Financial futures transaction intelligent operation and maintenance system and method based on knowledge graph

Abstract

The invention relates to a knowledge graph-based financial futures transaction intelligent operation and maintenance system and method, and the system comprises a graph database module, a data analysis module, a knowledge graph generation module, a root cause derivation module and a cloud terminal module, and the graph database module builds a graph database based on a graph structure; the data analysis module performs anomaly detection through analysis based on financial futures transaction log data obtained in real time; a knowledge graph generation module rapidly generates an exception analysis knowledge graph according to the exception information analyzed by the data analysis module in combination with a graph database; the root cause derivation module quickly completes root cause positioning based on an abnormal analysis knowledge graph and a root cause analysis path in a derivation rule base, and provides a corresponding solution; and the cloud terminal module provides operation and maintenance interaction and fault root cause display functions. Compared with the prior art, the method has the advantages of providing an operation and maintenance global view angle, being high in anomaly detection efficiency, high in root cause positioning accuracy, short in consumed time, good in auxiliary troubleshooting effect and the like.

Description

Technical Field

[0001] The present invention relates to the field of software system operation and maintenance, and in particular to an intelligent operation and maintenance system and method for financial futures trading based on knowledge graph. Background Art

[0002] The main goal of operation and maintenance technology in the software field is to ensure the continuous, efficient and reliable operation of the software system, and to assist operation and maintenance personnel in quickly locating and troubleshooting when an abnormality occurs in the system.

[0003] At present, the general automated operation and maintenance technology has extremely limited ability to mine historical data and analyze the root causes of faults. Intelligent operation and maintenance technology based on big data and machine learning technology is mainly used for data analysis, root cause location and auxiliary troubleshooting at the host and network levels. There are very few cases of use in the financial industry, especially in securities and futures trading systems. The main reason is that the trading system in the financial industry is highly customized and the operation and maintenance environment is complex, and there is less abnormal data in the production environment, which makes the mining of abnormal scenarios lack sufficient data support. In addition, due to its high degree of customization, the root cause location and troubleshooting are too dependent on the experience of the operation and maintenance personnel. It is difficult for automated operation and maintenance technology to fully automate the operation and maintenance experience into the operation and maintenance process. In addition, the financial futures trading system has many components, and the relationship between components is complex. An abnormal alarm may be related to multiple components, and an abnormal log of a component may be caused by another component. In the traditional operation and maintenance method, this information is scattered in various databases, documents, scripts and even in the minds of operation and maintenance personnel. Excessive information dispersion is the primary obstacle to the upgrade of operation and maintenance technology to intelligence. Summary of the invention

[0004] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a financial futures trading intelligent operation and maintenance system and method based on knowledge graph, which structurally transforms the complex operation and maintenance knowledge, operation and maintenance experience and the relationship between them and then stores them in the graph database, aggregates all nodes and their operation information into a knowledge graph when the trading system is running, and combines the knowledge graph with historical data to realize functions such as system operation anomaly detection and intelligent mining of abnormal logs. When the system has an abnormality, the root cause can be quickly located through the knowledge graph and assist in subsequent troubleshooting. The operation and maintenance knowledge based on the knowledge graph is platform-based, scenario-based, and intelligent, and has the characteristics of providing a global perspective on operation and maintenance, high efficiency in anomaly detection, high accuracy in root cause location, short time consumption, and good auxiliary troubleshooting effect, providing a better choice for the intelligent operation and maintenance practice of trading systems.

