Commercial operation management system and method

Abstract

The invention relates to the technical field of commercial operation management, and particularly discloses a commercial operation management system and a commercial operation management method, which are characterized in that data traffic among key nodes such as a supply chain, a sales channel and customer feedback is monitored in real time through a network traffic acquisition tool, and the data traffic comprises transmission quantity, flow direction and interaction frequency; identifying abnormal interaction nodes by using time sequence analysis and a Gaussian mixture model; on the basis of the identified abnormal interaction nodes, cooperative failure points among the nodes are judged by analyzing operation frequencies and response time delays among the nodes, and a sliding window technology and a vector autoregression model are adopted to calculate a joint abnormal score; based on the cooperative failure point, quantifying the influence degree of the abnormal event among different nodes by constructing a dependency matrix and an initial abnormal event vector, and dividing the influence degree into general influence and serious influence according to a preset threshold value; and performing traceability analysis on upstream and downstream associated nodes and paths which severely influence the nodes, and identifying an abnormal propagation path.

Description

Technical Field

[0001] The present invention relates to the technical field of commercial operation management, and in particular to a commercial operation management system and method. Background Art

[0002] With the rapid development of globalization and information technology, modern business operations are becoming increasingly complex, involving multiple links and a large amount of data exchange. Key areas such as supply chain management, sales channel optimization and customer feedback processing all require efficient and reliable systems to ensure the smooth operation of the business. However, various abnormal events are often encountered during business operations, such as technical failures, human errors, supply chain problems, market changes and security incidents. These abnormal events will not only lead to data transmission interruptions and operational delays, but may also cause greater business risks and even cause significant economic losses.

[0003] Existing business operation management systems also have deficiencies in handling abnormal events. Although some systems can initially identify abnormal nodes, they are still insufficient in determining the failure points of collaboration between nodes, assessing the impact of abnormal events, and generating emergency response plans. Especially in the face of complex and changing market environments and technical challenges, these systems often fail to provide timely and accurate solutions, leaving companies in a passive position when responding to emergencies.

[0004] Therefore, there is an urgent need for a system that can manage business operations comprehensively, in real time and intelligently. The system should have the following characteristics: first, it should be able to monitor and analyze data traffic in the process of business operations in a multi-dimensional and all-round manner, and detect abnormal nodes in a timely manner; second, it should be able to accurately determine the collaborative failure points between nodes and the impact of abnormal events through advanced data analysis and machine learning algorithms; third, it should be able to automatically generate emergency response plans, allocate additional resources to affected nodes, and reduce the possibility of business interruptions. Summary of the invention

[0005] The object of the present invention is to provide a business operation management system and method to solve the above-mentioned problems.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A business operation management method comprises the following steps:

[0008] S1: Collect data traffic between nodes during business operations, including data transmission volume, flow direction, and interaction frequency, analyze data traffic peaks, fluctuation patterns, and abnormal transmission, and identify abnormal interaction nodes;

[0009] The nodes include: supply chain, sales channels and customer feedback;

[0010] S2: Based on abnormal interaction nodes, the cooperation failure points between nodes are determined by analyzing the operation frequency and response delay between nodes;

[0011] S3: Based on the collaborative failure point, since the impact of abnormal events on different nodes is different, the impact of abnormal events on the collaborative failure point is judged, and the impact is divided into general impact and severe impact according to the judgment result;

[0012] S4: Perform source analysis on the upstream and downstream associated nodes and paths of the severely affected nodes, identify abnormal propagation paths, allocate additional resources to the affected nodes based on the abnormal propagation paths, and automatically generate emergency response plans

[0013] As a further solution of the present invention: analyzing the traffic peak, fluctuation pattern and abnormal transmission of data traffic to identify abnormal interaction nodes specifically includes:

[0014] The transmission volume, flow direction and interaction frequency of the collected data are organized into a multidimensional feature vector of the time series, denoted as X = {x1, x2, ..., x n};

[0015] Each feature vector x i Represents the traffic characteristics in the i-th time window, denoted by x i =[d i , f i , σ i ];

[0016] Where i represents the number of time windows, d i represents the amount of data transmitted in the i-th window, f i represents the interaction frequency of data in the i-th window, σ i Indicates the fluctuation range of the data in the i-th window;

[0017] The data are standardized for different features to eliminate the impact of dimension;

[0018] Set the number of components k, where the component represents a Gaussian distribution;

