Data sharing method of operation and maintenance auditing system

Abstract

The invention discloses a data sharing method of an operation and maintenance auditing system, and particularly relates to the technical field of data management, and the method comprises the following steps: firstly, collecting and storing auditing data generated in a storage, transportation and maintenance auditing process for subsequent processing; during data sharing, feature extraction and analysis are carried out on audit data, an analysis result is input into a pre-trained mode judgment model, and the model outputs 0 or 1 which respectively correspond to a batch processing mode and a stream processing mode; selecting a corresponding data processing mode to execute sharing operation according to a model output result; when the output result is 1, performing access analysis on the access information of the data, dividing the data into high-frequency access data and low-frequency access data, performing cache acceleration on the high-frequency access data, reducing the data loading load and improving the system response efficiency; by judging the access requirement and the abnormal condition, the batch processing mode or the stream processing mode can be dynamically selected, resource optimization of data sharing is achieved, and the data sharing effect is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data management technology, and more specifically, to a data sharing method for an operation and maintenance audit system. Background Art

[0002] In modern operation and maintenance audit systems, with the continuous expansion of the system and the rapid growth of data volume, efficient sharing of operation and maintenance audit data has become crucial. The core task of the operation and maintenance audit system is to monitor, record, and analyze various operations, events, and behaviors within the system in real time, and share this data with other system modules or operation and maintenance personnel when necessary so that timely response measures can be taken. However, traditional data sharing models often have the following problems:

[0003] In the case of low access frequency or non-real-time requirements, the applicability of the traditional sharing model can meet the current data sharing scenarios. However, in the case of high-frequency access and high real-time requirements, the traditional data sharing model often has great limitations, and the performance will also decline. It may also cause data response delays and fail to share key audit information with other system modules or operation and maintenance personnel in a timely manner, affecting the rapid location and response of problems. Therefore, a data sharing method for the operation and maintenance audit system is proposed here to solve the above problems. Summary of the invention

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] A data sharing method for an operation and maintenance audit system comprises the following steps:

[0006] Collect the audit data generated by the operation and maintenance audit system during the operation and maintenance audit process, and store the collected audit data for subsequent processing operations;

[0007] During the data sharing process, the audit data is feature extracted and analyzed, and the feature analysis results are transmitted to the pre-trained pattern determination model. The output result of the pattern determination model is 0 or 1, and 0 or 1 corresponds to two preset data processing modes respectively. Based on the output result of the pattern determination model, the corresponding data processing mode is selected to perform the processing operation;

[0008] When the output result of the pattern determination model is 1, access analysis is performed on the access information of the audit data. The audit data is divided into high-frequency access data or low-frequency access data according to the access analysis results. All high-frequency access data are aggregated and cached for acceleration to alleviate the data loading load.

[0009] In a preferred embodiment, feature extraction of audit data refers to extracting access requirement information and access exception information respectively.

[0010] In a preferred embodiment, during feature analysis, an access demand index is generated based on the access demand information, and an access anomaly index is generated based on the access anomaly information.

[0011] In a preferred embodiment, the access demand index acquisition logic is:

[0012] Based on the access demand information, the total number of accesses is counted within a preset fixed time window, divided by the time value of the fixed time window to obtain the access frequency, the average response time of each data request is calculated to obtain the average delay, the number of statistical data updates is calculated to obtain the data refresh frequency, and the number of repetitions of the same request content is counted;

[0013] The calculation formula of access demand index is:

[0014] R = DD + JH;

[0015] DD=α*ln(F+1)+β*(Td) 2 +γ*log(U+1)+δ*Cmax;

[0016]

[0017] DD represents the sum of all individual items, JH represents the sum of all interaction items, α, β, γ, δ, ε, θ, ζ are all preset non-zero proportional coefficients, and the sum of all non-zero proportional coefficients is a constant, F represents the access frequency, T d represents the average delay, U represents the data refresh frequency, Cmax represents the maximum number of repetitions of the same request content, and R represents the access demand index.