[0005] The purpose of the present invention can be achieved by the following technical solutions:

[0006] According to a first aspect of the present invention, there is provided a financial futures trading intelligent operation and maintenance system based on a knowledge graph, comprising a graph database module, a data parsing module, a knowledge graph generation module, a root cause derivation module and a cloud terminal module, wherein:

[0007] The graph database module builds a graph database based on a graph structure, and the graph database is used to realize structured storage of operation and maintenance knowledge, including a transaction event library, a historical event library, a transaction knowledge library, and a derivation rule library;

[0008] The data analysis module performs anomaly detection by analyzing the financial futures transaction log data acquired in real time;

[0009] The knowledge graph generation module quickly generates an anomaly analysis knowledge graph based on the anomaly information analyzed by the data analysis module and the graph database;

[0010] The root cause derivation module quickly locates the root cause based on the abnormal analysis knowledge graph and the root cause analysis path in the derivation rule base, and provides corresponding solutions;

[0011] The cloud terminal module provides operation and maintenance interaction and fault root cause display functions.

[0012] As a preferred technical solution, the transaction event library stores known transaction events and transaction emergency plans, including event determination indicators, event analysis paths and event handling processes, which are used for event confirmation, root cause analysis, auxiliary troubleshooting and targeted event detection;

[0013] The transaction knowledge base stores transaction system knowledge and operating environment information, including various dimensional indicators of the system and host, deployment information, transaction component associations, scenarios, causes and impacts of transaction abnormality logs, and associations between infrastructure resources and components;

[0014] The historical event library stores transaction history logs, historical events and all associated information when they occur, which is used for event matching and auxiliary troubleshooting;

[0015] The derivation rule base stores fuzzy derivation paths when various events, alarms, abnormal indicators, and abnormal logs occur, and is used to assist in root cause analysis and positioning.

[0016] As an optimal technical solution, the financial futures trading log data includes real-time logs of all components of the trading system, transaction flows, host resource logs and monitoring system alarm logs. Based on the financial futures trading log data, the data analysis module performs log analysis and event analysis.

[0017] As a preferred technical solution, the log analysis performs real-time analysis on the logs, extracts transaction operation indicators and writes them into a time series database for subsequent construction of a knowledge graph, wherein:

[0018] When parsing the real-time log line by line, the time period in which the log appeared in history, the total number of times on the day, and the frequency information of the log appearing in multiple preset time intervals in the past are retrieved from the historical event library as audit conditions to determine whether the current log meets expectations. When the time period in which a log appears has never appeared in the same time period in history, a transaction abnormality log is automatically generated to realize the intelligent mining function of abnormal logs;

[0019] When parsing the host resource log, according to the host resource index value recorded in the host resource log, a correlation curve between the entrustment amount and the host resource index value is fitted based on historical data, and the expected value of the host resource index is calculated based on the correlation curve under any real-time entrustment amount. When the actual value and the expected value of the host resource index exceed the historical difference average value, median value and maximum value, a host resource abnormality log is generated respectively, so as to realize the system operation abnormality detection function;

[0020] Self-generated exception logs are used for event parsing and analysis.

[0021] As a preferred technical solution, the event analysis includes the following steps:

[0022] Normalize multiple source data to generate standardized abnormal events, where the multiple source data include monitoring system alarm logs, scenario analysis messages manually triggered by operation and maintenance personnel through cloud terminal modules, and abnormal logs self-generated in log analysis;

[0023] The abnormal event is matched with the events in the transaction event library and the historical event library based on the event judgment index. If the matching degree is greater than the set threshold, a knowledge graph is generated according to the matching result to complete the rapid fault location. Otherwise, a comprehensive health scan is performed, and the transaction knowledge base is searched based on the abnormal data found in the comprehensive health scan to obtain the association relationship between all related nodes and nodes. The searched data is combined into a frame of scene snapshot for constructing a knowledge graph and performing root cause analysis.

[0024] As a preferred technical solution, the comprehensive health scan includes core health check and general health check, wherein the core health check includes process check, seat connection check, matching loop connectivity check, matching continuity check and market continuity check; the general health check includes component message gap check and host resource saturation check.

