A terminal operation and maintenance management method and platform for a medical big data platform

Abstract

The application provides a terminal operation and maintenance management method and platform for a medical big data platform, which first collects multi-modal historical operation and maintenance data of the platform terminal in a normal working state, and constructs a time sequence feature vector sequence after preprocessing and fusion. Then, a deep sequence learning model training process is used to learn a latent representation to capture the context state of the normal workflow mode and establish a reconstruction baseline model. Then, real-time operation and maintenance data of the terminal are obtained and a feature vector is constructed, the latent context representation is extracted by the trained model, and the reconstruction error is calculated. Based on the latent representation, the current workflow state is identified, and the context-aware abnormality measurement value is calculated combined with the state information and the reconstruction error. By analyzing the time evolution characteristics of the abnormality measurement value and comparing it with the preset abnormality mode criterion, it is determined whether the terminal has a workflow anomaly, and if so, an early warning signal containing the abnormal evolution characteristic description is generated. The application has the effect of improving the accuracy of terminal operation and maintenance detection.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of operation and maintenance, and particularly relates to a terminal operation and maintenance management method and platform for a medical big data platform. BACKGROUND

[0002] Traditional monitoring methods for medical big data platforms usually adopt isolated single-index analysis, lacking comprehensive analysis capability for multi-dimensional data. The health status of a system is often the result of the joint action of multiple indicators, and the fluctuation of a single indicator may be normal, but a specific combination mode of multiple indicators may indicate a problem. Secondly, existing technologies generally lack a deep understanding of time series data, and cannot effectively capture long-term dependencies and seasonal patterns. System behavior usually has complex time dependence, such as daily, weekly and monthly fluctuations, which are difficult to describe with simple rules.

[0003] On the other hand, traditional methods are difficult to adapt to the evolution of system behavior. As the business develops, system load and usage patterns change constantly, and fixed monitoring rules quickly become outdated. Manually adjusting these rules not only consumes time and effort, but also easily introduces human errors. Moreover, existing technologies lack an understanding of the context of system state, and the same indicator value may have completely different meanings in different scenarios. For example, the normal range of CPU usage may be quite different during business peak and low periods. These limitations lead to the dilemma of high false positive rate and low detection rate, making operation and maintenance personnel overwhelmed by a large number of false alarms, while missing real system abnormalities, ultimately affecting service quality and user experience. SUMMARY

[0004] The application provides a terminal operation and maintenance management method and platform for a medical big data platform to solve the problems of high false positive rate and low detection rate in traditional operation and maintenance processes.

[0005] In a first aspect, the application provides a terminal operation and maintenance management method for a medical big data platform, which includes the following steps:

[0006] Collecting multi-modal historical operation and maintenance data of the platform terminal in a normal workflow mode;

[0007] Preprocessing and fusion processing of the multi-modal historical operation and maintenance data to construct a historical time series feature vector sequence reflecting the historical normal dynamic behavior of the platform terminal;

[0008] Training a pre-set deep sequence learning model using the historical time series feature vector sequence, the model training process including learning the latent representation of the historical time series feature vector sequence to capture the context state of the normal workflow mode, and establishing a baseline model based on the latent representation to reconstruct the historical time series feature vector sequence;

[0009] constructing a real-time time sequence feature vector sequence according to the real-time operation and maintenance data of the platform terminal currently acquired, extracting a latent context representation of the real-time time sequence feature vector sequence by using the deep sequence learning model trained, and calculating a reconstruction error of the real-time time sequence feature vector sequence by using the baseline model;

[0010] identifying an inference workflow state in which the platform terminal currently locates based on the latent context representation, and calculating a context-aware abnormality metric value in combination with the inference workflow state and the reconstruction error;

[0011] analyzing a time evolution feature of the abnormality metric value, and comparing the time evolution feature with a preset abnormality pattern criterion to determine whether the platform terminal has a workflow pattern abnormality, and generating an early warning signal including a platform terminal abnormality evolution feature description if the platform terminal has the workflow pattern abnormality.

[0012] Optionally, the preprocessing and fusion processing of the multi-modal historical operation and maintenance data and the construction of a historical time sequence feature vector sequence reflecting historical normal dynamic behaviors of the platform terminal include the following steps:

[0013] performing time alignment and data analysis processing on the multi-modal historical operation and maintenance data in a unified sampling time interval, and analyzing key information fields of the multi-modal historical operation and maintenance data;

[0014] calculating and extracting derived correlation features representing instant interaction relationships between different modal data;

[0015] fusing the key information fields and the derived correlation features into a single high-dimensional feature vector after encoding processing, and arranging the high-dimensional feature vector in time sequence to form the historical time sequence feature vector sequence.

[0016] Optionally, the training of the preset deep sequence learning model by using the historical time sequence feature vector sequence includes the following steps:

[0017] mapping the historical time sequence feature vector sequence to a latent representation space by using an encoder in the preset deep sequence learning model;

[0018] training the deep sequence learning model to perform multi-task learning, and the learning tasks at least include: reconstructing an original input sequence based on a decoder in the deep sequence learning model and according to a latent context representation in the latent representation space to minimize a model reconstruction error; and predicting a time sequence feature vector at a next time step based on the latent context representation to minimize a model prediction error;

[0019] after the multi-task learning of the deep sequence learning model is completed, retaining the encoder for real-time extraction of the latent context representation, and retaining a reconstruction task part as the baseline model.

[0020] Optionally, the identifying the inferred workflow state that the platform terminal currently stays in based on the latent context representation comprises the following steps:

[0021] performing cluster analysis on the latent context representations in the latent representation space, and defining discrete inferred workflow state clusters according to the cluster analysis results;

[0022] calculating the spatial distance between the latent context representation of the real-time time-series feature vector sequence and the center of each inferred workflow state cluster;

[0023] statistically analyzing the local density and the neighboring sample distribution characteristics of the latent context representation of the real-time time-series feature vector sequence in the latent representation space;

[0024] combining the spatial distance, the local density and the neighboring sample distribution characteristics to assign the current target inferred workflow state to the platform terminal.

[0025] Optionally, the calculating the context-aware abnormality metric value based on the inferred workflow state and the reconstruction error comprises the following steps:

[0026] for each inferred workflow state, calculating and storing a multi-dimensional error statistical model under the inferred workflow state based on the reconstruction errors of the samples belonging to the inferred workflow state in the historical time-series feature vector sequence;

[0027] according to the currently assigned target inferred workflow state, searching for a corresponding target multi-dimensional error statistical model;

[0028] comparing the reconstruction error of the real-time time-series feature vector sequence with the target multi-dimensional error statistical model, calculating the statistical significance and the unexpectedness under the target inferred workflow state, and calculating the context-aware abnormality metric value based on the statistical significance and the unexpectedness.

[0029] Optionally, the analyzing the time evolution characteristics of the abnormality metric value, and comparing the time evolution characteristics with preset abnormality pattern criteria to determine whether the platform terminal has a workflow pattern abnormality comprises the following steps:

[0030] maintaining the abnormality metric value as a continuous abnormality metric value sequence within a time window;

[0031] calculating a dynamic evolution index of the abnormality metric value sequence, the dynamic evolution index including a trend slope, a fluctuation amplitude change rate and an autocorrelation change;

[0032] selecting a corresponding target evolution template from a predefined normal evolution pattern template library according to the target inferred workflow state, the evolution templates in the normal evolution pattern template library representing the normal fluctuation range and the dynamic characteristics of the abnormality metric value under different states;

[0033] The dynamic evolution index is compared with the target evolution template, and a comprehensive deviation degree of the dynamic evolution index from the target evolution template is calculated;

[0034] When the comprehensive deviation degree exceeds a preset threshold, it is determined that the platform terminal has an abnormal workflow mode, and the comprehensive deviation degree and the target evolution template are taken as an abnormal evolution feature description.

[0035] Optionally, after the generation of the early warning signal containing the abnormal evolution feature description of the platform terminal, the following steps are further included:

[0036] The abnormal evolution feature description and the current inferred workflow state of the platform terminal are integrated into a comprehensive abnormal feature;

[0037] Based on the reconstruction error analysis, the original feature dimension with the highest correlation degree to the comprehensive abnormal feature in the real-time time sequence feature vector sequence is analyzed;

[0038] The comprehensive abnormal feature and the original feature dimension are combined, and a set of potential fault roots sorted by possibility are inferred and output by using a pre-constructed platform correlation knowledge graph.

