optimization calculations, the algorithm ultimately generates a set of Pareto-optimal solutions. A Pareto-optimal solution is one in which improving the performance of any objective necessarily leads to a decrease in the performance of at least one other objective. This set of solutions provides a range of options that balance different objectives. Finally, the system selects the final solution from the Pareto-optimal set based on pre-defined decision rules. These decision rules may take into account current business priorities, cost constraints, performance requirements, and other factors. For example, during periods of resource constraints, the system may prefer a solution that prioritizes resource utilization; during periods of critical performance, it may choose a solution that prioritizes quality of service. By applying these rules, the system ultimately generates a specific resource scheduling policy.

[0073] 105. Conduct real-time monitoring and fault detection on the elastic computing cluster to obtain a cluster health status report. Based on the full system log, abnormal behavior reports, user portraits and cluster health status reports, a multi-dimensional KPI indicator system is constructed to analyze and evaluate the SaaS system.

[0074] In one embodiment of the present invention, the elastic computing cluster is monitored and fault detected in real time to obtain a cluster health status report, and a multi-dimensional KPI indicator system is constructed based on the full system log, abnormal behavior report, user portrait and cluster health status report. The analysis and evaluation of the SaaS system through the multi-dimensional KPI indicator system includes: deploying distributed probes on the elastic computing cluster, collecting real-time performance indicators and resource utilization data, obtaining original monitoring data streams, and applying anomaly detection algorithms and fault diagnosis rules based on the original monitoring data streams to perform real-time fault identification and location to obtain a cluster health status report; the full system log, Data fusion and feature extraction are performed on abnormal behavior reports, user portraits, and cluster health status reports to obtain a multi-source heterogeneous data feature set. Based on the multi-source heterogeneous data feature set, the hierarchical analysis method and the Delphi method are applied to construct a multi-level KPI indicator system. The Monte Carlo simulation method is applied to the multi-level KPI indicator system to conduct large-scale data sampling and indicator sensitivity analysis to obtain the KPI fluctuation range and threshold. Based on the KPI fluctuation range and threshold, combined with historical data, an adaptive KPI evaluation benchmark is constructed. The adaptive KPI evaluation benchmark is applied to the real-time operation data of the SaaS system to conduct multi-dimensional performance evaluation and health analysis to obtain a comprehensive system score.

[0075] Specifically, a comprehensive distributed probe deployment is first implemented across the elastic computing cluster. These probes are lightweight monitoring agents installed on every node in the cluster, continuously collecting various real-time performance metrics and resource utilization data. Collected data includes key indicators such as CPU usage, memory usage, disk I / O, network throughput, and process status. These probes are configured to collect data at a high frequency (e.g., every second or every minute) and transmit the data in real time to a central monitoring system, generating a raw monitoring data stream. The system then applies a series of anomaly detection algorithms and predefined fault diagnosis rules to this raw monitoring data stream. Anomaly detection algorithms can include statistical methods (such as Z-score or Interquartile Range) and machine learning methods (such as Isolation Forest or One-Class Support Vector Machine). These algorithms identify data points that deviate from normal patterns. The system also applies a complex set of fault diagnosis rules, developed based on domain expert knowledge and historical fault data, to correlate detected anomalies with specific types of system failures. This process enables the system to identify potential failures in real time, pinpoint their location and type, and ultimately generate a detailed cluster health status report. Next, the system performs in-depth data fusion and feature extraction on the full set of system logs, abnormal behavior reports, user profiles, and the newly generated cluster health status report. This process involves unified processing and correlation analysis of data from different sources and formats. For example, error messages in system logs may be correlated with certain abnormal indicators in the cluster health status report, while usage patterns in user profiles may explain certain abnormal behaviors. Using complex data processing algorithms, such as feature engineering techniques and automatic feature extraction using deep learning, the system extracts a comprehensive set of features from this heterogeneous data. This feature set encompasses all aspects of system operation. Based on this multi-source, heterogeneous data feature set, the system applies the Analytic Hierarchy Process (AHP) and the Delphi method to construct a multi-level KPI indicator system. The AHP decomposes complex evaluation problems into a hierarchical structure and determines the relative importance of different indicators. The Delphi method continuously optimizes and adjusts the indicator system through multiple rounds of expert feedback. This process combines quantitative analysis with qualitative judgment to ensure that the KPI indicator system is both scientifically sound and reflects business needs. The resulting KPI indicator system includes multiple levels, including system-level indicators (such as service availability and response time), business-level indicators (such as transaction success rate and user activity), and strategic-level indicators (such as customer satisfaction and market share). To determine appropriate thresholds and evaluation criteria for these KPI indicators, the system uses Monte Carlo simulation methods to conduct large-scale data sampling and sensitivity analysis. This process involves generating a large amount of simulated data, which is based on the statistical properties of historical data but incorporates a variety of possible variations.By analyzing this simulated data, the system understands the range and sensitivity of each KPI under different conditions. These analysis results are used to determine the normal fluctuation range and warning threshold for each KPI. Combining these simulated KPI fluctuation ranges and thresholds with the system's actual historical operating data, the system constructs an adaptive KPI evaluation benchmark. This benchmark is not static but dynamically adapts to the actual system operation. For example, during peak business periods, the acceptable ranges for certain performance indicators may be relaxed; during sensitive periods, security-related indicators may be subject to stricter standards. Finally, the system applies this adaptive KPI evaluation benchmark to the real-time operating data of the SaaS system to conduct a multi-dimensional performance evaluation and health analysis. This process involves calculating the current value of each KPI in real time, comparing it to the evaluation benchmark, and comprehensively considering the importance and interrelationships of each indicator. The system not only evaluates the performance of individual indicators but also analyzes the correlations and combined impacts between indicators. For example, a slight decrease in certain performance indicators may be a normal result of an increase in user volume and does not necessarily indicate a deterioration in system health.

