A data sharing method for operation and maintenance audit system

Abstract

The present invention discloses a data sharing method for an operation and maintenance audit system, which specifically relates to the field of data management technology. The method comprises the following steps: firstly collecting and storing audit data generated in the operation and maintenance audit process for subsequent processing; when sharing data, extracting and analyzing features of the audit data, inputting the analysis results into a pre-trained mode determination model, and the model outputting 0 or 1, which respectively correspond to a batch mode and a stream mode; selecting a corresponding data processing mode to perform a sharing operation according to the model output result; when the output result is 1, performing access analysis on the access information of the data, dividing the data into high-frequency access data and low-frequency access data, caching and accelerating the high-frequency access data, reducing the data loading load, and improving the system response efficiency; the present invention can dynamically select the batch mode or the stream processing mode by judging the access demand and abnormal situation, thereby realizing resource optimization of data sharing and ensuring the effect of data sharing.

Description

Technical Field

[0001] The present invention relates to the field of data management technology, and more specifically, to a data sharing method for an operation and maintenance audit system. Background Art

[0002] In modern operation and maintenance audit systems, with the continuous expansion of systems and the rapid growth of data volume, efficient sharing of operation and maintenance audit data has become crucial. The core task of the operation and maintenance audit system is to monitor, record, and analyze various operations, events, and behaviors within the system in real time, and share this data with other system modules or operation and maintenance personnel when necessary so that timely countermeasures can be taken. However, traditional data sharing models often have the following problems:

[0003] In situations with low access frequency or non-real-time requirements, the traditional sharing model can meet the current data sharing scenarios. However, in situations with high access frequency and high real-time requirements, the traditional data sharing model often has significant limitations, performance degradation, and may cause data response delays, making it impossible to share key audit information with other system modules or operation and maintenance personnel in a timely manner, affecting the rapid location and response of problems. Therefore, this paper proposes a data sharing method for the operation and maintenance audit system to address the above problems. Summary of the Invention

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] A data sharing method for an operation and maintenance audit system includes the following steps:

[0006] Collect the audit data generated by the operation and maintenance audit system during the operation and maintenance audit process, and store the collected audit data for subsequent processing operations;

[0007] During the data sharing process, features are extracted and analyzed on the audit data, and the feature analysis results are fed into a pre-trained pattern determination model. The pattern determination model outputs a result of 0 or 1, which corresponds to two preset data processing modes. Based on the output of the pattern determination model, the corresponding data processing mode is selected to perform the processing operation.

[0008] When the output result of the pattern determination model is 1, access analysis is performed on the access information of the audit data. According to the access analysis results, the audit data is divided into high-frequency access data or low-frequency access data. All high-frequency access data are aggregated and cached to alleviate the data loading load.

[0009] In a preferred embodiment, extracting features from audit data refers to extracting access requirement information and access exception information respectively.

[0010] In a preferred embodiment, during feature analysis, an access demand index is generated based on the access demand information, and an access anomaly index is generated based on the access anomaly information.

[0011] In a preferred embodiment, the access demand index is obtained by:

[0012] Based on the access demand information, the total number of accesses within a preset fixed time window is counted and divided by the time value of the fixed time window to obtain the access frequency. The average response time of each data request is calculated to obtain the average latency. The number of statistical data updates is calculated to obtain the data refresh frequency. The number of repetitions of the same request content is also counted.

[0013] The calculation formula of access demand index is:

[0014] R=DD+JH;

[0015] DD=α*ln(F+1)+β*(Td) 2 +γ*log(U+1)+δ*Cmax;

[0016]

[0017] DD represents the sum of all individual terms, JH represents the sum of all interaction terms, α, β, γ, δ, ε, θ, ζ are all preset non-zero proportional coefficients, and the sum of all non-zero proportional coefficients is a constant, F represents the access frequency, T d represents the average delay, U represents the data refresh frequency, Cmax represents the maximum number of repetitions of the same request content, and R represents the access demand index.