[0018] In a preferred embodiment, the access anomaly index acquisition logic is:

[0019] Based on the access anomaly information, the minimum time interval between all two consecutive accesses is obtained within the preset fixed time window, and compared with the normal time interval Tnorm, the time interval anomaly At is calculated, and the formula is as follows:

[0020] The total number of visits W is counted and compared with the preset visit frequency threshold Wnorm to calculate the visit frequency abnormality Aw. The formula is as follows:

[0021] Based on the preset abnormality score table of different access paths, the access times P and the total access times Ptotal of the abnormal path within the preset fixed time window are counted to calculate the access path abnormality Ap. The formula is as follows:

[0022] The calculation formula of access anomaly index is:

[0023] Y is the access anomaly index, and ∈ is a constant set to prevent the calculation formula from being meaningless.

[0024] In a preferred embodiment, the feature analysis result is transmitted to a pre-trained mode determination model, and the mode determination model output result of 0 or 1 means:

[0025] The access anomaly index and the access demand index are used together as input to the pre-trained pattern determination model. The pattern determination model is a combination of a polynomial regression model and a threshold partitioning model. The output result of the polynomial regression model is then transmitted to the threshold partitioning model. The threshold partitioning model has a preset partitioning threshold. If the output result of the polynomial regression model is greater than or equal to the preset partitioning threshold, the output result of the threshold partitioning model is 1. If the output result of the polynomial regression model is less than the preset partitioning threshold, the output result of the threshold partitioning model is 0.

[0026] In a preferred embodiment, 0 or 1 corresponds to two preset data processing modes respectively:

[0027] 0 corresponds to the batch processing mode among the two preset data processing modes;

[0028] 1 corresponds to the stream processing mode of the two preset data processing modes.

[0029] In a preferred embodiment, performing access analysis on the access information of the audit data and classifying the audit data into high-frequency access data or low-frequency access data according to the access analysis result means:

[0030] Get a single data item in the audit data, and obtain the ratio BL of its corresponding number of accesses to the total number of accesses of all single data items within a preset fixed time window, as well as the average time interval TJ between two consecutive accesses of a single data item. Then calculate the ratio BL divided by the average time interval TJ to get the access coefficient. Compare the access coefficient with the preset separation threshold. If the access coefficient of the single data item is greater than the preset separation threshold, classify it as high-frequency access data. If the access coefficient of the single data item is less than or equal to the preset separation threshold, classify it as low-frequency access data.

[0031] Technical effects and advantages of the present invention:

[0032] The present invention realizes resource optimization of data sharing by judging access requirements and abnormal situations and dynamically selecting batch processing mode or stream processing mode. In the scenario of low-frequency access or non-real-time demand, the system automatically selects batch processing mode to reduce unnecessary resource consumption; in the scenario of high-frequency access or high-real-time demand, the system automatically switches to stream processing mode to ensure timely sharing of data and processing efficiency.

[0033] The present invention can automatically switch the processing mode according to the access demand index and the anomaly index, and switch to the stream processing mode when there is high demand or frequent anomalies, so as to ensure that the data can be shared with relevant operation and maintenance personnel in real time. This can effectively shorten the response time, improve the agility of the system, and enable the system to provide the required operation and maintenance data support in a timely manner at critical moments.

[0034] The present invention generates access demand index and access anomaly index by analyzing the access characteristics of audit data, so as to timely discover potential abnormal behaviors. The system can quickly switch to stream processing mode when necessary, and share abnormal data with operation and maintenance personnel in real time for rapid response and processing, effectively improving the security of the system.

[0035] The present invention enables the system to flexibly respond to different load conditions through an automated mode determination model. When the access demand is high or abnormal access behavior occurs frequently, the system can dynamically adjust to the stream processing mode to meet the real-time requirements of the system; when the load is low, the system can return to the batch processing mode to reduce resource usage, avoid excessive processing, and ensure the stable operation of the system.

