Equipment monitoring method and system based on deep learning

Abstract

The invention belongs to the technical field of computers, and provides an equipment monitoring method and system based on deep learning. The method comprises the steps that an Agent module of a monitoring end obtains first real-time operation data of each piece of monitored electronic equipment, and the electronic equipment exceeding a corresponding risk threshold value is determined as target electronic equipment; evaluating the importance level of the target electronic equipment, and if the importance level is higher than a level threshold value, obtaining second real-time operation data of each associated electronic equipment located in the same geographic area as the target electronic equipment and a corresponding risk threshold value, and evaluating to obtain an associated abnormal index, lowering the risk threshold value of the target electronic equipment to a second preset threshold value; and if the first real-time operation data of the target electronic equipment exceeds the second preset threshold value, outputting an abnormal alarm signal for the target electronic equipment. According to the invention, the relevance between the electronic devices and the surrounding environment factors are considered, and the accuracy and timeliness of fault early warning can be improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a deep learning-based equipment monitoring method and system thereof. Background Art

[0002] In today's electronic equipment monitoring field, with the increasing number of electronic devices and the increasing complexity of application scenarios, effective monitoring of the operating status of electronic devices is particularly important. At present, the monitoring end establishes a communication connection with multiple electronic devices to receive the real-time operating data of each electronic device, and then uses an abnormal analysis algorithm to analyze and judge these data. When the real-time operating data exceeds the preset threshold, it is determined that the device is abnormal, that is, a fault may have occurred.

[0003] However, the prior art has obvious defects. The preset thresholds currently designed usually correspond to each electronic device one by one. This method only judges whether a single electronic device has a fault based on its own preset threshold. Moreover, in order to avoid misjudgment, the preset threshold is usually designed to be slightly higher. Too high a preset threshold may cause the electronic device to fail to be promptly alarmed and handled, which is not conducive to the health of electronic devices, especially those with a higher degree of importance, and leads to poor system stability.

[0004] Therefore, how to improve the dynamic adjustment of the preset threshold of electronic equipment, and thus achieve more effective monitoring and fault warning processing of electronic equipment, is a technical problem that urgently needs to be solved. Summary of the invention

[0005] In response to the above technical problems, the present invention provides a device monitoring method, system, electronic device, computer storage medium and computer program product based on deep learning.

[0006] The present invention discloses a device monitoring method based on deep learning, the method comprising the following steps: The Agent module of the monitoring end uses the eBPF technology to obtain the first real-time operation data of each monitored electronic device in real time, and determines the electronic device whose first real-time operation data exceeds the corresponding risk threshold as the target electronic device; wherein the risk threshold is lower than the standard preset threshold; Assessing the importance level of the target electronic device, and if the importance level is higher than a level threshold, acquiring second real-time operation data of each associated electronic device in the same geographical area as the target electronic device; Determine a correlation anomaly index based on each of the second real-time operation data and the corresponding risk threshold, and adjust the standard preset threshold of the target electronic device to a temporary standard preset threshold based on the correlation anomaly index; If the first real-time operation data of the target electronic device exceeds the temporary standard preset threshold, an abnormal alarm signal for the target electronic device is output.

[0007] Optionally, the evaluating the importance level of the target electronic device includes: Acquire performance parameters of the target electronic device itself, and evaluate and obtain a first importance score and a second importance score according to the performance parameters; wherein the operation record data includes data that can be used to evaluate the operation reliability of the target electronic device; Acquire functional link information of the target electronic device in the entire deployed system, and evaluate and obtain a third importance score based on the functional link information; The first importance score, the second importance score, and the third importance score are weightedly integrated to obtain a fourth importance score, and the importance level is obtained based on matching of the fourth importance score.

[0008] Optionally, the acquiring the second real-time operation data of each associated electronic device in the same geographical area as the target electronic device includes: According to the importance level of the target electronic device, a first screening distance is obtained by matching the preset first association data; Acquire all historical fault records of the target electronic device, classify each of the historical fault records into an internal fault type and an external fault type, obtain the number of external fault types by counting, and obtain a range-increasing weight coefficient by matching from a preset second associated data according to the number of types; The first screening distance is adjusted to a larger second screening distance using the range-increasing weighting factor.

