System, method and device for realizing security business real-time self-healing service based on large model technology, processor and readable storage medium thereof

Abstract

The invention relates to a system for realizing a security service real-time self-healing service based on a large model technology, and the system comprises an analysis engine which is based on a distributed computing architecture and a real-time stream processing technology and is used for capturing monitoring data of a security service system and real-time system fault alarm message data accurately in real time; the calculation engine is used for constructing a large model knowledge base algorithm model based on deep learning optimization; the rule engine is used for establishing intelligent output of mapping from a system operation state root cause occurrence part to a multi-dimensional emergency rule; and the self-healing implementation engine is used for implementing automatic healing of root cause parts causing faults of the security business system. By adopting the system, the method, the device, the processor and the computer readable storage medium for realizing the security service real-time self-healing service based on the large model technology, hundred million-level data volume consistency top-speed analysis can be realized, script configuration type development, open type elastic deployment and visual operation are supported, and the security service real-time self-healing service is realized. The method has the characteristics of diversified comparison dimensions and freestyle capacity expansion.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and in particular to the field of securities business middle-office systems, and specifically refers to a system, method, device, processor and computer-readable storage medium thereof for implementing real-time self-healing services for securities business based on big model technology. Background Art

[0002] The securities industry continues to promote the transformation of wealth management to provide investors with better, more comprehensive and smarter services. With "leading digital technology" as its core capability, our company is committed to improving system service capabilities through digital and intelligent capability building. Among them, the securities middle-office business system, as a bridge connecting the front and back offices, still faces many challenges in actual applications, such as occasional unexpected system interruptions, delays in fault detection and recovery, and obstacles to cross-departmental data sharing. These factors together constitute the main obstacles to business continuity and customer satisfaction. Especially in securities business scenarios with high-frequency trading and big data processing, the consequences of these problems may be more significant, posing a threat to the overall operational efficiency and market competitiveness of financial institutions.

[0003] It is crucial to the continuity of financial securities business. It reduces the impact of emergencies on the business by quickly identifying and automatically recovering from system failures, improves business resilience through multi-dimensional monitoring, early warning and adaptive adjustment, and improves decision-making efficiency by optimizing resource allocation, ensuring service experience and enhancing customer satisfaction, which together help financial securities business maintain continuous and stable operations in complex environments. Summary of the invention

[0004] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and to provide a system, method, device, processor and computer-readable storage medium thereof that realizes real-time self-healing service for securities business based on large model technology, which is efficient, stable, highly available and has a wide range of applications.

[0005] In order to achieve the above objectives, the system, method, device, processor and computer-readable storage medium thereof for implementing real-time self-healing service for securities business based on large model technology of the present invention are as follows:

[0006] The main features of the system for implementing real-time self-healing services for securities business based on large model technology are as follows:

[0007] The analysis engine is connected to the data source and is used to collect monitoring data and system alarm message data of the securities business system in real time, and standardize these data into system operation data;

[0008] A computing engine connected to the analysis engine is used to receive real-time data from the analysis engine, input the real-time data into a large model knowledge base, perform real-time analysis, identify the root cause of the fault, determine the location of the root cause of the fault, and make intelligent decisions;

[0009] A rule engine, connected to the computing engine, for mapping the system state to multi-dimensional emergency rules according to the decision results of the computing engine;

[0010] The self-healing implementation engine is connected to the computing engine and the rule engine, and can connect to heterogeneous systems with different protocols, languages ​​and operating environments, and can take refined self-healing measures for different levels (system layer, component layer, node layer and API layer) of the securities business system.

[0011] Preferably, the analysis engine performs data analysis and processing in real time, converts the data into standard system operation data, and outputs the standard system operation data to the calculation engine and the database.

[0012] Preferably, the analysis engine extracts and parses information from business system data of various formats and sources, including but not limited to business system alarm message queues and system monitoring data;

[0013] When the analysis engine obtains data from the system alarm message queue, it parses the message content according to the configuration file, extracts the key information and converts it into standardized system operation data; when the analysis engine obtains data from the system monitoring data, it pulls the system operation data from the monitoring component at a regular interval and converts the monitoring data into standardized system operation data.

[0014] Preferably, the computing engine includes a deep learning algorithm and a large model knowledge base, and the large model knowledge base contains system historical operation data, fault type information, root cause location, root cause information and recovery measure information.

[0015] Preferably, the computing engine obtains standardized data from the analysis engine, uses the large model knowledge base to perform analysis and decision-making, determines whether there is a system fault, the type and severity of the fault, identifies the root cause of the fault, and the location of the root cause, or confirms that the system is in normal operation, and writes the computing engine fault type, system fault, root cause and location or normal operation signal into the computing engine's memory queue for execution by the rule engine; the computing engine also synchronously updates the fault type, root cause and location information to the database.

[0016] Preferably, when a failure occurs, the rule engine matches corresponding emergency measures according to the failure conditions in different dimensions, and flexibly calls system-level rules, component-level rules, node-level rules and API-level rules.

[0017] Preferably, the self-healing implementation engine, based on service governance and heterogeneous adaptation assembly technology, quickly takes automated repair and control measures for the root cause of the system failure to ensure the stable operation of the business system.

[0018] Preferably, the system-level rules are applicable to the scenario where the entire business system fails, the component-level rules are applicable to the response measures when some components in the system fail, the node-level rules are applicable to handling the situation where individual nodes in the business system fail, and the API-level rules are applicable to responding to failures at the internal and external interface call levels.

[0019] The method for implementing a real-time self-healing service for securities business based on a large model technology using the above system is mainly characterized in that the method comprises the following steps:

[0020] (1) The analysis engine obtains data from the system alarm message queue or monitoring component in real time, analyzes it, and extracts key information;

[0021] (2) The computing engine reads standardized data from the memory queue of the analysis engine and uses deep learning algorithms and a large model knowledge base to identify the root cause of the fault, determine the location of the root cause, and make intelligent decisions;

[0022] (3) The rule engine obtains system failure or normal operation signals and their corresponding failure types from the memory queue of the computing engine; the rule engine establishes a mapping relationship between the root cause of the system operation status and the multi-dimensional emergency rules, which can achieve accurate emergency strategy recommendations for different failures. When a system failure occurs, it can quickly locate the adapted rules based on the mapping relationship.

[0023] (4) The self-healing implementation engine automatically repairs and controls the root causes of system failures.

[0024] Preferably, the step (1) further comprises the following steps:

[0025] The analysis engine puts the parsed standardized data into a memory queue and synchronously writes it into a database for persistent storage.

[0026] Preferably, the step (2) specifically comprises the following steps:

[0027] The computing engine uses deep learning algorithms and large model knowledge base analysis to determine whether a system fault occurs and its fault type, identify the root cause of the fault, locate the root cause location, or confirm that the system is in normal operation; matches the corresponding emergency rules according to the mapping relationship between the fault type and the emergency rules predefined in the configuration file; the computing engine writes the system fault or normal state signal and the fault type, root cause identification, and root cause location into the memory queue, and updates the rule information related to the data in the database at the same time.