[0025] As a preferred technical solution, the knowledge graph generation module constructs four sub-graphs, namely, the benchmark graph, the system operation graph, the indicator graph and the abnormal scenario graph. These four sub-graphs form a complete abnormal analysis knowledge graph by inferring the root cause derivation path in the rule base;

[0026] Among them, the benchmark graph records the static basic information of the trading system, including version information, configuration information, deployment information and change information; the system operation graph records the current dynamic operation of the system, including the current publishing and subscription status between components, the message gap between components and between threads within components, and the host resource occupancy of components; the indicator graph records the indicator values ​​of trading indicators on the day, the trading indicators come from the trading knowledge base, and the indicator value data comes from the time series database; the abnormal scenario graph records abnormal events and their corresponding scenario snapshots.

[0027] As a preferred technical solution, the root cause derivation module performs the following steps:

[0028] The derivation starts with the abnormal event node in the abnormal scenario graph as the path starting point;

[0029] Perform root cause analysis according to predefined derivation rules, check nodes on the system operation map and indicator map, and use the benchmark map as static data to assist in analyzing abnormal nodes;

[0030] When there is no derivation path, automatically search for associated nodes and establish a derivation path;

[0031] Complete root cause derivation and locate the root cause;

[0032] Based on the root cause location results, search the transaction event library and transaction knowledge base and recommend solutions.

[0033] According to a second aspect of the present invention, a method for intelligent operation and maintenance of financial futures trading based on a knowledge graph is provided. Based on the above-mentioned system implementation, the method comprises the following steps:

[0034] The event analysis module performs analysis based on the financial futures transaction log data obtained in real time;

[0035] When the event parsing module parses an abnormal event, it matches the abnormal event with the events in the transaction event library and the historical event library to obtain associated information associated with the abnormal event;

[0036] The event analysis module sends the abnormal events and their related information to the knowledge graph generation module;

[0037] The knowledge graph generation module constructs an abnormal scenario graph based on abnormal events and their associated information, obtains corresponding transaction knowledge from the transaction knowledge base, obtains indicator values ​​from the time series database, constructs a benchmark graph, a system operation graph, and an indicator graph, and combines the abnormal scenario graph, the benchmark graph, the system operation graph, and the indicator graph to obtain an abnormal analysis knowledge graph;

[0038] Importing the anomaly analysis knowledge graph into a root cause derivation module;

[0039] The root cause derivation module quickly locates the root cause based on the abnormal analysis knowledge graph and the root cause analysis path in the derivation rule base, and provides corresponding solutions;

[0040] The root cause derivation module structures the results of the root cause derivation and sends them to the cloud terminal module for displaying the root cause of the fault.

[0041] According to a third aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program implements the method described above when executed by a processor.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] (1) Providing a global perspective on operation and maintenance: Traditional operation and maintenance monitoring methods are difficult to represent the correlation between operating indicators, especially for an operation and maintenance environment such as a financial futures trading system with many components and complex relationships between components. The information provided by traditional methods is even more limited. The knowledge graphs such as the system operation graph in the present invention integrate and unify the entities, indicators and their correlations at all levels in the system. Through the knowledge graph, operation and maintenance personnel can observe the real-time status of the system data flow, the health of key business paths, etc. in a more subtle way, and improve the operation and maintenance personnel's ability to grasp the overall situation of the system.

[0044] (2) High anomaly detection efficiency: The monitoring and alarm method based on static thresholds will only generate an alarm event when a certain monitoring indicator of the system exceeds the threshold, notifying the operation and maintenance personnel that the system is abnormal. Based on the transaction knowledge base and historical data, the present invention realizes intelligent monitoring of indicators such as logs and capacity by real-time analysis of transaction logs and operation data during system operation, which can quickly detect possible abnormal trends and risk points of the system, realize risk left shift, and reduce risk costs.