[0009] Optionally, evaluating and obtaining a correlation anomaly index based on each of the second real-time operation data and a corresponding risk threshold value includes: Calculating a first difference between each of the second real-time operating data of each associated electronic device and a corresponding risk threshold, and calculating an equivalent value of a normalized value of all the first differences; If the equivalent value is higher than a preset value, further calculating a second difference between the first real-time operation data of the target electronic device and the corresponding risk threshold, and obtaining a first correlation abnormality index according to a normalized value of the second difference and the equivalent value; If the equivalent value is not higher than the preset value, further acquiring each recent historical operation data of each associated electronic device, fitting the historical operation data with the second real-time operation data of the same type to obtain an operation trend curve, and identifying an abnormal trend curve segment therein; A convolutional network is used to extract features from the vectorized abnormal trend curve segments to obtain operation sub-features of any associated electronic device, and the operation sub-features are spliced ​​and integrated into operation features. An associated abnormality prediction model is used to predict and analyze the operation features and the first real-time operation data of the target electronic device and the corresponding risk threshold to obtain a second associated abnormality index.

[0010] Optionally, the Agent module regularly collects and updates historical fault records of the target electronic device, constructs a training data set using the historical fault records, and locally trains the associated abnormality prediction model using the training data in the training data set; In addition, the Agent module also regularly publishes the associated anomaly prediction model to the alliance chain network for distributed training, and integrates the important parameters of the model obtained from the distributed training into the associated anomaly prediction model after local training, and then performs secondary training.

[0011] The present invention also discloses a deep learning-based equipment monitoring system, the system comprising a processing device and a storage device, the computer code stored in the storage device is called and executed by the processing device to implement the following steps: The Agent module of the monitoring end uses the eBPF technology to obtain the first real-time operation data of each monitored electronic device in real time, and determines the electronic device whose first real-time operation data exceeds the corresponding risk threshold as the target electronic device; wherein the risk threshold is lower than the standard preset threshold; Assessing the importance level of the target electronic device, and if the importance level is higher than a level threshold, acquiring second real-time operation data of each associated electronic device in the same geographical area as the target electronic device; Determine a correlation anomaly index based on each of the second real-time operation data and the corresponding risk threshold, and adjust the standard preset threshold of the target electronic device to a temporary standard preset threshold based on the correlation anomaly index; If the first real-time operation data of the target electronic device exceeds the temporary standard preset threshold, an abnormal alarm signal for the target electronic device is output.

[0012] The present invention also discloses an electronic device, comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement any of the above methods.

[0013] The present invention also discloses a computer storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above methods.

[0014] The present invention also discloses a computer program product, which includes computer codes. When the computer codes are executed by a processor of an electronic device, any of the above methods is implemented.

[0015] The beneficial effects of the present invention are at least: Compared with the traditional single fixed threshold judgment method, the above method of the present invention can more comprehensively consider the correlation between electronic devices and surrounding environmental factors, greatly improving the accuracy and timeliness of fault warning. For important electronic equipment, it can detect potential fault risks in advance, effectively reduce the probability of equipment damage, improve the stability and reliability of the entire system, reduce business interruptions and economic losses caused by equipment failures, and provide a strong guarantee for the stable operation of electronic equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flowchart of a device monitoring method based on deep learning disclosed in an embodiment of the present invention; Figure 2 It is a structural schematic diagram of a deep learning-based equipment monitoring system disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following is a description of the implementation of the present application by specific specific embodiments. People familiar with the technology can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0019] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0020] In response to the above technical issues, such as Figure 1 As shown, an embodiment of the present invention discloses a device monitoring method based on deep learning, and the method comprises the following steps: S101, the Agent module of the monitoring end uses the eBPF technology to obtain the first real-time operation data of each monitored electronic device in real time, and determines the electronic device whose first real-time operation data exceeds the corresponding risk threshold as the target electronic device; wherein the risk threshold is lower than the standard preset threshold.