[0028] Preferably, the step (2) further comprises the following steps:

[0029] The computing engine dynamically adjusts the large model knowledge base through interface-based visualization operations.

[0030] The main feature of the device for implementing real-time self-healing service for securities business based on large model technology is that the device comprises:

[0031] a processor configured to execute computer-executable instructions;

[0032] The memory stores one or more computer executable instructions. When the computer executable instructions are executed by the processor, the various steps of the method for implementing the real-time self-healing service for securities business based on the big model technology are implemented.

[0033] The processor for implementing real-time self-healing service for securities business based on big model technology has the main feature that the processor is configured to execute computer executable instructions. When the computer executable instructions are executed by the processor, the various steps of the above-mentioned method for implementing real-time self-healing service for securities business based on big model technology are implemented.

[0034] The main feature of the computer-readable storage medium is that a computer program is stored thereon, and the computer program can be executed by a processor to implement the various steps of the above-mentioned method for implementing real-time self-healing services for securities business based on big model technology.

[0035] The system, method, device, processor and computer-readable storage medium thereof for realizing real-time self-healing service for securities business based on large model technology of the present invention are adopted to solve the shortcomings of traditional data consistency analysis tools, such as strong manual dependence, few file format types supported for analysis, small amount of data processed, long analysis time, difficulty in developing new analysis projects, lack of graphical display interface for analysis process and results, and difficulty in expanding performance in the face of data growth. A better solution is provided, which can realize extremely fast analysis of consistency of data volume of billions, meet the strict and consistent requirements of the securities industry, especially the core securities trading system, in the face of massive data, meet the needs of high throughput and extremely fast analysis in complex text scenarios and multiple data sources, support script configuration development, open elastic deployment, and visual operation, and have the characteristics of diversified comparison dimensions and liberalized capacity expansion. It overcomes the shortcomings of traditional analysis tools or systems, such as significant decline in performance of massive data, single applicable scenarios, limited capacity, difficulty in developing new verification projects, and unclear comparison process, and has relatively outstanding practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a structural diagram of the system for implementing real-time self-healing services for securities business based on large model technology of the present invention.

[0037] Figure 2 The present invention is a flow chart of a method for implementing a real-time self-healing service for securities business based on a large model technology. DETAILED DESCRIPTION

[0038] In order to more clearly describe the technical content of the present invention, further description is given below in conjunction with specific embodiments.

[0039] The system of the present invention for implementing real-time self-healing service for securities business based on large model technology includes:

[0040] The analysis engine is connected to the data source and is used to collect monitoring data and system alarm message data of the securities business system in real time, and standardize these data into system operation data;

[0041] A computing engine connected to the analysis engine is used to receive real-time data from the analysis engine, input the real-time data into a large model knowledge base, perform real-time analysis, identify the root cause of the fault, determine the location of the root cause of the fault, and make intelligent decisions;

[0042] The rule engine is connected to the computing engine and is used to map the system status to multi-dimensional emergency rules according to the decision results of the computing engine.

[0043] As a preferred embodiment of the present invention, the analysis engine performs data analysis and processing in real time, converts the data into standard system operation data, and outputs the standard system operation data to the calculation engine and the database.

[0044] As a preferred embodiment of the present invention, the analysis engine extracts and parses information from business system data in various formats and sources, including but not limited to business system alarm message queues and system monitoring data;

[0045] When the analysis engine obtains data from the system alarm message queue, it parses the message content according to the configuration file, extracts the key information and converts it into standardized system operation data; when the analysis engine obtains data from the system monitoring data, it pulls the system operation data from the monitoring component at a regular interval and converts the monitoring data into standardized system operation data.

[0046] As a preferred embodiment of the present invention, the computing engine includes a deep learning algorithm and a large model knowledge base, and the large model knowledge base contains system historical operation data, fault type information, root cause identification information, root cause occurrence location information and recovery measure information.

[0047] As a preferred embodiment of the present invention, the computing engine obtains standardized data from the analysis engine, uses deep learning algorithms and a large model knowledge base to perform analysis and decision-making, determines whether the system has a fault, the type and severity of the fault, identifies the root cause of the fault, locates the location of the root cause, or confirms that the system is in normal operation, and writes the computing engine fault type, system fault, root cause and location, or normal operation signal into the computing engine's memory queue for execution by the rule engine; the computing engine also synchronously updates the fault type information to the database.

[0048] As a preferred embodiment of the present invention, when a failure occurs, the rule engine matches corresponding emergency measures according to the failure conditions in different dimensions, and flexibly calls system-level rules, component-level rules, node-level rules and API-level rules.

[0049] As a preferred embodiment of the present invention, the system-level rules are applicable to the scenario where the entire business system fails, the component-level rules are applicable to the response measures when some components in the system fail, the node-level rules are applicable to handling the situation where individual nodes in the business system fail, and the API-level rules are applicable to responding to failures at the internal and external interface call levels.

[0050] The method of the present invention using the above system to implement a real-time self-healing service for securities business based on large model technology, wherein the method comprises the following steps:

[0051] (1) The analysis engine obtains data from the system alarm message queue or monitoring component in real time, analyzes it, and extracts key information;

[0052] (2) The computing engine reads standardized data from the memory queue of the analysis engine and uses deep learning algorithms and a large model knowledge base to identify the root cause of the fault, locate the root cause, and make intelligent decisions.

[0053] (3) The rule engine obtains system faults, root cause identification, root cause location or normal operation signals and their corresponding fault types, root cause identification, and root cause location from the memory queue of the computing engine; the rule engine establishes a mapping relationship between the root cause location of the system operation status and the multi-dimensional emergency rules, which can realize accurate emergency strategy recommendations for different faults. When a system fault occurs, it can quickly locate the adapted rules based on the mapping relationship;

[0054] (4) The self-healing implementation engine is closely connected with the computing engine and the rule engine, and has powerful service governance capabilities, and can connect to heterogeneous systems with different protocols, languages, and operating environments. Through adapter design, it supports seamless integration with external systems and third-party services, and can achieve cross-platform self-healing capabilities without changing the existing system structure.

[0055] As a preferred embodiment of the present invention, the step (1) further comprises the following steps:

[0056] The analysis engine puts the parsed standardized data into a memory queue and synchronously writes it into a database for persistent storage.

[0057] As a preferred embodiment of the present invention, the step (2) specifically comprises the following steps:

[0058] The computing engine uses deep learning algorithms and large model knowledge base analysis to determine whether a system fault occurs and its fault type, identify the root cause of the fault, locate the location of the root cause, or confirm that the system is in normal operation; matches the corresponding emergency rules according to the mapping relationship between the fault type and the emergency rules predefined in the configuration file; the computing engine writes the system fault or normal state signal and the fault type, root cause identification, and root cause location into the memory queue, and updates the rule information related to the data in the database at the same time.

[0059] As a preferred embodiment of the present invention, the step (2) further comprises the following steps:

[0060] The computing engine dynamically adjusts the large model knowledge base through interface-based visualization operations.