[0039] Optionally, the combination of the comprehensive abnormal feature and the original feature dimension and the inference and output of a set of potential fault roots sorted by possibility by using a pre-constructed platform correlation knowledge graph include the following steps:

[0040] The comprehensive abnormal feature and the original feature dimension are taken as query conditions;

[0041] The target node and the target path with the highest correlation degree to the query conditions are searched in the pre-constructed platform correlation knowledge graph, the target node includes a terminal component, a terminal service port or a terminal resource port, and the target path represents a dependency relationship or an influence relationship between the target nodes;

[0042] The target node is taken as a potential fault root, and the correlation scores of the potential fault roots are calculated according to the target path, and the potential fault roots are sorted by the correlation scores.

[0043] In a second aspect, the present application further provides a terminal operation and maintenance management platform for a medical big data platform, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the terminal operation and maintenance management method for the medical big data platform as described in the first aspect when executing the computer program.

[0044] In a third aspect, the present application further provides a computer readable storage medium, which stores instructions, and the instructions make the processor be configured to execute the terminal operation and maintenance management method for the medical big data platform as described in the first aspect when executed by the processor.

[0045] The beneficial effects of the present application are:

[0046] The present application significantly improves the accuracy and intelligence level of platform terminal anomaly detection through deep sequence learning and context perception analysis, effectively solving many challenges faced by traditional monitoring systems. Compared with traditional methods that rely on fixed thresholds and static rules, the present application can adaptively learn the normal behavior patterns of the system, establish a dynamic baseline, thereby greatly reducing the false positive rate and improving the detection rate of real anomalies. Through multi-modal data fusion processing, the present application overcomes the limitations of single indicator monitoring, achieving comprehensive perception of system status. In particular, in capturing time series features, the present application can identify complex time-dependent relationships and seasonal patterns, which is difficult for traditional methods to achieve. In addition, the context perception capability of the present application enables it to dynamically adjust the anomaly judgment criteria according to the workflow state of the system, avoiding the "one-size-fits-all" problem in traditional methods. In practical applications, the present application not only can detect anomalies in a timely manner, but also can provide anomaly evolution feature descriptions, providing more valuable decision support for operation and maintenance personnel. This intelligent anomaly detection method significantly reduces the workload of operation and maintenance personnel, shortens the problem response time, improves system reliability, provides strong technical support for enterprise digital transformation, and ultimately realizes the dual improvement of operation and maintenance efficiency and service quality. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 Figure 1 is a flowchart of a terminal operation and maintenance management method for a medical big data platform according to an embodiment of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be described clearly below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art belong to the scope of protection of the present application.

[0049] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of a kind and do not limit the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims means at least one of the connected objects, and the character " / ", generally represents a "or" relationship between the objects before and after it.

[0050] Figure 1This is a flowchart illustrating a terminal operation and maintenance management method for a medical big data platform in one embodiment. It should be understood that, although... Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps. For example Figure 1 As shown, the terminal operation and maintenance management method for a medical big data platform disclosed in this invention specifically includes the following steps:

[0051] S101. Collect multimodal historical operation and maintenance data of the platform terminal under normal working flow mode.

[0052] In the terminal operation and maintenance management of the medical big data platform, the first step is to collect multimodal historical operation and maintenance data of the platform terminals under normal working workflow mode. This data includes, but is not limited to: system performance indicators such as CPU utilization, memory usage, disk I / O rate, network traffic, application response time, database query latency, and number of user sessions; text data such as error messages, warning messages, and operation records in log files; and user interaction behavior data and business process execution data. The collection process is implemented through a monitoring agent program deployed on the terminal, recording data points at fixed time intervals (e.g., every 5 minutes) to ensure data continuity and timeliness. For example, for a medical image processing terminal, multimodal data such as CPU utilization curves, memory usage changes, network transmission rate, and application logs will be recorded simultaneously during image processing tasks. This data collectively constitutes the complete behavioral characteristics of the terminal under normal working conditions, providing a benchmark reference for subsequent anomaly detection.

[0053] S102. Perform preprocessing and fusion processing on multimodal historical operation and maintenance data to construct a historical time-series feature vector sequence that reflects the historical normal dynamic behavior of platform terminals.

[0054] Among them, the pre-processing and fusion processing of the collected multi-modal historical operation and maintenance data first need to be time-aligned, and the data of different sources and different sampling frequencies are unified to the same time scale, such as resampling all data to one data point every 5 minutes. Then data cleaning is performed, including removing outliers (such as error data with CPU usage exceeding 100%), filling missing values (using linear interpolation or previous value filling method), and standardizing (normalizing different dimensional data to the same range). Then extract the key information field, such as extracting error type, severity and other structured information from system logs. Further calculate the derived correlation features, such as the ratio of CPU usage to memory occupation, the correlation between network traffic and database query times, etc. These features can reflect the interaction between different modal data. Finally, all processed features are encoded and fused into a high-dimensional feature vector (such as a 300-dimensional vector), arranged in time sequence to form a historical time series feature vector sequence, which fully reflects the dynamic behavior characteristics of the platform terminal during the historical normal operation.

[0055] S103. Utilize the historical time series feature vector sequence to train the preset deep sequence learning model, and the model training process includes learning the latent representation of the historical time series feature vector sequence to capture the context state of the normal workflow mode, and establishing a baseline model based on the latent representation to reconstruct the historical time series feature vector sequence.

[0056] Among them, the historical time series feature vector sequence is trained by the preset deep sequence learning model, which usually adopts LSTM (Long Short Term Memory Network) or Transformer architecture, which can effectively capture the long-term dependence relationship in time series data. The training process first maps the input historical time series feature vector sequence to a low-dimensional latent representation space (such as compressing 300-dimensional original features to 50-dimensional latent representations) through an encoder, which can capture the context state information of the normal workflow mode. The model uses a multi-task learning framework to perform two key tasks simultaneously: one is the reconstruction task, which maps the latent representation back to the original feature space through the decoder, minimizing the reconstruction error (using mean square error loss function); the second is the prediction task, which predicts the feature vector of the next time step based on the current latent representation. For example, for a medical image processing terminal, the model can learn the normal change pattern of CPU, memory, disk I / O, etc. when processing large image files. After training, the encoder is retained for real-time feature extraction, and the reconstruction part is retained as a baseline model for subsequent anomaly detection.

[0057] S104. According to the real-time operation and maintenance data of the platform terminal currently acquired, a real-time time series feature vector sequence is constructed, the latent context representation of the real-time time series feature vector sequence is extracted using the trained deep sequence learning model, and the reconstruction error of the real-time time series feature vector sequence is calculated using the baseline model.

[0058] wherein, according to the current acquired platform terminal real-time operation and maintenance data, the real-time time sequence feature vector sequence is constructed according to the same preprocessing process as the historical data. Specifically, the multi-modal operation and maintenance data of the terminal is collected once every fixed time interval (such as 5 minutes), time alignment, data cleaning, feature extraction and fusion are performed, and real-time feature vectors consistent with the historical data format are formed. Then, these real-time feature vectors are input into the encoder of the trained deep sequence learning model to extract their latent context representation. For example, for a medical information system terminal that is executing a database backup task, the encoder will compress its current CPU usage, memory occupation, disk write rate and other multi-dimensional features into a compact latent representation. Then, the reserved baseline model (decoder part) is used to try to reconstruct the original real-time feature vector from these latent representations, and the error (such as Euclidean distance or cosine similarity) between the reconstruction result and the actual observation value is calculated. These reconstruction errors reflect the degree of deviation of the current terminal behavior from the historical normal mode, providing a basic metric for anomaly detection.

[0059] S105. Identify the inferred workflow state of the platform terminal based on the latent context representation, and calculate the context-aware anomaly metric value based on the inferred workflow state and the reconstruction error.

[0060] wherein, based on the extracted latent context representation, firstly, the latent representation space is divided into multiple discrete workflow state clusters through clustering analysis (such as K-means or DBSCAN algorithm), and each cluster represents a typical working mode (such as data processing state, idle state, backup state, etc.). Then, the spatial distance between the real-time latent representation and the center of each state cluster is calculated, and the local density (the density of the surrounding sample points) and the distribution characteristics of the adjacent samples (such as the category distribution of the nearest neighbor samples) are analyzed. Based on these features, the most matched inferred workflow state is assigned to the current terminal. For example, the current latent representation of a medical image terminal is closest to the "high-load image processing" state cluster, and it is identified as this workflow state. Then, the error distribution model corresponding to this state is found from the pre-established multi-dimensional error statistical model library, the current reconstruction error is compared with the model, and the statistical significance (such as z-score) and unexpectedness (such as Mahalanobis distance) are calculated. Finally, the context-aware anomaly metric value is calculated by combining these indicators, which not only considers the absolute size of the reconstruction error, but also considers the normal error fluctuation range under the current workflow state, providing a more accurate anomaly evaluation.