[0019] Initialize the weight of each Gaussian distribution, set the initial value to uniform distribution, and the calculation expression is:

[0020]

[0021] In the formula, k represents the number of components, K represents the maximum number of components, and π k represents the weight of the Gaussian distribution of the kth component;

[0022] Initialize the mean of each Gaussian distribution. The initial value is randomly selected from the data. The calculation expression is:

[0023] μ k =X;

[0024] Initialize the covariance matrix of each Gaussian distribution. The initial value is the unit matrix. The calculation expression is:

[0025] Σ k =I;

[0026] In the formula, Σ k represents the covariance matrix of the kth component, and I represents the identity matrix;

[0027] For each feature vector x i , calculate the posterior probability belonging to the kth component, the calculation expression is:

[0028]

[0029] In the formula, γ ik represents the posterior probability of the kth component in the i-th time window, N(x i ∣μ k ,Σ k ) represents the probability density function of the kth component, and the calculation expression is:

[0030]

[0031] In the formula, g represents the dimension of the feature vector;

[0032] According to the posterior probability, the weight of the Gaussian distribution is updated, and the calculation expression is:

[0033]

[0034] In the formula, n represents the maximum number of time windows;

[0035] According to the posterior probability, update the mean of the Gaussian distribution, and the calculation expression is:

[0036]

[0037] According to the posterior probability, the covariance matrix of the Gaussian distribution is updated, and the calculation expression is:

[0038]

[0039] To update the weight, mean and covariance matrix of the final Gaussian distribution, recalculate the probability density function, and calculate the corresponding probability density for each eigenvector. The calculation expression is:

[0040]

[0041] In the formula, p(x i ) represents the feature vector x i The probability density of

[0042] Calculate the log-likelihood value of the probability density corresponding to each feature vector to obtain the anomaly score. The calculation expression is:

[0043] A(x i )=-log(p(x i ));

[0044] In the formula, A(x i ) represents the feature vector x i The anomaly score at

[0045] Determine the eigenvector x i The anomaly score A(x i ) is greater than or equal to a preset threshold. If so, it is recorded as an outlier. For the data flow of each node, the total number of outliers N is counted;

[0046] It is determined whether the total number N of abnormal points is greater than or equal to a preset threshold. If so, the corresponding node is marked as an abnormal interaction node.

[0047] As a further solution of the present invention: the abnormal interaction node determines the cooperation failure point between nodes by analyzing the operation frequency and response delay between nodes, specifically including:

[0048] Collect operation frequency f(t) and response delay t from commercial operations r (t) Two types of time series data;

[0049] Among them, the operation frequency f(t) represents the number of interactions between two nodes in the unit time window of time t;

[0050] Response delay t r (t) represents the average delay between two interacting nodes in time t;

[0051] Set a window size w and sliding step size Δt;

[0052] Among them, the window size w represents the time range covered by each calculation;

[0053] The sliding step size Δt represents the time interval of window movement;

[0054] For each sliding window, calculate the average operation frequency f(t m ), average response delay t r (t m ), Operation frequency variance and response delay variance

[0055] Where m represents the number of time points, m is a positive integer greater than 0, and t m represents the mth time point of the time series;

[0056] Create a multidimensional vector:

[0057] The expression is calculated by vector autoregression to represent the multi-dimensional vector, and the joint anomaly score is calculated based on the multi-feature residual calculation expression;

[0058] Wherein, the vector autoregression calculation expression is:

[0059]

[0060] In the formula, p represents the historical order, P represents the maximum historical order, Φ p represents the p-th order regression matrix, representing the time point t m The predicted value of the feature vector at t m-p represents the mpth time point of the time series, X(t m-p ) represents the tth m-p The feature vector of each time point;

[0061] Among them, the multi-feature residual calculation expression is:

[0062]

[0063] In the formula, S(t m ) represents the time point t m The joint anomaly score at X (t m ) represents the multi-feature residual vector, represents the transpose of the multi-feature residual vector, Σ -1 represents the inverse matrix of the residual covariance matrix;

[0064] For each abnormal interaction node, calculate the joint anomaly score of the corresponding node, and compare the joint anomaly score of each node with the preset threshold;

[0065] If the joint anomaly score is greater than or equal to the preset threshold, the corresponding node is a collaborative failure point.