[0061] The device for implementing a real-time self-healing service for securities business based on a large model technology of the present invention comprises:

[0062] a processor configured to execute computer-executable instructions;

[0063] The memory stores one or more computer executable instructions. When the computer executable instructions are executed by the processor, the various steps of the method for implementing the real-time self-healing service for securities business based on the big model technology are implemented.

[0064] The processor of the present invention is used to implement real-time self-healing service for securities business based on big model technology, wherein the processor is configured to execute computer executable instructions, and when the computer executable instructions are executed by the processor, the various steps of the above-mentioned method for implementing real-time self-healing service for securities business based on big model technology are implemented.

[0065] The computer-readable storage medium of the present invention has the main feature of storing a computer program thereon, which can be executed by a processor to implement the various steps of the above-mentioned method for implementing real-time self-healing services for securities business based on big model technology.

[0066] In a specific embodiment of the present invention, a securities business real-time self-healing service system and method based on big model technology with intelligent fault diagnosis, real-time decision optimization, dynamic emergency handling and business continuity guarantee capabilities are provided. The system effectively solves the deficiencies of traditional systems in fault detection, response speed and emergency handling through the dynamic update mechanism of the big model knowledge base and multi-level automated emergency rules, and improves the intelligence level of the system and the high availability of the business. At the same time, the present invention supports flexible visual operations, so that the business system can be dynamically adjusted according to actual needs, further enhancing the adaptability and operability of the system, and ensuring efficient and stable operation in a complex and changeable securities business environment.

[0067] In order to achieve the above objectives, the securities business real-time self-healing service system and method based on large model technology are as follows:

[0068] The real-time self-healing service system and method for securities business based on big model technology are mainly characterized in that the system includes: an analysis engine, a calculation engine, a rule engine and a self-healing implementation engine, which cooperate with each other to jointly realize real-time monitoring, automatic fault diagnosis and recovery of the securities business system.

[0069] The analysis engine is responsible for collecting monitoring data and system alarm message data of the securities business system in real time, and standardizing this data into system operation data. By parsing the original data and converting it into a unified format for processing, the analysis engine ensures that the data can be quickly and accurately entered into subsequent modules for analysis and processing. The analyzed data will be written to the memory queue and distributed database at the same time to ensure high availability and persistence of the data.

[0070] The analysis engine is specifically:

[0071] Supports extracting and parsing information from business system data in various formats and sources, including but not limited to business system alarm message queues and system monitoring data. The module can perform flexible parsing operations based on configuration files and supports multiple data mapping modes to ensure accurate data processing. These mapping modes include field mapping, regular expression mapping, array field mapping, etc., which can adapt to data sources of different structures and complexities, thereby improving the accuracy and adaptability of data parsing.

[0072] When obtaining data from the system alarm message queue, the analysis engine parses the message content according to the configuration file, extracts the key information and converts it into standardized system operation data; when obtaining data from the system monitoring data, it periodically pulls the system operation data from the monitoring component, including but not limited to indicator data such as the number of successful calls and the number of failed calls, and converts these monitoring data into standardized system operation data.

[0073] The main function of the analysis engine is to acquire and standardize multi-source heterogeneous data from securities business systems in real time. During the operation of securities business systems, a large amount of log data, system alarm data, and monitoring data will be generated. These data are in various formats and may be distributed in different system components. Therefore, unified analysis and processing of data is the basis for achieving system self-healing.

[0074] The analysis engine supports real-time data acquisition from different data sources, including but not limited to system alarm message queues, log files, and monitoring data provided by monitoring components. The module has powerful data processing capabilities and can support multiple mapping modes according to the configuration file, such as field mapping, regular expression mapping, and array field mapping, to ensure compatibility with multiple data formats. After the acquired data is parsed and processed, key information (such as IP address, service name, function number, etc.) is extracted, and the processed standardized data is placed in the memory queue of the analysis engine for use by subsequent modules. At the same time, the standardized data is written into the distributed database for persistent storage to ensure data security and consistency.

[0075] The analysis engine also supports flexible configuration adjustment, and can dynamically adjust the parsing rules through the configuration file to adapt to different types of business systems and application scenarios. Through this module, the system can better realize comprehensive monitoring of the business system and provide reliable data support for subsequent fault diagnosis and emergency handling.

[0076] The computing engine performs preprocessing based on the historical operation data of the business system and establishes a model knowledge base covering the business operation status. After receiving the real-time data from the analysis engine, the computing engine inputs it into the large model knowledge base for real-time analysis and decision-making. This process relies on the intelligent reasoning of the large model technology, which can effectively determine whether the system has failed or is in normal operation, identify the root cause of the failure, and locate the location of the root cause.

[0077] The computing engine is specifically:

[0078] The computing engine relies on deep learning algorithms and the dynamic update mechanism of the large model knowledge base to achieve efficient real-time decision optimization. The knowledge base supports both automatic updates and manual adjustments based on business needs to ensure that the system always has the latest fault diagnosis, root cause identification and location, and emergency response capabilities. Through the application of the large model knowledge base, the computing engine can quickly make intelligent decisions when system failures occur to ensure business continuity and stability. Through the dynamic update mechanism of the large model knowledge base, the decision-making process can be optimized to ensure that the system's fault diagnosis and emergency response are accurate and timely.

[0079] The computing engine supports manual updating of large model knowledge bases, allowing domain personnel to accurately optimize and adjust the knowledge base, thereby ensuring that the knowledge base content is highly consistent with the latest needs of business scenarios. Through human intervention, the decision-making basis of the knowledge base can be more targeted and accurate, ensuring that the system can make intelligent decisions based on the most optimized information in a complex business environment, further improving the effectiveness and reliability of fault diagnosis and emergency response.

[0080] The computing engine is the core of the system's intelligent decision-making. Based on deep learning algorithms and large model technology, this module processes standardized data from the analysis engine and uses the large model knowledge base to make real-time decisions. The core capabilities of the computing engine are reflected in the intelligent detection and analysis of faults, thereby identifying the root cause of the fault, and then locating the part or component where the root cause occurs, and matching the fault model and emergency rules in the knowledge base to output the decision result.

[0081] The large model knowledge base is a key component of the computing engine, which contains multi-dimensional information such as system historical operation data, fault type, root cause identification, root cause location, recovery measures, etc. By learning from historical data, the knowledge base can continuously optimize its own model and provide more accurate fault detection and decision support. It is worth emphasizing that the update mechanism of the knowledge base supports manual update mode. Administrators can make targeted adjustments to the knowledge base through a visual interface, add or delete business scenario data, and ensure the flexibility and controllability of the knowledge base when facing complex business needs.

[0082] After the computing engine obtains the standardized data from the analysis engine, it uses the large model knowledge base to analyze and make decisions, determine whether the system has a fault, the type and severity of the fault, or confirm that the system is in normal operation, identify the root cause of the fault, and locate the root cause. The computing engine writes the fault type and system fault, root cause identification, and location or normal operation signal into the memory queue of the computing engine for execution by the rule engine. In addition, the computing engine will also synchronously update the fault type, root cause identification, and location information to the database to ensure the accuracy of subsequent queries and analysis.