[0061] S106. Analyze the time evolution characteristics of the abnormal metric value, and compare the time evolution characteristics with the preset abnormal pattern criterion to determine whether the platform terminal has a workflow mode abnormality. If the platform terminal has a workflow mode abnormality, a warning signal containing a description of the abnormal evolution characteristics of the platform terminal is generated.

[0062] The continuously calculated abnormal metric value is maintained as a sequence within a fixed time window (such as the last 30 minutes), and the time evolution characteristics thereof are analyzed. Three types of dynamic evolution indicators are specifically calculated: a trend slope (an upward or downward trend of the abnormal metric value is calculated using linear regression), a fluctuation amplitude change rate (a rate of expansion or contraction of the fluctuation range of the abnormal metric value is calculated), and an autocorrelation change (periodicity and persistence of the abnormal metric value sequence are analyzed). According to the current inferred workflow state, a corresponding template is selected from a pre-defined normal evolution pattern template library, and these templates define the normal fluctuation range and dynamic characteristics of the abnormal metric value under different workflow states. For example, for the "database backup" state, the normal template can exhibit a mode in which the abnormal metric value first rapidly rises and then slowly falls. The calculated dynamic evolution indicators are compared with the template, and a comprehensive deviation degree is calculated. When the deviation degree exceeds a preset threshold (such as a 95% confidence interval), it is determined that the terminal has a workflow mode abnormality, and a warning signal containing a description of the abnormal evolution characteristics (such as "abnormal metric value continuously rising and fluctuation amplitude abnormally expanding") is generated for further analysis and processing by the operation and maintenance personnel.

[0063] In one embodiment, the pre-processing and fusion processing of the multi-modal historical operation and maintenance data to construct a historical time sequence feature vector sequence reflecting the historical normal dynamic behavior of the platform terminal includes the following steps:

[0064] The multi-modal historical operation and maintenance data is time-aligned and data-parsed within a unified sampling time interval, and key information fields of the multi-modal historical operation and maintenance data are parsed;

[0065] Derivative correlation features representing the instantaneous interaction relationship between different modal data are calculated and extracted;

[0066] The key information fields and the derivative correlation features are encoded and fused into a single high-dimensional feature vector, and the high-dimensional feature vector is arranged in chronological order to form a historical time sequence feature vector sequence.

[0067] In this embodiment, the terminal operation and maintenance data of the medical big data platform has various sources and different collection frequencies, and therefore needs to be first time-aligned. In specific implementation, a uniform sampling time interval (e.g., 5 minutes) is selected, and all data is resampled to this time scale. For example, CPU usage rate can be collected every 1 minute, while log data can be generated irregularly, and they are unified to the same time axis through time alignment. For high-frequency data, an average value or a maximum value or the like is used for downsampling; for low-frequency data, linear interpolation or the like is used for interpolation. After time alignment, data analysis is performed, and raw data in different formats is converted into structured information. For example, for system performance indicators, numerical values and their units are extracted; for log texts, regular expressions or natural language processing techniques are used to extract error types, severity, affected components and other key information fields; for network traffic data, source addresses, target addresses, transmission protocols and other fields are parsed. This step ensures the consistency of data from different sources in the time dimension, and converts unstructured or semi-structured data into a structured form that can be quantitatively analyzed, laying a foundation for subsequent feature extraction.

[0068] After obtaining the key information fields, the interaction between different modal data needs to be further mined to generate derivative correlation features. These features can capture the overall system state that cannot be reflected by single modal data. In specific implementation, first, basic statistical correlation features are calculated, such as the ratio of CPU usage rate to memory occupancy rate, reflecting the balance of computing resources; the correlation coefficient of network traffic and database query times, reflecting the coordination of data transmission and processing. Second, time window features are constructed, such as calculating the lag correlation between disk I / O and CPU usage rate in the past 30 minutes, capturing the causal relationship of resource usage. Third, mode conversion features are extracted, such as detecting the conversion mode from low network traffic to high CPU usage, which may indicate the processing stage after data download. Compound indicators can also be calculated, such as the "resource pressure index" (a weighted average of CPU, memory, and disk I / O). For business logic specific to medical platforms, features such as "image processing efficiency" (the ratio of the number of processed images to resource consumption) can be defined. These derivative correlation features greatly enrich the expression ability of data, enabling the system to understand the complex working state of the terminal and the mutual influence between modalities, providing a more comprehensive perspective for anomaly detection.

[0069] The key information fields and derived correlation features obtained in the previous two steps are encoded and fused to construct a unified feature representation. For numerical features (such as CPU usage, memory occupancy, etc.), standardization processing is performed to map them to the [0, 1] interval or standard normal distribution, eliminating dimensional differences. For categorical features (such as error types, component names, etc.), one-hot encoding or embedding encoding is used to convert them into numerical vectors. For text features (such as log messages), TF-IDF or word embedding techniques are used to convert them into fixed-dimensional vectors. All encoded features are concatenated in a predefined order to form a single high-dimensional feature vector (such as 300 dimensions). For example, the feature vector of a medical image processing terminal at a certain time point may include: the first 100 dimensions for system performance indicators, the middle 100 dimensions for log text features, and the last 100 dimensions for derived correlation features. The high-dimensional feature vectors at different time points are arranged in chronological order to form a sequence of historical time series feature vectors, such as {V1, V2,..., V n}, where each Vi represents a complete feature vector at a time point. This unified time series feature representation preserves the temporal evolution characteristics of the original data, while integrating multi-modal information, providing a structured input for subsequent deep sequence learning models, enabling the model to learn complex dynamic behavior patterns under normal operating conditions of the terminal.

[0070] In one embodiment, training the pre-set deep sequence learning model using the sequence of historical time series feature vectors includes the following steps:

[0071] Mapping the sequence of historical time series feature vectors to a latent representation space using an encoder in the pre-set deep sequence learning model;

[0072] Training the deep sequence learning model to perform multi-task learning, including at least: reconstructing the original input sequence based on a decoder in the deep sequence learning model and according to the latent context representation in the latent representation space to minimize the model reconstruction error; predicting the time series feature vector at the next time step based on the latent context representation to minimize the model prediction error;

[0073] After training the deep sequence learning model to complete multi-task learning, the encoder is retained for real-time extraction of the latent context representation, and the reconstruction task part is retained as a baseline model.

[0074] In this implementation, the encoder portion of the deep sequence learning model is responsible for compressing and mapping the high-dimensional historical time-series feature vector sequence to a low-dimensional latent representation space, achieving dimensionality reduction and key information extraction. Specifically, a Bidirectional Long Short-Term Memory (BiLSTM) network or a Transformer encoder architecture is employed, as these architectures effectively capture long-term dependencies and contextual information in the sequence data. Taking BiLSTM as an example, the input layer receives a historical time-series feature vector sequence {X1, X2, ..., X...} with dimension d. n}, where each X i It is a d-dimensional vector (e.g., d = 300). The BiLSTM layer contains two LSTM units, one forward and one backward, processing data from the beginning to the end of the sequence and from the end to the beginning, respectively. Each LSTM unit in each direction contains h hidden neurons (e.g., h = 128). The outputs of the two directions are concatenated at each time step to form a 2h-dimensional hidden state. Subsequently, a fully connected layer maps the 2h-dimensional hidden state to a k-dimensional latent representation space (e.g., k = 50), resulting in the sequence {Z1, Z2, ..., Z...}. n}, where each Z i It is a k-dimensional vector representing the latent context representation at time point i. This mapping significantly reduces the data dimensionality (from 300 to 50) while preserving key temporal patterns and state information in the original sequence, providing a compact and information-rich representation for subsequent tasks.

