Abnormity processing method based on grading judgment

Abstract

The invention discloses an exception handling method based on hierarchical judgment, which comprises the following steps of: collecting monitoring data of environment, personnel and equipment through a self system, converting the monitoring data into object attribute data, generating a multi-dimensional exception field based on a time sequence and a space attribute of physical object attribute data, and according to a position and a form of an exception in a corresponding exception field, carrying out hierarchical judgment on the exception in the multi-dimensional exception field. Judging abnormal types and severity; calculating an abnormal diffusion path and a potential influence range according to an abnormal position in the multi-dimensional abnormal field; carrying out anomaly classification identification by using a hierarchical ripple model, sensing the propagation rate and intensity of an abnormal ripple, and determining the level to which the anomaly belongs; and according to an anomaly grading result, different anomaly processing strategies are selected to process anomalies, and the anomaly processing strategies at least comprise self-splitting, self-fusion, future state shaping and time repair. According to the invention, the problems of insufficient anomaly detection flexibility, single processing strategy and unreasonable resource scheduling in the prior art are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data exception processing, and in particular to an exception processing method based on hierarchical judgment. Background Art

[0002] In the modern information society, the widespread application of various complex systems has made anomaly detection and processing technology a key link in ensuring the security and stable operation of the system. These complex systems cover multiple fields such as financial transactions, network communications, industrial control, and intelligent manufacturing. Any anomaly in the system operation process may cause serious economic losses, safety accidents, or business interruptions. Therefore, how to effectively monitor, warn, and handle abnormal events has become the focus of research in the field of information technology.

[0003] At present, anomaly detection technologies mainly include rule-based detection, statistical methods, machine learning algorithms, and big data analysis. However, with the increasing complexity of the system, traditional rule-based and threshold-based anomaly detection methods have gradually exposed their limitations. These methods usually rely on pre-set static rules or thresholds. When the system environment changes, the static thresholds may not adapt to the new operating conditions, resulting in frequent false positives and false negatives. This limitation is particularly prominent in the ever-changing network environment and multi-level industrial control systems.

[0004] In addition, the existing technology also has obvious deficiencies in exception handling strategies. The exception handling mechanism adopted by many systems is relatively simple, and usually can only take preset processing measures for known exception types, which makes it difficult to flexibly respond to unknown or complex abnormal events. When anomalies propagate or spread in the system, the existing processing mechanism often cannot be adjusted in time, resulting in further spread of anomalies and even causing chain failures of the system. At the same time, the existing processing methods are mostly passive responses, lacking the ability to predict and actively intervene in potential anomalies, and cannot effectively prevent the occurrence and escalation of anomalies.

[0005] As the scale and complexity of the system increase, existing exception handling methods also have certain defects in resource scheduling. The allocation of system resources is often based on the anomaly detection results of a single dimension, lacking a global perspective, resulting in unreasonable resource allocation and affecting the overall response capability of the system. Especially in the case of multi-system linkage, resource coordination and optimization become more complicated, and existing technologies are difficult to provide effective solutions. Summary of the invention

[0006] In view of the deficiencies of the prior art, the present invention provides an exception handling method based on hierarchical judgment, which improves the problems of insufficient flexibility of exception detection, single processing strategy and unreasonable resource scheduling in the prior art.

[0007] The technical solution adopted by the present invention to solve the technical problem is: an exception handling method based on hierarchical judgment, comprising the following steps:

[0008] S1. Collect monitoring data on the environment, personnel and equipment through its own system, which includes a host computer monitoring system and an intelligent integrated management and control platform;

[0009] S2. Converting the monitoring data into object attribute data, wherein the object attribute data has the ability of self-regulation and historical data evolution;

[0010] S3, generating a multidimensional abnormal field based on the time series and spatial attributes of the physical object attribute data, and judging the type and severity of the abnormality according to the position and form of the abnormality in the corresponding abnormal field;

[0011] S4. Calculate the anomaly diffusion path and potential impact range according to the anomaly position in the multi-dimensional anomaly field;

[0012] S5. Use the hierarchical ripple model to identify abnormal classification, sense the propagation rate and intensity of abnormal ripples, and determine the level of the abnormality;

[0013] S6. According to the result of the exception classification, different exception handling strategies are selected to handle the exception. The exception handling strategies include at least: self-splitting, self-fusion, future state shaping and time repair.

[0014] Furthermore, step S1 specifically includes:

[0015] S1.1. Initialize the system and set the parameters to be monitored, including environment, system performance, network transmission, equipment operation, and abnormal user behavior data;

[0016] S1.2, start the sensor module in its own system to collect various data in real time during the operation of its own system;

[0017] S1.3, input the collected data into the core computing module of its own system, and conduct preliminary analysis and cleaning of the data;

[0018] S1.4, storing the processed data in a temporary storage area;

[0019] S1.5. Use the set monitoring threshold to compare the system's operating data in real time and identify potential anomalies;

[0020] S1.6. When abnormal data is detected, the alarm module is automatically triggered to record the abnormality and proceed to step S2.