[0018] In a preferred embodiment, the logic for obtaining the access anomaly index is:

[0019] Based on the access anomaly information, the minimum time interval between two consecutive accesses is obtained within the preset fixed time window, and compared with the normal time interval Tnorm to calculate the time interval anomaly At. The formula is as follows:

[0020] The total number of visits W is counted and compared with the preset access frequency threshold Wnorm to calculate the access frequency abnormality Aw. The formula is as follows:

[0021] Based on the preset abnormality score table for different access paths, the number of accesses P and the total number of accesses Ptotal of the abnormal path within the preset fixed time window are counted to calculate the access path abnormality Ap. The formula is as follows:

[0022] The calculation formula for the access anomaly index is:

[0023] Y is the access anomaly index, and ∈ is a constant set to prevent the calculation formula from being meaningless.

[0024] In a preferred embodiment, the feature analysis result is fed to a pre-trained pattern determination model. The pattern determination model outputs a result of 0 or 1, which means:

[0025] The access anomaly index and the access demand index are used as input to the pre-trained pattern determination model. The pattern determination model is a combination of a polynomial regression model and a threshold partitioning model. The output result of the polynomial regression model is then transmitted to the threshold partitioning model. The threshold partitioning model has a preset partitioning threshold. If the output result of the polynomial regression model is greater than or equal to the preset partitioning threshold, the output result of the threshold partitioning model is 1. If the output result of the polynomial regression model is less than the preset partitioning threshold, the output result of the threshold partitioning model is 0.

[0026] In a preferred embodiment, 0 or 1 corresponds to two preset data processing modes respectively:

[0027] 0 corresponds to the batch mode of the two preset data processing modes;

[0028] 1 corresponds to the stream processing mode among the two preset data processing modes.

[0029] In a preferred embodiment, performing access analysis on access information of audit data and classifying the audit data into high-frequency access data or low-frequency access data according to the access analysis results refers to:

[0030] Obtain a single data item in the audit data, obtain the ratio BL of its corresponding number of accesses to the total number of accesses of all single data items within a preset fixed time window, and the average time interval TJ between two consecutive accesses of a single data item, then calculate the ratio BL divided by the average time interval TJ to obtain the access coefficient, and compare the access coefficient with the preset separation threshold. If the access coefficient of the single data item is greater than the preset separation threshold, it is classified as high-frequency access data. If the access coefficient of the single data item is less than or equal to the preset separation threshold, it is classified as low-frequency access data.

[0031] Technical effects and advantages of the present invention:

[0032] This invention optimizes data sharing resources by dynamically selecting between batch and stream processing modes based on access requirements and exceptions. In scenarios with low-frequency access or non-real-time requirements, the system automatically selects batch mode to reduce unnecessary resource consumption. In scenarios with high-frequency access or high-real-time requirements, the system automatically switches to stream processing mode to ensure timely data sharing and efficient processing.

[0033] This system automatically switches processing modes based on the access demand index and anomaly index, switching to stream processing mode when demand is high or anomalies are frequent, ensuring that data is shared with relevant operations and maintenance personnel in real time. This effectively shortens response time, improves system agility, and enables the system to provide timely operational and maintenance data support at critical moments.

[0034] This invention analyzes access characteristics of audit data to generate an access demand index and an access anomaly index, enabling timely detection of potential abnormal behavior. When necessary, the system can quickly switch to stream processing mode, sharing abnormal data in real time with operations and maintenance personnel for rapid response and processing, effectively improving system security.

[0035] This invention uses an automated mode determination model to enable the system to flexibly respond to varying load conditions. When access demand is high or abnormal access behavior is frequent, the system can dynamically switch to stream processing mode to meet the system's real-time requirements. Under lower load conditions, the system can revert to batch processing mode to reduce resource usage, avoid excessive processing, and ensure stable system operation.

[0036] The data sharing method of this invention not only optimizes system resource utilization but also enhances data sharing effectiveness. Sharing frequently accessed data through cache acceleration helps alleviate system load, ensuring efficient data sharing and rapid response, and enhancing the system's data sharing capabilities in large-scale operation and maintenance scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0038] Figure 1 This is a schematic diagram of a data sharing method for an operation and maintenance audit system in the present invention. DETAILED DESCRIPTION

[0039] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention, with reference to the accompanying drawings. Obviously, the described embodiments are only some, and not all, of the embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0040] Reference Figure 1 The following examples were obtained:

[0041] Example 1: A data sharing method for an operation and maintenance audit system, comprising the following steps:

[0042] The O&M audit system collects and stores audit data generated during the O&M audit process for subsequent processing. This fundamental data collection and storage process is the starting point for the entire O&M audit system's data analysis process. By collecting audit data generated during the O&M process, the system can record all important O&M activities, system events, and operation logs. Once this data is stored, it can be further analyzed, filtered, and used for decision support in subsequent steps. The core significance of this process is to ensure data integrity and traceability, enabling the system to provide data support for subsequent analysis, classification, and pattern identification. The collection and storage of O&M audit data is a fundamental operation of the O&M audit system, aiming to provide data support for the overall security, stability, and optimization of the system. This data can help detect abnormal operations, assess system resource usage, and provide data support for subsequent analysis and troubleshooting.