[0036] The data sharing method of the present invention can not only optimize the resource utilization of the system, but also improve the effect of data sharing. High-frequency access data is shared through cache acceleration, which helps to alleviate the system's loading load, ensure efficient data sharing and rapid response, and enhance the system's data sharing capabilities in large-scale operation and maintenance scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0038] Figure 1 This is a schematic diagram of a data sharing method for an operation and maintenance audit system in the present invention. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Reference Figure 1 The following examples are obtained:

[0041] Embodiment 1: A data sharing method of an operation and maintenance audit system comprises the following steps:

[0042] The audit data generated by the operation and maintenance audit system during the operation and maintenance audit process is collected and stored for subsequent processing operations; the basic operation of data collection and storage is the starting point of the data analysis process of the entire operation and maintenance audit system. By collecting the audit data generated during the operation and maintenance process, the system can record all important operation and maintenance activities, system events, operation records, etc. After storing these data, they can be further analyzed, screened and supported for decision making in subsequent steps. The core significance of this process is to ensure the integrity and traceability of the data, so that the system can provide data support for subsequent analysis, classification and pattern judgment. The collection and storage of operation and maintenance audit data is the basic operation of the operation and maintenance audit system, and its purpose is to provide data support for the overall security, stability and optimization of the system. These data can help detect abnormal operations, evaluate the resource usage of the system, and provide data support for subsequent analysis and troubleshooting.

[0043] In the existing technology, the operation and maintenance audit system usually uses automated tools to monitor system activities in real time, collect a large number of system logs, user behavior records, etc., and store them in a centralized or distributed database. The centralized storage of data can ensure the consistency and integrity of the data, allowing operation and maintenance personnel to retrieve the data at any time for analysis and tracking.

[0044] In the process of data sharing, the audit data is feature extracted and analyzed, and the feature analysis results are sent to the pre-trained mode determination model. The output of the mode determination model is 0 or 1, which corresponds to two preset data processing modes. The corresponding data processing mode is selected based on the output of the mode determination model to perform processing operations; feature extraction converts the original data into specific features (such as access requirements), which are used to describe the state and characteristics of the data. The feature analysis results are input into the mode determination model, and the data processing mode is determined according to the performance of the features (0 represents batch processing mode, 1 represents stream processing mode). The main significance of this step is to realize the automatic processing decision of data, and determine whether real-time processing is required according to the access requirements and abnormality of the data. Through the pre-trained mode determination model, the system can select the most appropriate data processing mode without human intervention, so as to find a balance between resource consumption and real-time processing. Batch processing is suitable for situations with low data access frequency or low latency requirements, while stream processing mode is suitable for situations with high access frequency and more abnormalities. This automated decision greatly improves the response speed and resource utilization efficiency of the system.

[0045] In traditional operation and maintenance audit systems, data processing modes are usually statically set, manually specifying how data should be processed, and cannot be dynamically adjusted according to real-time conditions. By introducing feature analysis and pattern determination models, modern operation and maintenance audit systems can achieve automated decision-making, allowing the system to dynamically select appropriate processing modes based on changes in data features.

[0046] When the output result of the mode determination model is 1, the access information of the audit data is analyzed, and the audit data is divided into high-frequency access data or low-frequency access data according to the access analysis results. All high-frequency access data are summarized and cached to relieve the data loading load. When the stream processing mode is selected, further optimization can be performed. Specifically, when the output result of the mode determination model is 1 (i.e., stream processing mode), the system analyzes the access frequency of the data and classifies high-frequency access data and low-frequency access data. Cache and accelerate high-frequency access data to improve the processing efficiency of the system and reduce the load pressure caused by frequent access, thereby achieving efficient use of resources. Caching high-frequency access data can significantly reduce the load pressure of the system. In the stream processing mode, the access frequency of data is high, and direct access to data will cause large system overhead and delay. By caching high-frequency data, the number of database reads can be reduced, the data response speed can be improved, and the overall performance and resource usage of the system can be significantly optimized.