[0066] As a further solution of the present invention: Based on the collaborative failure point, since the influence of abnormal events on different nodes is different, the influence of abnormal events on the collaborative failure point is judged, and the calculation of abnormal contribution scores specifically includes:

[0067] Using the dependency matrix A and the initial abnormal event vector E(t h)Build an impact propagation model;

[0068] The impact of abnormal events on the collaborative failure point is calculated iteratively, and the abnormal contribution score of each node is calculated through normalization and contribution.

[0069] As a further solution of the present invention: according to the judgment result, the impact degree is divided into: general impact and severe impact, specifically including:

[0070] Determine whether the abnormal contribution score of each node is greater than or equal to the preset threshold. If so, it is recorded as a serious impact; if not, it is recorded as a general impact.

[0071] As a further solution of the present invention: the tracing analysis of upstream and downstream associated nodes and paths that seriously affect the node and calculating the risk score specifically includes:

[0072] The connection relationship between nodes is described through the adjacency matrix to form a directed graph;

[0073] Use depth-first search to start from the severely affected node, traverse the upstream and downstream nodes of the severely affected node, and record the path;

[0074] Through the path finding algorithm, find all paths from the severely affected nodes to other nodes;

[0075] The risk score of each path is obtained by summing up the abnormal contribution scores on each path.

[0076] As a further solution of the present invention: the identifying abnormal propagation path specifically includes:

[0077] Determine whether the risk score of each path is greater than or equal to the preset threshold. If so, it is recorded as an abnormal path; if not, it is recorded as a normal path.

[0078] A business operation management system, comprising:

[0079] A data collection module, which is used to collect data traffic between various nodes during business operations, including data transmission volume, flow direction and interaction frequency;

[0080] An abnormal interaction node identification module, the abnormal interaction node identification module is used to analyze the traffic peak, fluctuation pattern and abnormal transmission of data traffic, and identify abnormal interaction nodes;

[0081] A collaborative failure point judgment module, which is based on abnormal interactive nodes and determines the collaborative failure points between nodes by analyzing the operation frequency and response delay between nodes;

[0082] An impact degree analysis module, which is based on the collaborative failure point. Since the impact degree of abnormal events on different nodes is different, the impact degree of abnormal events on the collaborative failure point is judged, and the impact degree is graded into: general impact and severe impact according to the judgment result;

[0083] The abnormal path identification module performs source tracing analysis on upstream and downstream associated nodes and paths that seriously affect the node, identifies the abnormal propagation path, allocates additional resources to the affected nodes according to the abnormal propagation path, and automatically generates an emergency response plan.

[0084] A business operation management system, wherein the abnormal interaction node identification module at least includes:

[0085] The anomaly score calculation unit is used to calculate the log-likelihood value of the probability density corresponding to each feature vector to obtain an anomaly score.

[0086] A business operation management system, wherein the collaborative failure point judgment module at least includes:

[0087] A joint anomaly score calculation unit is used to calculate a joint anomaly score for each node.

[0088] Beneficial effects of the present invention:

[0089] (1) The present invention realizes real-time monitoring and anomaly detection of data traffic during business operations by integrating advanced data analysis technology and machine learning algorithms. This innovation can not only timely discover abnormal interaction nodes in key links such as supply chain, sales channels and customer feedback, but also quickly determine the specific location of the failure of collaboration between these nodes and the extent of its impact. Compared with traditional manual monitoring methods, this method shortens the discovery time of abnormal events and improves the accuracy and efficiency of detection. More importantly, once a severely affected node is detected, the system can immediately activate the emergency response mechanism and allocate additional resources to the affected nodes, such as increasing bandwidth, computing power and providing manual intervention, so as to quickly restore normal business operations and minimize the negative impact of abnormal events on business operations. In addition, through the traceability analysis of the abnormal propagation path, the present invention can also help enterprises deeply understand the occurrence mechanism of abnormal events.

[0090] (2) The present invention constructs a comprehensive and sophisticated business operation management platform by introducing advanced technologies such as multidimensional feature analysis, Gaussian mixture model, and vector autoregression. The platform can not only automatically identify and handle abnormal events, but also has powerful predictive analysis capabilities, which can foresee potential risk points and take preventive measures in advance to avoid losses. In particular, when facing complex and changing market environments and technical challenges, this system can help enterprises quickly adapt to changes and make more informed decisions. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] The present invention will be further described below in conjunction with the accompanying drawings.