[0045] (3) High accuracy and short time for root cause location: The traditional method of locating the root cause of faults using manual and automated tools takes a long time, and the negative business impact generated increases exponentially over time. Based on the transaction knowledge base and the derivation rule base that store a large amount of knowledge and experience of operation and maintenance personnel and even transaction system experts, the present invention can quickly build a knowledge graph when handling abnormal events, which provides rich context information and associations, and comprehensively displays the status and behavior of the system. It completes inspection and analysis in automatic derivation, locates the cause of the abnormality, and the accuracy can reach the level of transaction operation and maintenance experts. This process takes less than 1 minute, which is much less than the time consumed by traditional methods and transaction operation and maintenance experts for fault location.

[0046] (4) Good auxiliary troubleshooting effect: Based on the located cause of the problem, the knowledge graph quickly extracts the operation and maintenance troubleshooting knowledge from the historical event library and the transaction knowledge library, integrates them, and recommends expert-level solutions. Operation and maintenance personnel refer to the recommended solutions to implement emergency troubleshooting and restore the normal operation of the trading system. This intelligent recommendation method can greatly improve operation and maintenance efficiency, shorten fault repair time, and reduce the external impact of faults. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a system structure diagram of the present invention;

[0048] Figure 2 The present invention is a flow chart of the system operation method. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0050] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0051] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0052] Example 1

[0053] This embodiment provides a financial futures trading intelligent operation and maintenance system based on knowledge graph, such as Figure 1 As shown, it includes a graph database module, a data parsing module, a knowledge graph generation module, a root cause derivation module and a cloud terminal module. The following is a detailed description of each module.

[0054] (1) Graph Database Module

[0055] Graph database technology is a data management technology that uses points and edges as basic storage units combined with graph data structures as design principles, where points represent entities and edges are the lines between points, representing the relationships between entities. Graph databases are the best way to store, query, and analyze highly correlated data, and have been widely used in user risk management, fraud detection, investment research and decision-making in the financial field. The present invention uses a graph database to achieve structured storage of operation and maintenance knowledge, integrate the relationships between all components, application services, infrastructure, etc. of the trading system, and build a multi-level, multi-functional operation and maintenance relationship network.

[0056] The present invention constructs a total of four types of databases based on the graph database, namely, a transaction event database, a historical event database, a transaction knowledge database, and a derivation rule database.

[0057] The transaction event database stores known transaction events and transaction emergency plans, including event determination indicators, event analysis paths, and event handling processes, which can be used for event confirmation, root cause analysis, auxiliary troubleshooting, and targeted event detection.

[0058] The transaction knowledge base stores transaction system knowledge and operating environment information, including various dimensional indicators of the system and host, deployment information, relationship between transaction components, scenarios, causes and impacts of transaction abnormality logs, and relationship between infrastructure resources such as CPU / network / disk / memory and components.

[0059] The historical event library stores transaction history logs, historical events, and all associated information when they occur, which is used for event matching and auxiliary troubleshooting;

[0060] The inference rule base stores the fuzzy inference paths when various events, alarms, abnormal indicators, and abnormal logs occur, which is used to assist in root cause analysis and positioning.

[0061] (2) Data analysis module

[0062] The data analysis module performs anomaly detection by analyzing the financial futures trading log data acquired in real time. In this embodiment, the financial futures trading log data relied on by the data analysis module includes the real-time log of all components of the trading system, transaction flow, host resource log and monitoring system alarm log. Based on the financial futures trading log data, the data analysis module performs log analysis and event analysis.

[0063] (21) Log analysis

[0064] Log parsing performs real-time parsing of logs, extracts transaction operation indicators and writes them into the time series database for subsequent construction of the knowledge graph.

[0065] Because routine operation and maintenance will not monitor INFO level logs, when parsing real-time logs line by line, the time period in which the log appeared in history, the total number of times on the day, and the frequency of occurrence in the past 1 / 5 / 30 minutes are retrieved from the historical event library as audit conditions to determine whether the current log meets expectations. When the time period in which a log appears has never appeared in the same historical time period, a transaction exception log is automatically generated to realize the intelligent mining function of exception logs.