[0083] The advantage of the computing engine is its high intelligence and adaptability. Through continuous learning and optimization of the large model knowledge base, the system can accurately determine the root cause of failures in various complex scenarios and make timely and accurate decisions, reducing human intervention and reducing the time cost of fault handling.

[0084] The rule engine is responsible for mapping the system status to multi-dimensional emergency rules based on the decision results of the calculation engine. When a system failure occurs, the rule engine can quickly match the corresponding emergency measures. At the same time, when the fault is eliminated, the module will automatically match the emergency relief measures. The flexibility and automation of the rule engine ensure that the system can respond quickly in various failure scenarios and maintain business continuity.

[0085] The rule engine is specifically:

[0086] The rule engine can flexibly call system-level, component-level, node-level and API-level emergency rules according to failure conditions in different dimensions. The emergency rules include but are not limited to system disabling, function degradation, traffic control, service restart, resource reallocation and automatic switching to backup resources to ensure high availability of the system and business continuity.

[0087] The rule engine includes:

[0088] System-level rules apply to situations where the entire business system cannot provide normal services to the outside world. When the entire system fails, system-level rules will trigger a series of emergency measures, which may include disabling system-level functions, limiting traffic, degrading services, switching traffic to backup systems, and starting automated fault recovery processes. Its purpose is to ensure the minimum availability of core services during system recovery and prevent the entire system from crashing;

[0089] Component-level rules are emergency measures taken when certain key components in the system (such as databases, middleware, etc.) are abnormal. Component-level rules may involve component disabling, current limiting, downgrading operations, and redirecting data requests. In addition, measures such as data isolation and cache switching may be triggered to reduce the scope of the failure and ensure the normal operation of other components;

[0090] Node-level rules are applicable to situations where some nodes in the business system fail. Node-level rules ensure that the business system can maintain overall service availability when some nodes fail by disabling or isolating failed nodes, restarting service nodes, dynamically adjusting load balancing strategies, adjusting node resource allocation, and transferring traffic to other healthy nodes;

[0091] API-level rules: When internal or external interface calls fail, API-level rules will trigger corresponding emergency measures. These measures may include dynamic call restrictions and controls, timeout and retry strategies, dynamic parameter adjustment and mapping, and call fuse and degradation strategies.

[0092] The rule engine is responsible for executing the decision results output by the computing engine. When a fault occurs, the system needs to take corresponding emergency measures according to different fault types to minimize the impact of the fault on the business system. The rule engine obtains the fault signal from the memory queue of the computing engine, matches the emergency rules according to the nature of the fault, and performs corresponding operations on the business system.

[0093] The emergency rules are divided into system-level rules, component-level rules, node-level rules and API-level rules according to different failure scenarios of the business system. System-level rules apply to scenarios where the entire business system fails. For example, when the business system as a whole is unavailable, certain functions can be disabled or current limiting can be performed. Component-level rules apply to countermeasures when some components in the system (such as databases, middleware, etc.) have abnormalities. Node-level rules are used to handle failures of individual nodes in the business system, and API-level rules are used to deal with failures at the internal and external interface call levels.

[0094] The self-healing implementation engine is specifically:

[0095] The main function of the self-healing implementation engine is to quickly take automated repair and control measures for the root causes of system failures based on service governance and heterogeneous adaptation assembly technology to ensure the stable operation of business systems. The self-healing implementation engine supports multi-level and multi-dimensional processing measures, including differentiated processing solutions at the system layer, component layer, node layer, and API layer.

[0096] At the system level, the self-healing implementation engine connects to external systems with different protocols and languages ​​through heterogeneous adaptation and assembly technology to achieve automatic flow control, circuit breaking and recovery of services. At the component level, the self-healing implementation engine can intelligently control anomalies in key infrastructure components such as databases and middleware. For failures in different domains or nodes in a distributed system, the self-healing implementation engine supports separate control at the node level. The control measures of the self-healing implementation engine on the API layer are reflected in the governance capabilities at the interface level. When certain business APIs cause high latency or increased failure rates due to abnormal calls, the self-healing implementation engine will accurately control the interface traffic, including dynamic flow control, group isolation and request priority adjustment.

[0097] The self-healing implementation engine is connected to the computing engine and the rule engine at the same time, including different processing measures at the system layer, component layer, node layer, and API layer. At the system layer, it reflects the heterogeneous systems involved in the call, based on adapters to implement external call system current limiting and circuit breaking in different protocols and languages. The component layer reflects measures such as database / middleware, and the node layer reflects the separate control of different domains and different nodes.

[0098] The real-time self-healing service system for securities business based on big model technology supports dynamic management of the big model knowledge base through visual operations on the interface. Through the visual interface, users can easily add, delete and modify the data in the knowledge base. For example, when a new application scenario is added to the business system, users can add corresponding data entries through the interface; when certain business scenarios are outdated or no longer applicable, users can delete invalid data through the interface to ensure that the knowledge base is always consistent with business needs. The dynamic update and visual management functions of the knowledge base effectively improve the flexibility and operability of the system, ensuring that the system can maintain efficient and stable operation in a complex and changing business environment.

[0099] The method comprises the following steps:

[0100] (1) The analysis engine obtains data from the system alarm message queue or monitoring component in real time, parses it, and extracts key information such as IP, service name, function number, etc. The parsed standardized data is first placed in the memory queue of the analysis engine, and then synchronously written to the database for persistent storage;

[0101] (2) The computing engine reads standardized data from the memory queue of the analysis engine and uses the large model knowledge base to make intelligent decisions. Through large model analysis, the module can determine whether the system has a fault and its fault type, or confirm that the system is in normal operation. According to the mapping relationship between the fault type and the emergency rule predefined in the configuration file, the corresponding emergency rule is matched. Subsequently, the system fault or normal state signal and the fault type are written into the memory queue of the computing engine, and the rule information related to the data in the database is updated at the same time;

[0102] (3) The rule engine obtains system failure or normal operation signals and their corresponding failure types from the memory queue of the computing engine. When the system fails, the rule engine matches the rules according to the failure type; when the system returns to normal, the rule engine automatically matches the rules for releasing the applied emergency measures.

[0103] (4) The self-healing implementation engine is closely connected with the computing engine and the rule engine, and has powerful service governance capabilities, and can connect to heterogeneous systems with different protocols, languages, and operating environments. Through adapter design, it supports seamless integration with external systems and third-party services, and can achieve cross-platform self-healing capabilities without changing the existing system structure.

[0104] The step (2) further comprises:

[0105] It supports dynamic adjustment of large model knowledge bases through interface-based visual operations. For new application scenarios of the business system, users can intuitively add new data entries to the knowledge base; for outdated or no longer applicable business scenarios, users can easily delete the corresponding invalid data to ensure the accuracy and real-time nature of the knowledge base, continuously optimize the decision-making ability of the model, and ensure the system's agile response to business changes.