[0092] Figure 1 It is a flowchart of the specific steps of a commercial operation management method of the present invention;

[0093] Figure 2 It is a flow chart of a commercial operation management system in the present invention. DETAILED DESCRIPTION

[0094] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0095] See also Figure 1 As shown, the present invention is a business operation management method, comprising the following steps:

[0096] S1: Collect data traffic between nodes during business operations, including data transmission volume, flow direction, and interaction frequency, analyze data traffic peaks, fluctuation patterns, and abnormal transmission, and identify abnormal interaction nodes;

[0097] The nodes include: supply chain, sales channels and customer feedback;

[0098] S2: Based on abnormal interaction nodes, the cooperation failure points between nodes are determined by analyzing the operation frequency and response delay between nodes;

[0099] S3: Based on the collaborative failure point, since the impact of abnormal events on different nodes is different, the impact of abnormal events on the collaborative failure point is judged, and the impact is divided into general impact and severe impact according to the judgment result;

[0100] S4: Conduct source tracing analysis on upstream and downstream associated nodes and paths that severely affect the node, identify abnormal propagation paths, allocate additional resources (such as bandwidth, computing power or manual intervention) to the affected nodes based on the abnormal propagation paths, and automatically generate emergency response plans to reduce the possibility of business interruption.

[0101] In S1, the data traffic between each node during the business operation process is collected, including the data transmission volume, flow direction and interaction frequency. The traffic peak, fluctuation pattern and abnormal transmission of the data traffic are analyzed to identify abnormal interaction nodes, including:

[0102] Use network traffic collection tools (such as Wireshark, NetFlow, sFlow) to directly monitor network communications between nodes. During the traffic collection process, count the amount of data transmitted in each time window.

[0103] Collect data transmission volume, flow direction and interaction frequency from various interaction nodes of business operations;

[0104] Among them, the data transmission volume refers to the data transmission volume per unit time;

[0105] The flow direction of data indicates the source and destination nodes of the data;

[0106] The interaction frequency of the data indicates the number of interactions within a unit time window;

[0107] The transmission volume, flow direction and interaction frequency of the collected data are organized into a multidimensional feature vector of the time series, denoted as X = {x1, x2, ..., x n};

[0108] Each feature vector x i Represents the traffic characteristics in the i-th time window, denoted by x i =[d i , f i , σ i ];

[0109] Where i represents the number of time windows, i = 1, 2, ..., n, d i represents the amount of data transmitted in the i-th window, f i represents the interaction frequency of data in the i-th window, σ i Indicates the fluctuation range of the data in the i-th window;

[0110] The data are standardized for different features to eliminate the impact of dimension;

[0111] Set the number of components k, where the components represent Gaussian distributions, representing different types of traffic patterns (e.g., normal traffic and abnormal traffic);

[0112] Initialize the weight of each Gaussian distribution, set the initial value to uniform distribution, and the calculation expression is:

[0113]

[0114] In the formula, k represents the number of components, K represents the maximum number of components, and π k represents the weight of the Gaussian distribution of the kth component;

[0115] Initialize the mean of each Gaussian distribution. The initial value is randomly selected from the data. The calculation expression is:

[0116] μ k =X;

[0117] Initialize the covariance matrix of each Gaussian distribution. The initial value is the unit matrix. The calculation expression is:

[0118] Σ k =I;

[0119] In the formula, Σ k represents the covariance matrix of the kth component, and I represents the identity matrix;

[0120] For each feature vector x i , calculate the posterior probability belonging to the kth component, the calculation expression is:

[0121]

[0122] In the formula, γ ik represents the posterior probability of the kth component in the i-th time window, N(x i ∣μ k ,Σ k ) represents the probability density function of the kth component, and the calculation expression is:

[0123]

[0124] In the formula, g represents the dimension of the feature vector;

[0125] According to the posterior probability, the weight of the Gaussian distribution is updated, and the calculation expression is:

[0126]

[0127] In the formula, n represents the maximum number of time windows;

[0128] According to the posterior probability, update the mean of the Gaussian distribution, and the calculation expression is:

[0129]

[0130] According to the posterior probability, the covariance matrix of the Gaussian distribution is updated, and the calculation expression is:

[0131]

[0132] To update the weight, mean and covariance matrix of the final Gaussian distribution, recalculate the probability density function, and calculate the corresponding probability density for each eigenvector. The calculation expression is:

[0133]

[0134] In the formula, p(x i ) represents the feature vector x i The probability density of

[0135] Calculate the log-likelihood value of the probability density corresponding to each feature vector to obtain the anomaly score. The calculation expression is:

[0136] A(x i )=-log(p(x i ));