[0021] Furthermore, step S2 specifically includes:

[0022] S2.1. Extract the monitored data, including real-time data and historical data; generate initial object attribute data;

[0023] S2.2, performing attribute expansion on the object attribute data, including self-regulation factors, associated object attributes and environmental perception factors;

[0024] S2.3, through machine learning algorithms, give the object attribute data the ability to self-evolve, so that it can automatically adjust its own state based on historical data and adapt to dynamic environmental changes;

[0025] S2.4, interactively analyzing object attribute data and environmental data to form an adaptive data model;

[0026] S2.5. Continuously update the state of object attribute data to keep it adapted to the current system environment and data flow;

[0027] S2.6. Input the object attribute data into the multi-dimensional anomaly field generation module and proceed to step S3.

[0028] Furthermore, step S3 specifically includes:

[0029] S3.1, initializing a multidimensional anomaly field generator, and inputting object attribute data and its adaptive data model to construct a multidimensional anomaly field;

[0030] S3.2, mapping the monitored data into a multi-dimensional anomaly field to form an anomaly data position coordinate system;

[0031] S3.3, classify abnormal data in multiple dimensions, including time dimension, space dimension and impact dimension;

[0032] S3.4, analyzing the morphological characteristics of anomalies through field deformation;

[0033] S3.5. Preliminarily identify the anomaly type based on the anomaly’s morphological characteristics and multi-dimensional coordinate information;

[0034] S3.6. Determine the severity of the anomaly and transmit the location data of the anomaly to the diffusion path calculation module, and proceed to step S4.

[0035] Furthermore, step S4 specifically includes:

[0036] S4.1, inputting the abnormal position in the multi-dimensional abnormal field into the diffusion path calculation module;

[0037] S4.2. Analyze the changes in the coordinates of the anomaly positions in the anomaly field and predict the diffusion direction and path of the anomaly;

[0038] S4.3. Combine the architecture of the system and the dependencies between modules to simulate the propagation path of anomalies in the system.

[0039] S4.4. Calculate the potential impact range on each propagation path, including the affected modules, number of users, and amount of data;

[0040] S4.5. Generate anomaly diffusion map based on propagation path calculation results to identify the areas affected by the anomaly;

[0041] S4.6. Feedback the calculation results of the abnormal diffusion map and propagation path to the hierarchical processing module and proceed to step S5.

[0042] Furthermore, step S5 specifically includes:

[0043] S5.1, initialize the hierarchical ripple model, and identify the anomaly as the ripple center according to the anomaly diffusion map;

[0044] S5.2. Analyze the initial propagation rate and intensity of the ripples and determine the basic characteristics of the ripples based on the preliminary classification type of the anomaly;

[0045] S5.3. Dynamically adjust the ripple propagation model according to the ripple diffusion path and abnormal forms in the multidimensional field;

[0046] S5.4. Divide ripples into different layers, including core layer, important layer, middle layer and peripheral layer;

[0047] S5.5. Determine the abnormality classification at each level based on the propagation rate and intensity of the ripples;

[0048] S5.6. Input the classified exceptions into the exception handling strategy selection module and proceed to step S6.

[0049] Further, step S6 specifically includes:

[0050] S6.1. Initialize the exception handling strategy selector and select a preliminary handling strategy based on the exception classification result.

[0051] S6.2. For core layer anomalies, the self-integration mechanism between modules is triggered to merge the resources of multiple modules to deal with the anomaly;

[0052] S6.3. For abnormalities in important or intermediate layers, trigger the future state shaping mechanism, simulate multiple possible future states of the data, and perform some repair operations in advance;

[0053] S6.4. For anomalies in the peripheral layer, the self-splitting mechanism between modules is activated to isolate the affected modules from other modules to limit the spread of anomalies;

[0054] S6.5. When an abnormality is detected with an escalating trend, dynamically adjust the processing strategy and, if necessary, start the time repair mechanism to trace the system status back to the safe state before the abnormality;

[0055] S6.6. Continuously monitor the exception handling process and adjust the exception handling strategy based on real-time feedback information until the exception is completely controlled or eliminated.

[0056] Furthermore, the location coordinates of the abnormal data are:

[0057] Among them, w i represents the abnormal weight of the attribute data of the i-th object, depending on the self-regulation state S i (t), (x i ,y i ,z i ) represents the coordinates of the i-th object attribute data in the multidimensional space, N represents the number of object attribute data, (x 异常 ,y 异常 ,z 异常 ) represents the location coordinates of the anomaly;

[0058] The calculation formula of abnormal morphological feature I is:

[0059] T d =t 结束 -t 开始 ,

[0060] Among them, T d Represents the time difference from the beginning to the end of the ripple wave. Represents the average value of the coordinates.

[0061] Furthermore, the calculation formula of the diffusion path calculation module is: R(t)=R0+v·(t-t0), where:

[0062] R(t) represents the anomaly impact radius, which changes with time; R0 represents the initial impact radius of the anomaly; v represents the anomaly diffusion speed, and t0 represents the initial time of the anomaly occurrence;

[0063] The calculation formula for the potential impact range on the propagation path is:

[0064] Two-dimensional space: A(t) = π[R(t)] 2 , where A(t) represents the potential impact range at time t, and R(t) represents the anomaly diffusion radius at time t;

[0065] Three-dimensional space: Among them, V(t) represents the potential impact range at time t, and R(t) represents the anomaly diffusion radius at time t.