[0047] In traditional operation and maintenance audit systems, high-frequency access data and low-frequency access data are usually not specially distinguished and cached. This method cannot effectively handle the access pressure of high-frequency data and easily causes system bottlenecks. After the introduction of cache acceleration technology, modern operation and maintenance systems can dynamically cache high-frequency data according to data access conditions, reduce the impact of high-frequency requests on the system, and thus improve overall processing efficiency.

[0048] Feature extraction of audit data refers to extracting access demand information and access anomaly information respectively. During feature analysis, an access demand index is generated based on the access demand information, and an access anomaly index is generated based on the access anomaly information. Access demand information provides key information about system access frequency, data latency, data refresh frequency, and repeated request frequency, and can clearly describe the interaction between users and the system. Different access demands will cause different pressures on system resources (such as bandwidth, CPU, and memory). Through access demand information, we can understand the resource consumption of the system within a certain time window and help make corresponding load management decisions. By quantifying the access demand information, an access demand index is generated, which can accurately represent the real-time demand level of the system in the current window. The higher the index, the faster the system needs to respond to meet user needs. The access demand index can be used as an input to the mode determination model to help the system automatically select the appropriate data processing mode (batch processing or stream processing).

[0049] Access anomaly information focuses on uncommon behaviors that may threaten system security or performance (such as frequent abnormal path access and abnormal access time intervals), helping the system to identify potential abnormal situations earlier. Through access anomaly information, the system can promptly identify potential malicious access behaviors or system vulnerabilities. For the operation and maintenance audit system, this abnormal information is very important because it is directly related to the security and stability of the system. By converting access anomaly information into an access anomaly index, different types of abnormal behaviors can be uniformly represented as a numerical value, which is convenient for the system to determine whether measures need to be taken. The higher the index, the more serious the abnormal behavior and the stronger the response demand of the system. The access anomaly index is also one of the key inputs of the mode determination model. By judging the access anomaly index and the access demand index, the present invention can decide whether to switch to a higher priority stream processing mode to ensure that abnormal access can be processed and tracked in a timely manner, which helps to ensure the stability of the system.

[0050] The logic of obtaining the access demand index is as follows: based on the access demand information, the total number of accesses is counted within a preset fixed time window, divided by the time value of the fixed time window to obtain the access frequency, the average response time of each data request is calculated to obtain the average delay, the number of statistical data updates is calculated to obtain the data refresh frequency, and the number of repetitions of the same request content is counted;

[0051] The calculation formula of access demand index is:

[0052] R = DD + JH;

[0053] DD=α*ln(F+1)+β*(Td) 2 +γ*log(U+1)+δ*Cmax;

[0054]

[0055] DD represents the sum of all individual items and is a linear combination of the logarithm of the access frequency, the square of the average delay, the logarithm of the data refresh frequency, and the maximum number of repetitions. Nonlinear processing of each item (such as logarithm, square) can increase the system's sensitivity to different access requirements. For example, T d The square of represents the higher impact of delay on the demand index, while the logarithmic term can smooth the extreme values ​​caused by higher frequency or refresh rate. In the present invention, the base of the log function defaults to e and will not be repeated.

[0056] JH represents the sum of all interaction terms, which is mainly used to represent the mutual influence between various factors in the access demand information. For example, the logarithmic interaction term of access frequency and maximum number of repetitions represents the combined influence of frequent and repeated visits. d *U represents the combined effect of latency and refresh rate, which helps the system evaluate the overall real-time requirements. α, β, γ, δ, ε, θ, ζ are all preset non-zero scale factors, and the sum of all non-zero scale factors is a constant. F represents the access frequency, T d represents the average delay, U represents the data refresh frequency, which reflects the speed of data change, Cmax represents the maximum number of repetitions of the same request content, which indicates the degree of repeated requests, and R represents the access demand index, which is the sum of individual items and interaction items, and represents the comprehensive quantification of access demand in the current time window. The access demand index R is a comprehensive measure of the system's access demand. The larger the value, the higher the system's access frequency, greater latency, higher refresh frequency, or more repeated requests in the time window. These factors all indicate that the system currently needs higher real-time processing capabilities. When R is high, the system may automatically switch to stream processing mode to process data in real time to meet user needs; when R is low, batch processing mode may be more appropriate to save resources.