[0137] In the formula, A(x i ) represents the feature vector x i The anomaly score at

[0138] Determine the eigenvector x i The anomaly score A(x i ) is greater than or equal to a preset threshold. If so, it is recorded as an outlier. For the data flow of each node, the total number of outliers N is counted;

[0139] Compare the total number N of outliers with a preset threshold;

[0140] If the total number N of abnormal points is greater than or equal to the preset threshold, the corresponding node is marked as an abnormal interaction node;

[0141] It should be noted that by comparing the total number N of abnormal points with the preset threshold, the complex distribution characteristics in the data traffic can be accurately captured, helping to identify abnormal interaction nodes and providing support for exception handling and optimization in business operation management.

[0142] In S2, based on abnormal interaction nodes, the operation frequency and response delay between nodes are analyzed to determine the cooperation failure points between nodes, including:

[0143] Collect operation frequency f(t) and response delay t from commercial operations r (t) Two types of time series data;

[0144] Among them, the operation frequency f(t) represents the number of interactions between two nodes in the unit time window of time t;

[0145] Response delay t r (t) represents the average delay between two interacting nodes in time t;

[0146] Set a window size w and sliding step size Δt;

[0147] Among them, the window size w represents the time range covered by each calculation (such as 5 seconds);

[0148] The sliding step size Δt represents the time interval of window movement (e.g., 1 second);

[0149] For each sliding window, calculate the average operation frequency, the calculation expression is:

[0150]

[0151] Where, t m Represents the mth time point of the time series, where m represents the number of time points and is a positive integer greater than 0. Indicates time point t m The average operation frequency in the corresponding sliding window, f(t) represents the operation frequency at time t, and w represents the time length of the sliding window;

[0152] For each sliding window, calculate the average response delay, and the calculation expression is:

[0153]

[0154] In the formula, Indicates time point t m The average response delay in the corresponding sliding window, t r (t) represents the operation frequency at time t;

[0155] For each sliding window, the operation frequency variance is calculated, and the calculation expression is:

[0156]

[0157] In the formula, Indicates time point t m The variance of the operation frequency in the corresponding sliding window;

[0158] For each sliding window, the response delay variance is calculated using the following expression:

[0159]

[0160] In the formula, Indicates time point t mThe response delay variance within the corresponding sliding window;

[0161] Create a multidimensional vector:

[0162] The expression is calculated by vector autoregression to represent the multi-dimensional vector, and the joint anomaly score is calculated based on the multi-feature residual calculation expression;

[0163] Wherein, the vector autoregression calculation expression is:

[0164]

[0165] In the formula, p represents the historical order, P represents the maximum historical order, Φ p represents the p-th order regression matrix, representing the time point t m The predicted value of the feature vector at t m-p represents the mpth time point of the time series, X(t m-p ) represents the tth m-p The feature vector of each time point;

[0166] Among them, the multi-feature residual calculation expression is:

[0167]

[0168] In the formula, S(t m ) represents the time point t m The joint anomaly score at X (t m ) represents the multi-feature residual vector, represents the transpose of the multi-feature residual vector, Σ -1 represents the inverse matrix of the residual covariance matrix;

[0169] It should be noted that the inverse matrix of the residual covariance matrix is ​​used to measure the degree of joint abnormality of multi-feature residuals.

[0170] For each abnormal interaction node, calculate the joint anomaly score of the corresponding node, and compare the joint anomaly score of each node with the preset threshold;

[0171] If the joint anomaly score is greater than or equal to the preset threshold, it means that the corresponding node is a collaborative failure point;

[0172] It should be noted that the joint anomaly score is used to evaluate the effectiveness of each abnormal interaction node, and the larger the value of the joint anomaly score of the corresponding node, the higher the degree of failure of the corresponding node.

[0173] In S3, based on the collaborative failure point, since the impact of abnormal events on different nodes is different, the impact of abnormal events on the collaborative failure point is judged. According to the judgment result, the impact degree is divided into: general impact and severe impact, including:

[0174] Among them, the abnormal events include: technical failures, human errors, supply chain problems, market changes and security incidents;

[0175] Using the dependency matrix A and the initial abnormal event vector E(t h )Build an impact propagation model;

[0176] The impact of abnormal events on the collaborative failure point is calculated iteratively, and the abnormal contribution score of each node is analyzed through normalization processing and contribution calculation;

[0177] Compare the anomaly contribution score of each node with a preset threshold;

[0178] If the abnormal contribution score is greater than or equal to the preset threshold, it means that the impact of the abnormal event is high and is recorded as a serious impact;

[0179] If the abnormal contribution score is less than the preset threshold, it means that the impact of the abnormal event is low and is recorded as a general impact;

[0180] It should be noted that the anomaly contribution score reflects the final impact of the abnormal transmission behavior of different nodes on the collaborative failure point, and the larger the anomaly contribution score, the higher the corresponding impact.