[0066] The host resource log records the usage rate of the current host CPU, memory, disk, network and other indicators. These indicator values ​​are positively correlated with the number of entrusted messages in the trading system. When parsing the host resource log, according to the host resource indicator values ​​recorded in the host resource log, the correlation curve between the entrusted amount and the host resource indicator value is fitted based on historical data. The expected value of the host resource indicator is calculated based on the correlation curve under any real-time entrusted amount. When the actual value and expected value of the host resource indicator exceed the historical difference average, median and maximum values, a host resource abnormality log is generated to realize the system operation abnormality detection function.

[0067] The self-generated exception logs are transmitted to the event analysis function for in-depth analysis.

[0068] (22) Event Analysis

[0069] Event analysis mainly processes the following source data: monitoring system alarm logs, scenario analysis messages manually triggered by operation and maintenance personnel through cloud terminals, and self-generated exception logs. Among them, the scenario analysis options available for cloud terminals are all events in the transaction event library.

[0070] Event parsing includes the following steps:

[0071] S201, normalizing multiple source data to generate standardized abnormal events;

[0072] S202, performing similarity matching between the abnormal event and the events in the transaction event library and the historical event library based on event determination indicators;

[0073] S203: If the matching degree is greater than the set threshold, a knowledge graph is generated according to the matching result to complete the rapid fault location.

[0074] S204, if the matching degree is less than or equal to the set threshold, perform a comprehensive health scan, search the transaction knowledge base based on the abnormal data found in the comprehensive health scan, obtain all the associated nodes and the relationship between the nodes, and combine the searched data into a frame of scene snapshot for constructing a knowledge graph and performing root cause analysis.

[0075] In this embodiment, the comprehensive health scan includes a core health check and a general health check, wherein the core health check includes a process check, a seat connection check, a matching loop connectivity check, a matching continuity check, and a market continuity check; the general health check includes a component message gap check and a host resource saturation check.

[0076] (3) Knowledge graph generation module

[0077] The knowledge graph generation module quickly generates an anomaly analysis knowledge graph based on the anomaly information analyzed by the data analysis module and the graph database. In this embodiment, the knowledge graph generation module constructs four subgraphs, namely the benchmark graph, the system operation graph, the indicator graph, and the anomaly scenario graph. These four subgraphs form a complete anomaly analysis knowledge graph by inferring the root cause derivation path in the rule base.

[0078] Among them, the benchmark graph records the static basic information of the trading system, including version information, configuration information, deployment information and change information. Through the benchmark graph, you can quickly obtain what content was modified in the most recent change, which configuration was modified in which change, and the person who modified the change and the reason for the modification; the system operation graph records the current dynamic operation of the system, including the current publishing and subscription status between components, the message gap between components and between threads within components, and the host resource usage of components; the indicator graph records the indicator values ​​of the trading indicators on the day. The trading indicators come from the trading knowledge base, and the indicator value data comes from the time series database; the abnormal scenario graph records abnormal events and their corresponding scenario snapshots.

[0079] By constructing the above knowledge spectrum, abnormal data, operation and maintenance knowledge and the current system status are integrated to provide data and technical support for the next step of root cause deduction.

[0080] (4) Root Cause Derivation Module

[0081] The root cause derivation module quickly locates the root cause based on the root cause analysis path in the anomaly analysis knowledge graph and the derivation rule base, and provides corresponding solutions.

[0082] The root cause derivation module performs the following steps:

[0083] S401, starting derivation with the abnormal event node in the abnormal scene graph as the path starting point.

[0084] S402, performing root cause analysis according to predefined derivation rules, checking the nodes on the system operation map and the indicator map, and using the benchmark map as static data to assist in analyzing abnormal nodes.

[0085] For example, if the entrustment delay increases, the abnormal nodes found through root cause deduction are "the CPU usage rate of the matching node data appearing thread" exceeds the historical maximum value under the same entrustment, and the message gap between the "matching node message processing thread" and the "matching node message subscription thread" exceeds the historical threshold. It can be basically located that a software abnormality occurs in the matching component data processing thread.