[0076] In this embodiment, by performing distributed log collection and preprocessing on cloud computing nodes, standardized log data is generated, and a centralized log aggregation index is established to obtain the full system log. The full system log is input into the real-time analysis model to generate an abnormal behavior report, and a hierarchical storage strategy is planned for the logs and reports to form a query structure. Based on this structure, a data lineage relationship graph is determined to generate a user profile. Based on the abnormal behavior report and user profile, the allocation of computing resources is planned, a multi-cloud collaborative elastic computing cluster is constructed, and real-time monitoring and fault detection are performed on it to generate a cluster health status report. The system is analyzed and evaluated through a multi-dimensional indicator system. This method improves the performance and efficiency of the system through distributed log collection, multi-dimensional real-time analysis, dynamic resource scheduling, and the construction of a multi-dimensional indicator system.

[0077] The above describes the cloud computing analysis method of the SaaS system in the embodiment of the present invention. The following describes the cloud computing analysis device of the SaaS system in the embodiment of the present invention. Figure 2 In one embodiment of the present invention, a cloud computing analysis device for a SaaS system includes:

[0078] Log processing module 201 is used to perform distributed log collection and data preprocessing on the cloud computing nodes of the SaaS system to obtain standardized log data, and to establish a centralized log aggregation index based on the standardized log data to obtain a queryable full system log;

[0079] A query structure building module 202 is configured to obtain an abnormal behavior report based on the full system log input into a preset multi-dimensional real-time analysis model, and perform a hierarchical storage strategy planning for the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure;

[0080] A graph structure construction module 203 is configured to determine a data lineage relationship graph of the standardized log data based on the hierarchical query optimization structure, and determine a user operation pattern based on the queryable full system logs, abnormal behavior reports, and the data lineage relationship graph to obtain a user profile;

[0081] A computing cluster construction module 204 is configured to dynamically allocate computing resources based on the abnormal behavior report and user profile, obtain a resource scheduling strategy, and construct a multi-cloud collaborative computing framework based on the resource scheduling strategy to obtain an elastic computing cluster.

[0082] The analysis and evaluation module 205 is used to perform real-time monitoring and fault detection on the elastic computing cluster, obtain a cluster health status report, and build a multi-dimensional KPI indicator system based on the full system log, abnormal behavior report, user profile and cluster health status report, and analyze and evaluate the SaaS system through the multi-dimensional KPI indicator system.