[0106] In the specific embodiment of the present invention, please refer to Figure 1 As shown, the securities business real-time self-healing service system based on large model technology, wherein the system includes:

[0107] The analysis engine is used to collect, parse and standardize data from various data sources such as system logs, monitoring data, and alarm messages. Specific functions include:

[0108] Multi-data source analysis: supports real-time data acquisition from multiple sources such as alarm message queues, system logs, and monitoring data;

[0109] Key information extraction: Extract key information such as IP address, service name, function number, etc. from the original data through field mapping and regular expressions;

[0110] Standardized data storage: After unified processing, data is stored in the memory queue and written to the database at the same time to ensure data persistence and consistency for the computing engine to call.

[0111] The computing engine is the intelligent decision-making engine of the entire system, which mainly relies on the large model knowledge base to judge the operating status of the system. The specific process is as follows:

[0112] Data acquisition: The computing engine obtains standardized system operation data from the memory queue of the analysis engine. This data includes system alarm information, logs, and monitoring indicators.

[0113] Fault judgment: Using the large model knowledge base, the computing engine performs intelligent analysis on the acquired data to determine whether the current system is in a fault state. The large model knowledge base can make decisions on the operating status of the system based on historical operating data and the training results of the AI ​​model. After confirming that a fault has occurred, the computing engine can also identify the specific type of fault, write the fault type and related judgment results into the memory blocking queue, and update the database to ensure that the fault information can be used by subsequent modules.

[0114] The rule engine is responsible for receiving the fault type information provided by the calculation engine and implementing emergency processing based on the predefined rule system. The specific process is as follows:

[0115] Rule matching: When the rule engine obtains the fault type information from the memory blocking queue, it matches the corresponding emergency handling rules according to the different levels of the fault (such as system level, component level, node level or API level). The rule engine contains pre-set fault emergency handling measures, which are classified and handled according to the severity and impact of the fault.

[0116] The self-healing implementation engine is closely connected with the calculation engine and the rule engine, and together they build a complete set of securities business system fault diagnosis and self-healing closed-loop mechanism. The specific process is as follows:

[0117] Execution of emergency measures: Once a suitable rule is matched, the self-healing implementation engine executes emergency measures in a variety of ways. Specific methods include but are not limited to HTTP calls, sending message queues, etc. These measures can include system current limiting, disabling specific components or nodes, enabling redundant services, restarting faulty services, etc., to minimize business interruption time and quickly restore system functions.

[0118] Automatic recovery: When the system fault is eliminated, the self-healing implementation engine will automatically cancel the implemented emergency measures according to the fault recovery signal matched by the calculation engine and the rule engine to ensure that the business system returns to normal. The whole process from fault discovery to repair implementation is automated, greatly reducing manual intervention.

[0119] The analysis engine is highly flexible and extensible. It not only supports reading data from business system log files, but also supports obtaining business system alarm messages from message queues and monitoring data from monitoring components of business systems. In order to better meet the needs of diverse data sources, the analysis engine adopts a plug-in design, which flexibly accesses different types of data sources through plug-ins. This plug-in data acquisition method can more efficiently process heterogeneous data from different data sources, enhancing the adaptability and extensibility of the system.

[0120] For each data source, the analysis engine can adopt different reading strategies through the corresponding plug-in module. Through this plug-in architecture, the analysis engine can dynamically load or unload specific data source reading plug-ins according to specific business needs, greatly simplifying the expansion and maintenance of data sources. After unified data cleaning and conversion processing, each plug-in will eventually convert the data into standard system operation data and write it to the memory queue and distributed database for further processing by the computing engine.

[0121] The advantage of the plug-in data acquisition method is that it can flexibly respond to the needs of different data sources. The analysis engine has a built-in standardized interface specification, and any plug-in can be seamlessly connected as long as it implements the interface. The interface requires the plug-in to return data in the key-value pair format to ensure that the output format of all data sources is unified, which is convenient for subsequent data processing and analysis. When the analysis engine calls the plug-in interface, if the plug-in detects new data input, it returns data in the key-value pair format; if there is no new data, it immediately returns a null value. This design greatly improves the real-time and flexibility of data acquisition. It is worth mentioning that different data sources can be connected to the analysis engine by developing different plug-ins without making any modifications to the overall architecture of the analysis engine. This not only reduces the complexity of development and maintenance, but also ensures the stability and scalability of the system. Through this plug-in design, the analysis engine can easily cope with new data sources in the future, ensuring that the system can flexibly adapt to different business needs.

[0122] After data acquisition, the analysis engine uniformly cleans and converts the data to ensure that all data can meet standardization requirements. Specifically, the analysis engine supports multiple data mapping modes, including field mapping, regular expression mapping, and array field mapping. Although the core mapping methods of different mapping modes are different, the overall processing flow remains consistent.

[0123] For the field mapping mode, the analysis engine first reads the configuration file and parses the corresponding mapping configuration tag. <fieldmappingset>`, and then further parse out each field mapping label` <fieldmapping>`. On this basis, the module obtains the mapping relationship between the source field `srcField` and the target field `targetField`. In the specific operation, the analysis engine converts the corresponding keys in the source data, that is, replaces the source field with the target field to ensure that the format of the data is consistent with the system standard. In this process, the data value corresponding to the source field remains unchanged, and only the key name is replaced. The core purpose of this field mapping method is to map non-standard fields in different data sources to a unified target field to ensure the compatibility and consistency of subsequent data processing and decision-making.

[0124] In regular expression mapping mode, the analysis engine reads the configuration file and parses the mapping rules related to the regular expression. First, the module reads the configuration tag ` <fieldmappingset>Parse the mapping label of each field in <regexfieldmapping>`. In this tag, the source field `srcField`, the target field `targetField`, the regular expression pattern `regexPattern`, and the regular expression group index `groupIndex` are defined. During the processing, the module will replace the key name in the source data with the target field name, match the value of the source data according to the regular expression, extract the qualified part, use the group index to locate the specific substring, and complete the data conversion. In this way, regular expression mapping can extract key information from unstructured data sources (such as logs or alarm messages) and convert it into standardized fields. This mode is very suitable for scenarios with non-fixed formats and complex data content, and can flexibly cope with various dynamically changing data structures.

[0125] In array field mapping mode, the analysis engine also reads the tags in the configuration file. <fieldmappingset>`to process. Specifically, the module will parse the field mapping tag` <arrayfieldmapping>`, which defines the source field `srcField`, the target field `targetField`, and the separator field `splitField`. During operation, the module first replaces the key name in the source data with the target field name, and then splits the value of the source data according to the configured separator and converts it into an array structure. This array mapping mode is very suitable for processing multi-level nested complex data. Multiple values ​​can be split and classified according to preset rules to adapt to the system's data processing standards.

[0126] Through the above plug-in architecture design and support for multiple mapping modes, the analysis engine can efficiently and flexibly respond to different data source requirements, ensuring the real-time, accuracy and scalability of the system.