[0075] Deep sequence learning models simultaneously perform two key tasks—reconstruction and prediction—through a multi-task learning framework, enabling the model to comprehensively understand the intrinsic structure and temporal evolution of data. In the reconstruction task, the decoder receives the latent context representation sequence {Z1, Z2, ..., Z...} output by the encoder. n}, attempt to reconstruct the original input sequence {X1,X2,...,X}. n The decoder employs a structure symmetrical to the encoder, such as an LSTM layer followed by a fully connected layer, mapping the k-dimensional latent representation back to the d-dimensional original feature space to obtain the reconstructed sequence {X1,X2,...,X}. n The reconstruction loss function uses mean squared error (MSE), and the calculation formula is L_recon=(1 / n)∑ i ||X i -X i || 2 Meanwhile, in the prediction task, another prediction network (usually an LSTM or feedforward network) receives the latent representation Z at time point t. t Predict the feature vector X at the next time point t+1. t+1 The prediction loss function also uses MSE, and the calculation formula is L_pred=(1 / n-1)∑ i ||Xi+1 - X i+1 || 2 The final total loss function is a weighted sum of two parts: L_total = aL_recon + bL_pred, where a and b are weight hyperparameters (e.g., a = 0.7, b = 0.3). The model is trained using the Adam optimizer with a learning rate of 0.001, a batch size of 64, and 100 training epochs.

[0076] After the deep sequence learning model completes the multi-task learning training, the model structure is decomposed into two key components for the real-time anomaly detection system. First, the trained encoder part is retained, which has learned how to effectively compress high-dimensional raw feature vectors into low-dimensional latent context representations. In the real-time running phase, the encoder receives the real-time feature vector sequence {X_t-w+1, X_t-w+2,..., X_t} within the current time window (where w is the window size, e.g., w = 10), and outputs the corresponding latent context representation sequence {Z_t-w+1, Z_t-w+2,..., Z_t}. These latent representations capture the essential features of the current system state and contain temporal context information. At the same time, the network components related to the reconstruction task (i.e., the decoder part) are retained as a baseline model to evaluate the deviation of the current system state from the normal mode. Specifically, the baseline model receives the latent representation Z_t output by the encoder, attempts to reconstruct the original feature vector X_t, and calculates the reconstruction error e_t = ||X_t - X_t||. This decomposition design makes the anomaly detection system have an efficient modular structure: the encoder is responsible for feature extraction and dimension reduction, providing a compact state representation; the baseline model is responsible for anomaly evaluation, quantifying the degree of abnormality of system behavior through reconstruction error. These two components together constitute the core engine of anomaly detection, which can monitor the system state in real time and identify potential anomalies.

[0077] In one embodiment, the step of identifying the current inference workflow state of the platform terminal based on the latent context representation comprises the following steps:

[0078] Performing clustering analysis on the latent context representation in the latent representation space, and defining discrete inference workflow state clusters according to the clustering analysis results;

[0079] Calculating the spatial distance between the latent context representation of the real-time time series feature vector sequence and the center of each inference workflow state cluster;

[0080] Statistically analyzing the local density and neighboring sample distribution characteristics of the latent context representation of the real-time time series feature vector sequence in the latent representation space;

[0081] Assigning the current target inference workflow state of the platform terminal based on the spatial distance, local density, and neighboring sample distribution characteristics.

[0082] In this embodiment, a large number of latent context representation samples are extracted from historical normal operation data using the trained encoder, which form a point cloud in a k-dimensional latent representation space (e.g., k = 50). A Gaussian Mixture Model (GMM) clustering algorithm is applied to these point cloud data, which assumes that the data is generated by a mixture of multiple Gaussian distributions and can capture the probability distribution characteristics of different working states. In implementation, the optimal clustering number m (e.g., m = 8) is first determined by Bayesian Information Criterion (BIC) or silhouette coefficient, representing the number of possible main workflow states of the medical platform terminal. Subsequently, the GMM algorithm estimates the parameters of each Gaussian distribution, including the mean vector μ i (representing the i-th cluster center), the covariance matrix Σ i (representing the shape and direction of the cluster), and the mixing weight π i (representing the prior probability of the cluster). Each cluster represents a specific workflow state, such as "image data processing", "patient information query", "system idle", etc. For ease of understanding and interpretation, the k-dimensional clustering results can be visualized as two-dimensional or three-dimensional graphics through dimensionality reduction techniques such as t-SNE or PCA, and combined with domain knowledge to assign semantic labels to each cluster. This clustering analysis divides the continuous latent representation space into a finite number of discrete workflow state clusters, providing a structured reference framework for subsequent state inference and anomaly detection, enabling the system to understand the working state of the terminal at different times.

[0083] In the real-time monitoring phase, the system continuously receives the time series feature vector sequence of the terminal and maps it to the latent representation space through the pre-trained encoder to obtain the current latent context representation Z_current. To determine the relationship between Z_current and each predefined workflow state cluster, the spatial distance between Z_current and each cluster center needs to be calculated. Considering the non-uniformity of the latent representation space and the shape difference of each cluster, the Mahalanobis distance is used as the distance measure, which takes into account the covariance structure of the data. For the i-th cluster, the Mahalanobis distance calculation formula is: d_i = √[(Z_current - μ_i)^T Σ_i^(-1) (Z_current - μ_i)], where μ_i is the center vector of the i-th cluster and Σ_i is its covariance matrix.

[0084] For example, suppose a medical terminal is currently processing a large amount of image data, its latent context representation Z_current might have a Mahalanobis distance of 1.2 to the "image processing" cluster center and 5.7 to the "patient information query" cluster center. The system will compute the distances of Z_current to all m cluster centers, forming a distance vector D = [d_1, d_2,..., d_m]. These distance values not only reflect the similarity of the current state to each typical workflow state, but also provide important evidence for subsequent state assignment. The distance computation results can be converted to similarity scores, such as through a Gaussian kernel function s_i = exp(-d_i^2 / 2σ^2), where σ is a bandwidth parameter controlling the rate of similarity decay with distance. This distance-based similarity quantifies the matching degree of the current state to each workflow mode, providing a primary reference indicator for workflow state inference.

[0085] In addition to computing distances to cluster centers, it is also necessary to analyze the local properties of the current latent context representation Z_current in the latent representation space, which helps to assess whether it belongs to a normal workflow mode or is a potential outlier. First, the local density ρ of Z_current is computed, representing the sample density level in its surrounding area. The local density can be obtained through kernel density estimation: ρ = (1 / n)∑_iK((Z_current-Z_i) / h), where Z_i is a sample point in the historical sample set, K is a kernel function (such as Gaussian kernel), h is a bandwidth parameter, and n is the total number of samples. High local density indicates that the current state is located in a high-frequency region of historical data, possibly representing a common workflow mode; low local density may imply an abnormal or rare state.

[0086] Secondly, the distribution characteristics of the k-nearest neighbor samples (such as k = 20) of Z_current are analyzed, including: (1) the cluster label distribution of the nearest neighbor samples, calculating the occurrence frequency of each cluster label to form a probability vector P = [p_1, p_2,..., p_m], where p_i represents the proportion of the i-th cluster label in the neighbors; (2) the temporal distribution of the nearest neighbor samples, checking whether these samples come from different time periods or concentrate in a specific period; (3) the spatial dispersion of the nearest neighbor samples, quantified by computing the average distance or variance of the nearest neighbor samples. This local property analysis provides more fine-grained context information for workflow state inference, enabling the system to understand the position and meaning of the current state in the overall workflow mode.

[0087] Based on the multi-dimensional information obtained from the previous three steps, a comprehensive decision mechanism is adopted to assign the most suitable workflow state to the terminal. First, a state assignment score function is constructed, which takes into account three key factors: Mahalanobis distance D = [d_1, d_2, …, d_m] from the cluster center, local density ρ, and the distribution of cluster labels P = [p_1, p_2, …, p_m] of the nearest neighbors. For the i-th cluster, the state assignment score is calculated as: Score_i = w_1·exp(-d_i^2 / σ_1^2) + w_2·ρ·p_i + w_3·(1-H(P))·p_i, where w_1, w_2, w_3 are weight parameters, σ_1 is the distance normalization parameter, H(P) is the entropy of the label distribution, which quantifies the uncertainty of the distribution.