[0083] In an embodiment of the present invention, the cloud computing analysis device of the SaaS system runs the cloud computing analysis method of the SaaS system. The cloud computing analysis device of the SaaS system generates standardized log data by performing distributed log collection and preprocessing on cloud computing nodes, and establishes a centralized log aggregation index to obtain the full system log. The full system log is input into the real-time analysis model to generate an abnormal behavior report, and a hierarchical storage strategy is planned for the logs and reports to form a query structure. Based on this structure, a data lineage relationship diagram is determined to generate a user profile. Based on the abnormal behavior report and user profile, computing resource allocation is planned, a multi-cloud collaborative elastic computing cluster is constructed, and real-time monitoring and fault detection are performed on it to generate a cluster health status report. The system is analyzed and evaluated using a multi-dimensional indicator system. This method improves the performance and efficiency of the system through distributed log collection, multi-dimensional real-time analysis, dynamic resource scheduling, and the construction of a multi-dimensional indicator system.

[0084] above Figure 2 The cloud computing analysis device of the SaaS system in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The cloud computing analysis device of the SaaS system in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0085] Figure 3The diagram below is a schematic diagram of the structure of a cloud computing analysis device for a SaaS system, provided by an embodiment of the present invention. The cloud computing analysis device 300 for a SaaS system may vary significantly depending on configuration or performance. The device may include one or more central processing units (CPUs) 310 (e.g., one or more processors), memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) storing applications 333 or data 332. The memory 320 and storage media 330 may be either ephemeral or persistent storage. The program stored in the storage medium 330 may include one or more modules (not shown), each of which may include a series of instructions for operating on the SaaS system's cloud computing analysis device 300. Furthermore, the processor 310 may be configured to communicate with the storage medium 330, executing the instructions stored in the storage medium 330 on the SaaS system's cloud computing analysis device 300 to implement the steps of the aforementioned SaaS system's cloud computing analysis method.

[0086] The cloud computing analysis device 300 of the SaaS system may further include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input and output interfaces 360, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. It will be understood by those skilled in the art that Figure 3 The structure of the cloud computing analysis device of the SaaS system shown does not constitute a limitation on the cloud computing analysis device of the SaaS system provided by the present invention, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0087] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the steps of the cloud computing analysis method of the SaaS system.

[0088] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0089] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0090] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cloud computing analysis method for a SaaS system, characterized in that: The cloud computing analysis method of the SaaS system includes: A lightweight log collection agent is deployed on the cloud computing nodes of the SaaS system to collect multi-source heterogeneous log data to obtain the original log stream; the original log stream is timestamp normalized and field extracted to obtain standardized log data, and the standardized log data is stored in a preset distributed log storage cluster; the structured log data in the distributed log storage cluster is indexed and optimized to obtain a full-text search index, and a distributed query engine is implemented based on the full-text search index to obtain the full system log that can be queried; An abnormal behavior report is obtained by inputting a preset multi-dimensional real-time analysis model according to the full system log, and a hierarchical storage strategy is planned for the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure; Determine a data lineage relationship graph of the standardized log data based on the hierarchical query optimization structure, and determine a user operation mode based on the queryable full system log, abnormal behavior report, and data lineage relationship graph to obtain a user profile; Based on the abnormal behavior report and user portrait, a multi-dimensional prediction of the future load of the SaaS system is performed to obtain a resource demand prediction result; a multi-dimensional test of the existing computing resources is performed to obtain a resource performance indicator set, and a dynamic resource utilization curve is constructed based on the resource performance indicator set and historical load data; a time series decomposition algorithm is applied to the dynamic resource utilization curve to extract the trend, cycle and random components in the dynamic resource utilization curve to obtain a resource utilization pattern, and a multi-dimensional resource state vector is constructed based on the resource utilization pattern and the resource performance indicator set to obtain a resource state matrix; a difference analysis is performed on the resource state matrix and the resource demand prediction result to identify areas of resource surplus and shortage and obtain a resource balance demand diagram, And based on the resource balancing demand graph, a multi-objective optimization problem model is constructed to obtain an optimization problem expression; an improved genetic algorithm is applied to the optimization problem expression, and multi-generation iterative optimization calculations are performed to obtain a Pareto optimal solution set, and based on the Pareto optimal solution set, combined with preset decision rules, a resource scheduling strategy is generated; based on the resource scheduling strategy, a distributed consistency protocol is applied to the SaaS system, a cross-cloud resource collaboration mechanism is constructed, and a multi-cloud collaborative computing framework is obtained; based on the multi-cloud collaborative computing framework, computing tasks are intelligently scheduled and load balanced to obtain an initial elastic computing cluster, and a fault-tolerant mechanism and automatic scaling strategy are applied to the initial elastic computing cluster to perform real-time resource adjustment to obtain an elastic computing cluster; The elastic computing cluster is monitored and fault detected in real time to obtain a cluster health status report. Based on the full system log, abnormal behavior report, user profile and cluster health status report, a multi-dimensional KPI indicator system is constructed to analyze and evaluate the SaaS system through the multi-dimensional KPI indicator system.