[0181] The calculation expression of the iterative calculation is:

[0182] E(t h +1)=A*E(t h );

[0183] Where A represents the dependency matrix, E(t h ) represents the initial abnormal event vector, E(t h +1) indicates that at time t h Abnormal event vector at +1;

[0184] The abnormal contribution score calculation expression is:

[0185]

[0186] In the formula, E′(t h ) represents the abnormal contribution score, z represents the vector E(t h ), c represents the number of elements in the vector E(t h ) of all the elements in e z (t h) represents the vector E(t h ) in the .

[0187] In S4, the upstream and downstream associated nodes and paths of the severely affected nodes are traced and analyzed to identify abnormal propagation paths. Based on the abnormal propagation paths, additional resources (such as bandwidth, computing power or manual intervention) are allocated to the affected nodes, and an emergency response plan is automatically generated to reduce the possibility of business interruption, including:

[0188] The connection relationship between nodes is described through the adjacency matrix to form a directed graph;

[0189] Use depth-first search to start from the severely affected node, traverse its upstream and downstream nodes, and record the path;

[0190] Through the path finding algorithm, find all paths from the severely affected nodes to other nodes;

[0191] The risk score of each path is obtained by summing up the abnormal contribution scores on each path;

[0192] According to the path risk score, the paths are divided into: normal paths and abnormal paths;

[0193] The process of dividing the path levels includes:

[0194] Compare the risk score of each path to a preset threshold;

[0195] If the risk score of a path is greater than or equal to the preset threshold, it means that the corresponding path risk coefficient is high and is recorded as an abnormal path;

[0196] If the risk score of a path is less than the preset threshold, it means that the risk coefficient of the corresponding path is low and is recorded as a normal path;

[0197] Allocate additional resources to affected nodes, such as bandwidth, computing power, or human intervention;

[0198] Automatically generate emergency response plans based on path risk scores and resource allocation to reduce the possibility of business interruption;

[0199] It should be noted that the path risk score can be used to identify and evaluate upstream and downstream related nodes and paths that seriously affect nodes in business operations, so as to better manage and respond to abnormal events.

[0200] See also Figure 2 As shown, a business operation management system includes:

[0201] A data collection module, which is used to collect data traffic between various nodes during business operations, including data transmission volume, flow direction and interaction frequency;

[0202] An abnormal interaction node identification module, the abnormal interaction node identification module is used to analyze the traffic peak, fluctuation pattern and abnormal transmission of data traffic, and identify abnormal interaction nodes;

[0203] A collaborative failure point judgment module, which is based on abnormal interactive nodes and determines the collaborative failure points between nodes by analyzing the operation frequency and response delay between nodes;

[0204] An impact degree analysis module, which is based on the collaborative failure point. Since the impact degree of abnormal events on different nodes is different, the impact degree of abnormal events on the collaborative failure point is judged, and the impact degree is graded into general impact and severe impact according to the judgment result;

[0205] The abnormal path identification module performs source tracing analysis on upstream and downstream associated nodes and paths that seriously affect the node, identifies the abnormal propagation path, allocates additional resources to the affected nodes according to the abnormal propagation path, and automatically generates an emergency response plan.

[0206] The working principle of the present invention is as follows: through the traffic collection tools deployed in the network, the system can monitor the data traffic between key nodes such as the supply chain, sales channels and customer feedback in real time, including information such as transmission volume, flow direction and interaction frequency, and then use time series analysis and Gaussian mixture model to conduct in-depth analysis of traffic peaks, fluctuation patterns and abnormal transmissions, and identify potential abnormal interaction nodes. Subsequently, based on the identified abnormal interaction nodes, the system further analyzes the operation frequency and response delay between each node, uses the sliding window technology to calculate the average and variance, and combines the vector autoregression model to calculate the joint abnormal score, so as to determine the collaborative failure point between nodes. Next, for the collaborative failure point, the system quantifies the impact of abnormal events between different nodes by constructing an impact propagation model, and divides the impact degree into two categories of general impact and severe impact according to the preset threshold. Finally, for nodes that are judged to be severely affected, the system will perform traceability analysis of upstream and downstream related nodes and paths, accurately locate the abnormal propagation path, automatically allocate additional resources to the affected nodes, and generate targeted emergency response plans to minimize the impact of abnormal events on the business and ensure the stability and continuity of business operations.