[0043] In existing technologies, operations and audit systems typically utilize automated tools to monitor system activity in real time, collecting large amounts of system logs and user behavior records, and storing them in a centralized or distributed database. Centralized data storage ensures data consistency and integrity, allowing operations and maintenance personnel to access this data at any time for analysis and tracking.

[0044] During the data sharing process, audit data undergoes feature extraction and analysis. The analysis results are fed into a pre-trained pattern determination model. The model outputs a value of 0 or 1, corresponding to two pre-set data processing modes. Based on the model's output, the corresponding data processing mode is selected for processing. Feature extraction transforms raw data into specific features (such as access requirements) that describe the data's state and characteristics. The feature analysis results are then fed into the pattern determination model, which determines the data processing mode based on the features (0 for batch processing and 1 for stream processing). This step is crucial for automated data processing decisions, determining whether real-time processing is necessary based on data access requirements and the degree of anomalies. Using the pre-trained pattern determination model, the system can select the most appropriate data processing mode without human intervention, balancing resource consumption and real-time processing. Batch processing is suitable for scenarios with low data access frequency or low latency requirements, while stream processing is suitable for scenarios with high access frequency and a high number of anomalies. This automated decision-making significantly improves system responsiveness and resource efficiency.

[0045] In traditional operations and maintenance audit systems, data processing modes are typically static, manually specifying how data should be processed and failing to dynamically adjust to real-time conditions. By introducing feature analysis and pattern determination models, modern operations and maintenance audit systems can achieve automated decision-making, allowing the system to dynamically select the appropriate processing mode based on changes in data characteristics.

[0046] When the pattern determination model output is 1, access analysis is performed on the audit data. Based on the analysis results, the audit data is classified as either high-frequency or low-frequency data. All high-frequency data is aggregated and cached to alleviate data loading. Further optimization is possible when stream processing mode is selected. Specifically, when the pattern determination model output is 1 (stream processing mode), the system analyzes data access frequency and categorizes high-frequency and low-frequency data. Caching high-frequency data improves system processing efficiency, reduces the load caused by frequent access, and achieves efficient resource utilization. Caching high-frequency data can significantly reduce system load. In stream processing mode, data access frequency is high, and direct data access results in significant system overhead and latency. Caching high-frequency data reduces database reads, improves data response speed, and significantly optimizes overall system performance and resource utilization.

[0047] Traditional operations and audit systems typically don't differentiate between high-frequency and low-frequency data and perform caching. This approach can't effectively handle the pressure of high-frequency data access and can easily lead to system bottlenecks. However, with the introduction of cache acceleration technology, modern operations and audit systems can dynamically cache high-frequency data based on data access conditions, reducing the impact of high-frequency requests on the system and improving overall processing efficiency.

[0048] Feature extraction from audit data involves extracting access demand information and access anomaly information. During feature analysis, an access demand index is generated based on the access demand information, and an access anomaly index is generated based on the access anomaly information. Access demand information provides key information about system access frequency, data latency, data refresh frequency, and repeated request frequency, clearly describing user interaction with the system. Different access demands place varying pressures on system resources (such as bandwidth, CPU, and memory). Access demand information can be used to understand system resource consumption within a specific time window, helping to make appropriate load management decisions. By quantifying access demand information, an access demand index is generated, which accurately represents the system's real-time requirements within the current window. A higher index indicates that the system requires faster responses to meet user needs. The access demand index can serve as input to the mode decision model, helping the system automatically select the appropriate data processing mode (batch or stream processing).