[0021] The Agent module on the monitoring end uses the eBPF (extended Berkeley Packet Filter) technology to obtain the first real-time operation data of each monitored electronic device in real time. eBPF technology is an efficient kernel-state programmable technology that can go deep into the operating system kernel and accurately capture various system data without affecting system performance. For example, in a large cloud computing data center, there are thousands of servers. The Agent module uses eBPF technology to obtain the first real-time operation data of each server, such as CPU usage, memory occupancy, and disk I / O rate. In addition, the Agent module can also support OTLP (Open Telemetry Protocol) and Prometheus protocols, so that it can collect millions of time series data with extremely low system overhead.

[0022] If any first real-time operation data of an electronic device does not exceed the standard preset threshold, but exceeds the corresponding risk threshold, the electronic device is deemed to have an abnormal tendency and is identified as a target electronic device. For example, if the CPU usage of a server exceeds the threshold of 80% (but is lower than the standard preset threshold of 90%), then the server will be identified as a target electronic device.

[0023] S102, evaluating the importance level of the target electronic device, and if the importance level is higher than a level threshold, acquiring second real-time operation data of each associated electronic device in the same geographical area as the target electronic device.

[0024] The evaluation of the importance level can be determined based on factors such as the function of the electronic device in the entire system and the criticality of the business it carries. For example, in a financial transaction system, the importance level of the server responsible for core transaction processing will be much higher than that of the server responsible for log recording. If the importance level is higher than the level threshold, it means that the target electronic device is very critical, and once a failure occurs, it will have a serious impact on the entire system. At this time, in order to more comprehensively and accurately judge the status of the target electronic device, it is necessary to obtain the second real-time operating data of each associated electronic device in the same geographical area as the target electronic device. For example, in the same computer room of a data center, if a key database server is determined to be the target electronic device, then it is necessary to obtain the real-time operating data of other servers, network equipment and other associated electronic devices in the same computer room, such as the traffic data of the network equipment, the load data of other servers, etc.

[0025] S103: deriving an associated abnormality index according to each of the second real-time operation data and the corresponding risk threshold evaluation, and adjusting the standard preset threshold of the target electronic device to a temporary standard preset threshold according to the associated abnormality index.

[0026] This step is to compare the real-time operation data of the associated electronic devices with their respective risk thresholds (also lower than the standard preset thresholds), and comprehensively analyze to obtain a correlation anomaly index to measure the degree of synchronization anomaly between these associated electronic devices and the target electronic devices. For example, if the CPU usage of multiple servers in the same computer room is close to or exceeds their own risk thresholds (but all lower than the standard preset thresholds), and the traffic of network devices is far higher than the normal level; or, if strong electromagnetic interference occurs in the computer room, the data transmission rate of multiple servers in the computer room drops significantly, etc. In the above cases, the corresponding correlation anomaly index will be higher.

[0027] If the above-mentioned correlation anomaly index is very high, it means that the environment in which the target electronic device is located has a greater risk. In order to promptly discover possible faults in the target electronic device, it is necessary to adjust the standard preset threshold of the target electronic device. For example, the original standard preset threshold of the CPU usage of the target electronic device is 90%. When the correlation anomaly index shows that the surrounding devices also have obvious anomalies, the threshold can be set to be lowered to 80%; or, the original standard preset threshold (lower limit) of the data transmission rate of the target electronic device is 50GT / s. When the correlation anomaly index shows that the surrounding devices also have obvious anomalies, the threshold can be set to be increased to 60GT / s.

[0028] S104: if the first real-time operation data of the target electronic device exceeds the temporary standard preset threshold, an abnormal alarm signal for the target electronic device is output.

[0029] After the previous steps, the threshold of the target electronic device has been adjusted more reasonably. At this time, once its first real-time operating data (for example, exceeding the maximum amplitude of the corresponding risk threshold) exceeds (i.e., is higher or lower than) the adjusted temporary standard preset threshold, it can be determined that the target electronic device has an abnormality and output an alarm signal in time. For example, when the CPU usage of the target electronic device exceeds the lowered 80% threshold, or the data transmission rate is lower than the increased 60GT / s threshold, the monitoring system will immediately issue an alarm and notify the operation and maintenance personnel to handle it to avoid further deterioration of the fault. In addition, after the alarm is completed, the temporary standard preset threshold is restored to the standard preset threshold.