[0088] The first term of this score function prefers states with a short distance from the cluster center, the second term prefers states with high local density and a large proportion in the nearest neighbors, and the third term gives an additional reward when the label distribution of the nearest neighbors is concentrated. After calculating the scores of all clusters, two assignment strategies can be adopted: hard assignment, which assigns the terminal to the workflow state with the highest score; soft assignment, which calculates the normalized probability distribution of each state, representing the possibility of the terminal being in multiple workflow states simultaneously. The confidence of state assignment is also calculated, such as the difference between the score and the second highest score or the entropy of the score. Assignments with low confidence are marked as "transition states" or "mixed states", which are very important for understanding the workflow transition process of the terminal. This comprehensive decision mechanism not only considers the similarity between the current state and the typical workflow pattern, but also takes into account the local data distribution characteristics, which can accurately identify the working state of the terminal, even in the transition period of workflow transition or complex scenarios with multiple task parallelism, and give reasonable state inference, providing reliable context information for subsequent anomaly detection and performance optimization.

[0089] In one embodiment, the combination of the inferred workflow state and the reconstruction error calculation to obtain the context-aware anomaly metric value includes the following steps:

[0090] For each inferred workflow state, based on the reconstruction error of the samples belonging to the corresponding sample of the inferred workflow state in the historical time series feature vector sequence, a multi-dimensional error statistical model under the inferred workflow state is calculated and stored;

[0091] According to the currently assigned target inferred workflow state, the corresponding target multi-dimensional error statistical model is searched;

[0092] The reconstruction error of the real-time time series feature vector sequence is compared with the target multi-dimensional error statistical model, and the statistical significance and unexpectedness under the target inferred workflow state are calculated, and the context-aware anomaly metric value is calculated by combining the statistical significance and unexpectedness.

[0093] In this embodiment, for each identified workflow state cluster (e.g. "imaging", "patient information query", etc.), a dedicated error statistical model needs to be constructed to characterize the reconstruction error distribution under normal operation of this state. First, all sample points belonging to the specific workflow state are filtered out from the historical data, which are identified by the aforementioned cluster analysis labels. For workflow state i, collect all its corresponding historical samples {X1 i ,X2 i ,...,X n i}, input these samples into the pre-trained autoencoder to get the reconstruction results {X1 i ,X2 i ,...,X n i}. Compute the reconstruction error vector e j i = X j i - X j i for each sample, where the dimension of each error vector is the same as the original feature vector.

[0094] Considering the importance and variability of different feature dimensions, a multi-dimensional Gaussian distribution is adopted to model the error distribution, rather than simply using a scalar error. For workflow state i, compute the mean vector μ i = (1 / n)∑ j e j i and the covariance matrix Σ i = (1 / n)∑ j (e j i - μ i )(e j i - μ i ) T for all error vectors. This pair of parameters (μ i , Σ i ) constitutes the multi-dimensional error statistical model for this workflow state, capturing the correlation and variability patterns among different feature dimensions.

[0095] To handle the computational challenge that might be brought by high-dimensional data, the error vectors can be reduced to a lower dimension by principal component analysis (PCA), preserving the main variability information while reducing the computational complexity. Furthermore, to enhance the robustness of the model against outliers, a pruning strategy can be adopted to remove the 5% samples with the largest reconstruction errors for each workflow state before computing the statistical model. Finally, for each workflow state i, construct and store its error statistical model (μ i , Σ iThese models will serve as benchmarks for subsequent anomaly detection.

[0096] Once the real-time monitoring system assigns a target inference workflow state to the terminal, it needs to immediately invoke the error statistics model matching that state to perform context-dependent anomaly detection. Specifically, it first retrieves the terminal's current workflow state identifier i (e.g., i=2, corresponding to the "Patient Data Analysis" state) from the previous step. The system then retrieves the corresponding multidimensional error statistics model parameters (μ) from a pre-built model library. i ,Σ i ), where μ i It is a d-dimensional mean vector, Σ i It is a d×d dimension covariance matrix (or a low-dimensional representation after PCA dimensionality reduction).

[0097] Considering that a terminal may be in a transitional zone between multiple workflow states or performing multiple tasks simultaneously, the system also supports a soft state allocation method. In this case, the terminal is assigned a state probability distribution P = [p1, p2, ..., p...]. m ], where p i This represents the probability that the terminal is in the i-th workflow state. Accordingly, the system retrieves multiple relevant error statistics models and constructs a Gaussian mixture model based on the probability weights: μ mix =∑ i p i μ i , Σ mix =∑ i p i (Σ i +(μ i -μ mix (μ) i -μ mix ) T This hybrid model can more accurately represent the normal error distribution of the terminal under state transitions or multi-tasking scenarios. This dynamic model selection mechanism ensures the context relevance of anomaly detection, enabling the system to adjust the anomaly judgment criteria according to the current working state of the terminal, avoiding the high false alarm rate problem that may be caused by static thresholds.

[0098] After obtaining the target error statistical model, the system performs anomaly assessment on real-time monitoring data. First, the time series feature vector sequence X_current in the current time window is reconstructed by the pre-trained autoencoder to obtain the reconstructed sequence X_current, and the reconstruction error vector e_current=X_current-X_current is calculated. To comprehensively assess the degree of anomaly, two complementary dimensions are analyzed: statistical significance and unexpectedness. Statistical significance measures the degree to which the current observation deviates from the normal pattern, which is achieved by calculating the Mahalanobis distance of the reconstruction error vector under the target multi-dimensional Gaussian distribution: MD=√[(e_current-μ_target)^TΣ_target^(-1)(e_current-μ_target)], where μ_target and Σ_target are the parameters of the target error statistical model. The Mahalanobis distance considers the variability and correlation of different dimensions, providing a unified measure for multi-dimensional anomalies. For high-dimensional data, the Mahalanobis distance can be converted into a p-value, representing the probability of observing the current or more extreme error: p=1-CDF(χ 2 _d,MD 2 ), where χ 2 _d is the chi-square distribution with degree of freedom d, and CDF is its cumulative distribution function. A smaller p-value (such as p<0.01) indicates a highly statistically significant anomaly.

[0099] Unexpectedness assesses the novelty of the current error pattern, which is quantified by comparing the local density of the reconstruction error vector with historical error samples: S=-log(ρ_current / ρ_avg), where ρ_current is the local density of the current error vector, and ρ_avg is the average local density of historical errors under the target workflow state. High unexpectedness indicates that the current error pattern is rare in historical data, possibly representing a new type of anomaly.

[0100] Finally, the system combines these two indicators to calculate a context-aware anomaly metric value: A=w1·(-log(p))+w2·S, where w1 and w2 are weight parameters (such as w1=0.6, w2=0.4). When the anomaly metric value A exceeds a preset threshold (such as A>5), an anomaly alert is triggered, and detailed features of the anomaly are provided, including the most contributing feature dimension, the time pattern of the anomaly, and the similarity analysis with historical anomalies. This multi-dimensional anomaly assessment mechanism not only detects anomalies that significantly deviate from the normal pattern, but also identifies potential problems that are statistically insignificant but novel in pattern, significantly improving the accuracy and interpretability of anomaly detection. For example, the CPU usage rate of a certain medical terminal in the "image processing" state may be within the normal range, but the combination mode with memory usage is abnormal. The system can capture this multi-dimensional correlation anomaly, while traditional single-dimensional monitoring may be ignored.

[0101] In one embodiment, the time evolution of the abnormality metric value is analyzed, and the time evolution is compared with a preset abnormality pattern criterion to determine whether the platform terminal has a workflow mode abnormality.

[0102] The abnormality metric value is maintained as a sequence of continuous abnormality metric values within a time window.

[0103] A dynamic evolution index of the sequence of abnormality metric values is calculated, and the dynamic evolution index includes a trend slope, a fluctuation amplitude change rate, and an autocorrelation change.

[0104] A target evolution template corresponding to a target inferred workflow state is selected from a predefined normal evolution mode template library, and the evolution templates in the normal evolution mode template library represent normal fluctuation ranges and dynamic characteristics of the abnormality metric values in different states.

[0105] The dynamic evolution index is compared with the target evolution template, and a comprehensive deviation degree of the dynamic evolution index from the target evolution template is calculated.

[0106] When the comprehensive deviation degree exceeds a preset threshold, it is determined that the platform terminal has a workflow mode abnormality, and the comprehensive deviation degree and the target evolution template are used as abnormal evolution characteristic descriptions.

[0107] In this embodiment, the abnormality metric value sequence is maintained using a sliding time window mechanism, and the abnormality metric values A1, A2,..., A n At each time when a new abnormality metric value A n+1 is calculated, it is added to the end of the sequence, and the earliest value A1 is removed, so that the window size is kept constant. This sliding window design can capture both short-term fluctuations and long-term evolution trends of the abnormality. To ensure data quality, median filtering (window size of 3) is applied to the original abnormality metric value to eliminate transient noise, and minimum-maximum normalization processing is performed to map the abnormality metric value to the [0, 1] interval, facilitating comparison between different time periods and different terminals.