[0049] Access anomaly information focuses on uncommon behaviors that may threaten system security or performance (such as frequent abnormal path access and abnormal access time intervals), helping the system to identify potential abnormal situations earlier. Through access anomaly information, the system can promptly identify potential malicious access behaviors or system vulnerabilities. For the operation and maintenance audit system, this anomaly information is very important because it is directly related to the security and stability of the system. By converting access anomaly information into an access anomaly index, different types of abnormal behaviors can be uniformly represented as a numerical value, which makes it easier for the system to determine whether measures need to be taken. The higher the index, the more serious the abnormal behavior and the stronger the system's response requirements. The access anomaly index is also one of the key inputs of the pattern determination model. By judging the access anomaly index and the access demand index, the present invention can decide whether to switch to a higher priority stream processing mode to ensure that abnormal access can be processed and tracked in a timely manner, which helps to ensure the stability of the system.

[0050] The access demand index is obtained by counting the total number of accesses within a preset fixed time window based on the access demand information, dividing it by the time value of the fixed time window to obtain the access frequency, averaging the response time of each data request to obtain the average latency, counting the number of statistical updates to obtain the data refresh frequency, and counting the number of repetitions of the same request content.

[0051] The calculation formula of access demand index is:

[0052] R=DD+JH;

[0053] DD=α*ln(F+1)+β*(Td) 2 +γ*log(U+1)+δ*Cmax;

[0054]

[0055] DD represents the sum of all individual terms and is a linear combination of the logarithm of the access frequency, the square of the average delay, the logarithm of the data refresh frequency, and the maximum number of repetitions. Nonlinear processing of each term (such as logarithm and square) can increase the system's sensitivity to different access requirements. For example, T d The square of represents the higher impact of delay on the demand index, while the logarithmic term can smooth the extreme values caused by higher frequency or refresh rate. In the present invention, the base of the log function defaults to e and will not be repeated here.

[0056] JH represents the sum of all interaction terms, which is mainly used to represent the mutual influence between various factors in the access demand information. For example, the logarithmic interaction term of access frequency and maximum number of repetitions represents the combined influence of frequent and repeated visits. Interaction terms such as T d *U represents the combined effect of latency and refresh rate, which helps the system evaluate the overall real-time requirements. α, β, γ, δ, ε, θ, and ζ are all preset non-zero scaling coefficients, and the sum of all non-zero scaling coefficients is a constant. F represents the access frequency, and T d = represents average latency, U represents the data refresh frequency, reflecting the rate of data change, Cmax represents the maximum number of repetitions of the same request content, indicating the degree of repeated requests, and R represents the access demand index, which is the sum of individual terms and interaction terms and represents a comprehensive quantification of access demand within the current time window. The access demand index R is a comprehensive measure of the system's access demand. A larger value indicates a higher access frequency, greater latency, a higher refresh rate, or more repeated requests within the time window. These factors indicate that the system currently requires higher real-time processing capabilities. When R is high, the system may automatically switch to stream processing mode to process data in real time to meet user needs; when R is low, batch processing mode may be more appropriate to conserve resources.

[0057] The logic for obtaining the access anomaly index is:

[0058] Based on the access anomaly information, the minimum time interval between two consecutive accesses is obtained within the preset fixed time window, and compared with the normal time interval Tnorm to calculate the time interval anomaly At. The formula is as follows: The time interval anomaly score measures the abnormality of access intervals within a fixed time window. If the minimum time interval between two consecutive accesses is significantly smaller than the preset normal interval, it indicates abnormal frequent access behavior. The exponential form amplifies this difference. Using the exponential form helps significantly increase the anomaly score when the time interval is small, thus being more sensitive to abnormal behavior.

[0059] Count the total number of visits W and compare it with the preset access frequency threshold Wnorm to calculate the access frequency abnormality Aw. The formula is as follows: Frequency anomaly measures the abnormality of the total number of accesses within a time window relative to the normal access frequency. During data sharing, higher access frequencies indicate that the system may be under pressure from frequent requests, potentially indicating abnormal behavior. Using the logarithmic square method can smooth out high access frequencies while increasing sensitivity to frequency anomalies and preventing excessive impact from extreme frequency values.

[0060] Based on the preset anomaly score table for different access paths, count the number of accesses P and the total number of accesses Ptotal of the abnormal path within the preset fixed time window, and calculate the access path anomaly Ap. The formula is as follows: The path anomaly score is used to assess the degree of anomaly on a specific access path. By counting the number of accesses on the anomaly path and the total number of accesses, the proportion of anomaly paths can be quantified. Cubic calculations increase the sensitivity of the path anomaly score, causing the anomaly score to increase rapidly when an anomaly path is frequently accessed. Cubic calculations can amplify the impact of anomaly paths, resulting in a more pronounced response when path anomalies are detected.