[0086] S403: When there is no derivation path, automatically search for associated nodes and establish a derivation path.

[0087] To make up for the insufficiency and incompleteness of the derivation path, the root cause derivation module will automatically search for related nodes and establish a derivation path. For example, component B subscribes to the message of component A. At this time, the message gap between B and A continues to increase. The derivation path of this scenario only involves one node, namely the indicator node "B process CPU usage". At this time, the module automatically searches for related nodes and incorporates the found related nodes such as "network traffic" and "B's subscription thread CPU usage" into the derivation path. This operation is also applicable when there is no derivation path, but because it is time-consuming, it is currently used as a supplement to the predefined derivation rules.

[0088] S404, completing root cause derivation and locating the root cause.

[0089] S405, based on the root cause location result, search the transaction event database and the transaction knowledge database and recommend solutions.

[0090] (5) Cloud terminal module

[0091] The cloud terminal module provides operation and maintenance interaction and fault root cause display functions.

[0092] Table 1 shows the technical selection of the present invention, in which the Django framework is used to build an intelligent operation and maintenance web server to realize the front-end handover and root cause display functions of the operation and maintenance personnel.

[0093] Table 1

[0094] name Selection Graph Databases Neo4j Time Series Database influxDB Server Framework Django

[0095] The intelligent operation and maintenance system for financial futures trading based on knowledge graph proposed in the present invention realizes platform-based management of trading operation and maintenance knowledge through graph database, and solves the pain points of complex and difficult to grasp environment and time-consuming root cause location of transaction anomalies through knowledge graph. It has many advantages such as providing a global perspective of operation and maintenance, high efficiency of anomaly detection, high accuracy of root cause location with short time consumption, and good auxiliary troubleshooting effect.

[0096] In this embodiment, the use of a graph database can efficiently solidify the knowledge of the trading system and the experience of operation and maintenance experts, realize the structuring, unification and platformization of operation and maintenance knowledge, and provide data support for the generation of knowledge graphs. The knowledge graph is used to quickly build the association between the global view of system operation and the internal instance, providing technical support for the intelligent operation and maintenance of the trading system. The historical data mining technology used detects data anomalies such as transaction logs and capacity indicators that do not trigger monitoring alarms, and self-generates an abnormal event, filling the monitoring blind spot and timely discovering potential risks of the system. Although the comprehensive health scan is time-consuming, it solves the problem that it is difficult to construct an abnormal scenario knowledge graph when the abnormal event does not match the event in the graph database. In addition, the automatic search of the derivation path used in this embodiment can automatically search for related nodes and perform inspections and analyses based on the abnormal event as the starting point when the derivation rules of the abnormal event are not entered into the graph database, and automatically upload the path related to the final positioning to the derivation rule library.

[0097] Example 2

[0098] This embodiment provides a financial futures trading intelligent operation and maintenance method based on knowledge graph, based on the system implementation described in the above embodiment 1, such as Figure 2 As shown, the method comprises the following steps:

[0099] Step 1: The event analysis module performs analysis based on the financial futures transaction log data obtained in real time;

[0100] Step 2: When the event analysis module analyzes an abnormal event, the abnormal event is matched with events in the transaction event library and the historical event library to obtain associated information associated with the abnormal event;

[0101] Step 3: The event analysis module sends the abnormal event and its related information to the knowledge graph generation module;

[0102] Step 4: The knowledge graph generation module obtains the corresponding transaction knowledge from the transaction knowledge base;

[0103] Step 5: The knowledge graph generation module obtains the index value from the time series database;

[0104] Step 6: The knowledge graph generation module constructs an abnormal scenario graph based on the abnormal event and its associated information, constructs a benchmark graph, a system operation graph and an indicator graph based on the transaction knowledge and the indicator value, combines the abnormal scenario graph, the benchmark graph, the system operation graph and the indicator graph to obtain an abnormal analysis knowledge graph, and imports the abnormal analysis knowledge graph into the root cause derivation module;

[0105] Step 7, together with step 6, constructs a global perspective and abnormal scenario data for root cause analysis, providing data and technical support for completing intelligent root cause location;

[0106] Step 8: The root cause derivation module quickly locates the root cause based on the root cause analysis path in the anomaly analysis knowledge graph and the derivation rule base, and provides corresponding solutions.