[0108] The sequence storage uses a ring buffer structure to ensure efficient and fixed memory usage, which is suitable for long-term running monitoring systems. For each terminal, a statistical summary of the abnormality metric value is additionally maintained, including the mean, standard deviation, maximum value, minimum value, and their occurrence time points within the sliding window, which facilitates quick access to key statistical characteristics without repeated calculation. To handle possible data missing (such as monitoring gaps caused by network interruption), linear interpolation is used to fill short-term missing values, and for long-term missing values exceeding a preset threshold (such as 5 consecutive points), they are marked as invalid intervals and excluded in subsequent analysis.

[0109] Furthermore, for anomaly patterns at different time scales, multiple time windows of varying lengths (e.g., 10 minutes, 2 hours, 24 hours) are maintained simultaneously, forming a multi-scale anomaly metric sequence set. This enables the system to simultaneously detect both rapidly emerging anomalies and slowly evolving anomaly patterns. For example, a medical image processing terminal may exhibit a resource usage pattern of morning peak, midday trough, and afternoon stability on a normal workday. By maintaining sufficiently long time windows, this periodic pattern can be distinguished from genuine anomalies.

[0110] Based on the maintained sequence of anomaly metrics, three key dynamic evolution indicators are calculated to comprehensively characterize the temporal evolution of anomalous behavior. First, the trend slope is calculated by analyzing the anomaly metric sequence {A1, A2, ..., A...} within the time window. n Applying linear regression yields: Where t i For time points, t and These are the mean values ​​of time and outlier measures, respectively. To enhance sensitivity to short-term trends, exponentially weighted regression is used, assigning higher weights to recent data: w_i = α(1-α)^(ni), where α = 0.1 is a smoothing factor. A positive slope indicates an increasing degree of anomaly, a negative slope indicates a decreasing degree of anomaly, and the absolute value of the slope reflects the rate of change.

[0111] The rate of change in volatility measures the change in the intensity of anomalous volatility and is obtained by calculating the relative change within the moving variance window. The time window is divided into k equal sub-windows, and the standard deviation σ1, σ2, ..., σ of the anomalous measures within each sub-window is calculated. k Then calculate the relative rate of change of the standard deviation of adjacent sub-windows: amp_change=(1 / k-1)∑ i＝1 k-1 |(σ i+1 -σ i ) / σ i This indicator can effectively capture the process of a system transitioning from a steady state to an unstable state, even if the average anomaly metric remains unchanged.

[0112] Autocorrelation variation is used to assess the periodicity and regularity of anomalous patterns by calculating the autocorrelation coefficient and its variation under different time delays. For a delay τ, the autocorrelation coefficient is calculated as follows: Select multiple key delays τ1,τ2,...,τ m (e.g., 5 minutes, 30 minutes, 1 hour), calculate the rate of change of the autocorrelation spectrum: acf_change=(1 / m)∑ j |ACF_current(τ j )-ACF_previous(τ j|, where ACF_current and ACF_previous are the autocorrelation coefficients of the current window and the previous window, respectively. The autocorrelation change can detect the rhythm change of abnormal patterns, such as a resource usage peak that originally occurs every hour suddenly becomes irregular. The three types of dynamic evolution indicators together form a multi-dimensional feature vector [slope, amp_change, acf_change] of abnormal behavior evolution, providing a comprehensive dynamic feature description for subsequent comparison with normal evolution templates.

[0113] The normal evolution pattern template library is a pre-constructed knowledge base that stores the normal dynamic behavior patterns of abnormal metric values under various workflow states. For each workflow state i, the template library contains a set of evolution templates T_i = {T_i1, T_i2,..., T_ik}, each template T_ij representing a typical normal evolution pattern under that state. Each evolution template consists of three parts: the normal range interval of dynamic evolution indicators, the typical time series pattern, and the context condition description.

[0114] The normal range interval of dynamic evolution indicators defines the expected range of variation of trend slope, fluctuation amplitude change rate, and autocorrelation change under normal circumstances, usually represented as [min_value, max_value] or mean ± standard deviation. For example, the normal trend slope range under the "image processing" state may be [-0.05, 0.08], indicating that the abnormal metric value may have a slight increase but not a sharp increase. The typical time series pattern captures the characteristic morphology of the abnormal metric value sequence in the time dimension, such as periodic fluctuations, gradual growth, or stable plateau, etc. These patterns can be represented by parameterized curves, Fourier coefficients, or wavelet transform coefficients. The context condition describes the specific scenario conditions that the template is applicable to, such as time period (working hours / non-working hours), system load level (high / medium / low), or external events (such as regular maintenance), etc. This allows the system to select the most matching template according to the current context.

[0115] After determining the target inferred workflow state i of the terminal, the system retrieves all template sets T_i corresponding to that state from the template library, and then filters out the most matching target evolution template T_target according to the current context conditions (such as time, load, etc.). If there are multiple matching templates, a weighted combined template can be constructed, with the weights determined based on the context matching degree. This dynamic template selection mechanism ensures the context adaptability of abnormal detection, and can adjust the expected range of normal behavior according to different scenarios.

[0116] The computed dynamic evolution indicators are compared with the selected target evolution template in multiple dimensions, quantifying their deviation degree. First, for the trend slope indicator, its standardized deviation from the template normal range is computed: d_slope = max(0, (slope - upper_bound) / range_width) or max(0, (lower_bound - slope) / range_width), where upper_bound and lower_bound are the normal upper and lower bounds of the slope in the template, and range_width is the range width. This standardization makes the deviation degrees of different indicators comparable, with a value of 0 indicating within the normal range, a positive value indicating deviation from the normal range, and a larger value indicating more severe deviation.

[0117] Similarly, the standardized deviations of the fluctuation amplitude change rate and autocorrelation change are computed as d_amp and d_acf. Considering that the importance of different dynamic indicators can vary with the workflow state, a state-dependent weight vector w = [w_slope, w_amp, w_acf] is introduced, e.g., for the "patient monitoring" state requiring stability, w = [0.3, 0.5, 0.2] can be set, giving more weight to the fluctuation amplitude change.

[0118] In addition to range deviation, the matching degree of the timing pattern also needs to be evaluated. The dynamic time warping (DTW) distance or Euclidean distance is computed between the current abnormality measure value sequence and the typical timing pattern in the template, obtaining the pattern deviation d_pattern. The DTW distance is particularly suitable for handling time series comparison, as it allows nonlinear alignment of sequences on the time axis and can tolerate slight stretching of patterns in time.

[0119] Finally, the comprehensive deviation degree is computed by weighted combination of the individual deviation indicators: deviation = w_slope · d_slope + w_amp · d_amp + w_acf · d_acf + w_pattern · d_pattern, where the weights reflect the relative importance of each indicator in the specific workflow state. To enhance interpretability, the contribution percentage of each indicator to the total deviation can also be computed, helping to quickly locate the main manifestation of the anomaly. For example, the comprehensive deviation of a certain medical terminal in the "data transmission" state is 2.7, of which 75% comes from the abnormal increase in fluctuation amplitude, indicating that the system resource usage has experienced an abnormal and severe fluctuation.

[0120] Based on the calculated comprehensive deviation degree, it is determined whether there is an abnormal workflow mode by comparing with a preset threshold value. The threshold value setting adopts an adaptive mechanism, which dynamically adjusts according to the workflow state, time period and historical deviation distribution. Specifically, for the workflow state i and the context condition c, the threshold value is calculated as: threshold(i,c) = base_threshold(i) x context_factor(c) x (1+adaptive_term), wherein base_threshold(i) is the basic threshold value of state i (such as 3.0), context_factor(c) is the context adjustment factor (such as 1.2 at night, which tolerates greater deviation), and adaptive_term is dynamically adjusted based on the percentile of the historical deviation distribution, such as the 95th percentile of the deviation degree of the same state at the same period in the past 30 days.

[0121] When the comprehensive deviation degree exceeds the threshold value, the system determines that the terminal has an abnormal workflow mode, and generates a detailed abnormal evolution feature description. The description content includes: (1) basic information of the abnormality, such as detection time, duration, belonging workflow state and comprehensive deviation degree; (2) main forms of the abnormality, such as "trend abnormal rise", "fluctuation amplitude increases dramatically" or "periodicity suddenly disappears", etc., and the specific deviation value and contribution proportion of each index are marked; (3) similarity analysis with historical abnormality, find out the most similar historical abnormal event and its processing method; (4) assessment of the possible influence range and severity of the abnormality, based on the workflow criticality and deviation degree comprehensive judgment.