[0061] The calculation formula for the access anomaly index is:

[0062] Y represents the access anomaly index, and ∈ is a constant used to prevent the calculation formula from being meaningless. The access anomaly index Y combines the individual and interactive terms of each anomaly degree, capturing the multidimensional characteristics of abnormal behavior in greater detail. This ensures that when multiple anomaly degrees are abnormal simultaneously, the index rapidly increases, triggering a system response. A larger access anomaly index Y indicates a higher degree of system access anomaly, potentially indicating frequent requests, unusual access paths, or abnormal access intervals. A high index value typically indicates that the system requires appropriate security checks or load adjustments to address potential abnormal behavior or security risks.

[0063] The pre-set access path anomaly scoring table records the anomaly of each access path. Each path is assigned a basic anomaly score based on its access frequency or historical behavior (such as the number of abnormal accesses or misuse frequency). By scoring different paths, the degree of anomaly in each path can be more accurately quantified. Infrequently accessed paths in the system will receive a higher anomaly score, while frequently accessed paths may receive a lower score to prevent normal access from being misclassified as anomalies. The introduction of the scoring table improves the accuracy of anomaly detection and helps the system distinguish between normal and abnormal usage. For operations and audit systems, this path-based scoring helps operators better monitor various system access activities and provide timely warnings when abnormal activity occurs.

[0064] The feature analysis results are transmitted to a pre-trained pattern determination model. The output result of the pattern determination model is 0 or 1, which means that the access anomaly index and the access demand index are used as input to the pre-trained pattern determination model. The pattern determination model is a combination of a polynomial regression model and a threshold partitioning model. The output result of the polynomial regression model is then transmitted to the threshold partitioning model. The threshold partitioning model has a preset partitioning threshold. If the output result of the polynomial regression model is greater than or equal to the preset partitioning threshold, the output result of the threshold partitioning model is 1. If the output result of the polynomial regression model is less than the preset partitioning threshold, the output result of the threshold partitioning model is 0.

[0065] The pattern determination model receives two input features: the access anomaly index and the access demand index. These indices quantify the degree of anomaly and real-time requirements of the system's current access, respectively, and can comprehensively describe the urgency and load of the current access situation.

[0066] The mode determination model consists of the following components: Polynomial regression model: This model calculates a comprehensive score for the input features. Through polynomial regression, the model captures the nonlinear relationship between the access anomaly index and the access demand index, more accurately reflecting the current system's access demand and anomaly status. Threshold classification model: The output of the polynomial regression model is passed to the threshold classification model. The threshold classification model classifies the polynomial regression results into two categories based on a preset classification threshold, outputting a value of 0 or 1 to represent the system's selected processing mode.

[0067] Output 1: When the polynomial regression model's output is greater than or equal to the preset partitioning threshold, the threshold partitioning model outputs 1, indicating that the system needs to enter stream processing mode. This indicates that the current system access demand is high or the degree of anomalies is high, and the system requires real-time processing to cope with the load.

[0068] Output is 0: When the polynomial regression model's output is less than the preset partitioning threshold, the threshold partitioning model outputs 0, indicating that the system can use batch processing mode. This indicates that the current system access demand is low or the anomaly is not significant. The system can use batch processing to process data with lower resource consumption.

[0069] By combining the access anomaly index and the access demand index, a polynomial regression model provides a comprehensive analysis of the current system state. A threshold-based partitioning model then performs a simple binary classification, enabling automated switching of data processing modes. This design reduces the burden of manual judgment and enables the system to intelligently adapt to varying workloads. When the model determines a 1 (stream processing mode), the system uses real-time stream processing, which is particularly important during high load or abnormal situations. When the model determines a 0 (batch processing mode), the system uses a more resource-efficient batch processing method to process data, achieving optimal resource utilization. By incorporating access demand and anomaly index analysis, the mode determination model can quickly respond to changes in access demand and abnormal behavior, dynamically adjusting processing methods to ensure system stability and service quality.

[0070] 0 or 1 corresponds to the two preset data processing modes respectively: 0 corresponds to the batch processing mode of the two preset data processing modes; 1 corresponds to the stream processing mode of the two preset data processing modes.