[0057] The logic for obtaining the access anomaly index is:

[0058] Based on the access anomaly information, the minimum time interval between all two consecutive accesses is obtained within the preset fixed time window, and compared with the normal time interval Tnorm, the time interval anomaly At is calculated, and the formula is as follows: The time interval abnormality is used to measure the abnormality of the access interval within a fixed time window. If the minimum time interval between two consecutive accesses is much smaller than the preset normal interval, it indicates that there is abnormal behavior of frequent access, and the exponential form amplifies this difference. Using the exponential form helps to significantly increase the abnormality when the time interval is small, so that it is more sensitive when abnormal behavior occurs.

[0059] The total number of visits W is counted and compared with the preset access frequency threshold Wnorm to calculate the access frequency abnormality Aw. The formula is as follows: Frequency anomaly measures the abnormality of the total number of accesses within the time window relative to the normal access frequency. In the process of data sharing, the higher the access frequency, the more likely the system is under pressure from frequent requests, which may be abnormal behavior. The use of the logarithmic peace method can smooth out higher access frequencies while enhancing sensitivity to frequency anomalies and avoiding excessive impact from extreme frequency values.

[0060] Based on the preset abnormality score table of different access paths, the number of accesses P and the total number of accesses Ptotal of the abnormal path within the preset fixed time window are counted, and the access path abnormality Ap is calculated. The formula is as follows: Path anomaly is used to evaluate the degree of anomaly on a specific access path. By counting the number of accesses to the abnormal path and the total number of accesses, the proportion of abnormal paths can be quantified. Cubic operations increase the sensitivity of path anomaly, so that when abnormal paths are frequently accessed, the anomaly increases rapidly. Cubic calculations can amplify the impact of abnormal paths, making the response more obvious when path anomalies are detected.

[0061] The calculation formula of access anomaly index is:

[0062] Y is the access anomaly index, and ∈ is a constant set to prevent the calculation formula from being meaningless. The access anomaly index Y combines the individual items and interaction items of each anomaly degree, which can capture the multi-dimensional characteristics of abnormal behavior more carefully, and ensure that when multiple anomalies are abnormal at the same time, the index will increase rapidly, thereby triggering the system's response. The larger the access anomaly index Y is, the higher the degree of access anomaly in the system, which may have frequent requests, abnormal access paths, or abnormal access intervals. A high index value usually indicates that the system needs to perform corresponding security checks or load adjustments to deal with potential abnormal behavior or security risks.

[0063] The preset access path anomaly score table is a table that records the anomalies of each access path. Each path will be set with a basic anomaly score based on its access frequency or historical behavior (such as the number of abnormal accesses, misuse frequency, etc.). By scoring different paths, the degree of anomaly of each path can be quantified more accurately. For paths that are not frequently used in the system, if they are frequently accessed, the anomaly score will be higher; while for commonly used paths, the score may be lower to avoid normal access being misjudged as abnormal. The introduction of the score table can improve the accuracy of anomaly detection and help the system distinguish between normal and abnormal usage behaviors. For the operation and maintenance audit system, this path-based scoring can help operation and maintenance personnel better monitor various access activities of the system and issue timely warnings when abnormal activities occur.

