System operation abnormity monitoring and analyzing method based on intelligent algorithm

Abstract

The invention discloses a system operation abnormity monitoring analysis method based on an intelligent algorithm, which relates to the field of system operation monitoring analysis and comprises a system operation data acquisition step, a multi-modal characteristic data fusion step, a model establishment and learning step, an abnormity monitoring and analysis step and a multi-stage feedback repair step. In the abnormity monitoring and analysis step, the fusion feature vector output by the multi-modal feature data fusion step and the operation analysis model output by the model building and learning step are used for monitoring the operation state of the system and outputting an operation monitoring result. According to the method, the operation state of the system is monitored in real time, the subsequent operation state of the system is predicted, and the abnormal development state is predicted by adopting the abnormal monitoring and analysis step and the multi-stage feedback repairing step; and the system management personnel is assisted to adjust and repair the running system, so that the normal operation of the system is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of system operation monitoring and analysis, and in particular to a system operation abnormality monitoring and analysis method based on an intelligent algorithm. Background Art

[0002] With the development of information technology, the operation of various systems plays a vital role in the normal use of the system. The normal state and stability of the system operation are the key to the normal use of the system. Therefore, it is necessary to monitor the operation state of the system during the operation of the system. However, the traditional system operation abnormality monitoring and analysis method mainly relies on the comparison between the actual single data and the static threshold. It cannot predict the system operation state and the abnormal development state while realizing the system operation state monitoring, and it cannot determine the abnormal location, abnormal type and abnormal cause, which reduces the system use effect and abnormality repair efficiency.

[0003] The defects of the existing system operation abnormality monitoring and analysis methods are:

[0004] 1. The application document CN116155560A mainly solves the problem of how to monitor illegal access to the Internet software system, but the above patent cannot achieve the solution to the problem of accurately monitoring the system operation status and predicting the system operation status and abnormal development status;

[0005] 2. The application document CN117667589A mainly solves the problem of early warning of operating risks through operating temperature, but the above patent cannot achieve the function of tracing the abnormal location, abnormal type and abnormal cause;

[0006] 3. Patent document CN117539727A implements the monitoring of computer operating status, but the above patent does not consider how to improve the accuracy and timeliness of the monitoring results. Summary of the invention

[0007] The purpose of the present invention is to provide a system operation abnormality monitoring and analysis method based on an intelligent algorithm to solve the problems raised in the above background technology.

[0008] To achieve the above-mentioned object, the present invention provides the following technical solutions: a method for monitoring and analyzing system operation anomalies based on intelligent algorithms, comprising a system operation data acquisition step, a multimodal feature data fusion step, a model establishment and learning step, anomaly monitoring and analysis step, and a multi-stage feedback repair step;

[0009] The multimodal feature data fusion step extracts and fuses features for the multimodal data acquired in the system operation data acquisition step; the abnormality monitoring and analysis step uses the fused feature vector output by the multimodal feature data fusion step and the operation analysis model output by the model establishment and learning step to monitor the system operation status and output the operation monitoring result, and the operation analysis model includes an abnormality diagnosis model and an operation prediction model; the multi-stage feedback repair step is used to perform abnormality feedback and response optimization according to the system operation monitoring result;

[0010] The abnormality monitoring and analysis step includes a monitoring and analysis sub-step, an abnormality marking sub-step and an abnormality tracing sub-step;

[0011] The monitoring and analysis sub-step is used to receive the real-time fusion feature vector and analyze the overlap between the real-time fusion feature vector and the normal operation standard vector through the abnormal diagnosis model. , determine the real-time operating status of the system, and the real-time operating status of the system includes "abnormal operation" and "normal operation";

[0012] The abnormality marking sub-step includes abnormality level marking and abnormal fusion feature marking. The abnormality level marking is to analyze the overlap interval of the real-time fusion feature vector of "operation abnormality" and the normal operation standard vector, and to mark the abnormality level of the real-time fusion feature. The abnormality fusion feature marking is to determine the abnormal point in the real-time fusion feature vector and set an abnormal marking point at the abnormal point.

[0013] The abnormality tracing sub-step is used to extract abnormal marking points and vector segments where abnormal marking points are located from the real-time fusion feature vector, and trace the abnormal operation related information and the cause of the abnormal operation;

[0014] The multi-stage feedback repair step includes a prompt and prediction sub-step, a response repair sub-step and an evaluation feedback sub-step. The prompt and prediction step is used to receive the system real-time operation status judgment result and the abnormality level marking result, and to prompt the system operation management personnel and predict the "operation abnormality" development status. The response repair sub-step is used to select the corresponding system repair means to perform system repair according to the system real-time operation status judgment result and the "operation abnormality" development status prediction result.