[0071] In the data sharing method of the operation and maintenance audit system, batch processing mode and stream processing mode are two different data processing methods, which are suitable for the processing needs of the system under different load and demand conditions. The following is a detailed explanation of batch processing and stream processing mode:

[0072] Batch processing collects and accumulates data within a specific time window and processes it centrally at predetermined intervals or after certain conditions are met. It is suitable for scenarios with large data volumes but low real-time requirements. In batch processing, the system aggregates audit data from a specific time period and processes it centrally once processing conditions (such as time interval and data volume) are met. The system treats the audit data collected within a specific time interval as a "batch" and performs a single processing operation on the entire batch. When system access demand is low or the anomaly index is low, batch processing can save resources while still meeting processing requirements. When data volumes are large and latency requirements are low, batch processing can be more efficient. Batch processing reduces system resource consumption by processing data in a centralized manner, especially when system access volume is low, allowing for delayed processing to conserve computing and storage resources. Batch processing is suitable for scenarios with large data volumes, as it can process large amounts of data in a single operation, helping to improve processing efficiency. However, because data is processed only after a certain period of accumulation, real-time performance is poor and it may not be suitable for scenarios requiring rapid response. When abnormal access suddenly increases, the batch mode responds slowly and cannot handle emergencies quickly.

[0073] Stream processing is a real-time data processing method. Data is processed immediately upon generation or collection. It is suitable for scenarios with high data access frequency and strict real-time requirements. In stream processing mode, the system processes each piece of data immediately upon generation or collection, rather than waiting for a certain amount of data to accumulate before batch processing. Stream processing responds to each record in the data stream in real time, dynamically adjusting the processing flow based on current access demand and anomaly levels. When the access demand index is high or the access anomaly index exceeds a preset threshold, the system enters stream processing mode to ensure real-time data processing. When the system receives frequent requests or requires real-time feedback, stream processing mode can quickly respond and process this data. Stream processing mode analyzes and processes data streams in real time, reacting quickly to changes in access demand or anomalies. Stream processing is highly adaptable to sudden, high-frequency access and abnormal access, enabling timely processing and feedback when anomalies occur. However, stream processing requires continuous processing of each piece of data, consuming high computing resources and potentially placing a strain on system hardware resources.

[0074] Performing access analysis on audit data access information and classifying audit data into high-frequency access data or low-frequency access data based on the access analysis results means:

[0075] Obtain a single data item in the audit data, obtain the ratio BL of its corresponding number of accesses to the total number of accesses of all single data items within a preset fixed time window, and the average time interval TJ between two consecutive accesses of a single data item, then calculate the ratio BL divided by the average time interval TJ to obtain the access coefficient, and compare the access coefficient with the preset separation threshold. If the access coefficient of the single data item is greater than the preset separation threshold, it is classified as high-frequency access data. If the access coefficient of the single data item is less than or equal to the preset separation threshold, it is classified as low-frequency access data.

[0076] High-frequency data refers to data that is frequently accessed over a period of time. This type of data typically requires high system response speed and may be critical data frequently accessed during system operations or user data sharing interactions. Low-frequency data refers to data that is rarely accessed over a period of time. This type of data has lower real-time requirements. By classifying data into high-frequency and low-frequency data, the system can intelligently manage resources, allocating more computing resources to high-frequency data to improve response speed. The ratio value represents the ratio of the number of accesses to a single data item within a time window to the total number of accesses to all items. It is a relative indicator of the access frequency of that data item. A larger ratio value indicates a higher access frequency for that data item relative to other data items. A smaller average time interval indicates a more frequent access to that data item. By calculating the access coefficient, the system can quantify the access frequency of each data item. This coefficient combines the access frequency and time interval and is a key indicator for determining whether data is frequently accessed.

[0077] By classifying high-frequency and low-frequency data, the system can allocate resources more efficiently. For example, high-frequency data can be cached to speed up responses and reduce system burden. High-frequency data is often frequently accessed by users, and caching or prioritizing it can significantly improve system response speed and enhance the user experience. This classification method enables the system to automatically adjust data processing strategies based on changing access demands, optimize resource utilization, and better adapt to varying needs under varying load conditions.