[0127] The core function of the computing engine is to intelligently analyze and diagnose the operation data of the securities business system based on the big model technology. Its workflow first obtains the standardized system operation data from the memory queue of the analysis engine. After unified cleaning and formatting, these data have the basis for further processing in the computing engine.

[0128] The computing engine first matches the input data with the existing knowledge items in the knowledge base through a vector matching algorithm. Specifically, the vector matching algorithm vectorizes the system running data and then calculates the similarity with the data vector in the knowledge base to find the N knowledge items that are closest to the input data. In this case, the vector matching algorithm uses a calculation method based on the vector space model. Its basic principle is to quantify the similarity by comparing the cosine similarity or Euclidean distance between two vectors. Vectorization processing can ensure that the data can effectively express its characteristics in a high-dimensional space. During the matching process, each piece of knowledge data in the knowledge base is stored in the form of a vector. This efficient algorithm can quickly find the closest historical data or fault scenario. By default, the N value is set to 15, that is, the computing engine will find the 15 most similar pieces of knowledge data in the knowledge base for subsequent processing. However, according to actual business needs, the size of N can be flexibly adjusted. For example, for some complex business scenarios, the N value can be increased to ensure that more potential similar scenarios are covered; while in some simple scenarios, the N value can be reduced to speed up the matching speed and improve the response efficiency of the system.

[0129] After completing the vector matching, the computing engine sends the standardized system operation data, the N most similar knowledge data matched from the knowledge base, and the PROMPT prompt information generated for the business scenario to the AI ​​big model. As the core decision engine in the entire computing engine, the AI ​​big model is responsible for generating decision-making outputs based on the input data and knowledge base information. The PROMPT prompt information is used to provide the big model with necessary context or auxiliary guidance to ensure that the big model can accurately understand the business scenario and the current data status, and further improve the decision-making accuracy of the big model. The AI ​​big model generates a decision-making answer in natural language through in-depth understanding and analysis of the input data, which usually includes whether a system failure has occurred, the specific type of the failure, and its possible impact range. Since the output of the AI ​​big model is expressed in natural language, in order to facilitate automatic processing by the system, the computing engine will use regular expressions to parse the natural language answer and extract key information. Specifically, regular expressions are used to extract two core elements from the big model's answer: whether a system failure is detected, and the type of failure. Regular expressions can efficiently and accurately capture specific patterns or keywords from natural language, ensuring that the system can extract the required information within milliseconds. After extracting the fault status and fault type, the calculation engine writes this information into its memory queue.

[0130] The high flexibility in the computing engine design also enables it to dynamically adjust model parameters or processing procedures according to the actual needs of the business system. For example, the adjustment of the N value can not only improve the accuracy of system matching, but also reduce the occupancy of computing resources when the system load is high, thereby improving the overall performance of the system. The decision-making process of the AI ​​large model can also be continuously optimized and tuned to ensure that the decision results can respond to changes in the business system in a timely manner, providing strong guarantees for business continuity. Through the above process, the computing engine can efficiently and intelligently analyze, detect faults and judge the operating data of the securities business system. This module not only greatly improves the accuracy and timeliness of the system's self-healing, but also provides an accurate decision-making basis for the rule engine's emergency handling of faults, ensuring that the system can quickly take effective countermeasures when a failure occurs.

[0131] The rule engine is mainly responsible for matching emergency rules for fault status in the securities business system and matching recovery rules after the fault is resolved. The core task of the rule engine is to obtain the system's fault status and fault type from the memory queue of the computing engine, and to respond intelligently based on this. When the computing engine determines that the system is in normal operation, the main task of the rule engine is to match the emergency measures rules previously imposed on the business system to deal with the fault, so that the system can be restored to normal operation; and when the computing engine determines that the system is in a fault state, the rule engine needs to quickly match the emergency measures rules to reduce the impact of the fault on the business and improve the system's response capabilities.

[0132] Specifically, when the rule engine handles system failures, it first matches the emergency handling rules corresponding to the current fault type from the configuration file. The configuration file predefines the emergency handling measures to be taken in different fault scenarios. These measures are classified in different dimensions according to the severity of the fault and business needs, such as system-level rules, component-level rules, node-level rules, API-level rules, etc. Each type of rule defines clear response plans for different business scenarios to ensure that the business system can make reasonable and timely responses under different levels of fault conditions. The rule matching process is completed through the mapping relationship between the fault type and the rules in the configuration file. When the computing engine identifies the fault type, the rule engine will search for the corresponding emergency handling rules in the configuration file based on this type. The configuration of emergency rules is highly flexible, and each rule can contain multiple emergency measures implementation methods to ensure that the system can effectively respond to faults through different technical means.

[0133] The main function of the self-healing implementation engine is to accurately locate the root cause of system failures based on service governance and heterogeneous adaptation assembly technology, and quickly take automated repair and control measures to ensure the stable operation of the business system. The self-healing implementation engine supports multi-level and multi-dimensional processing measures, including differentiated processing solutions at the system layer, component layer, node layer and API layer, as follows:

[0134] For the selection of rule implementation methods, the self-healing implementation engine supports multiple execution mechanisms. Common methods include imposing emergency measures on business systems through HTTP calls or message queue delivery. The HTTP call method is to execute emergency measures by sending requests to specific interfaces of the business system, such as disabling certain services, limiting traffic, or shutting down certain faulty nodes. The advantage of the HTTP call method is its flexibility and scalability, which can easily adapt to different business systems and scenarios. At the same time, the message queue delivery method delivers emergency measures to various components of the business system by sending emergency processing instructions to the message queue. This method is suitable for distributed systems or microservice architectures, because the message queue can ensure that emergency measures can be reliably delivered and executed in complex system architectures, avoiding the failure of emergency measures due to network fluctuations or excessive system load.

[0135] When a failure occurs, the self-healing implementation engine will select the appropriate execution mechanism to apply emergency measures to the business system based on the rules and implementation methods matched by the rule engine. For example, if a component in the system is abnormal, the self-healing implementation engine can disable the component or limit the call of its related services to prevent the abnormal component from affecting the overall system. At the same time, the self-healing implementation engine can also dynamically adjust the execution scope and intensity of emergency measures based on the configuration in the matched rules to ensure that the impact of the failure is kept to a minimum while ensuring business continuity. The execution of emergency measures is a dynamic process. When the system returns to normal, the self-healing implementation engine will promptly lift the applied emergency measures according to the abnormal recovery rules matched by the rule engine, so that the business system can return to normal operation mode.

[0136] The self-healing implementation engine can significantly improve the fault tolerance and business continuity of the securities business system through comprehensive management of the system layer, component layer, node layer and API layer. At the same time, it supports dynamic expansion in heterogeneous environments and can adapt to the diverse needs of complex business scenarios, fully demonstrating the efficiency and intelligence of the present invention in real-time self-healing services.

[0137] In a specific embodiment of the present invention, the system also provides a visual management interface, allowing users to manually modify and update the large model knowledge base through the interface. Users can adjust the rules and fault handling logic in the knowledge base according to the operating status of the business system to ensure that the decision is consistent with the actual business needs. The visual interface improves the flexibility and operability of the system, enabling the system to better adapt to the ever-changing business environment.