[0015] Preferably, the real-time fusion feature vector is obtained by the following steps: during the system operation process, the system real-time operation multivariate data is obtained and processed by the system operation data acquisition step, and the system real-time operation multivariate data is subjected to feature extraction and feature fusion by the multimodal feature fusion step to obtain the real-time fusion feature vector corresponding to the system real-time operation multivariate data;

[0016] The coincidence analysis between the real-time fusion feature vector and the normal operation standard vector includes: When the abnormal diagnosis model outputs the judgment result of "normal operation", the real-time fusion feature vector coincides with the normal operation standard vector under the same state conditions. When the abnormal diagnosis model outputs the judgment result of "operation abnormality", the analysis and judgment result and the real-time fusion feature vector are output to the abnormal marking sub-step; when the abnormal diagnosis model outputs the judgment result of "operation normal", the analysis and judgment result and the real-time fusion feature vector are output to the operation prediction model;

[0017] The abnormality tracing sub-step specifically includes: extracting abnormal marking points and vector segments where the abnormal marking points are located from the real-time fusion feature vector, performing multivariate data restoration on the vector segments through a decoding device to obtain data for abnormality tracing, using the abnormality tracing data in combination with the real-time operation multivariate data to analyze the location of the system operation abnormality, locating the time when the operation abnormality occurs based on the actual sequence of the real-time operation multivariate data, judging the abnormality type by using the vector segment where the abnormal marking points are located, the abnormality tracing data, the location of the operation abnormality and the time when the operation abnormality occurs, and recording the abnormality tracing data, the location of the operation abnormality, the time when the abnormality occurs, and the abnormality type as abnormal operation related information, and using decision tree analysis\causal reasoning\deep learning algorithms to analyze the cause of the abnormal operation through the abnormality tracing data, the location of the operation abnormality, the time when the abnormality occurs, the abnormality type and the real-time operation multivariate data.

[0018] Preferably, the coincidence analysis of the real-time fusion feature vector and the normal operation standard vector also includes comparing the coincidence of the real-time fusion feature vector corresponding to the "operation abnormality" judgment result with the normal operation standard vector under the same state conditions and marking the abnormality level, specifically including: when the coincidence interval of the real-time fusion feature vector and the normal operation standard vector under the same state conditions is , marking the real-time operating state of the system corresponding to the real-time fusion feature vector as “slight operating abnormality”;

[0019] When the overlap between the real-time fusion feature vector and the normal operation standard vector under the same state conditions belongs to the interval , marking the real-time operating state of the system corresponding to the real-time fusion feature vector as “moderate operating abnormality”;

[0020] When the overlap between the real-time fusion feature vector and the normal operation standard vector under the same state conditions belongs to the interval When the real-time fusion feature vector is detected, the real-time operation status of the system corresponding to the real-time fusion feature vector is marked as "serious operation abnormality".

[0021] Preferably, the system operation data acquisition step includes a data collection sub-step and a data processing sub-step;

[0022] The data collection sub-step includes using sensors and automated monitoring tools to obtain system real-time operation multivariate data and system historical operation multivariate data of the system, wherein the system real-time operation multivariate data and system historical operation multivariate data both include operation logs, call chains, network traffic usage data, system operation indicator data, and system resource usage data;

[0023] The data processing sub-step includes: performing denoising and data removal on the acquired system real-time operation multivariate data and system historical operation multivariate data, wherein the data removal is to remove useless and repeated data in the multivariate data;

[0024] Based on the time series, multiple groups of timestamps are set for each group of system real-time operation multivariate data and system historical operation multivariate data, and the multiple groups of multivariate data are synchronized and aligned according to the set timestamps;

[0025] For the system real-time operation multivariate data and the system historical operation multivariate data after synchronous alignment, the missing data are filled using interpolation method and / or mean method, and the processed data is transmitted to the multimodal feature fusion step.

[0026] Preferably, the multimodal feature data fusion step includes a feature extraction sub-step and a feature fusion sub-step; the feature extraction sub-step includes extracting time domain features from the system real-time operation multivariate data and the system historical operation multivariate data by using CNN\autocorrelation function, extracting frequency domain features from the system real-time operation multivariate data and the system historical operation multivariate data by using Fourier transform\spectral analysis method, and extracting spatial domain features from the system real-time operation multivariate data and the system historical operation multivariate data by analyzing the spatial distribution state of system resources;

[0027] The feature fusion sub-step includes normalizing the multiple extracted features and constraining the feature range, wherein the normalization method is as follows: ,

[0028] in, is the i-th feature in the m-th category after processing, To process the i-th feature in the first m-th feature, is the minimum feature among the features of the first m category, is the maximum feature among the features of the mth category before processing;

[0029] The normalized features are concatenated and fused\weighted to obtain a fused feature vector, where the fused feature vector obtained by the system's historical running multivariate data is recorded as a historical fused feature vector, and the fused feature vector obtained by the system's real-time running multivariate data is recorded as a real-time fused feature vector.

[0030] Preferably, the model building and learning step includes an analysis model building sub-step and a model training and verification sub-step;

[0031] The model building and training sub-step is to use a combination of deep learning and traditional machine learning algorithms to build an operational analysis model, wherein the deep learning algorithms include LSTM and AutoEncoder, and the traditional machine learning algorithms include random forest and SVM;

[0032] The model training and verification sub-step includes integrating the historical fusion feature vectors into a feature set based on the time series, and labeling the operating status of the feature set according to the historical operating status of the system, dividing the feature set into a training set and a verification set to train and verify the operation analysis model, and optimizing the operation analysis model using a Bayesian optimization algorithm based on the verification results.