[0064] The feature analysis result is transmitted to the pre-trained pattern determination model. The output result of the pattern determination model is 0 or 1, which means: the access anomaly index and the access demand index are used as input to the pre-trained pattern determination model. The pattern determination model is a combination of a polynomial regression model and a threshold partitioning model. The output result of the polynomial regression model is then transmitted to the threshold partitioning model. The threshold partitioning model has a partitioning threshold preset. If the output result of the polynomial regression model is greater than or equal to the preset partitioning threshold, the output result of the threshold partitioning model is 1. If the output result of the polynomial regression model is less than the preset partitioning threshold, the output result of the threshold partitioning model is 0.

[0065] The mode determination model receives two input features: access anomaly index and access demand index. These two indices quantify the abnormality and real-time demand of the current access of the system, and can fully describe the urgency and load of the current access situation.

[0066] Composition of the mode determination model: Polynomial regression model: This model is used to calculate the comprehensive score of the input features. Through polynomial regression, the model can capture the nonlinear relationship between the access anomaly index and the access demand index, thereby more accurately reflecting the access demand and abnormal status of the current system. Threshold partitioning model: The output of the polynomial regression model is passed to the threshold partitioning model. The threshold partitioning model will classify the results of the polynomial regression into two categories according to the preset partitioning threshold, and output 0 or 1 to represent the system's processing mode selection.

[0067] Output result is 1: When the output result of the polynomial regression model is greater than or equal to the preset partition threshold, the threshold partition model outputs 1, indicating that the system needs to enter stream processing mode. This means that the current system has a high access demand or a high degree of abnormality, and the system needs real-time processing to cope with the load.

[0068] Output result is 0: When the output result of the polynomial regression model is less than the preset partition threshold, the threshold partition model outputs 0, indicating that the system can select batch processing mode. This means that the current system access demand is low or the abnormal situation is not significant, and the system can use batch processing with low resource consumption to process data.

[0069] By combining the access anomaly index and the access demand index, the polynomial regression model can achieve a comprehensive analysis of the current system status, and then perform simple binary classification processing through the threshold partition model, thereby realizing the automatic switching of data processing modes. This design reduces the burden of manual judgment and enables the system to intelligently adapt to different workloads. When the model is judged as 1 (stream processing mode), the system will use real-time stream processing, which is particularly important under high load or abnormal conditions; when it is judged as 0 (batch processing mode), the system can choose a batch processing method with lower resource consumption to process data, thereby achieving better resource utilization. By introducing the analysis of access demand and anomaly index, the mode judgment model can respond quickly when access demand and abnormal behavior change, and dynamically adjust the processing method to ensure system stability and service quality.

[0070] 0 or 1 corresponds to two preset data processing modes respectively, which means: 0 corresponds to the batch processing mode of the two preset data processing modes; 1 corresponds to the stream processing mode of the two preset data processing modes.

[0071] In the data sharing method of the operation and maintenance audit system, batch processing mode and stream processing mode are two different data processing methods, which are respectively suitable for the processing needs of the system under different loads and requirements. The following is a detailed description of batch processing and stream processing modes:

[0072] Batch processing mode is a mode that collects and accumulates data within a certain time window and processes it uniformly at a predetermined time interval or after certain conditions are met. It is suitable for scenarios with large data volumes but low real-time requirements. In batch processing mode, the system aggregates audit data within a period of time and waits for processing conditions (such as time interval, data volume, etc.) to be met before centralized processing. The system treats the collected audit data within a specific time interval as a "batch" and performs a one-time processing operation on the entire batch of data. When the system's access requirements are low or the anomaly index is low, batch processing can save resources while meeting processing requirements. In the case of large data volumes and low latency requirements, batch processing can make more efficient use of resources. Batch processing mode processes data uniformly, which can reduce the consumption of system resources, especially in the case of low system access volume, processing can be delayed to save computing and storage resources. Batch processing is suitable for scenarios with large data volumes, and can process a large amount of data in a single operation, which helps improve processing efficiency. Since data is processed after a certain period of accumulation, it has poor real-time performance and may not be suitable for scenarios that require fast response. When abnormal access suddenly increases, the batch mode responds slowly and cannot handle sudden events quickly.