[0207] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0208] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0209] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0210] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0211] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A business operation management method, characterized in that: The following steps are involved: S1: Collect data traffic between nodes during business operations, including data transmission volume, flow direction, and interaction frequency, analyze data traffic peaks, fluctuation patterns, and abnormal transmission, and identify abnormal interaction nodes; The nodes include: supply chain, sales channels and customer feedback; S2: Based on abnormal interaction nodes, the cooperation failure points between nodes are determined by analyzing the operation frequency and response delay between nodes; S3: Based on the collaborative failure point, since the impact of abnormal events on different nodes is different, the impact of abnormal events on the collaborative failure point is judged, and the impact is divided into general impact and severe impact according to the judgment result; S4: Conduct source tracing analysis on upstream and downstream associated nodes and paths of severely affected nodes, identify abnormal propagation paths, allocate additional resources to affected nodes based on abnormal propagation paths, and automatically generate emergency response plans.

2. A commercial operation management method according to claim 1, characterized in that: The analysis of the traffic peak, fluctuation pattern and abnormal transmission of the data traffic to identify abnormal interaction nodes specifically includes: The transmission volume, flow direction and interaction frequency of the collected data are organized into a multidimensional feature vector of the time series, denoted as X = {x1, x2, ..., x n }; Each feature vector x i Represents the traffic characteristics in the i-th time window, denoted by x i =[d i , f i , σ i ]; Where i represents the number of time windows, d i represents the amount of data transmitted in the i-th window, f i represents the interaction frequency of data in the i-th window, σ i Indicates the fluctuation range of the data in the i-th window; The data are standardized for different features to eliminate the impact of dimension; Set the number of components k, where the component represents a Gaussian distribution; Initialize the weight of each Gaussian distribution, set the initial value to uniform distribution, and the calculation expression is: In the formula, k represents the number of components, K represents the maximum number of components, and π k represents the weight of the Gaussian distribution of the kth component; Initialize the mean of each Gaussian distribution. The initial value is randomly selected from the data. The calculation expression is: m k =X; Initialize the covariance matrix of each Gaussian distribution. The initial value is the unit matrix. The calculation expression is: S k =I; In the formula, Σ k represents the covariance matrix of the kth component, and I represents the identity matrix; For each feature vector x i , calculate the posterior probability belonging to the kth component, the calculation expression is: In the formula, γ ik represents the posterior probability of the kth component in the i-th time window, N(x i ∣μ k ,Σ k ) represents the probability density function of the kth component, and the calculation expression is: In the formula, g represents the dimension of the feature vector; According to the posterior probability, the weight of the Gaussian distribution is updated, and the calculation expression is: In the formula, n represents the maximum number of time windows; According to the posterior probability, update the mean of the Gaussian distribution, and the calculation expression is: According to the posterior probability, the covariance matrix of the Gaussian distribution is updated, and the calculation expression is: To update the weight, mean and covariance matrix of the final Gaussian distribution, recalculate the probability density function, and calculate the corresponding probability density for each eigenvector. The calculation expression is: In the formula, p(x i ) represents the feature vector x i The probability density of Calculate the log-likelihood value of the probability density corresponding to each feature vector to obtain the anomaly score. The calculation expression is: A(x i )=-log(p(x i )); In the formula, A(x i ) represents the feature vector x i The anomaly score at Determine the eigenvector x i The anomaly score A(x i ) is greater than or equal to a preset threshold. If so, it is recorded as an outlier. For the data flow of each node, the total number of outliers N is counted; It is determined whether the total number N of abnormal points is greater than or equal to a preset threshold. If so, the corresponding node is marked as an abnormal interaction node.