[0122] In one embodiment, after the step of generating the early warning signal containing the platform terminal abnormal evolution feature description, the following steps are further included:

[0123] Integrating the abnormal evolution feature description and the current inferred workflow state of the platform terminal into a comprehensive abnormal feature;

[0124] Based on the reconstruction error analysis, the original feature dimension with the highest correlation degree to the comprehensive abnormal feature in the real-time time sequence feature vector sequence is analyzed;

[0125] Combining the comprehensive abnormal feature and the original feature dimension and using the pre-constructed platform correlation knowledge graph, a set of potential fault roots sorted by possibility are inferred and output.

[0126] In this embodiment, the integration of anomaly evolution feature description and inferred workflow state adopts a multi-level feature fusion mechanism to construct a comprehensive and integrated anomaly feature representation. First, the quantitative indicators (such as comprehensive deviation degree 2.7, trend slope deviation 1.5, fluctuation amplitude change rate deviation 0.8, autocorrelation change deviation 0.4) in the anomaly evolution feature description are separated from the qualitative description (such as "fluctuation amplitude increases sharply", "periodicity suddenly disappears") and extracted. The quantitative indicators are directly used as numerical components of the feature vector, while the qualitative description is converted into standardized feature labels and corresponding severity scores through a pre-defined semantic mapping table. For example, "fluctuation amplitude increases sharply" is mapped to feature label "amplitude_fluctuation" and severity score 0.85 (full score is 1).

[0127] At the same time, the state identifiers (such as "patient data processing", "image analysis" or "drug dispensing") and their associated context information, including the typical resource consumption pattern, criticality level (such as "high", "medium", "low") and expected duration of the state, are extracted from the inferred workflow state. The workflow state information is converted into a fixed-dimensional vector representation through a state embedding matrix, which is pre-learned through unsupervised learning on a large amount of normal workflow execution data, and can capture the semantic similarity between different workflow states.

[0128] Next, the anomaly evolution feature vector is connected with the workflow state embedding vector, and a comprehensive anomaly feature is generated through an attention fusion network. This network calculates the association weight between the anomaly feature and each dimension of the workflow state, highlighting the most critical anomaly feature under the current workflow state. For example, in the "real-time patient monitoring" workflow, the system stability related anomaly feature will get higher weight; while in the "batch data analysis" workflow, the resource efficiency related anomaly feature weight may be higher. The final generated comprehensive anomaly feature is a multi-dimensional vector, containing the type, severity, time characteristics, workflow context and their association scores of the anomaly. This structured representation not only retains the detailed features of the anomaly, but also integrates the workflow context information, providing rich and accurate input for subsequent root cause analysis. For example, for a medical image processing terminal, the comprehensive anomaly feature may indicate that in the "emergency CT scan processing" workflow state, the system has periodic abnormal fluctuations in resource utilization, and the anomaly is highly related to the image processing stage of the workflow.

[0129] Based on the comprehensive anomaly features, the original feature dimensions most relevant to the anomaly are accurately located by reconstruction error analysis technology. Specifically, the data subset of the abnormal period is extracted from the real-time time series feature vector sequence continuously collected by the monitoring system. These original feature vectors usually contain tens or even hundreds of dimensions, covering CPU usage, memory occupancy, network traffic, disk I / O, application-level indicators, and other aspects of system running status. To improve analysis efficiency, principal component analysis (PCA) is applied to the original feature vector for dimension reduction, retaining the principal components required to explain 90% of the variance. Usually, the dimension can be reduced to 20-30% of the original. Next, the pre-trained autoencoder model is used to reconstruct the dimension-reduced feature vector. The autoencoder consists of an encoder and a decoder. The encoder compresses the input features into latent representations, and the decoder attempts to reconstruct the original input from the latent representations. The autoencoder trained on normal running data can accurately reconstruct the normal mode, but the reconstruction effect of the abnormal mode is poor. The reconstruction error of each time point feature vector is calculated: error(t) = ||X(t)-X'(t)||2, where X(t) is the original feature vector and X'(t) is the reconstructed feature vector.

[0130] To determine the original dimensions most relevant to the comprehensive anomaly features, the distribution of reconstruction error on each original feature dimension is calculated. For each original feature dimension i, the reconstruction error contribution is calculated: contrib(i) = |X_i(t)-X'_i(t)| / sum_j|X_j(t)-X'_j(t)|. The dimensions with high reconstruction error contribution are usually closely related to the abnormal phenomenon. Further, the cross-correlation coefficient of the reconstruction error time series and the time series of each abnormal indicator in the comprehensive anomaly features is calculated, and the feature dimensions showing significant correlation before and after the anomaly occurs are identified. Finally, based on the reconstruction error contribution and cross-correlation analysis, the top K original feature dimensions (such as K=5) with the highest correlation are selected as potential root cause indicators.

[0131] Based on the comprehensive abnormal features and the identified key original feature dimensions, a list of potential fault root causes is generated through multi-path reasoning on the platform correlation knowledge graph. The platform correlation knowledge graph is a pre-constructed structured knowledge base that contains complex dependency relationships and impact paths between system components, services, resources, and configuration items. The nodes in the knowledge graph represent system entities (such as database servers, network switches, application services, etc.), and the edges represent relationships between entities (such as "depends on", "influences", "contains", etc.), and the edge weights reflect the relationship strength. The knowledge graph is constructed through three ways: expert knowledge encoding, historical fault case learning, and system topology automatic discovery. Root cause inference first locates the node set S corresponding to the key original feature dimensions in the knowledge graph. For example, if "database connection pool usage rate" is identified as a key feature, the "database connection pool" node in the knowledge graph is located. From these nodes, a bidirectional graph traversal algorithm is executed to trace possible fault sources upwards and explore possible impact ranges downwards. During the traversal process, the edge weights are dynamically adjusted according to the comprehensive abnormal features, so that the paths that match the current abnormal feature pattern obtain higher weights. For example, if the abnormality is "periodic delay increase", the path weights related to timed tasks, cache expiration, etc. will be increased.

[0132] For each potential root cause node r identified in the traversal process, its likelihood score is calculated: score(r) = base_prob(r) x path_strength(r, S) x feature_match(r), where base_prob(r) is the base fault probability of node r (based on historical statistics), path_strength(r, S) is the path strength of node r to the feature node set S, and feature_match(r) is the matching degree of the features of node r to the current comprehensive abnormal features. Finally, the list of potential fault root causes is output in descending order of likelihood score, and each root cause item contains: root cause description, likelihood score, impact path explanation, suggested verification steps, and repair scheme. For example, for the abnormality of a medical image processing terminal, the system may output: "1. Database connection pool configuration is improper (likelihood: 0.87) - connection maximum survival time is too short, causing periodic connection reconstruction, suggest checking the connection pool maxLifetime parameter; 2. Network bandwidth limitation (likelihood: 0.65) - large image transmission triggers bandwidth upper limit, suggest checking network QoS configuration; 3. Storage I / O bottleneck (likelihood: 0.42) - image data writing competes with other applications for I / O resources, suggest checking storage performance monitoring". This structured root cause analysis result greatly shortens the fault diagnosis time and improves the repair efficiency, especially suitable for fault rapid positioning and solving in complex medical platform environments.

[0133] In one embodiment, the method of combining the abnormal feature dimensions and the original feature dimensions and inferring and outputting a set of potential fault sources ranked by likelihood using a pre-built platform correlation knowledge graph comprises the following steps:

[0134] combining the abnormal feature dimensions and the original feature dimensions as query conditions;

[0135] retrieving the target nodes and target paths with the highest correlation to the query conditions in the pre-built platform correlation knowledge graph, the target nodes including terminal components, terminal service ports or terminal resource ports, and the target paths representing the dependency or influence relationships between the target nodes;

[0136] taking the target nodes as potential fault sources and calculating the correlation scores of each potential fault source according to the target paths, and ranking the potential fault sources by the correlation scores.