[0030] Compared with the traditional single fixed threshold judgment method, the above method of the present invention can more comprehensively consider the correlation between electronic devices and surrounding environmental factors, greatly improving the accuracy and timeliness of fault warning. For important electronic equipment, it can detect potential fault risks in advance, effectively reduce the probability of equipment damage, improve the stability and reliability of the entire system, reduce business interruptions and economic losses caused by equipment failures, and provide a strong guarantee for the stable operation of electronic equipment.

[0031] Optionally, the evaluating the importance level of the target electronic device includes: Acquire performance parameters of the target electronic device itself, and evaluate and obtain a first importance score and a second importance score according to the performance parameters; wherein the operation record data includes data that can be used to evaluate the operation reliability of the target electronic device; Acquire functional link information of the target electronic device in the entire deployed system, and evaluate and obtain a third importance score based on the functional link information; The first importance score, the second importance score, and the third importance score are weightedly integrated to obtain a fourth importance score, and the importance level is obtained based on matching of the fourth importance score.

[0032] In this embodiment, the performance parameters of the target electronic device itself are one of the key indicators to measure its importance. For example, in a data center, the server's CPU core number, memory capacity, hard disk read and write speed and other parameters determine its ability to handle tasks. A high-performance server can quickly respond to a large number of business requests. If its performance degrades or fails, it will have a great impact on the entire system. Through a specific evaluation algorithm (such as the analytic hierarchy process AHP, multi-layer perceptron MLP, etc.), these performance parameters are quantified as the first important score. The better the parameter, the higher the score.

[0033] In order to control costs, for important key components, designers generally choose equipment produced based on higher product design and production standards, and for those unimportant non-critical components, they choose equipment produced based on lower product design and production standards. Therefore, by statistically analyzing the number of failures and average trouble-free operation time in the operation record data of the target electronic equipment, its failure rate is evaluated, and it is judged whether it is a key device or a non-key device based on the failure rate. If statistics show that a certain device has a high failure rate, it means that it is likely to be a non-key device and has a low importance in the entire production system, and then the second most important score is set to a low value; conversely, if the failure rate of an electronic device is very low, it means that it is very important and is likely to be a key device, and then the second most important score is set to a high value.

[0034] The information about the functional link of the target electronic device in the entire system is also critical to judging its importance level. For example, in an e-commerce platform system, the server responsible for order processing is in the core functional link, which is directly related to the completion of the transaction and has a higher importance; while the server responsible for displaying user comments, although it also has a certain role, is less important than the order processing link. By analyzing the criticality of the functional link in the entire system, the third importance score is evaluated. The more critical the function, the higher the score.

[0035] The first important score, the second important score, and the third important score obtained above are weighted and integrated. Different score weights can be set according to actual conditions and experience. For example, if the system pays more attention to the performance of the equipment, the weight of the first important score can be set higher; if the operating reliability of the equipment is more valued, the weight of the second important score can be increased. The fourth important score is obtained through weighted calculation, which comprehensively reflects the important factors of many aspects of the equipment.

[0036] Finally, according to the pre-set matching rules between the score and the importance level, for example, the importance score is divided into different intervals, each interval corresponds to a different importance level (high, medium, low, etc.), so as to match the importance level of the target electronic device.

[0037] Optionally, the acquiring the second real-time operation data of each associated electronic device in the same geographical area as the target electronic device includes: According to the importance level of the target electronic device, a first screening distance is obtained by matching the preset first association data; Acquire all historical fault records of the target electronic device, classify each of the historical fault records into an internal fault type and an external fault type, obtain the number of external fault types by counting, and obtain a range-increasing weight coefficient by matching from a preset second associated data according to the number of types; The first screening distance is adjusted to a larger second screening distance using the range-increasing weighting factor.