[0066] Furthermore, the formula for calculating the propagation rate of ripples is: Among them, v j represents the propagation rate of the j-th layer ripple, R j represents the influence radius of the j-th layer ripple;

[0067] In step S5.5, the strategy for determining the abnormality classification at each level is:

[0068] According to the abnormal intensity I and propagation rate v of the ripples j , set the abnormal classification threshold;

[0069] If I≥I 核心 And v j ≥v 核心 , it is determined to be a core layer abnormality;

[0070] If I 重要 ≤I 核心 And v 重要 ≤v j <v 核心 , it is judged as an important layer abnormality;

[0071] If I 中间 ≤I 重要 And v 中间 ≤v j <v 重要 , it is determined to be an abnormality in the middle layer;

[0072] Otherwise, it is determined that the peripheral layer is abnormal.

[0073] The beneficial effect of the present invention is that the exception handling method of the present invention has the following advantages:

[0074] (1) The present invention realizes self-monitoring and adjustment of system operation data by introducing the concepts of its own system and object attribute data. The system can automatically adjust the monitoring threshold according to real-time data and historical behavior, making the monitoring process more flexible and able to timely discover and respond to complex dynamic anomalies. It solves the problem that traditional anomaly monitoring systems usually rely on preset static rules or thresholds, which leads to false alarms or missed alarms in the face of dynamically changing environments and makes it difficult to respond to new anomalies in a timely manner.

[0075] (2) The present invention can accurately locate anomalies in a multi-dimensional space by generating a multi-dimensional anomaly field and classifying them according to their location and morphology. This not only improves the accuracy of anomaly detection, but also enables the classification of the type and potential impact of anomalies at the early stage of their occurrence, thus providing a scientific basis for subsequent processing.

[0076] ​​(3) By introducing the "hierarchical ripple" mechanism, the present invention can dynamically adjust the classification according to the propagation rate and intensity of the anomaly, and select an appropriate processing strategy, which can ensure that the core layer anomalies are handled first, and a lighter processing method is adopted for the peripheral layer anomalies, thereby optimizing resource utilization and improving response efficiency.

[0077] (4) By constructing a multi-dimensional anomaly field and combining it with the system architecture, the present invention can accurately predict the diffusion path and potential impact range of the anomaly, so that the system can plan response measures in advance, reduce the impact range of the anomaly on the entire system, and improve the robustness of the system.

[0078] (5) The present invention combines multiple strategies such as module self-splitting, self-fusion, future state shaping and time repair, and can select the most appropriate processing method according to the classification and type of anomalies. The comprehensive processing mechanism makes the system more flexible and effective in dealing with various anomalies, ensuring the stability and continuity of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0080] Figure 1 It is a structural schematic diagram of the present invention. DETAILED DESCRIPTION

[0081] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0082] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "multiple" means two or more.

[0083] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0084] As shown in the figure, the present invention discloses an exception handling method based on hierarchical judgment, comprising the following steps:

[0085] S1. Collect monitoring data on the environment, personnel and equipment through its own system, which includes a host computer monitoring system and an intelligent integrated management and control platform.

[0086] S2. Convert the monitoring data into object attribute data, wherein the object attribute data has the ability of self-regulation and historical data evolution.

[0087] S3. Generate a multidimensional anomaly field based on the time series and spatial attributes of the physical object attribute data, and determine the type and severity of the anomaly according to the position and shape of the anomaly in the corresponding anomaly field.

[0088] S4. Calculate the anomaly diffusion path and potential impact range based on the anomaly position in the multi-dimensional anomaly field.

[0089] S5. Use the hierarchical ripple model to identify abnormal classification, sense the propagation rate and intensity of abnormal ripples, and determine the level of the abnormality.

[0090] S6. According to the result of the exception classification, different exception handling strategies are selected to handle the exception. The exception handling strategies include at least: self-splitting, self-fusion, future state shaping and time repair.

[0091] Specifically, step S1 specifically includes:

[0092] S1.1. Initialize the system and set the parameters to be monitored, including environment, system performance, network transmission, equipment operation, and abnormal user behavior data.

[0093] For each monitoring parameter C n , set the corresponding threshold range [c low ,c up ], c low represents the lower threshold, c up Indicates the upper threshold value. When parameter C n When the value of exceeds the set threshold range, it is considered that the parameter C n The data are abnormal and need further analysis.

[0094] S1.2. Start the sensor module in its own system to collect various data in real time during the operation of its own system.

[0095] S1.3. Input the collected data into the core computing module of its own system and conduct preliminary analysis and cleaning of the data.

[0096] S1.4. Store the processed data in the temporary storage area.

[0097] S1.5. Use the set monitoring threshold to compare the system's operating data in real time and identify potential anomalies.

[0098] The system compares the data stored in the temporary storage area with the preset monitoring thresholds in real time. During the comparison process, the system checks whether each monitoring parameter is within its set normal range. If the current value of the monitoring parameter exceeds the corresponding threshold range, the parameter is marked as a potential anomaly. If one or more monitoring parameters exceed the set threshold range, it is considered that there may be an anomaly in the system.

[0099] When certain parameters exceed the preset range, the system will trigger the abnormal identification mechanism to preliminarily determine whether there is an emergency. This mechanism combines historical data trends for analysis to reduce the possibility of false alarms.