[0033] Preferably, the prompt and prediction sub-step is used to receive the real-time fused feature vector corresponding to the judgment result of "operation abnormality", the abnormality level marking result, and the output result of the abnormality tracing sub-step, and predict the development status of "operation abnormality" by running the prediction model;

[0034] When the abnormality level marking result is "minor operation abnormality", the abnormality diagnosis model is used to analyze whether the abnormality can be self-repaired during the continued use of the system, and self-repair instructions and manual repair instructions are output;

[0035] When the output of the abnormal diagnosis model is a manual repair instruction, the operation prediction model is used to predict the development status based on the real-time fusion feature vector corresponding to the "minor operation abnormality" and the output of the abnormality tracing sub-step. The development status prediction includes predicting whether the "minor operation abnormality" will develop into a "moderate operation abnormality", predicting the abnormal development time, and predicting the probability of related abnormal phenomena occurring during the abnormal development process;

[0036] When the abnormality level marking result is "moderate operation abnormality", the operation prediction model is used to predict the development status based on the real-time fusion feature vector corresponding to the "moderate operation abnormality" and the output result of the abnormality tracing sub-step. The development status prediction includes predicting whether the "moderate operation abnormality" will develop into a "serious operation abnormality", predicting the abnormality development time, and predicting the probability of related abnormal phenomena occurring during the abnormality development process.

[0037] Preferably, the prompt and prediction sub-step further includes sending an early warning prompt to the system operation management personnel according to the real-time system operation status result, the abnormal level marking result and the "operation abnormality" development prediction result;

[0038] The response repair sub-step includes setting a plurality of repair means, and selecting an appropriate repair means to perform adaptive repair on the abnormal operation state according to the output results of the abnormal monitoring and analysis step and the output results of the prompt and warning sub-step.

[0039] Preferably, the evaluation and feedback sub-step includes obtaining real-time multivariate data of the system operation and analyzing the corresponding real-time operation status of the system after adaptive repair, and evaluating the system adaptive repair effect by comparing the two groups of system real-time operation status before and after repair.

[0040] Preferably, the model building and learning step also includes a model adaptive optimization step, which includes receiving a "normal operation" judgment result output by the abnormal diagnosis model, a corresponding real-time fusion feature vector, setting a prediction time period, and selecting a prediction time point;

[0041] The system operation state within the prediction time period is predicted by running the prediction model based on the current "normal operation" judgment result and the real-time fusion feature vector, and the system operation state at the selected prediction time point in the prediction time period is recorded as the first state;

[0042] The real-time operating state of the system when the selected prediction time point in the prediction time period is reached is analyzed by the abnormal diagnosis model and recorded as the second state;

[0043] The deviation between the first state and the second state is analyzed, and the operation prediction model is optimized according to the analysis result.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] 1. The present invention realizes the purpose of real-time monitoring of system operation status, prediction of subsequent system operation status and prediction of abnormal development status by adopting abnormal monitoring and analysis steps and multi-stage feedback repair steps. By predicting the operation status and abnormal development status, the present invention assists system administrators to adjust and repair the running system, thereby ensuring the normal operation of the system.

[0046] 2. The present invention is designed with an exception marking sub-step and an exception tracing sub-step to mark the fusion feature vector corresponding to the "operation abnormality" judgment result with an exception level and an exception fusion feature mark, so that system management personnel can select appropriate system repair methods according to the exception level mark, and trace the location, type and cause of the exception, so as to help system maintenance personnel quickly locate the abnormal location and perform corresponding system repairs, which is beneficial to improving the system repair efficiency under abnormal system operation conditions.

[0047] 3. The present invention uses deep learning and traditional machine learning combined algorithms to construct an operation analysis model, which is beneficial to improving the analysis ability of the model, and thus improving the accuracy of the system operation status monitoring and analysis. The model adaptive optimization step optimizes and adjusts the operation prediction model and the abnormal diagnosis model, which is beneficial to improving the accuracy and timeliness of the prediction results, as well as improving the availability of the operation analysis model under multiple environmental conditions, and is beneficial to improving the model prediction accuracy and model robustness.

[0048] 4. The present invention realizes the collection of multivariate data of system operation by designing a system operation data acquisition step, thereby ensuring the coverage width of system operation related information, providing strong data support for the establishment of an operation analysis model, and thereby improving the accuracy of diagnosis and prediction of the operation analysis model. A multimodal feature data fusion step is designed to realize the role of effectively integrating key features, making it convenient to analyze whether the system operation status is abnormal and determine the abnormal occurrence point, abnormal occurrence type and abnormal occurrence cause through the fusion feature vector. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a step diagram of the monitoring and analysis method of the present invention;

[0050] Figure 2 It is a step diagram of the abnormal monitoring and analysis steps in the monitoring and analysis method of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] See also Figure 1, an embodiment provided by the present invention: a system operation abnormality monitoring and analysis method based on intelligent algorithm, comprising a system operation data acquisition step, a multi-modal feature data fusion step, a model building and learning step, an abnormality monitoring and analysis step and a multi-stage feedback repair step, wherein the system operation data acquisition step comprises a data collection sub-step and a data processing sub-step;