[0038] In this embodiment, the abnormality of the target electronic device may be caused by external factors (such as electromagnetic interference), and external factors usually affect other electronic devices in the area. At this time, by referring to whether other electronic devices in the same geographical area (such as the same server room) also generally have abnormalities, auxiliary analysis can be performed on whether the target electronic device has external abnormalities. The size of the geographical area can be determined in the following way: The first associated data for characterizing the correspondence between the importance level of the device and the screening distance is pre-set, and then a matching first screening distance is obtained from the first associated data according to the importance level of the target electronic device obtained by evaluation. For example, for target electronic devices with a high importance level, a larger first screening distance will be matched in the first associated data. For example, in a large data center, the importance level of the core server is high, and its first screening distance may be set to the associated electronic devices within a radius of 20 meters with the server as the center; while for non-core servers with a lower importance level, the screening distance can be a radius of 10 meters.

[0039] At the same time, different target electronic devices have different abilities to resist external influences. By analyzing the number of external-cause failures in all historical failure records of the target electronic devices, this ability can be indirectly analyzed. Specifically: Obtain all historical fault records of the target electronic device and divide them into internal fault types and external fault types. Internal faults are usually caused by internal factors such as equipment overload and software errors; external faults are caused by external factors such as electromagnetic interference, power supply abnormalities, physical vibrations, etc.

[0040] The number of external fault types is counted, and this number reflects the degree to which the target electronic device is susceptible to the external environment. Similar to the first associated data, the pre-set second associated data is used to characterize the correspondence between the number of external fault types and the distance-increasing weight coefficient. If the number of external fault types is large, it means that the target electronic device has a smaller ability to resist external influences, that is, multiple external factors are likely to cause the target electronic device to fail, and the distance-increasing weight coefficient matched from the second associated data will be large; otherwise, it will be small. For example, if the target electronic device has historically failed due to 10 external factors such as electromagnetic interference and voltage fluctuations, the matched distance-increasing weight coefficient is 1.5; if there are 5 types of external faults, the distance-increasing weight coefficient is set to 1.1.

[0041] Then, the obtained distance-increasing weight coefficient is used to adjust the first screening distance to a larger second screening distance. In this way, the degree to which the first screening distance obtained above should be increased can be decided based on the difficulty of the target electronic device itself being affected by external factors. When the target electronic device is more susceptible to multiple external environmental influences, it may not be comprehensive enough to obtain the data of the associated electronic device based only on the first screening distance (for example, some electronic devices within the first screening distance will not be affected by electromagnetic interference. At this time, these electronic devices cannot be used to assist in analyzing whether the target electronic device is affected by electromagnetic interference). It is necessary to expand the scope to obtain more real-time operating data of associated electronic devices that may be affected by the same external factors, thereby improving the accuracy and timeliness of abnormal analysis of the target electronic device.

[0042] It should be noted that historical fault records refer to fault cause record data obtained by managers after manual analysis of faulty electronic equipment, or fault cause record data automatically analyzed and recorded by the management system based on monitored fault data.

[0043] Optionally, evaluating and obtaining a correlation anomaly index based on each of the second real-time operation data and a corresponding risk threshold value includes: Calculating a first difference between each of the second real-time operating data of each associated electronic device and a corresponding risk threshold, and calculating an equivalent value of a normalized value of all the first differences; If the equivalent value is higher than a preset value, further calculating a second difference between the first real-time operation data of the target electronic device and the corresponding risk threshold, and obtaining a first correlation abnormality index according to a normalized value of the second difference and the equivalent value; If the equivalent value is not higher than the preset value, further acquiring each recent historical operation data of each associated electronic device, fitting the historical operation data with the second real-time operation data of the same type to obtain an operation trend curve, and identifying an abnormal trend curve segment therein; A convolutional network is used to extract features from the vectorized abnormal trend curve segments to obtain operation sub-features of any associated electronic device, and the operation sub-features are spliced ​​and integrated into operation features. An associated abnormality prediction model is used to predict and analyze the operation features and the first real-time operation data of the target electronic device and the corresponding risk threshold to obtain a second associated abnormality index.