[0138] See also Figure 2 As shown, the method for implementing the real-time self-healing service of securities business using the above system with large model technology, wherein the method comprises the following steps:

[0139] (1) During the operation of the securities business real-time self-healing service system, the business system first generates operation logs, alarm information, and monitoring data, which constitute the basic information of the system operation. These data sources may come from different channels, covering the business system's log files, alarm messages, and various types of real-time monitoring information.

[0140] (2) The analysis engine is responsible for extracting these raw data from the business system. This module obtains data from different business system interfaces through a flexible plug-in mechanism, including reading log files, monitoring alarm message queues, and accessing system monitoring data. This plug-in design enables the analysis engine to flexibly respond to different data sources. Regardless of the data source, the analysis engine can process it uniformly.

[0141] (3) After data extraction, the analysis engine will standardize the data. Through data cleaning, field mapping, regular expression matching and other technical means, the analysis engine can convert these diverse input data into standardized system operation data. In this process, the system will extract key fields such as IP address, service name and function number, and format them into unified standard data.

[0142] (4) After data extraction, the analysis engine will standardize the data. Through data cleaning, field mapping, regular expression matching and other technical means, the analysis engine can convert these diverse input data into standardized system operation data. During this process, the system will extract key fields such as IP address, service name and function number, and format them into unified standard data. The standardized data will be written into the memory queue of the analysis engine for use by subsequent modules. At the same time, the analysis engine will also store these standard data persistently to ensure that these data can be traced back to for further analysis and processing in the event of a failure.

[0143] (5) The standardized data will be written into the memory queue of the analysis engine for use by subsequent modules. At the same time, the analysis engine will also store these standard data persistently to ensure that these data can be traced back to further analysis and processing when a failure occurs.

[0144] (6) After the analysis engine completes the data standardization process, the computing engine takes over the processing. It obtains the standardized system operation data from the memory queue of the analysis engine, and then enters the fault judgment and intelligent decision-making stage. The computing engine uses a vector matching algorithm to filter out N pieces of historical knowledge data that are most similar to the current standardized data from the system's knowledge base. The vector matching algorithm can effectively identify possible faults that may be occurring in the system by calculating the similarity between the input data and the existing records in the knowledge base.

[0145] (7) The computing engine submits these analysis results, along with the system's current operating data and the PROMPT prompts used to prompt the big model, to the AI ​​big model. The big model will conduct a comprehensive analysis of these inputs and determine whether the system has failed and the specific type of failure. The big model's decision-making basis not only relies on standardized data, but also combines historical data and PROMPT prompts in the knowledge base, so that it can make more accurate and flexible decisions.

[0146] (8) The decision results output by the large model are usually described in natural language. The computing engine uses regular expressions to extract two key pieces of information from the output of the large model: whether the system has failed and the specific type of failure. This information is encapsulated and stored in the memory queue of the computing engine for subsequent processing by the rule engine.

[0147] (9) The rule engine reads the fault status and fault type information from the memory queue of the computing engine, and reads the rules associated with the current fault type from the configuration file. Each fault type has a corresponding emergency response plan, for example, for network failures, database connection abnormalities, etc.

[0148] (10) After receiving the rules matched by the rule engine and the corresponding emergency response plan, the self-healing implementation engine selects an appropriate execution method. Common rule execution methods include passing commands through HTTP calls or message queues. HTTP calls are suitable for simple operations, such as shutting down certain services or calling external APIs, while message queue delivery is suitable for complex distributed systems to ensure that instructions can be reliably transmitted to various parts of the business system.

[0149] (11) After the self-healing implementation engine applies emergency measures, the business system will take corresponding actions in a timely manner to avoid or reduce the impact of the fault on the overall system. At the same time, the self-healing implementation engine also continuously monitors the system status. When the fault is eliminated and the system returns to normal, the self-healing implementation engine will automatically cancel the emergency measures previously applied and restore the business system to normal operation.

[0150] This technical solution focuses on the computing engine, rule engine, and self-healing real-time engine. That is, this technical solution performs the next step based on the knowledge that a fault has occurred and what fault has occurred. For securities systems, it is more difficult to quickly identify the cause of the fault, rather than waiting for developers to conduct further manual investigations and locate the component where the fault occurred, which is common in the industry. Only then can corresponding correct measures be taken to eliminate the cause of the fault or shield the impact of the fault, thereby ensuring business continuity and stability.

[0151] This technical solution solves the problem from the development level. The self-healing implementation engine directly takes intervention measures to restore the system. At the same time, the emergency plan can provide plans that are common in large-scale fault plans. In reality, there are thousands of errors that occur at any time, including normal business errors and fault errors. This technical solution identifies the real faults in all monitoring alarms, analyzes the root causes of the faults, takes different self-healing measures, and eliminates the impact, so as to achieve the purpose of business continuity and system stability.

[0152] The securities business real-time self-healing service system based on the large model technology of the present invention has the following significant technical effects:

[0153] 1. Real-time fault detection and response: Through real-time analysis and processing of logs, alarm messages, and monitoring data, the system can quickly detect abnormal conditions in the business system, and automatically match corresponding emergency rules when a fault occurs, take recovery measures in a timely manner, and reduce the impact of the fault on the business.

[0154] 2. Intelligent decision-making and optimization: The computing engine relies on a large model knowledge base and can optimize the decision-making process of fault diagnosis and emergency response in real time through a dynamic update mechanism to ensure the accuracy and timeliness of decisions.

[0155] 3. Multi-dimensional emergency response mechanism: The rule engine supports the automated application of multiple emergency measures, including system-level, component-level, node-level, and API-level fault emergency response solutions, which can flexibly respond to faults at different levels and ensure the stable operation of the system.

[0156] 4. Visual management and operation: The knowledge base supports dynamic adjustment through interface operation. Users can easily add, delete and modify business scenarios to ensure that the knowledge base is always synchronized with actual business needs, improving the flexibility and operability of the system.

[0157] 5. Business continuity guarantee: The present invention improves the high availability of the system, reduces the risk of business interruption, and enhances the continuity and stability of the business system through comprehensive monitoring and automated fault handling of the securities business system.

[0158] The present invention can effectively improve the stability and fault recovery capability of the securities business system, reduce human intervention, and achieve highly automated business continuity assurance by combining large model technology with an automated emergency response mechanism. The system can not only adapt to complex and changing business needs, but also continuously optimize its decision-making capabilities, providing strong support for the efficient and stable operation of the financial industry.

[0159] The specific implementation scheme of this embodiment can refer to the relevant description in the above embodiment, which will not be repeated here.