[0100] S1.6. When abnormal data is detected, the alarm module is automatically triggered to record the abnormality and proceed to step S2.

[0101] Automatic alarm: Once the system detects data anomalies, the alarm module is automatically triggered. The alarm module is responsible for recording abnormal information and passing it to the subsequent abnormality handling module. The triggering conditions of the alarm module are: C n (t) <c low or C n (t)>c up That is, when the real-time value of the parameter exceeds the threshold range, an alarm is triggered and the abnormal information is recorded.

[0102] Abnormal records: The abnormal information recorded includes abnormal time, abnormal indicators, abnormal values, involved system components, etc. All abnormal information will be recorded in detail and enter the subsequent step (i.e., step S2) for further processing.

[0103] Step S2 specifically includes:

[0104] S2.1. Extract the monitored data, including real-time data and historical data; generate initial object attribute data.

[0105] The real-time data Dreal-time and historical data Dhistorical monitored are extracted from the system's temporary storage area. Real-time data reflects the current operating status of the system, while historical data provides trends and patterns in the system's past operations.

[0106] The initial object attribute data is: D i ={x i (t),H i (t),E i (t),S i (t)}, where x i (t) represents real-time data, H i (t) represents historical behavior data, indicating the trend and fluctuation of historical status; E i (t) represents environmental data, reflecting the environmental conditions of the system; S i (t) represents the self-regulation state, which indicates the self-regulation ability of the data.

[0107] S2.2. Extending the attributes of the object attribute data, including self-regulation factors, associated object attributes and environmental perception factors.

[0108] The generated initial object attribute data D i ={x i (t),H i (t),E i (t),S i (t)} to expand the attributes and add the self-regulation factor α i and environmental perception factor β i , in order to enhance the data's ability to adapt to external environment and its own changes. The expanded object attribute data is: D i ={x i (t),H i (t),E i (t),S i (t),α i ,β i}.

[0109] S2.3. Through machine learning algorithms, the object attribute data is given the ability to self-evolve, so that it can automatically adjust its own state based on historical data and adapt to dynamic environmental changes.

[0110] The machine learning model is trained by historical data and real-time data, so that the object attribute data has the ability to self-evolve. i (t) and historical behavior data H i (t) changes and predict possible future states.

[0111] Self-evolution mechanism: Once the system detects changes in the environment, the object attribute data will adjust its own state based on the learning results. i (t+1)=S i (t)+α i ·Δx i (t)+β i ΔE i (t), where Δx i (t) = x i (t)-x i (t-1) represents the change of real-time data, ΔE i (t) = E i (t)-E i (t-1) represents the change of environmental data.

[0112] S2.4. Interactively analyze object attribute data and environmental data to form an adaptive data model.

[0113] Interactive analysis: Interactively analyze the expanded object attribute data and environmental data to find out the mutual influence relationship between the object attribute data and the environment. Through this interactive analysis, the system continuously updates and optimizes the object attribute data to make it more adaptable to the current environment.

[0114] The adaptive data model is M i (t) = f(D i (t),E i (t),H i (t)), M i (t) represents the adaptive data model that changes with time t, f(D i (t),E i (t),H i (t)) represents the function obtained by interaction analysis.

[0115] S2.5. Continuously update the status of object attribute data to keep it adapted to the current system environment and data flow.

[0116] Status update: The system continuously updates the status of object attribute data according to changes in the environment and data flow, so that it remains adaptable to the current system status.

[0117] S2.6. Input the object attribute data into the multi-dimensional anomaly field generation module and proceed to step S3.

[0118] Data input: The object attribute data after self-evolution and attribute expansion will be input into the generation module of the multi-dimensional anomaly field as the basic data for subsequent anomaly detection and processing.

[0119] Output preparation: All object attribute data units are organized in a unified format and passed to step S3 for use by the multi-dimensional anomaly field generation module.

[0120] Step S3 specifically includes:

[0121] S3.1. Initialize a multidimensional anomaly field generator and input object attribute data and its adaptive data model to construct a multidimensional anomaly field.

[0122] Initialization step: The initialization of the multidimensional anomaly field generator includes setting the basic dimensions of the multidimensional space, such as the time dimension, space dimension, impact dimension, etc. These dimensions together constitute a multidimensional space for mapping the data in the system.

[0123] Input data: Input the object attribute data and its adaptive data model processed by step S2 into the multidimensional anomaly field generator. Each object attribute data contains the adaptive state and interaction information with the environment, which will generate an anomaly field in the multidimensional space.

[0124] S3.2. Map the monitored data into the multi-dimensional anomaly field to form an anomaly data location coordinate system.

[0125] Data mapping: Map the monitoring data (including object attribute data and other system data) to the multidimensional anomaly field. Each object attribute data occupies a position in the multidimensional space. According to the attributes and status of the data, its coordinates in time, space and other dimensions are determined.

[0126] The location coordinates of the abnormal data are:

[0127] Among them, w i represents the abnormal weight of the attribute data of the i-th object, depending on the self-regulation state S i (t), (x i ,y i ,z i ) represents the coordinates of the i-th object attribute data in the multidimensional space, N represents the number of object attribute data, (x 异常 ,y 异常 ,z 异常 ) represents the location coordinates of the anomaly.