[0044] In this embodiment, multiple second real-time operation data of each associated electronic device are obtained (each second real-time operation data corresponds to a different component or module of the associated electronic device, or different operation parameters of the same component or module), and the first difference between each second real-time operation data and the corresponding risk threshold is calculated (risk threshold-second real-time operation data). For example, the second real-time operation data of the CPU usage rate of the associated electronic device is 65%, and its corresponding risk threshold is 70%, then the first difference is 70%-65%=5%. After calculating multiple first differences of each associated electronic device, the equivalent value of the normalized value of these first differences (removing the influence of the dimensions of different operation parameters) is calculated. The equivalent value can be the median value or maximum value of the normalized values ​​of each first difference, etc., and is not specifically limited.

[0045] When the calculated equivalent value is higher than the preset value, it means that the associated electronic device has a tendency to deviate significantly from the normal range, which indirectly reflects that the associated electronic device and the target electronic device are likely to have abnormal conditions together. At this time, the above equivalent value of the associated electronic device can be directly used to calculate the associated abnormality index of the target electronic device: first calculate the second difference (first real-time operating data - risk threshold) between the first real-time operating data of the target electronic device (for example, the maximum amplitude exceeding the corresponding risk threshold) and the corresponding risk threshold; then, calculate the first associated abnormality index based on the normalized value of the second difference and the equivalent value calculated previously (for example, calculate the difference between the two). The first associated abnormality index is negatively correlated with the difference between the two.

[0046] If the equivalent value is not higher than the preset value, it means that the current operating data of the associated electronic device deviates from the preset threshold within an acceptable range, and there is no obvious abnormality but there may still be potential abnormalities. At this time, the historical operating data of each associated electronic device in the recent period (for example, within 20 seconds) is obtained, and these historical operating data are fitted with the second real-time operating data of the same type (for example, the same data transmission rate) to generate an operating trend curve. The abnormal trend curve segment is identified through the data analysis method, such as the part of the data transmission rate curve that suddenly drops sharply.

[0047] The identified abnormal trend curve segments are vectorized so that they can be processed by the convolutional network. The convolutional network has a powerful feature extraction capability. By performing convolution operations, pooling and other operations on the vectorized abnormal trend curve segments, the operating sub-features of any associated electronic device can be extracted. For example, the frequency, amplitude and other features of the curve change are extracted. Then the various operating sub-features are spliced ​​and integrated into an operating feature, which comprehensively reflects the abnormal conditions of all associated electronic devices. Finally, the pre-trained associated anomaly prediction model is used to predict and analyze the operating features, together with the first real-time operating data of the target electronic device and the corresponding risk threshold, to obtain a second associated anomaly index. Among them, multiple abnormal trend curve segments corresponding to different operating parameters can be obtained, and the maximum value of the associated anomaly indexes corresponding to these abnormal trend curve segments that are predicted and analyzed is taken as the second associated anomaly index.

[0048] Among them, the associated anomaly prediction model can be constructed based on a machine learning algorithm (such as a support vector machine, random forest, etc.) or a deep learning algorithm (such as a recurrent neural network, etc.), and through learning a large amount of historical data, it can predict the abnormality of the current associated electronic device based on the input operation characteristics, the first real-time operation data of the target electronic device, and the corresponding risk threshold. However, the associated anomaly prediction model can also be obtained by local fine-tuning training of a general large model (such as DeepSeek, GPT-4), which is not specifically limited.

[0049] Optionally, the Agent module regularly collects and updates historical fault records of the target electronic device, constructs a training data set using the historical fault records, and locally trains the associated abnormality prediction model using training data in the training data set; In addition, the Agent module also regularly publishes the associated anomaly prediction model to the alliance chain network for distributed training, and integrates the important parameters of the model obtained from the distributed training into the associated anomaly prediction model after local training, and then performs secondary training.

[0050] In this embodiment, the Agent module also undertakes the key task of regularly collecting and updating the historical fault records of the target electronic device during operation. These historical fault records contain various types of fault information that occurred in the past operation of the device, such as the time when the fault occurred, the type of fault, the operating parameters of the device at the time of the fault, etc. By sorting and filtering these rich and detailed data, the Agent module can construct a training data set for model training. For example, data of the same fault type are classified into one category, and key operating parameters related to the fault are extracted as features, thus forming training data with clear features and labels.