[0160] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0161] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0162] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0163] The system, method, device, processor and computer-readable storage medium thereof for realizing real-time self-healing service for securities business based on large model technology of the present invention are adopted to solve the shortcomings of traditional data consistency analysis tools, such as strong manual dependence, few file format types supported for analysis, small amount of data processed, long analysis time, difficulty in developing new analysis projects, lack of graphical display interface for analysis process and results, and difficulty in expanding performance in the face of data growth. A better solution is provided, which can realize extremely fast analysis of consistency of data volume of billions, meet the strict and consistent requirements of the securities industry, especially the core securities trading system, in the face of massive data, meet the needs of high throughput and extremely fast analysis in complex text scenarios and multiple data sources, support script configuration development, open elastic deployment, and visual operation, and have the characteristics of diversified comparison dimensions and liberalized capacity expansion. It overcomes the shortcomings of traditional analysis tools or systems, such as significant decline in performance of massive data, single applicable scenarios, limited capacity, difficulty in developing new verification projects, and unclear comparison process, and has relatively outstanding practicality.

[0164] In this specification, the present invention has been described with reference to specific embodiments thereof. However, it is apparent that various modifications and variations may be made without departing from the spirit and scope of the present invention. Therefore, the specification and drawings should be regarded as illustrative rather than restrictive.< / arrayfieldmapping> < / fieldmappingset> < / regexfieldmapping> < / fieldmappingset> < / fieldmapping> < / fieldmappingset>

Claims

1. A system for implementing real-time self-healing services for securities business based on large model technology, characterized in that: The system comprises: The analysis engine is connected to the data source and is used to collect monitoring data and system alarm message data of the securities business system in real time, and standardize these data into system operation data; A computing engine connected to the analysis engine is used to receive real-time data from the analysis engine, input the real-time data into a large model knowledge base algorithm model based on deep learning optimization, perform real-time analysis, identify the root cause of the fault, determine the location of the root cause of the fault, and make intelligent decisions; A rule engine, connected to the computing engine, for mapping the system state to multi-dimensional emergency rules according to the decision results of the computing engine; The self-healing implementation engine is connected to the computing engine and the rule engine, and based on service governance and heterogeneous adaptive assembly technical means, it automatically repairs and controls the root causes of system failures.

2. The system for implementing real-time self-healing services for securities business based on large model technology according to claim 1 is characterized in that: The analysis engine performs data analysis and processing in real time, converts the data into standard system operation data, and outputs the standard system operation data to the calculation engine and the database.

3. The system for implementing real-time self-healing services for securities business based on large model technology according to claim 1 is characterized in that: The analysis engine extracts and parses information from business system data in multiple formats and sources, including but not limited to business system alarm message queues and system monitoring data; When the analysis engine obtains data from the system alarm message queue, it parses the message content according to the configuration file, extracts the key information and converts it into standardized system operation data; when the analysis engine obtains data from the system monitoring data, it pulls the system operation data from the monitoring component at a regular interval and converts the monitoring data into standardized system operation data.

4. The system for implementing real-time self-healing services for securities business based on large model technology according to claim 1 is characterized in that: The computing engine includes a deep learning algorithm and a large model knowledge base, and the large model knowledge base contains system historical operation data, fault type information, root cause location, root cause information and recovery measure information.

5. The system for implementing real-time self-healing services for securities business based on large model technology according to claim 1 is characterized in that: The computing engine obtains standardized data from the analysis engine, uses deep learning algorithms and large model knowledge base models to perform analysis and decision-making, determines whether the system has a fault, the type and severity of the fault, the root cause of the fault, the location of the root cause, or confirms that the system is in normal operation, and writes the computing engine fault type, the root cause of the fault, the location of the root cause, and the signal of system failure or normal operation into the memory queue of the computing engine for execution by the rule engine; The calculation engine also synchronously updates the fault and root cause type information to the database.

6. The system for implementing real-time self-healing services for securities business based on large model technology according to claim 1 is characterized in that: When a failure occurs, the rule engine matches corresponding emergency measures according to the failure conditions in different dimensions, and flexibly calls system-level rules, component-level rules, node-level rules and API-level rules.

7. The system for implementing real-time self-healing services for securities business based on large model technology according to claim 1 is characterized in that: The self-healing implementation engine is based on service governance and heterogeneous adaptation assembly technology, and quickly takes automated repair and control measures for the root cause of system failures to ensure the stable operation of the business system.

8. The system for implementing real-time self-healing services for securities business based on large model technology according to claim 6 is characterized in that: The system-level rules are applicable to scenarios where the entire business system fails, the component-level rules are applicable to countermeasures when some components in the system fail, the node-level rules are applicable to handling situations where individual nodes in the business system fail, and the API-level rules are applicable to responding to failures at the internal and external interface call levels.

9. A method for implementing a real-time self-healing service for securities business based on a large model technology using the system of claim 1, characterized in that: The method comprises the following steps: (1) The analysis engine obtains data from the system alarm message queue or monitoring component in real time, analyzes it, and extracts key information; (2) The computing engine reads standardized data from the memory queue of the analysis engine and uses deep learning algorithms and a large model knowledge base to locate the root cause and make intelligent decisions; (3) The rule engine obtains system failure or normal operation signals and their corresponding failure types, root causes, and locations from the memory queue of the computing engine. When a system failure occurs, the rule engine can quickly locate the adapted rules based on the mapping relationship to ensure the efficiency and effectiveness of failure recovery. (4) The self-healing implementation engine automatically repairs and controls the root causes of system failures.

10. The method for implementing real-time self-healing service for securities business based on large model technology according to claim 1, characterized in that: The step (1) further comprises the following steps: The analysis engine puts the parsed standardized data into a memory queue and synchronously writes it into a database for persistent storage.

11. The method for implementing real-time self-healing service for securities business based on large model technology according to claim 1, characterized in that: The step (2) specifically comprises the following steps: The computing engine uses deep learning algorithms and large model knowledge base analysis to determine whether a system fault occurs and its fault type, root cause and location, or confirm that the system is in normal operation; matches the corresponding emergency rules according to the mapping relationship between the fault type and the emergency rules predefined in the configuration file; the computing engine writes the system fault, root cause and location or the normal state signal and fault type into the memory queue, and updates the rule information related to the data in the database at the same time.

12. The method for implementing real-time self-healing service for securities business based on large model technology according to claim 1, characterized in that: The step (2) further comprises the following steps: The computing engine dynamically adjusts the large model knowledge base through interface-based visualization operations.

13. A device for implementing real-time self-healing service for securities business based on large model technology, characterized in that: The device comprises: a processor configured to execute computer-executable instructions; A memory storing one or more computer executable instructions, wherein when the computer executable instructions are executed by the processor, the steps of the method for implementing real-time self-healing service for securities business based on big model technology as described in any one of claims 8 to 11 are implemented.

14. A processor for implementing real-time self-healing services for securities business based on large model technology, characterized in that: The processor is configured to execute computer executable instructions. When the computer executable instructions are executed by the processor, the various steps of the method for implementing real-time self-healing service for securities business based on big model technology as described in any one of claims 8 to 11 are implemented.

15. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program can be executed by a processor to implement the various steps of the method for implementing real-time self-healing service for securities business based on big model technology as described in any one of claims 8 to 11.

Images