[0107] Step 9: The root cause derivation module structures the root cause derivation results and sends them to the cloud terminal module for displaying the root cause of the fault. Finally, the operation and maintenance personnel troubleshoot the fault based on the positioning results and the recommended solutions. The entire process of intelligent root cause analysis takes less than 1 minute, providing strong support for the business recovery rate.

[0108] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0109] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A financial futures trading intelligent operation and maintenance system based on knowledge graph, characterized in that: It includes graph database module, data analysis module, knowledge graph generation module, root cause derivation module and cloud terminal module, among which: The graph database module builds a graph database based on a graph structure, and the graph database is used to realize structured storage of operation and maintenance knowledge, including a transaction event library, a historical event library, a transaction knowledge library, and a derivation rule library; The data analysis module performs anomaly detection by analyzing the financial futures transaction log data acquired in real time; The knowledge graph generation module quickly generates an anomaly analysis knowledge graph based on the anomaly information analyzed by the data analysis module and the graph database; The root cause derivation module quickly locates the root cause based on the abnormal analysis knowledge graph and the root cause analysis path in the derivation rule base, and provides corresponding solutions; The cloud terminal module provides operation and maintenance interaction and fault root cause display functions.

2. According to claim 1, a financial futures trading intelligent operation and maintenance system based on knowledge graph is characterized in that: The transaction event library stores known transaction events and transaction emergency plans, including event determination indicators, event analysis paths and event handling processes, which are used for event confirmation, root cause analysis, auxiliary troubleshooting and targeted event detection; The transaction knowledge base stores transaction system knowledge and operating environment information, including various dimensional indicators of the system and host, deployment information, transaction component associations, scenarios, causes and impacts of transaction abnormality logs, and associations between infrastructure resources and components; The historical event library stores transaction history logs, historical events and all associated information when they occur, which is used for event matching and auxiliary troubleshooting; The derivation rule base stores fuzzy derivation paths when various events, alarms, abnormal indicators, and abnormal logs occur, and is used to assist in root cause analysis and positioning.

3. According to claim 1, a financial futures trading intelligent operation and maintenance system based on knowledge graph is characterized in that: The financial futures trading log data includes real-time logs of all components of the trading system, transaction flows, host resource logs and monitoring system alarm logs. Based on the financial futures trading log data, the data analysis module performs log analysis and event analysis.

4. According to claim 3, a financial futures trading intelligent operation and maintenance system based on knowledge graph is characterized in that: The log analysis performs real-time analysis on the logs, extracts transaction operation indicators and writes them into the time series database for subsequent construction of the knowledge graph, where: When parsing the real-time log line by line, the time period in which the log appeared in history, the total number of times on the day, and the frequency information of the log appearing in multiple preset time intervals in the past are retrieved from the historical event library as audit conditions to determine whether the current log meets expectations. When the time period in which a log appears has never appeared in the same time period in history, a transaction abnormality log is automatically generated to realize the intelligent mining function of abnormal logs; When parsing the host resource log, according to the host resource index value recorded in the host resource log, a correlation curve between the entrustment amount and the host resource index value is fitted based on historical data, and the expected value of the host resource index is calculated based on the correlation curve under any real-time entrustment amount. When the actual value and the expected value of the host resource index exceed the historical difference average value, median value and maximum value, a host resource abnormality log is generated respectively, so as to realize the system operation abnormality detection function; Self-generated exception logs are used for event parsing and analysis.