2. The cloud computing analysis method of the SaaS system according to claim 1, characterized in that: The step of inputting a preset multi-dimensional real-time analysis model based on the full system log to obtain an abnormal behavior report, and performing a hierarchical storage strategy planning on the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure includes: Perform time window segmentation and multi-dimensional feature extraction on the full system log to obtain a real-time feature vector stream, and apply a pre-trained multi-dimensional real-time analysis model to the real-time feature vector stream to perform event clustering and correlation analysis to obtain an abnormal event map; According to the abnormal event map, priority sorting and severity assessment are performed in combination with predefined business rules to obtain an abnormal behavior report; Performing data lifecycle analysis on the full system logs and abnormal behavior reports to obtain an access frequency attenuation curve, and performing hot and cold stratification and storage medium matching on the full system logs and abnormal behavior reports based on the access frequency attenuation curve to obtain a multi-level storage solution; According to the multi-level storage solution, the full system logs and abnormal behavior reports are compressed, encoded and stored in blocks to obtain a data storage structure, and based on the data storage structure, a distributed index and cache strategy is constructed to obtain a hierarchical query optimization structure.

3. The cloud computing analysis method of the SaaS system according to claim 1, characterized in that: The step of determining the data lineage relationship graph of the standardized log data based on the hierarchical query optimization structure, and determining the user operation mode based on the queryable full system log, abnormal behavior report, and data lineage relationship graph to obtain the user profile includes: Applying a graph traversal algorithm to the hierarchical query optimization structure to trace the data flow path to obtain initial data dependency relationships, and performing topological sorting and cycle detection on the initial data dependency relationships to obtain a data lineage relationship graph of the standardized log data; Performing session identification and behavior serialization processing on the full system log to obtain user operation time series data, and applying a sequence pattern mining algorithm based on the user operation time series data and abnormal behavior reports to obtain an initial user operation pattern; Performing correlation analysis on the initial user operation pattern and the data lineage relationship graph to identify key data nodes and operation paths to obtain enhanced user operation patterns, constructing user behavior feature vectors based on the enhanced user operation patterns, and applying an unsupervised clustering algorithm to obtain user grouping results; Perform multi-dimensional feature extraction and weight calculation on the user clustering results to obtain a user tag set, and apply a collaborative filtering algorithm based on the user tag set and historical interaction data to obtain an initial user profile; Apply a time series analysis method to the initial user profile to identify user behavior trends and periodic patterns to obtain a user profile.