[0073] Stream processing mode is a way to process data in real time. Data is processed immediately when it is generated or collected. It is suitable for scenarios with high data access frequency and high real-time requirements. In stream processing mode, the system processes each piece of data immediately when it is generated or collected, rather than waiting for the data to accumulate to a certain amount before batch processing. Stream processing mode responds to each record in the data stream in real time and dynamically adjusts the processing flow according to the current access demand and abnormality level. When the access demand index is high or the access abnormality index exceeds the preset threshold, the system enters stream processing mode to ensure the real-time performance of data processing. When the system is frequently requested or the system needs real-time feedback, the stream processing mode can quickly respond and process the data. Stream processing mode can analyze and process data streams in real time and respond quickly when access demand or abnormal conditions change. Stream processing mode has strong adaptability to sudden high-frequency access and abnormal access, and can process and feedback in time when abnormal events occur. Stream processing mode requires continuous processing of each piece of data, consumes high computing resources, and may put pressure on the system's hardware resources.

[0074] Performing access analysis on the access information of audit data and classifying the audit data into high-frequency access data or low-frequency access data based on the access analysis results means:

[0075] Get a single data item in the audit data, and obtain the ratio BL of its corresponding number of accesses to the total number of accesses of all single data items within a preset fixed time window, as well as the average time interval TJ between two consecutive accesses of a single data item. Then calculate the ratio BL divided by the average time interval TJ to get the access coefficient. Compare the access coefficient with the preset separation threshold. If the access coefficient of the single data item is greater than the preset separation threshold, classify it as high-frequency access data. If the access coefficient of the single data item is less than or equal to the preset separation threshold, classify it as low-frequency access data.

[0076] High-frequency access data refers to data that is frequently accessed within a period of time. This type of data usually requires a high response speed of the system and may be key data that is frequently called in system operations or user data sharing interactions. Low-frequency access data refers to data that is rarely accessed within a period of time. This type of data has a low requirement for real-time performance. By dividing the data into high-frequency and low-frequency data, the system can manage resources intelligently and allocate more computing resources to high-frequency data to improve response speed. The ratio value represents the ratio of the number of accesses to a single data item within the time window to the total number of accesses to all items. It is a relative indicator for measuring the access frequency of the data item. The larger the ratio value, the higher the access frequency of the data item relative to other data items. The smaller the average time interval, the more intensive the access to the data item. By calculating the access coefficient, the system can quantify the access frequency of each data item. This coefficient combines the access frequency and time interval and is a key indicator for determining whether data is high-frequency access data.

[0077] By dividing high-frequency and low-frequency data, the system can allocate resources more efficiently. For example, high-frequency data can be cached to speed up response and reduce system burden. High-frequency access data is often data that users frequently access. Caching or prioritizing it can significantly improve the system's response speed and enhance user experience. This classification method enables the system to automatically adjust data processing strategies according to changes in access requirements, optimize resource utilization, and better adapt to different requirements under different load conditions.

[0078] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0079] It should be understood that in various embodiments of the present application, the size of the serial numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0080] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0081] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data sharing method for an operation and maintenance audit system, characterized in that: The following steps are involved: Collect the audit data generated by the operation and maintenance audit system during the operation and maintenance audit process, and store the collected audit data for subsequent processing operations; During the data sharing process, the audit data is feature extracted and analyzed, and the feature analysis results are transmitted to the pre-trained pattern determination model. The output result of the pattern determination model is 0 or 1, and 0 or 1 corresponds to two preset data processing modes respectively. Based on the output result of the pattern determination model, the corresponding data processing mode is selected to perform the processing operation; When the output result of the pattern determination model is 1, access analysis is performed on the access information of the audit data. The audit data is divided into high-frequency access data or low-frequency access data according to the access analysis results. All high-frequency access data are aggregated and cached for acceleration to alleviate the data loading load.