[0053] The data collection sub-step includes using sensors and automated monitoring tools to obtain the system's real-time system operation multivariate data and the system's historical system operation multivariate data, wherein the system's real-time system operation multivariate data and the system's historical system operation multivariate data both include operation logs, call chains, network traffic usage data, system operation indicator data, and system resource usage data. For example, the operation log includes system operation abnormalities or error information, warning information, etc., the call chain information includes the system's service-related data information, request time, response time, etc., and the system operation indicator data includes multivariate data such as occupancy rate, usage rate, and temperature;

[0054] The data processing sub-step includes: performing denoising and data removal on the acquired system real-time operation multivariate data and system historical operation multivariate data, wherein the data removal is to remove useless duplicate data in the multivariate data, and the removal of useless duplicate data can be based on similarity or variance to remove the useless duplicate data;

[0055] Based on the time series, multiple groups of timestamps are set for each group of system real-time operation multivariate data and system historical operation multivariate data, and the multiple groups of multivariate data are synchronized and aligned according to the set timestamps;

[0056] For the system real-time operation multivariate data and the system historical operation multivariate data after synchronous alignment, the missing data are filled using interpolation method and / or mean method, and the processed data is transmitted to the multimodal feature fusion step.

[0057] Furthermore, by setting up a data collection sub-step to obtain multivariate data, the coverage width of system operation-related information is ensured, providing favorable data support for the establishment of an operation analysis model, thereby improving the accuracy of diagnosis and prediction of the operation analysis model. By using the data processing sub-step, multivariate data is denoised and useless duplicate data is removed, which improves data quality and reduces data redundancy, thereby reducing the interference of useless data on the operation analysis model, which is beneficial to improving the accuracy of subsequent system operation status analysis. By synchronizing the data and filling in missing data, the consistency of the multivariate data is ensured and the completeness of the monitoring data is improved, which is beneficial to improving the system operation status monitoring effect.

[0058] See also Figure 1, an embodiment provided by the present invention: a system operation abnormality monitoring and analysis method based on intelligent algorithm, the multimodal feature data fusion step includes a feature extraction sub-step and a feature fusion sub-step; the feature extraction sub-step includes extracting time domain features from system real-time operation multivariate data and system historical operation multivariate data by using CNN\autocorrelation function, extracting frequency domain features from system real-time operation multivariate data and system historical operation multivariate data by using Fourier transform\spectral analysis method, and extracting spatial domain features from system real-time operation multivariate data and system historical operation multivariate data by analyzing the spatial distribution state of system resources;

[0059] The feature fusion sub-step includes normalizing the multi-extracted features and constraining the feature range. The normalization method is as follows: ,

[0060] in, is the i-th feature in the m-th category after processing, To process the i-th feature in the first m-th feature, is the minimum feature among the features of the first m category, is the maximum feature among the features of the mth category before processing;

[0061] The normalized features are concatenated and fused\weighted to obtain a fused feature vector, where the fused feature vector obtained by the system's historical running multivariate data is recorded as a historical fused feature vector, and the fused feature vector obtained by the system's real-time running multivariate data is recorded as a real-time fused feature vector.

[0062] Furthermore, by setting a feature extraction sub-step and a feature fusion sub-step, relevant features are extracted from multivariate data and fused, and then a fused feature vector is obtained, thereby achieving the role of effectively integrating key features, making it convenient to analyze whether the system operation status is abnormal and to determine the abnormal occurrence point, abnormal occurrence type and abnormal occurrence cause through the fused feature vector. Moreover, normalization of various features is performed before feature fusion, which is beneficial to improve the range consistency of features and the feature fusion effect, thereby ensuring the correctness of the operation analysis model and the accuracy of the system operation status analysis results.

[0063] See also Figure 1 , an embodiment provided by the present invention: a system operation abnormality monitoring and analysis method based on intelligent algorithm, the model building and learning step includes an analysis model building sub-step, a model training and verification sub-step;

[0064] The model building and training sub-step is to use deep learning and traditional machine learning algorithms to build and run the analysis model. The deep learning algorithms include LSTM and AutoEncoder, and the traditional machine learning algorithms include random forest and SVM.

[0065] The model training and verification sub-steps include integrating the historical fusion feature vectors into a feature set based on the time series, annotating the feature set with the operating status according to the historical operating status of the system, dividing the feature set into a training set and a verification set to train and verify the operation analysis model, and using Bayesian

[0066] See also Figure 1 and Figure 2 , an embodiment provided by the present invention: a system operation abnormality monitoring and analysis method based on intelligent algorithm, the abnormality monitoring and analysis step includes a monitoring and analysis sub-step, an abnormality marking sub-step and an abnormality tracing sub-step;

[0067] The monitoring and analysis sub-steps include: acquiring and processing real-time system operation multivariate data through a system operation data acquisition step during system operation;

[0068] Through the multimodal feature fusion step, feature extraction and feature fusion are performed on the multivariate data of the real-time operation of the system to obtain a real-time fusion feature vector corresponding to the multivariate data of the real-time operation of the system;

[0069] The operation analysis model includes an abnormal diagnosis model and an operation prediction model. The real-time fused feature vector is output to the abnormal diagnosis model, and a multi-state normal operation standard vector is set in the abnormal diagnosis model. The coincidence degree between the real-time fused feature vector and the normal operation standard vector is analyzed by the abnormal diagnosis model to judge the real-time operation state of the system. When the abnormal diagnosis model outputs the judgment result of "operation abnormality", the analysis judgment result and the real-time fused feature vector are output to the abnormal marking sub-step. When the abnormal diagnosis model outputs the judgment result of "operation normal", the analysis judgment result and the real-time fused feature vector are output to the operation prediction model.