4. The cloud computing analysis method of the SaaS system according to claim 1, characterized in that: The real-time monitoring and fault detection of the elastic computing cluster are performed to obtain a cluster health status report, and a multi-dimensional KPI indicator system is constructed based on the full system log, abnormal behavior report, user profile and cluster health status report. The analysis and evaluation of the SaaS system using the multi-dimensional KPI indicator system includes: Deploy distributed probes on the elastic computing cluster to collect real-time performance indicators and resource utilization data to obtain raw monitoring data streams. Apply anomaly detection algorithms and fault diagnosis rules based on the raw monitoring data streams to perform real-time fault identification and location, and obtain a cluster health status report. Perform data fusion and feature extraction on the full system logs, abnormal behavior reports, user portraits, and cluster health status reports to obtain a multi-source heterogeneous data feature set. Based on the multi-source heterogeneous data feature set, apply the analytic hierarchy process and Delphi method to construct a multi-level KPI indicator system; Applying the Monte Carlo simulation method to the multi-level KPI indicator system, conducting large-scale data sampling and indicator sensitivity analysis, obtaining KPI fluctuation ranges and thresholds, and constructing an adaptive KPI evaluation benchmark based on the KPI fluctuation ranges and thresholds in combination with historical data; The adaptive KPI evaluation benchmark is applied to the real-time operation data of the SaaS system to conduct multi-dimensional performance evaluation and health analysis to obtain a comprehensive system score.

5. A cloud computing analysis device for a SaaS system, characterized in that: The cloud computing analysis device of the SaaS system includes: The log processing module is used to deploy a lightweight log collection agent on the cloud computing nodes of the SaaS system to collect multi-source heterogeneous log data to obtain the original log stream; perform timestamp normalization and field extraction on the original log stream to obtain standardized log data, and store the standardized log data in a preset distributed log storage cluster; index the structured log data in the distributed log storage cluster and optimize it to obtain a full-text search index, and implement a distributed query engine based on the full-text search index to obtain the full system log that can be queried; A query structure building module is used to obtain an abnormal behavior report based on the full system log input of a preset multi-dimensional real-time analysis model, and to plan a hierarchical storage strategy for the full system log and the abnormal behavior report to obtain a hierarchical query optimization structure; a graph structure construction module for determining a data lineage relationship graph of the standardized log data based on the hierarchical query optimization structure, and determining user operation patterns based on the queryable full system logs, abnormal behavior reports, and the data lineage relationship graph to obtain a user profile; The computing cluster construction module is used to perform multi-dimensional predictions on the future load of the SaaS system based on the abnormal behavior report and user portrait to obtain resource demand prediction results; perform multi-dimensional testing on existing computing resources to obtain a set of resource performance indicators, and construct a dynamic resource utilization curve based on the resource performance indicator set and historical load data; apply a time series decomposition algorithm to the dynamic resource utilization curve to extract trends, cycles and random components in the dynamic resource utilization curve to obtain a resource utilization pattern, and construct a multi-dimensional resource state vector based on the resource utilization pattern and resource performance indicator set to obtain a resource state matrix; perform difference analysis on the resource state matrix and resource demand prediction results to identify areas of resource surplus and shortage and obtain a resource balance demand diagram , and based on the resource balancing demand graph, construct a multi-objective optimization problem model to obtain an optimization problem expression; apply an improved genetic algorithm to the optimization problem expression, perform multi-generation iterative optimization calculations to obtain a Pareto optimal solution set, and generate a resource scheduling strategy based on the Pareto optimal solution set in combination with preset decision rules; based on the resource scheduling strategy, apply a distributed consistency protocol to the SaaS system, build a cross-cloud resource collaboration mechanism, and obtain a multi-cloud collaborative computing framework; based on the multi-cloud collaborative computing framework, perform intelligent scheduling and load balancing on computing tasks to obtain an initial elastic computing cluster, and apply a fault-tolerant mechanism and automatic expansion and contraction strategy to the initial elastic computing cluster to perform real-time resource adjustment to obtain an elastic computing cluster; An analysis and evaluation module is used to perform real-time monitoring and fault detection on the elastic computing cluster, obtain a cluster health status report, and build a multi-dimensional KPI indicator system based on the full system log, abnormal behavior report, user profile and cluster health status report, and analyze and evaluate the SaaS system through the multi-dimensional KPI indicator system.

6. A cloud computing analysis device for a SaaS system, characterized in that: The cloud computing analysis device of the SaaS system includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor calls the instructions in the memory to enable the cloud computing analysis device of the SaaS system to execute the steps of the cloud computing analysis method of the SaaS system according to any one of claims 1 to 4.

7. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the steps of the cloud computing analysis method of the SaaS system as described in any one of claims 1 to 4 are implemented.

Images