[0128] S3.3. Classify abnormal data in multiple dimensions, including time dimension, space dimension and impact dimension.

[0129] Dimension classification: The system classifies abnormal data according to different dimensions in multidimensional space. The main dimensions include the following: Time dimension: the time point and duration of the abnormality; Space dimension: the geographical location where the abnormality occurs or the module location within the system; Impact dimension: the potential impact of the abnormality on other parts of the system or users. Based on the performance of the data in these dimensions, the abnormal data can be initially screened out. This classification will help the subsequent analysis steps to more accurately identify the type and severity of the abnormality.

[0130] S3.4. Analyze the morphological characteristics of the anomaly through field deformation.

[0131] Deformation analysis of anomaly fields: By analyzing the distribution of anomaly data in a multidimensional anomaly field and its changes over time or other factors, the system can identify the morphological characteristics of the anomaly field, such as the concentration and diffusion trend of the anomaly.

[0132] The calculation formula of abnormal morphological feature I is: T d =t 结束 -t 开始 , where T d Represents the time difference from the beginning to the end of the ripple wave. Represents the average value of the coordinates. This formula is used to calculate the distribution intensity of each object attribute data in the abnormal field relative to the whole, that is, the abnormal intensity I. In other words, the morphological characteristics of the anomaly are the abnormal intensity. By calculating the difference between the position of each data unit and the overall average position, the concentration or dispersion of the anomaly is obtained, which helps to judge the severity of the anomaly.

[0133] S3.5. Preliminarily identify the anomaly type based on the anomaly’s morphological features and multi-dimensional coordinate information.

[0134] Preliminary identification: Based on the abnormal morphological characteristics and multi-dimensional coordinate information calculated above, the system preliminarily classifies and identifies the abnormal type. The classification basis includes the spatial concentration of the abnormality, the time persistence, the scope of influence, etc. The abnormal types include: transient abnormality: the abnormality appears and disappears quickly in a short period of time; diffuse abnormality: the abnormality spreads outward from a point and affects the surrounding system; concentrated abnormality: the abnormality is concentrated in a certain system module or location and lasts for a long time.

[0135] S3.6. Determine the severity of the anomaly and transmit the location data of the anomaly to the diffusion path calculation module, and proceed to step S4.

[0136] Severity judgment: Based on the results of steps S3.4 and S3.5, the system further evaluates the severity of the anomaly. The evaluation criteria include anomaly intensity, diffusion speed, impact range, etc. Data transfer: The location data of the anomaly that has undergone preliminary classification and severity assessment is transferred to the diffusion path calculation module to provide a basis for further calculation and linkage disposal.

[0137] Step S4 specifically includes:

[0138] S4.1. Input the abnormal position in the multi-dimensional abnormal field into the diffusion path calculation module.

[0139] The abnormal location data P obtained from step S3 异常 The position data contains the specific coordinates of the anomaly in multidimensional space and preliminary classification information. The diffusion path calculation module receives and processes these position data to prepare for the subsequent diffusion path calculation.

[0140] S4.2. Analyze the changes in the coordinates of the anomaly position in the anomaly field and predict the diffusion direction and path of the anomaly.

[0141] Analysis of changes in position coordinates: The system monitors abnormal position data P 异常 Changes over time to identify trends and directions of anomaly spread. By analyzing these changes, the system can predict the spread path of the anomaly.

[0142] Path prediction: Based on the coordinates of the anomaly at each time point, the system calculates the possible diffusion direction of the anomaly. These directions may propagate along the critical paths or module dependencies in the system architecture.

[0143] S4.3. Combine the architecture of the system itself and the dependencies between modules to simulate the propagation path of anomalies in the system itself.

[0144] The diffusion path calculation module combines the diffusion direction of the anomaly with the system architecture, paying special attention to the dependencies between modules. These dependencies determine the propagation path of the anomaly in the system.

[0145] The calculation formula of the diffusion path calculation module is: R(t)=R0+v·(t-t0), where R(t) represents the anomaly impact radius, which changes over time; R0 represents the initial impact radius of the anomaly; v represents the anomaly diffusion speed, and t0 represents the initial time of the anomaly. This formula is used to describe the impact range radius R(t) of the anomaly at time t. Through this formula, the diffusion of the anomaly at a future time point can be predicted, and then its propagation path in the system can be simulated.

[0146] S4.4. Calculate the potential impact range on each propagation path, including the affected modules, number of users, and amount of data.

[0147] According to the diffusion model of the anomaly, the system calculates the potential impact range on each propagation path and estimates the number of modules, number of users and amount of data that may be affected by the anomaly. The calculation formula for the potential impact range on the propagation path includes: Two-dimensional space: A(t) = π[R(t)] 2 , where A(t) represents the potential impact range at time t, and R(t) represents the anomaly diffusion radius at time t. Three-dimensional space: Among them, V(t) represents the potential impact range at time t, and R(t) represents the anomaly diffusion radius at time t.

[0148] These formulas are used to calculate the impact range of anomalies in different spatial dimensions. By calculating the area or volume, the system can quantify the potential threat of anomaly spread to the entire system.

[0149] S4.5. Generate an anomaly diffusion map based on the propagation path calculation results to identify the areas affected by the anomaly.