3. A commercial operation management method according to claim 1, characterized in that: The abnormal interaction node determines the cooperation failure point between nodes by analyzing the operation frequency and response delay between nodes, specifically including: Collect operation frequency f(t) and response delay t from commercial operations r (t) Two types of time series data; Among them, the operation frequency f(t) represents the number of interactions between two nodes in the unit time window of time t; Response delay t r (t) represents the average delay between two interacting nodes in time t; Set a window size w and sliding step size Δt; Among them, the window size w represents the time range covered by each calculation; The sliding step size Δt represents the time interval of window movement; For each sliding window, calculate the average operation frequency Average response delay Operation frequency variance and response delay variance Where m represents the number of time points, m is a positive integer greater than 0, and t m represents the mth time point of the time series; Create a multidimensional vector: The expression is calculated by vector autoregression to represent the multi-dimensional vector, and the joint anomaly score is calculated based on the multi-feature residual calculation expression; Wherein, the vector autoregression calculation expression is: In the formula, p represents the historical order, P represents the maximum historical order, Φ p represents the p-th order regression matrix, representing the time point t m The predicted value of the feature vector at t m-p represents the mpth time point of the time series, X(t m-p ) represents the tth m-p The feature vector of each time point; Among them, the multi-feature residual calculation expression is: S(t m )=∈ X (t m ) T Σ -1 ∈ X (t m ); In the formula, S(t m ) represents the time point t m The joint anomaly score at X (t m ) represents the multi-feature residual vector, ∈ X (t m ) T represents the transpose of the multi-feature residual vector, Σ -1 represents the inverse matrix of the residual covariance matrix; For each abnormal interaction node, calculate the joint anomaly score of the corresponding node, and compare the joint anomaly score of each node with the preset threshold; If the joint anomaly score is greater than or equal to the preset threshold, the corresponding node is a collaborative failure point.

4. A commercial operation management method according to claim 1, characterized in that: Based on the collaborative failure point, since the impact of abnormal events on different nodes is different, the impact of abnormal events on the collaborative failure point is judged, and the abnormal contribution score is calculated specifically including: Using the dependency matrix A and the initial abnormal event vector E(t h )Build an impact propagation model; The impact of abnormal events on the collaborative failure point is calculated iteratively, and the abnormal contribution score of each node is calculated through normalization and contribution.

5. A commercial operation management method according to claim 1, characterized in that: According to the judgment results, the impact degree is divided into: general impact and severe impact, including: Determine whether the abnormal contribution score of each node is greater than or equal to the preset threshold. If so, it is recorded as a serious impact; if not, it is recorded as a general impact.

6. A commercial operation management method according to claim 1, characterized in that: The traceability analysis of upstream and downstream related nodes and paths that seriously affect the node and the calculation of risk scores specifically include: The connection relationship between nodes is described through the adjacency matrix to form a directed graph; Use depth-first search to start from the severely affected node, traverse the upstream and downstream nodes of the severely affected node, and record the path; Through the path finding algorithm, find all paths from the severely affected nodes to other nodes; The risk score of each path is obtained by summing up the abnormal contribution scores on each path.

7. A commercial operation management method according to claim 1, characterized in that: The identifying of the abnormal propagation path specifically includes: Determine whether the risk score of each path is greater than or equal to the preset threshold. If so, it is recorded as an abnormal path; if not, it is recorded as a normal path.

8. A business operation management system, characterized in that: A commercial operation management method as claimed in any one of claims 1 to 7, comprising: A data collection module, which is used to collect data traffic between various nodes during business operations, including data transmission volume, flow direction and interaction frequency; An abnormal interaction node identification module, the abnormal interaction node identification module is used to analyze the traffic peak, fluctuation pattern and abnormal transmission of data traffic, and identify abnormal interaction nodes; A collaborative failure point judgment module, which is based on abnormal interactive nodes and determines the collaborative failure points between nodes by analyzing the operation frequency and response delay between nodes; An impact degree analysis module, which is based on the collaborative failure point. Since the impact degree of abnormal events on different nodes is different, the impact degree of abnormal events on the collaborative failure point is judged, and the impact degree is graded into: general impact and severe impact according to the judgment result; The abnormal path identification module performs source tracing analysis on upstream and downstream associated nodes and paths that seriously affect the node, identifies the abnormal propagation path, allocates additional resources to the affected nodes according to the abnormal propagation path, and automatically generates an emergency response plan.

9. A commercial operation management system according to claim 8, characterized in that: The abnormal interaction node identification module at least includes: The anomaly score calculation unit is used to calculate the log-likelihood value of the probability density corresponding to each feature vector to obtain an anomaly score.

10. A business operation management system according to claim 8, characterized in that: The collaborative failure point determination module at least includes: A joint anomaly score calculation unit is used to calculate a joint anomaly score for each node.

Images