[0070] Furthermore, the coincidence analysis between the real-time fusion feature vector and the normal operation standard vector includes: when the coincidence between the real-time fusion feature vector and the normal operation standard vector under the same state conditions is When the abnormal diagnosis model outputs the judgment result of "normal operation", the real-time fusion feature vector coincides with the normal operation standard vector under the same state conditions. , when , the abnormal diagnosis model outputs the judgment result of "operation abnormality";

[0071] The anomaly marking sub-step includes anomaly level marking and anomaly fusion feature marking;

[0072] The abnormal level marking is to analyze the overlap interval between the real-time fusion feature vector of "operation abnormality" and the normal operation standard vector, and mark the abnormal level of the real-time fusion feature;

[0073] Furthermore, the coincidence analysis between the real-time fusion feature vector and the normal operation standard vector also includes comparing the coincidence between the real-time fusion feature vector corresponding to the "operation abnormality" judgment result and the normal operation standard vector under the same state conditions and marking the abnormality level, specifically including: when the coincidence between the real-time fusion feature vector and the normal operation standard vector under the same state conditions belongs to the interval of When , the real-time running status of the system corresponding to the real-time fusion feature vector is marked as "slight running abnormality";

[0074] When the overlap between the real-time fusion feature vector and the normal operation standard vector under the same state conditions belongs to the interval When , the real-time operation status of the system corresponding to the real-time fusion feature vector is marked as "moderate operation abnormality";

[0075] When the overlap between the real-time fusion feature vector and the normal operation standard vector under the same state conditions belongs to the interval When , the real-time running status of the system corresponding to the real-time fusion feature vector is marked as "serious running abnormality";

[0076] The operating state of "minor operation abnormality" indicates that the normal operation of the system is not affected under this abnormal state. The operating state of "moderate operation abnormality" indicates that the operation of some system performance is affected under this abnormal state. The operating state of "serious operation abnormality" indicates that the overall operation of the system is affected under this abnormal state.

[0077] The abnormal fusion feature marking is to determine the abnormal points in the real-time fusion feature vector and set abnormal marking points at the abnormal points;

[0078] The abnormality tracing sub-step includes extracting abnormal marking points and the vector segment where the abnormal marking points are located from the real-time fusion feature vector, performing multivariate data restoration on the vector segment through a decoding device, obtaining data for abnormality tracing, using the abnormality tracing data in combination with the real-time operation multivariate data to analyze the location of the system operation abnormality, locating the time when the operation abnormality occurs based on the actual sequence of the real-time operation multivariate data, judging the type of abnormality using the vector segment where the abnormal marking points are located, the abnormality tracing data, the location of the operation abnormality and the time when the operation abnormality occurs, and using decision tree analysis\causal reasoning\deep learning algorithms to analyze the cause of the abnormal operation through the abnormality tracing data, the location of the operation abnormality, the time of the abnormality, the type of abnormality and the real-time operation multivariate data.

[0079] Furthermore, by setting up an abnormal monitoring and analysis step, the real-time fusion feature vector is monitored and analyzed using an abnormal diagnosis model, so as to judge whether the system operation is normal, and divide and mark the degree of system operation abnormality, so as to select corresponding repair means to repair the system operation according to the division result, and by setting up an abnormal tracing sub-step, the abnormal location, abnormal type and abnormal cause are traced for the abnormal marking point and the corresponding vector segment, so as to help system maintenance personnel quickly locate the abnormal location and perform corresponding system repair, which is beneficial to improve the system repair efficiency under abnormal system operation state.

[0080] See also Figure 1 and Figure 2 , an embodiment provided by the present invention: a system operation anomaly monitoring and analysis method based on intelligent algorithm, a multi-stage feedback repair step includes a prompt and prediction sub-step, a response repair sub-step and an evaluation feedback sub-step, the prompt and prediction step is used to receive the system real-time operation status judgment result and the abnormality level marking result, and to prompt the system operation management personnel and predict the "operation anomaly" development status, the response repair sub-step is used to select the corresponding system repair means according to the system real-time operation status judgment result and the "operation anomaly" development status prediction result to repair the system, and the evaluation and feedback sub-step is used to evaluate the system repair result;

[0081] The prompt and prediction sub-step is used to receive the real-time fusion feature vector corresponding to the judgment result of "operation abnormality", the abnormal level marking result, and the output result of the abnormality tracing sub-step, and predict the development status of "operation abnormality" by running the prediction model;

[0082] When the abnormality level is marked as "minor operation abnormality", the abnormality diagnosis model is used to analyze whether the abnormality can be self-repaired during the continued use of the system, and self-repair instructions and manual repair instructions are output;