[0051] Using the constructed training data set, the Agent module first uses the training data to perform local training on the associated anomaly prediction model. Through repeated iterative training, the model is gradually optimized and can more accurately predict whether there is an associated anomaly based on the input device operation data.

[0052] The Agent module also has the ability to publish the associated anomaly prediction model to the alliance chain network for distributed training. The alliance chain network consists of multiple nodes, and each node can use its own computing resources and data to train the model. This distributed training method can make full use of the resources and data of all parties, increase the diversity and scale of training data, and thus improve the generalization ability of the model. After the distributed training is completed, the Agent module will integrate the important parameters of the model trained by each node (depending on the type of model, such as the learning rate of the CNN model, the number of convolution kernels, etc.) into the locally trained associated anomaly prediction model. For example, the prediction parameters for a specific fault type in the models trained by different nodes are weighted averaged and then updated to the local model.

[0053] After completing parameter integration, the Agent module will perform a second training on the model to fine-tune the newly integrated parameters so that they can work better with the existing local parameters, thereby more accurately predicting associated anomalies when faced with complex and changeable equipment operating conditions.

[0054] like Figure 2The embodiment of the present invention further discloses a deep learning-based equipment monitoring system, the system comprising a processing device and a storage device, the computer code stored in the storage device is called and executed by the processing device to implement the following steps: The Agent module of the monitoring end uses the eBPF technology to obtain the first real-time operation data of each monitored electronic device in real time, and determines the electronic device whose first real-time operation data exceeds the corresponding risk threshold as the target electronic device; wherein the risk threshold is lower than the standard preset threshold; Assessing the importance level of the target electronic device, and if the importance level is higher than a level threshold, acquiring second real-time operation data of each associated electronic device in the same geographical area as the target electronic device; Determine an associated abnormality index based on each of the second real-time operation data and the corresponding risk threshold, and adjust the standard preset threshold of the target electronic device to a temporary standard preset threshold based on the associated abnormality index; If the first real-time operation data of the target electronic device exceeds the temporary standard preset threshold, an abnormal alarm signal for the target electronic device is output.

[0055] An embodiment of the present invention further discloses an electronic device, comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the method described in the above embodiment.

[0056] An embodiment of the present invention further discloses a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is executed by a processor to implement the method described in the above embodiment.

[0057] An embodiment of the present invention further discloses a computer program product, which includes computer code. When the computer code is executed by a processor of an electronic device, the method described in the above embodiment is implemented.

[0058] The computer-readable storage medium described above may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. Alternatively, the computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0059] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0060] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A device monitoring method based on deep learning, characterized in that: The method comprises the following steps: The Agent module of the monitoring end uses the eBPF technology to obtain the first real-time operation data of each monitored electronic device in real time, and determines the electronic device whose first real-time operation data exceeds the corresponding risk threshold as the target electronic device; wherein the risk threshold is lower than the standard preset threshold; Assessing the importance level of the target electronic device, and if the importance level is higher than a level threshold, acquiring second real-time operation data of each associated electronic device in the same geographical area as the target electronic device; Determine an associated abnormality index based on each of the second real-time operation data and the corresponding risk threshold, and adjust the standard preset threshold of the target electronic device to a temporary standard preset threshold based on the associated abnormality index; If the first real-time operation data of the target electronic device exceeds the temporary standard preset threshold, an abnormal alarm signal for the target electronic device is output.

2. The device monitoring method based on deep learning according to claim 1, characterized in that: The evaluation target electronic device importance level includes: Acquire performance parameters of the target electronic device itself, and evaluate and obtain a first importance score and a second importance score according to the performance parameters; wherein the operation record data includes data that can be used to evaluate the operation reliability of the target electronic device; Acquire functional link information of the target electronic device in the entire deployed system, and evaluate and obtain a third importance score based on the functional link information; The first importance score, the second importance score, and the third importance score are weightedly integrated to obtain a fourth importance score, and the importance level is obtained based on matching of the fourth importance score.