[0150] Anomaly diffusion map generation: Using the above-mentioned diffusion path and impact range calculation results, the system generates an anomaly diffusion map. This map details the areas and ranges that the anomaly may affect.

[0151] Map marking: Clearly mark the affected system modules, user groups and related resources on the map to facilitate subsequent response and processing.

[0152] S4.6. Feedback the calculation results of the abnormal diffusion map and propagation path to the hierarchical processing module and proceed to step S5.

[0153] Result feedback: The generated anomaly diffusion map and path calculation results are passed to the classification processing module in step S5. The results will provide a basis for subsequent anomaly classification and disposal strategy selection.

[0154] Data transfer: The diffusion path calculation module transfers data to the hierarchical processing module through a standard interface to ensure the accuracy and timeliness of the information.

[0155] Step S5 specifically includes:

[0156] S5.1. Initialize the hierarchical ripple model and identify the anomalies as ripple centers according to the anomaly diffusion map.

[0157] S5.2. Analyze the initial propagation rate and intensity of the ripples, and determine the basic characteristics of the ripples (such as the type and energy of the ripples) based on the preliminary classification type of the anomaly.

[0158] The formula for calculating the propagation rate of ripples is: Among them, v j represents the propagation rate of the j-th layer ripple, R j Represents the influence radius of the j-th layer of ripples.

[0159] S5.3. Dynamically adjust the ripple propagation model according to the ripple diffusion path and abnormal forms in the multidimensional field.

[0160] S5.4. Divide ripples into different layers, including core layer, important layer, middle layer and peripheral layer.

[0161] S5.5. Determine the anomaly classification for each level based on the propagation rate and intensity of the ripples.

[0162] The strategy for determining the abnormal classification at each level is:

[0163] According to the abnormal intensity I and propagation rate v of the ripples j , set the abnormal classification threshold;

[0164] If I≥I 核心 And v j ≥v 核心 , it is determined to be a core layer abnormality;

[0165] If I 重要 ≤I 核心 And v 重要 ≤v j <v 核心 , it is judged as an important layer abnormality;

[0166] If I 中间 ≤I 重要 And v 中间 ≤v j <v 重要 , it is determined to be an abnormality in the middle layer;

[0167] Otherwise, it is determined that the peripheral layer is abnormal.

[0168] S5.6. Input the classified exceptions into the exception handling strategy selection module and proceed to step S6.

[0169] Step S6 specifically includes:

[0170] S6.1. Initialize the exception handling strategy selector and select a preliminary handling strategy based on the exception classification result.

[0171] S6.2. For core layer anomalies, the self-integration mechanism between modules is triggered to merge the resources of multiple modules to deal with the anomalies.

[0172] ​​S6.3. For abnormalities in important layers or intermediate layers, the future state shaping mechanism is triggered to simulate multiple possible future states of the data and perform some repair operations in advance.

[0173] Future state shaping mechanism: For abnormalities in important or intermediate layers, the system triggers the future state shaping mechanism. This mechanism simulates multiple future state paths that may be caused by abnormalities and evaluates the performance and risks of the system under different paths.

[0174] Simulate multiple possible future states: Based on the current abnormal situation, the system generates multiple possible future states, covering the best, worst and most likely situations. Preemptive repair operations: During the simulation process, identify the possible deterioration of the state and perform repair operations in advance to reduce the impact of future abnormalities.

[0175] The future state prediction formula is: S 未来 (t+Δt) represents the system state at the future time, S 当前 (t) represents the system status at the current moment, F 演变 (S, t) represents the function of the system state evolving with time.

[0176] S6.4. For peripheral layer anomalies, the self-splitting mechanism between modules is activated to isolate the affected modules from other modules to limit the spread of the anomaly.

[0177] For peripheral layer anomalies, the system limits the impact of the anomaly by initiating a module self-splitting mechanism. The goal of the self-splitting mechanism is to isolate the affected module from the rest of the system to prevent the anomaly from spreading.

[0178] Implementation of the self-splitting mechanism:

[0179] Isolate the affected modules: Split the modules affected by the anomaly from the main system and run them separately to prevent the anomaly from affecting other modules.

[0180] Monitor isolated modules: Closely monitor isolated modules, evaluate their abnormal status and be prepared for further processing measures at any time.

[0181] S6.5. When an escalating trend of anomalies is detected, the processing strategy is adjusted dynamically, and the time repair mechanism is activated when necessary to trace the system status back to the safe state before the anomaly.

[0182] Dynamically adjust the processing strategy: The system will continuously monitor the changing trend of the anomaly during the processing process. Once an escalation trend of the anomaly is detected, the processing strategy selector will dynamically adjust the current processing strategy, introduce more resources or change the processing method if necessary.

[0183] Backtracking system status: When an abnormal situation becomes uncontrollable, the system can start the time repair mechanism to restore the normal operation of the system by backtracking the system to the safe state before the abnormality occurred.

[0184] Time repair mechanism: Repair operations include restoring data snapshots, restarting key services, and undoing recent operations.

[0185] The backtracking operation is: Among them, S(t) represents the system state at the current moment, S(t-Δt) represents the system state after backtracking, and F 补偿 (S, t) represents the compensation function, which is used to repair the anomaly.