2. According to claim 1, a data sharing method of an operation and maintenance audit system is characterized in that: Feature extraction of audit data refers to extracting access requirement information and access exception information separately.

3. The data sharing method of the operation and maintenance audit system according to claim 2 is characterized in that: During feature analysis, an access demand index is generated based on the access demand information, and an access anomaly index is generated based on the access anomaly information.

4. The data sharing method of the operation and maintenance audit system according to claim 3 is characterized in that: The logic for obtaining the access demand index is: Based on the access demand information, the total number of accesses is counted within a preset fixed time window, divided by the time value of the fixed time window to obtain the access frequency, the average response time of each data request is calculated to obtain the average delay, the number of statistical data updates is calculated to obtain the data refresh frequency, and the number of repetitions of the same request content is counted; The calculation formula of access demand index is: R = DD + JH; DD=α*ln(F+1)+β*(T d ) 2 +γ*log(U+1)+δ*Cmax; DD represents the sum of all individual items, JH represents the sum of all interaction items, α, β, γ, δ, ε, θ, ζ are all preset non-zero proportional coefficients, and the sum of all non-zero proportional coefficients is a constant, F represents the access frequency, T d represents the average delay, U represents the data refresh frequency, Cmax represents the maximum number of repetitions of the same request content, and R represents the access demand index.

5. A data sharing method for an operation and maintenance audit system according to claim 4, characterized in that: The logic for obtaining the access anomaly index is: Based on the access anomaly information, the minimum time interval between all two consecutive accesses is obtained within the preset fixed time window, and compared with the normal time interval Tnorm, the time interval anomaly degree At is calculated, and the formula is as follows: The total number of visits W is counted and compared with the preset access frequency threshold Wnorm to calculate the access frequency abnormality Aw. The formula is as follows: Based on the preset abnormality score table of different access paths, the number of accesses P and the total number of accesses Ptotal of the abnormal path within the preset fixed time window are counted, and the access path abnormality Ap is calculated. The formula is as follows: The calculation formula of access anomaly index is: Y is the access anomaly index, and ∈ is a constant set to prevent the calculation formula from being meaningless.

6. A data sharing method for an operation and maintenance audit system according to claim 5, characterized in that: The feature analysis results are sent to the pre-trained pattern determination model. The output of the pattern determination model is 0 or 1, which means: The access anomaly index and the access demand index are used together as input to the pre-trained pattern determination model. The pattern determination model is a combination of a polynomial regression model and a threshold partitioning model. The output result of the polynomial regression model is then transmitted to the threshold partitioning model. The threshold partitioning model has a preset partitioning threshold. If the output result of the polynomial regression model is greater than or equal to the preset partitioning threshold, the output result of the threshold partitioning model is 1. If the output result of the polynomial regression model is less than the preset partitioning threshold, the output result of the threshold partitioning model is 0.

7. A data sharing method for an operation and maintenance audit system according to claim 6, characterized in that: 0 or 1 corresponds to the two preset data processing modes: 0 corresponds to the batch processing mode among the two preset data processing modes; 1 corresponds to the stream processing mode of the two preset data processing modes.

8. A data sharing method for an operation and maintenance audit system according to claim 7, characterized in that: Performing access analysis on the access information of audit data and classifying the audit data into high-frequency access data or low-frequency access data based on the access analysis results means: Get a single data item in the audit data, and obtain the ratio BL of its corresponding number of accesses to the total number of accesses of all single data items within a preset fixed time window, as well as the average time interval TJ between two consecutive accesses of a single data item. Then calculate the ratio BL divided by the average time interval TJ to get the access coefficient. Compare the access coefficient with the preset separation threshold. If the access coefficient of the single data item is greater than the preset separation threshold, classify it as high-frequency access data. If the access coefficient of the single data item is less than or equal to the preset separation threshold, classify it as low-frequency access data.

Images