3. The device monitoring method based on deep learning according to claim 2, characterized in that: The step of obtaining the second real-time operation data of each associated electronic device in the same geographical area as the target electronic device includes: According to the importance level of the target electronic device, a first screening distance is obtained by matching the preset first association data; Acquire all historical fault records of the target electronic device, classify each of the historical fault records into an internal fault type and an external fault type, obtain the number of external fault types by counting, and obtain a range-increasing weight coefficient by matching from a preset second associated data according to the number of types; The first screening distance is adjusted to a larger second screening distance using the range-increasing weighting factor.

4. The device monitoring method based on deep learning according to claim 3 is characterized in that: The step of evaluating the associated abnormality index based on each of the second real-time operation data and the corresponding risk threshold comprises: Calculating a first difference between each of the second real-time operating data of each associated electronic device and a corresponding risk threshold, and calculating an equivalent value of a normalized value of all the first differences; If the equivalent value is higher than a preset value, further calculating a second difference between the first real-time operation data of the target electronic device and the corresponding risk threshold, and obtaining a first correlation abnormality index according to a normalized value of the second difference and the equivalent value; If the equivalent value is not higher than the preset value, further acquiring each recent historical operation data of each associated electronic device, fitting the historical operation data with the second real-time operation data of the same type to obtain an operation trend curve, and identifying an abnormal trend curve segment therein; A convolutional network is used to extract features from the vectorized abnormal trend curve segments to obtain operation sub-features of any associated electronic device, and the operation sub-features are spliced ​​and integrated into operation features. An associated abnormality prediction model is used to predict and analyze the operation features and the first real-time operation data of the target electronic device and the corresponding risk threshold to obtain a second associated abnormality index.

5. The device monitoring method based on deep learning according to claim 1, characterized in that: The Agent module regularly collects and updates historical fault records of the target electronic device, constructs a training data set using the historical fault records, and locally trains the associated anomaly prediction model using the training data in the training data set; In addition, the Agent module also regularly publishes the associated anomaly prediction model to the alliance chain network for distributed training, and integrates the important parameters of the model obtained from the distributed training into the associated anomaly prediction model after local training, and then performs secondary training.

6. A deep learning-based equipment monitoring system, the system comprising a processing device and a storage device, characterized in that: The computer code stored in the storage device is called and executed by the processing device to implement the following steps: The Agent module of the monitoring end uses the eBPF technology to obtain the first real-time operation data of each monitored electronic device in real time, and determines the electronic device whose first real-time operation data exceeds the corresponding risk threshold as the target electronic device; wherein the risk threshold is lower than the standard preset threshold; Assessing the importance level of the target electronic device, and if the importance level is higher than a level threshold, acquiring second real-time operation data of each associated electronic device in the same geographical area as the target electronic device; Determine an associated abnormality index based on each of the second real-time operation data and the corresponding risk threshold, and adjust the standard preset threshold of the target electronic device to a temporary standard preset threshold based on the associated abnormality index; If the first real-time operation data of the target electronic device exceeds the temporary standard preset threshold, an abnormal alarm signal for the target electronic device is output.

7. The deep learning-based equipment monitoring system according to claim 6, characterized in that: The evaluation target electronic device importance level includes: Acquire performance parameters of the target electronic device itself, and evaluate and obtain a first importance score and a second importance score according to the performance parameters; wherein the operation record data includes data that can be used to evaluate the operation reliability of the target electronic device; Acquire functional link information of the target electronic device in the entire deployed system, and evaluate and obtain a third importance score based on the functional link information; The first importance score, the second importance score, and the third importance score are weightedly integrated to obtain a fourth importance score, and the importance level is obtained based on matching of the fourth importance score.

8. An electronic device comprising: At least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the method according to any one of claims 1 to 5.

9. A computer storage medium storing a computer program, characterized in that: The computer program is executed by a processor to implement the method according to any one of claims 1 to 5.

10. A computer program product, characterized in that: The computer program product includes computer codes, and when the computer codes are executed by a processor of an electronic device, the method according to any one of claims 1 to 5 is implemented.

Images