[0186] S6.6. Continuously monitor the exception handling process and adjust the exception handling strategy based on real-time feedback information until the exception is completely controlled or eliminated.

[0187] Continuous monitoring and feedback: When executing the processing strategy, the system monitors the various indicators and status of the processing process in real time. By collecting feedback information, the system can determine the effectiveness of the current processing strategy.

[0188] Adjustment of processing strategies: If the current strategy is not effective, the system will further adjust the processing measures based on real-time feedback information to ensure that the anomaly is ultimately controlled or completely eliminated.

[0189] In summary, the exception handling method of the present invention has the following advantages:

[0190] (1) The present invention realizes self-monitoring and adjustment of system operation data by introducing the concepts of its own system and object attribute data. The system can automatically adjust the monitoring threshold according to real-time data and historical behavior, making the monitoring process more flexible and able to timely discover and respond to complex dynamic anomalies. It solves the problem that traditional anomaly monitoring systems usually rely on preset static rules or thresholds, which leads to false alarms or missed alarms in the face of dynamically changing environments and makes it difficult to respond to new anomalies in a timely manner.

[0191] (2) The present invention can accurately locate anomalies in a multi-dimensional space by generating a multi-dimensional anomaly field and classifying them according to their location and morphology. This not only improves the accuracy of anomaly detection, but also enables the classification of anomaly types and potential impacts at the early stage of anomaly occurrence, thus providing a scientific basis for subsequent processing.

[0192] (3) By introducing the "hierarchical ripple" mechanism, the present invention can dynamically adjust the classification according to the propagation rate and intensity of the anomaly, and select an appropriate processing strategy, which can ensure that the core layer anomalies are handled first, and a lighter processing method is adopted for the peripheral layer anomalies, thereby optimizing resource utilization and improving response efficiency.

[0193] (4) By constructing a multi-dimensional anomaly field and combining it with the system architecture, the present invention can accurately predict the diffusion path and potential impact range of the anomaly, so that the system can plan response measures in advance, reduce the impact range of the anomaly on the entire system, and improve the robustness of the system.

[0194] (5) The present invention combines multiple strategies such as module self-splitting, self-fusion, future state shaping and time repair, and can select the most appropriate processing method according to the classification and type of anomalies. The comprehensive processing mechanism makes the system more flexible and effective in dealing with various anomalies, ensuring the stability and continuity of the system.

[0195] Based on the above ideal embodiments of the present invention, the relevant staff can make various changes and modifications without departing from the technical concept of the present invention through the above description. The technical scope of the present invention is not limited to the contents of the specification, but must be determined according to the scope of the claims.

Claims

1. An exception handling method based on hierarchical judgment, characterized in that: The following steps are involved: S1. Collect monitoring data on the environment, personnel and equipment through its own system, which includes a host computer monitoring system and an intelligent integrated management and control platform; S2. Converting the monitoring data into object attribute data, wherein the object attribute data has the ability of self-regulation and historical data evolution; S3, generating a multidimensional abnormal field based on the time series and spatial attributes of the physical object attribute data, and judging the type and severity of the abnormality according to the position and form of the abnormality in the corresponding abnormal field; S4. Calculate the anomaly diffusion path and potential impact range according to the anomaly position in the multi-dimensional anomaly field; S5. Use the hierarchical ripple model to identify abnormal classification, sense the propagation rate and intensity of abnormal ripples, and determine the level of the abnormality; S6. According to the result of the exception classification, different exception handling strategies are selected to handle the exception. The exception handling strategies include at least: self-splitting, self-fusion, future state shaping and time repair.

2. The abnormality handling method based on hierarchical judgment according to claim 1, characterized in that: Step S1 specifically includes: S1.

1. Initialize the system and set the parameters to be monitored, including environment, system performance, network transmission, equipment operation, and abnormal user behavior data; S1.2, start the sensor module in its own system to collect various data in real time during the operation of its own system; S1.3, input the collected data into the core computing module of its own system, and conduct preliminary analysis and cleaning of the data; S1.4, storing the processed data in a temporary storage area; S1.

5. Use the set monitoring threshold to compare the system's operating data in real time and identify potential anomalies; S1.

6. When abnormal data is detected, the alarm module is automatically triggered to record the abnormality and proceed to step S2.

3. The abnormality handling method based on hierarchical judgment according to claim 2, characterized in that: Step S2 specifically includes: S2.

1. Extract the monitored data, including real-time data and historical data; generate initial object attribute data; S2.2, performing attribute expansion on the object attribute data, including self-regulation factors, associated object attributes and environmental perception factors; S2.3, through machine learning algorithms, give the object attribute data the ability to self-evolve, so that it can automatically adjust its own state based on historical data and adapt to dynamic environmental changes; S2.4, interactively analyzing object attribute data and environmental data to form an adaptive data model; S2.

5. Continuously update the state of object attribute data to keep it adapted to the current system environment and data flow; S2.

6. Input the object attribute data into the multi-dimensional anomaly field generation module and proceed to step S3.

4. The abnormality handling method based on hierarchical judgment according to claim 3, characterized in that: Step S3 specifically includes: S3.1, initializing a multidimensional anomaly field generator, and inputting object attribute data and its adaptive data model to construct a multidimensional anomaly field; S3.2, mapping the monitored data into a multi-dimensional anomaly field to form an anomaly data position coordinate system; S3.3, classify abnormal data in multiple dimensions, including time dimension, space dimension and impact dimension; S3.