[0083] When the output of the abnormal diagnosis model is a manual repair instruction, the operation prediction model is used to predict the development status based on the real-time fusion feature vector corresponding to the "minor operation abnormality" and the output of the abnormality tracing sub-step. The development status prediction includes predicting whether the "minor operation abnormality" will develop into a "moderate operation abnormality", predicting the abnormal development time, and predicting the probability of related abnormal phenomena occurring during the abnormal development process;

[0084] When the abnormality level marking result is "moderate operation abnormality", the operation prediction model is used to predict the development status based on the real-time fusion feature vector corresponding to the "moderate operation abnormality" and the output result of the abnormality tracing sub-step. The development status prediction includes predicting whether the "moderate operation abnormality" will develop into a "serious operation abnormality", predicting the abnormal development time, and predicting the probability of related abnormal phenomena occurring during the abnormal development process;

[0085] The prompt and prediction sub-step also includes sending early warning prompts to system operation managers based on the system real-time operation status results, abnormal level marking results and "operation abnormality" development prediction results, and the operation prompts can be sent via SMS or pop-up windows;

[0086] The response repair sub-step includes setting a variety of repair means, selecting an appropriate repair means to perform adaptive repair on the abnormal operation state according to the output results of the abnormal monitoring and analysis step and the output results of the prompt and warning sub-step;

[0087] Furthermore, for the operating status diagnosis results of "minor operating abnormality" and "moderate operating abnormality", the abnormal development status is predicted by the operation prediction model. When the prediction result is that the operating status cannot develop into the next level of abnormality, the management personnel is prompted that the system can continue to operate and complete the original operating task, and after the original operating task is completed, the corresponding repair means are selected to repair the system abnormality. When the prediction result is that the operating status can develop into the next level of abnormality, the management personnel is prompted with the system operation available time range according to the predicted abnormal development time, and then the management personnel is prompted to complete the storage or transfer of relevant data or speed up the completion of the original operating task within the system operation available time range. By setting a multi-stage feedback repair step, the prediction of the development of the operating abnormality state is realized, and the system management personnel are assisted in adjusting and repairing the system.

[0088] See also Figure 1 , an embodiment provided by the present invention: a system operation abnormality monitoring and analysis method based on intelligent algorithm, the model building and learning step also includes a model adaptive optimization step, the model adaptive optimization step includes receiving the "normal operation" judgment result output by the abnormal diagnosis model, the corresponding real-time fusion feature vector, setting the prediction time period and selecting the prediction time point;

[0089] The system operation state within the prediction time period is predicted by running the prediction model based on the current "normal operation" judgment result and the real-time fusion feature vector, and the system operation state at the selected prediction time point in the prediction time period is recorded as the first state;

[0090] The real-time operating state of the system when the selected prediction time point in the prediction time period is reached is analyzed by the abnormal diagnosis model and recorded as the second state;

[0091] Analyze the deviation between the first state and the second state, and optimize the operation prediction model according to the analysis results;

[0092] The model adaptive optimization step also includes identifying the operating modes under different environmental conditions and optimizing the abnormal diagnosis model.

[0093] Furthermore, by setting up an operation prediction model to predict whether there may be abnormal phenomena in the system operation, it is convenient to prompt the staff to manage and adjust the system operation, thereby improving the system operation effect. The operation prediction model and the abnormal diagnosis model are optimized and adjusted through the model adaptive optimization step, which is beneficial to improve the accuracy and timeliness of the prediction results, as well as improve the availability of the operation analysis model under multiple environmental conditions.

[0094] Working principle: The system historical operation multivariate data and system implementation multivariate data are obtained through the system operation data acquisition step, and the multivariate data is denoised and useless data is removed, the data is synchronized and the real-time data is supplemented. Then, the multivariate data is feature extracted and fused through the multimodal feature data fusion step to obtain the historical fusion feature vector and the real-time fusion feature vector. The operation analysis model is constructed through the model establishment and learning steps, and the operation analysis model is trained and optimized using the historical fusion feature vector. The trained and optimized operation analysis model is used to analyze the real-time fusion feature vector to determine the real-time operation status and operation abnormality level of the system, and to predict the system operation status. The multi-stage feedback repair step provides prompts and warnings based on the real-time operation abnormality status and selects response measures to repair the abnormality.