5. According to claim 4, a financial futures trading intelligent operation and maintenance system based on knowledge graph is characterized in that: The event analysis includes the following steps: Normalize multiple source data to generate standardized abnormal events, where the multiple source data include monitoring system alarm logs, scenario analysis messages manually triggered by operation and maintenance personnel through cloud terminal modules, and abnormal logs self-generated in log analysis; The abnormal event is matched with the events in the transaction event library and the historical event library based on the event judgment index. If the matching degree is greater than the set threshold, a knowledge graph is generated according to the matching result to complete the rapid fault location. Otherwise, a comprehensive health scan is performed, and the transaction knowledge base is searched based on the abnormal data found in the comprehensive health scan to obtain the association relationship between all related nodes and nodes. The searched data is combined into a frame of scene snapshot for constructing a knowledge graph and performing root cause analysis.

6. According to claim 5, a financial futures trading intelligent operation and maintenance system based on knowledge graph is characterized in that: The comprehensive health scan includes core health check and general health check, wherein the core health check includes process check, seat connection check, matching loop connectivity check, matching continuity check and market continuity check; the general health check includes component message gap check and host resource saturation check.

7. According to claim 1, a financial futures trading intelligent operation and maintenance system based on knowledge graph is characterized in that: The knowledge graph generation module constructs four subgraphs, namely, the benchmark graph, the system operation graph, the indicator graph, and the abnormal scenario graph. These four subgraphs form a complete abnormal analysis knowledge graph by inferring the root cause derivation path in the rule base; Among them, the benchmark graph records the static basic information of the trading system, including version information, configuration information, deployment information and change information; the system operation graph records the current dynamic operation of the system, including the current publishing and subscription status between components, the message gap between components and between threads within components, and the host resource occupancy of components; the indicator graph records the indicator values ​​of trading indicators on the day, the trading indicators come from the trading knowledge base, and the indicator value data comes from the time series database; the abnormal scenario graph records abnormal events and their corresponding scenario snapshots.

8. According to claim 7, a knowledge graph-based intelligent operation and maintenance system for financial futures trading is characterized in that: The root cause derivation module performs the following steps: The derivation starts with the abnormal event node in the abnormal scenario graph as the path starting point; Perform root cause analysis according to predefined derivation rules, check nodes on the system operation map and indicator map, and use the benchmark map as static data to assist in analyzing abnormal nodes; When there is no derivation path, automatically search for related nodes and establish a derivation path; Complete root cause derivation and locate the root cause; Based on the root cause location results, search the transaction event library and transaction knowledge base and recommend solutions.

9. A method for intelligent operation and maintenance of financial futures trading based on knowledge graph, characterized in that: Based on the system implementation according to any one of claims 1 to 8, the method comprises the following steps: The event analysis module performs analysis based on the financial futures transaction log data obtained in real time; When the event parsing module parses an abnormal event, it matches the abnormal event with the events in the transaction event library and the historical event library to obtain associated information associated with the abnormal event; The event analysis module sends the abnormal events and their related information to the knowledge graph generation module; The knowledge graph generation module constructs an abnormal scenario graph based on abnormal events and their associated information, obtains corresponding transaction knowledge from the transaction knowledge base, obtains indicator values ​​from the time series database, constructs a benchmark graph, a system operation graph, and an indicator graph, and combines the abnormal scenario graph, the benchmark graph, the system operation graph, and the indicator graph to obtain an abnormal analysis knowledge graph; Importing the anomaly analysis knowledge graph into a root cause derivation module; The root cause derivation module quickly locates the root cause based on the abnormal analysis knowledge graph and the root cause analysis path in the derivation rule base, and provides corresponding solutions; The root cause derivation module structures the results of the root cause derivation and sends them to the cloud terminal module for display of the root cause of the fault.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, an intelligent operation and maintenance system for financial futures trading based on a knowledge graph is implemented as described in any one of claims 1 to 8.

Images