4. Analyze the morphological characteristics of anomalies through field deformation; S3.

5. Preliminarily identify the anomaly type based on the anomaly’s morphological characteristics and multi-dimensional coordinate information; S3.

6. Determine the severity of the anomaly and transmit the location data of the anomaly to the diffusion path calculation module, and proceed to step S4.

5. The abnormality handling method based on hierarchical judgment according to claim 4, characterized in that: Step S4 specifically includes: S4.1, inputting the abnormal position in the multi-dimensional abnormal field into the diffusion path calculation module; S4.

2. Analyze the changes in the coordinates of the anomaly positions in the anomaly field and predict the diffusion direction and path of the anomaly; S4.

3. Combine the architecture of the system and the dependencies between modules to simulate the propagation path of anomalies in the system. S4.

4. Calculate the potential impact range on each propagation path, including the affected modules, number of users, and amount of data; S4.

5. Generate anomaly diffusion map based on propagation path calculation results to identify the areas affected by the anomaly; S4.

6. Feedback the calculation results of the abnormal diffusion map and the propagation path to the hierarchical processing module and proceed to step S5.

6. The abnormality handling method based on hierarchical judgment according to claim 5, characterized in that: Step S5 specifically includes: S5.1, initialize the hierarchical ripple model, and identify the anomaly as the ripple center according to the anomaly diffusion map; S5.

2. Analyze the initial propagation rate and intensity of the ripples and determine the basic characteristics of the ripples based on the preliminary classification type of the anomaly; S5.

3. Dynamically adjust the ripple propagation model according to the ripple diffusion path and abnormal forms in the multidimensional field; S5.

4. Divide ripples into different layers, including core layer, important layer, middle layer and peripheral layer; S5.

5. Determine the abnormality classification at each level based on the propagation rate and intensity of the ripples; S5.

6. Input the classified exceptions into the exception handling strategy selection module and proceed to step S6.

7. The abnormality handling method based on hierarchical judgment according to claim 6, characterized in that: Step S6 specifically includes: S6.

1. Initialize the exception handling strategy selector and select a preliminary handling strategy based on the exception classification result. S6.

2. For core layer anomalies, the self-integration mechanism between modules is triggered to merge the resources of multiple modules to deal with the anomaly; S6.

3. For abnormalities in important or intermediate layers, trigger the future state shaping mechanism, simulate multiple possible future states of the data, and perform some repair operations in advance; S6.

4. For anomalies in the peripheral layer, the self-splitting mechanism between modules is activated to isolate the affected modules from other modules to limit the spread of anomalies; S6.

5. When an abnormality is detected with an escalating trend, dynamically adjust the processing strategy and, if necessary, start the time repair mechanism to trace the system status back to the safe state before the abnormality; S6.

6. Continuously monitor the exception handling process and adjust the exception handling strategy based on real-time feedback information until the exception is completely controlled or eliminated.

8. The abnormality handling method based on hierarchical judgment according to claim 4, characterized in that: The location coordinates of the abnormal data are: Among them, w i represents the abnormal weight of the attribute data of the i-th object, depending on the self-regulation state S i (t), (x i ,y i ,z i ) represents the coordinates of the i-th object attribute data in the multidimensional space, N represents the number of object attribute data, (x 异常 ,y 异常 ,z 异常 ) represents the location coordinates of the anomaly; The calculation formula of abnormal morphological feature I is: Among them, T d Represents the time difference from the beginning to the end of the ripple wave. Represents the average value of the coordinates.

9. The abnormality handling method based on hierarchical judgment according to claim 5, characterized in that: The calculation formula of the diffusion path calculation module is: R(t)=R0+v·(t-t0), where: R(t) represents the anomaly impact radius, which changes with time; R0 represents the initial impact radius of the anomaly; v represents the anomaly diffusion speed, and t0 represents the initial time of the anomaly occurrence; The calculation formula for the potential impact range on the propagation path is: Two-dimensional space: A(t) = π[R(t)] 2 , where A(t) represents the potential impact range at time t, and R(t) represents the anomaly diffusion radius at time t; Three-dimensional space: Among them, V(t) represents the potential impact range at time t, and R(t) represents the anomaly diffusion radius at time t.

10. The abnormality handling method based on hierarchical judgment according to claim 6, characterized in that: The formula for calculating the propagation rate of ripples is: Among them, v j represents the propagation rate of the j-th layer ripple, R j represents the influence radius of the j-th layer ripple; In step S5.5, the strategy for determining the abnormality classification at each level is: According to the abnormal intensity I and propagation rate v of the ripples j , set the abnormal classification threshold; If I≥I 核心 And v j ≥v 核心 , it is determined to be a core layer abnormality; If I 重要 ≤I 核心 And v 重要 ≤v j <v 核心 , it is judged as an important layer abnormality;​ If I 中间 ≤I 重要 And v 中间 ≤v j <v 重要 , it is determined to be an abnormality in the middle layer;​ Otherwise, it is determined that the peripheral layer is abnormal.

Images