[0095] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A system operation abnormality monitoring and analysis method based on intelligent algorithm, characterized by: It includes system operation data acquisition steps, multi-modal feature data fusion steps, model building and learning steps, abnormality monitoring and analysis steps, and multi-stage feedback repair steps; The multimodal feature data fusion step extracts and fuses features for the multimodal data acquired in the system operation data acquisition step; the abnormality monitoring and analysis step uses the fused feature vector output by the multimodal feature data fusion step and the operation analysis model output by the model establishment and learning step to monitor the system operation status and output the operation monitoring result, and the operation analysis model includes an abnormality diagnosis model and an operation prediction model; the multi-stage feedback repair step is used to perform abnormality feedback and response optimization according to the system operation monitoring result; The abnormality monitoring and analysis step includes a monitoring and analysis sub-step, an abnormality marking sub-step and an abnormality tracing sub-step; The monitoring and analysis sub-step is used to receive the real-time fusion feature vector and analyze the overlap between the real-time fusion feature vector and the normal operation standard vector through the abnormal diagnosis model. , determine the real-time operating status of the system, and the real-time operating status of the system includes "abnormal operation" and "normal operation"; The abnormality marking sub-step includes abnormality level marking and abnormal fusion feature marking. The abnormality level marking is to analyze the overlap interval of the real-time fusion feature vector of "operation abnormality" and the normal operation standard vector, and to mark the abnormality level of the real-time fusion feature. The abnormality fusion feature marking is to determine the abnormal point in the real-time fusion feature vector and set an abnormal marking point at the abnormal point. The abnormality tracing sub-step is used to extract abnormal marking points and vector segments where abnormal marking points are located from the real-time fusion feature vector, and trace the abnormal operation related information and the cause of the abnormal operation; The multi-stage feedback repair step includes a prompt and prediction sub-step, a response repair sub-step and an evaluation feedback sub-step. The prompt and prediction step is used to receive the system real-time operation status judgment result and the abnormality level marking result, and to prompt the system operation management personnel and predict the "operation abnormality" development status. The response repair sub-step is used to select the corresponding system repair means to perform system repair according to the system real-time operation status judgment result and the "operation abnormality" development status prediction result.

2. The method for monitoring and analyzing system operation abnormality based on intelligent algorithm according to claim 1 is characterized by: The real-time fusion feature vector is obtained by the following steps: during the system operation process, the system real-time operation multivariate data is obtained and processed by the system operation data acquisition step, and the system real-time operation multivariate data is subjected to feature extraction and feature fusion by the multimodal feature fusion step to obtain the real-time fusion feature vector corresponding to the system real-time operation multivariate data; The coincidence analysis between the real-time fusion feature vector and the normal operation standard vector includes: When the abnormal diagnosis model outputs the judgment result of "normal operation", the real-time fusion feature vector coincides with the normal operation standard vector under the same state conditions. When the abnormal diagnosis model outputs the judgment result of "operation abnormality", the analysis and judgment result and the real-time fusion feature vector are output to the abnormal marking sub-step; when the abnormal diagnosis model outputs the judgment result of "operation normal", the analysis and judgment result and the real-time fusion feature vector are output to the operation prediction model; The abnormality tracing sub-step specifically includes: extracting abnormal marking points and vector segments where the abnormal marking points are located from the real-time fusion feature vector, performing multivariate data restoration on the vector segments through a decoding device to obtain data for abnormality tracing, using the abnormality tracing data in combination with the real-time operation multivariate data to analyze the location of the system operation abnormality, locating the time when the operation abnormality occurs based on the actual sequence of the real-time operation multivariate data, judging the abnormality type by using the vector segment where the abnormal marking points are located, the abnormality tracing data, the location of the operation abnormality and the time when the operation abnormality occurs, and recording the abnormality tracing data, the location of the operation abnormality, the time when the abnormality occurs, and the abnormality type as abnormal operation related information, and using decision tree analysis\causal reasoning\deep learning algorithms to analyze the cause of the abnormal operation through the abnormality tracing data, the location of the operation abnormality, the time when the abnormality occurs, the abnormality type and the real-time operation multivariate data.

3. The method for monitoring and analyzing system operation abnormality based on intelligent algorithm according to claim 1 is characterized by: The overlap analysis of the real-time fusion feature vector and the normal operation standard vector also includes comparing the overlap of the real-time fusion feature vector corresponding to the "operation abnormality" judgment result with the normal operation standard vector under the same state conditions and marking the abnormal level, specifically including: when the overlap interval of the real-time fusion feature vector and the normal operation standard vector under the same state conditions is , marking the real-time operating state of the system corresponding to the real-time fusion feature vector as "slight operating abnormality"; When the overlap between the real-time fusion feature vector and the normal operation standard vector under the same state conditions belongs to the interval , marking the real-time operating state of the system corresponding to the real-time fusion feature vector as "moderate operating abnormality"; When the overlap between the real-time fusion feature vector and the normal operation standard vector under the same state conditions belongs to the interval When the real-time fusion feature vector is marked as a "serious operation abnormality", the real-time operation status of the system corresponding to the real-time fusion feature vector is marked as a "serious operation abnormality".

4. The method for monitoring and analyzing system operation abnormality based on intelligent algorithm according to claim 1 is characterized by: The system operation data acquisition step includes a data collection sub-step and a data processing sub-step; The data collection sub-step includes using sensors and automated monitoring tools to obtain system real-time operation multivariate data and system historical operation multivariate data of the system, wherein the system real-time operation multivariate data and system historical operation multivariate data both include operation logs, call chains, network traffic usage data, system operation indicator data, and system resource usage data; The data processing sub-step includes: performing denoising and data removal on the acquired system real-time operation multivariate data and system historical operation multivariate data, wherein the data removal is to remove useless duplicate data in the multivariate data; Based on the time series, multiple groups of timestamps are set for each group of system real-time operation multivariate data and system historical operation multivariate data, and the multiple groups of multivariate data are synchronized and aligned according to the set timestamps; For the system real-time operation multivariate data and the system historical operation multivariate data after synchronous alignment, the missing data are filled using interpolation method and / or mean method, and the processed data is transmitted to the multimodal feature fusion step.