[0078] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0079] It should be understood that in various embodiments of the present application, the size of the serial numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0080] Those skilled in the art will appreciate that the units and algorithmic steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0081] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0082] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A data sharing method for an operation and maintenance audit system, characterized in that: The following steps are involved: Collect the audit data generated by the operation and maintenance audit system during the operation and maintenance audit process, and store the collected audit data for subsequent processing operations; During the data sharing process, features are extracted and analyzed on the audit data, and the feature analysis results are fed into a pre-trained pattern determination model. The pattern determination model outputs a result of 0 or 1, which corresponds to two preset data processing modes. Based on the output of the pattern determination model, the corresponding data processing mode is selected to perform the processing operation. When the output of the pattern determination model is 1, access analysis is performed on the access information of the audit data. Based on the access analysis results, the audit data is divided into high-frequency access data or low-frequency access data. All high-frequency access data is aggregated and cached to alleviate the data loading load. Feature extraction of audit data refers to extracting access demand information and access exception information respectively; During feature analysis, an access demand index is generated based on the access demand information, and an access anomaly index is generated based on the access anomaly information; 0 or 1 corresponds to the two preset data processing modes: 0 corresponds to the batch mode of the two preset data processing modes; 1 corresponds to the stream processing mode among the two preset data processing modes; Performing access analysis on audit data access information and classifying audit data into high-frequency access data or low-frequency access data based on the access analysis results means: Obtain a single data item in the audit data, obtain the ratio BL of its corresponding number of accesses to the total number of accesses of all single data items within a preset fixed time window, and the average time interval TJ between two consecutive accesses of a single data item, then calculate the ratio BL divided by the average time interval TJ to obtain the access coefficient, and compare the access coefficient with the preset separation threshold. If the access coefficient of the single data item is greater than the preset separation threshold, it is classified as high-frequency access data. If the access coefficient of the single data item is less than or equal to the preset separation threshold, it is classified as low-frequency access data.

2. A data sharing method for an operation and maintenance audit system according to claim 1, characterized in that: The logic for obtaining the access demand index is: Based on the access demand information, the total number of accesses within a preset fixed time window is counted and divided by the time value of the fixed time window to obtain the access frequency. The response time of each data request is averaged to obtain the average latency. The number of statistical data updates is calculated to obtain the data refresh frequency. The number of repetitions of the same request content is also counted. The calculation formula of access demand index is: R = DD + JH; DD=α*ln(F+1)+β*(Td) 2 +γ*log(U+1)+δ*Cmax; DD represents the sum of all individual terms, JH represents the sum of all interaction terms, α, β, γ, δ, ε, θ, ζ are all preset non-zero proportional coefficients, and the sum of all non-zero proportional coefficients is a constant, F represents the access frequency, T d represents the average delay, U represents the data refresh frequency, Cmax represents the maximum number of repetitions of the same request content, and R represents the access demand index.

3. The data sharing method of the operation and maintenance audit system according to claim 2 is characterized in that: The logic for obtaining the access anomaly index is: Based on the access anomaly information, the minimum time interval between two consecutive accesses is obtained within the preset fixed time window, and compared with the normal time interval Tnorm to calculate the time interval anomaly At. The formula is as follows: Count the total number of visits W and compare it with the preset access frequency threshold Wnorm to calculate the access frequency abnormality Aw. The formula is as follows: Based on the preset anomaly score table for different access paths, count the number of accesses P and the total number of accesses Ptotal of the abnormal path within the preset fixed time window, and calculate the access path anomaly Ap. The formula is as follows: The calculation formula for the access anomaly index is: Y is the access anomaly index, and ∈ is a constant set to prevent the calculation formula from being meaningless.

4. The data sharing method of the operation and maintenance audit system according to claim 3 is characterized in that: The feature analysis results are fed into a pre-trained pattern determination model. The pattern determination model outputs a result of 0 or 1, which means: The access anomaly index and the access demand index are used as input to the pre-trained pattern determination model. The pattern determination model is a combination of a polynomial regression model and a threshold partitioning model. The output result of the polynomial regression model is then transmitted to the threshold partitioning model. The threshold partitioning model has a preset partitioning threshold. If the output result of the polynomial regression model is greater than or equal to the preset partitioning threshold, the output result of the threshold partitioning model is 1. If the output result of the polynomial regression model is less than the preset partitioning threshold, the output result of the threshold partitioning model is 0.

Images