5. The method for monitoring and analyzing system operation abnormality based on intelligent algorithm according to claim 4 is characterized by: The multimodal feature data fusion step includes a feature extraction sub-step and a feature fusion sub-step; the feature extraction sub-step includes extracting time domain features from the system real-time operation multivariate data and the system historical operation multivariate data by using CNN\autocorrelation function, extracting frequency domain features from the system real-time operation multivariate data and the system historical operation multivariate data by using Fourier transform\spectral analysis method, and extracting spatial domain features from the system real-time operation multivariate data and the system historical operation multivariate data by analyzing the spatial distribution state of system resources; The feature fusion sub-step includes normalizing the multiple extracted features and constraining the feature range, wherein the normalization method is as follows: , in, is the i-th feature in the m-th category after processing, is the i-th feature in the m-th category before processing, is the minimum feature in the m-th category before processing, and is the maximum feature in the m-th category before processing; The normalized features are concatenated and fused\weighted to obtain a fused feature vector, where the fused feature vector obtained by the system's historical running multivariate data is recorded as a historical fused feature vector, and the fused feature vector obtained by the system's real-time running multivariate data is recorded as a real-time fused feature vector.

6. The method for monitoring and analyzing system operation abnormality based on intelligent algorithm according to claim 5 is characterized by: The model building and learning steps include an analysis model building sub-step and a model training and verification sub-step; The model building and training sub-step is to use a combination of deep learning and traditional machine learning algorithms to build an operational analysis model, wherein the deep learning algorithms include LSTM and AutoEncoder, and the traditional machine learning algorithms include random forest and SVM; The model training and verification sub-step includes integrating the historical fusion feature vectors into a feature set based on the time series, and labeling the operating status of the feature set according to the historical operating status of the system, dividing the feature set into a training set and a verification set to train and verify the operation analysis model, and optimizing the operation analysis model using a Bayesian optimization algorithm based on the verification results.

7. The method for monitoring and analyzing system operation abnormality based on intelligent algorithm according to claim 1 is characterized by: The prompt and prediction sub-step is used to receive the real-time fusion feature vector corresponding to the judgment result of "operation abnormality", the abnormality level marking result, and the output result of the abnormality tracing sub-step, and predict the development status of "operation abnormality" by running the prediction model; When the abnormality level marking result is "minor operation abnormality", the abnormality diagnosis model is used to analyze whether the abnormality can be self-repaired during the continued use of the system, and self-repair instructions and manual repair instructions are output; When the output of the abnormal diagnosis model is a manual repair instruction, the operation prediction model is used to predict the development status based on the real-time fusion feature vector corresponding to the "minor operation abnormality" and the output of the abnormal tracing sub-step. The development status prediction includes predicting whether the "minor operation abnormality" will develop into a "moderate operation abnormality", predicting the abnormal development time, and predicting the probability of related abnormal phenomena occurring during the abnormal development process; When the abnormality level marking result is "moderate operation abnormality", the operation prediction model is used to predict the development status based on the real-time fusion feature vector corresponding to the "moderate operation abnormality" and the output result of the abnormality tracing sub-step. The development status prediction includes predicting whether the "moderate operation abnormality" will develop into a "serious operation abnormality", predicting the abnormal development time, and predicting the probability of related abnormal phenomena occurring during the abnormal development process.

8. The method for monitoring and analyzing system operation abnormality based on intelligent algorithm according to claim 7 is characterized by: The prompt and prediction sub-step also includes sending early warning prompts to system operation managers based on the system real-time operation status results, abnormal level marking results and "operation abnormality" development prediction results; The response repair sub-step includes setting a plurality of repair means, and selecting an appropriate repair means to perform adaptive repair on the abnormal operation state according to the output results of the abnormal monitoring and analysis step and the output results of the prompt and warning sub-step.

9. The method for monitoring and analyzing system operation abnormalities based on intelligent algorithms according to claim 8 is characterized by: The evaluation and feedback sub-step includes obtaining real-time multivariate data of the system operation and analyzing the corresponding real-time operation status of the system after the adaptive repair, and evaluating the system adaptive repair effect by comparing the two sets of system real-time operation status before and after the repair.

10. The method for monitoring and analyzing system operation anomalies based on intelligent algorithms according to claim 1, characterized in that: The model building and learning step also includes a model adaptive optimization step, which includes receiving the "normal operation" judgment result output by the abnormal diagnosis model, the corresponding real-time fusion feature vector, setting the prediction time period and selecting the prediction time point; The system operation state within the prediction time period is predicted by running the prediction model based on the current "normal operation" judgment result and the real-time fusion feature vector, and the system operation state at the selected prediction time point in the prediction time period is recorded as the first state; The real-time operating state of the system when the selected prediction time point in the prediction time period is reached is analyzed by the abnormal diagnosis model and recorded as the second state; The deviation between the first state and the second state is analyzed, and the operation prediction model is optimized according to the analysis result.

Images