[0137] In this embodiment, the process of converting the abnormal feature dimensions and the original feature dimensions into structured query conditions uses feature vectorization and semantic enhancement techniques. First, the abnormal feature dimensions usually contain information of multiple dimensions, such as abnormal type (e.g. "response delay", "resource exhaustion"), severity (e.g. 0.85 out of 1), time characteristics (e.g. "periodic", "persistent", "sudden") and context information (e.g. "occurring in the data processing stage"). These abnormal feature dimensions are encoded into a multi-dimensional vector, where each dimension represents a characteristic. For example, the abnormal type is represented by one-hot encoding, the severity is directly represented by a numerical value, and the time characteristics are encoded by pre-defined categories. Key information is extracted from the original feature dimensions, including feature names (e.g. "CPU usage", "memory allocation failure times"), abnormal values (e.g. "95%", "growth rate 200%"), abnormal duration (e.g. "lasts for 30 minutes") and the like. These original feature information is also converted into structured vector representation. To enhance the semantic understanding ability of the query, domain ontology mapping is applied to the feature names, and different expressions but similar semantics of the features are unified to standard terms. For example, "memory shortage" and "memory exhaustion" are both mapped to the "memory_exhaustion" standard term.

[0138] Next, the integrated abnormal feature vector and the original feature vector are connected to form a unified query vector. To improve query efficiency, principal component analysis is applied to the query vector for dimension reduction, retaining the principal components required to explain 90% of the variance. At the same time, to handle the correlation between features, a feature correlation matrix is calculated, highly correlated feature groups are identified, and their weights are adjusted appropriately in the query to avoid certain types of related features from excessively influencing the query results. The final query condition is a structured multi-dimensional vector that contains the core features of the anomaly and the key original indicators, and has undergone dimension reduction and weight adjustment processing. For example, for an abnormality in a medical image processing terminal, the final query condition may include: "response delay (0.9)", "periodicity (0.8)", "memory usage peak (95%)", "database connection pool depletion (frequency: every 5 minutes)", etc. key information, laying the foundation for subsequent precise retrieval in the knowledge graph.

[0139] Based on the constructed query condition, multi-modal semantic retrieval is performed in the platform-associated knowledge graph to identify the most relevant target nodes and paths. The platform-associated knowledge graph is a complex multi-level network structure, containing four types of core elements: nodes (representing system components, services, resources, etc. entities), edges (representing the dependency or influence relationship between entities), attributes (describing the characteristics of nodes and edges), and semantic labels (providing additional domain knowledge). The knowledge graph is constructed and continuously updated through three ways: system topology automatic discovery, historical fault case learning, and expert knowledge coding. The retrieval process first uses a vector similarity matching algorithm to calculate the cosine similarity between the query vector and the feature vector of each node in the knowledge graph. The feature vector of each node contains its historical behavior pattern, associated abnormal features, resource consumption characteristics, etc. The similarity calculation considers the importance weight of the features, giving higher weight to the key abnormal features. For example, if "memory usage peak" is identified as a high importance feature in the query condition, this dimension will get a higher weight in the similarity calculation.

[0140] Next, a bidirectional graph traversal algorithm is performed from the top K nodes with the highest similarity (e.g., K = 10). The possible source nodes of influence are traced upwards (e.g., dependent services, shared resources), and the nodes that can be affected are explored downwards (e.g., services that depend on the current component). During the traversal, heuristic pruning strategies are applied to preferentially explore paths with high semantic relevance to the query conditions and limit the maximum traversal depth (typically 3-5 layers) to control the computational complexity. For each path in the traversal, a path relevance score is calculated: path_score = Σ(node_similarity x edge_weight x decay_factor^depth), where node_similarity is the similarity of the node to the query, edge_weight is the weight of the edge (reflecting the strength of the relationship), decay_factor is a depth decay factor (typically 0.7-0.9), and depth is the path depth.

[0141] Finally, the top M paths with the highest relevance scores (e.g., M = 20) are selected as target paths, and the set of nodes connected by these paths forms the target node set. For example, for a periodic response delay anomaly in a medical data processing terminal, the search may identify a highly relevant path "database connection pool" -> "database service" -> "storage system" and target nodes such as "database connection pool," "database service," "storage system," and "network switch." These target nodes and paths provide a clear scope and direction for subsequent root cause analysis, greatly reducing the search space for fault localization.

[0142] Based on the retrieved target nodes and target paths, a multi-dimensional scoring model is used to calculate the relevance score of each target node as a potential root cause of the fault and generate a ranking result. The scoring model considers four key dimensions: the direct relevance of the node to the query conditions, the topological importance of the node in the target path, the historical fault probability of the node, and the temporal correlation between the node state and the current anomaly. The direct relevance of the node is calculated, which is the semantic matching degree between the node features and the query conditions. The weighted cosine similarity method is used, giving higher weights to key features in the query conditions (such as specific anomaly patterns or resource indicators). For example, if the query condition emphasizes "periodic memory usage peaks," the relevance of similar patterns in the node's historical behavior will be higher. Next, the topological importance of the node in the target path is evaluated. The centrality indicators of the node are calculated, including degree centrality (the number of connected edges), betweenness centrality (the frequency of the node in the shortest path), and eigenvector centrality (a recursive definition considering the importance of neighbor nodes). Nodes with high topological importance are usually common dependency points for multiple components, and the impact of faults is wide.

[0143] The historical failure probability of the nodes needs to be calculated. Based on the historical failure records, the failure frequency and conditional probability of the nodes in similar scenarios can be calculated. For example, if the "database connection pool" has failed multiple times in the past "high concurrency access" scenario, its failure probability assessment will be higher in the current similar scenario. Finally, the time sequence correlation between the node state and the current anomaly needs to be analyzed. The cross-correlation function of the time series of the node monitoring indicators and the time series of the anomaly occurrence is calculated to identify nodes that show significant changes before the anomaly occurs. Nodes with strong time sequence correlation are more likely to be the root cause rather than the symptom. Finally, the correlation score of each target node is calculated by integrating the above four dimensions. Then, the potential failure root causes are sorted in descending order according to the correlation score, and an explanatory description is generated for each root cause, including: root cause name, correlation score, key impact path, anomaly feature matching point, and suggested verification and repair steps. For example, the sorting result may show: "1. Database connection pool misconfiguration (score: 0.89) - short connection maximum lifetime causes periodic connection reconstruction, suggest checking maxLifetime parameter; 2. Storage I / O bottleneck (score: 0.76) - large file operations conflict with database writes, suggest checking storage performance monitoring; 3. Network bandwidth limitation (score: 0.65) - data transfer peak triggers throttling, suggest checking network QoS configuration". This structured root cause analysis result intuitively presents the failure probability ranking, helping technical personnel quickly locate the problem core and improve fault resolution efficiency.

[0144] The application further discloses a terminal operation and maintenance management platform for a medical big data platform, which comprises a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the terminal operation and maintenance management method for the medical big data platform as described in the first aspect when executing the computer program.

[0145] The processor can be a central processing unit (CPU), of course, according to actual use, other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), ready-to-program gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. can also be used, and the general-purpose processor can be a microprocessor or any conventional processor, etc. The present application does not limit this.

[0146] The memory can be an internal storage unit of the computer device, for example, a hard disk or a memory of the computer device, or an external storage device of the computer device, for example, a plug-in hard disk, a smart memory card (SMC), a secure digital card (SD), or a flash card (FC) equipped on the computer device, or a combination of the internal storage unit and the external storage device of the computer device. The memory is used to store a computer program and other programs and data required by the computer device, and can also be used to temporarily store data that has been output or will be output, which is not limited in the application.

[0147] The application further discloses a computer readable storage medium, which stores instructions, and the instructions enable a processor to be configured to perform the terminal operation and maintenance management method for a medical big data platform described in any of the embodiments when the instructions are executed by the processor.

[0148] The computer program can be stored in a machine readable medium, and the computer program includes computer program code, which can be in the form of source code, object code, an executable file or some intermediate form, etc. The machine readable medium includes any entity or device, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. that can carry the computer program code. It should be noted that the machine readable medium includes but is not limited to the above-mentioned elements.

[0149] The computer readable storage medium is used to store the power transmission line comprehensive fault detection method in the above embodiments, and the method is loaded and executed on the processor to facilitate storage and application of the method.

[0150] Those skilled in the art should understand that the above discussion of any of the embodiments is only exemplary, and is not intended to limit the protection scope of the application to these examples; the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of one or more embodiments of the application as described above. In order to be brief, they are not provided in details.

[0151] One or more embodiments of the application are intended to cover all such alternatives, modifications and variations falling within the broad scope of the application. Therefore, any omission, modification, equivalent replacement, improvement, etc. made in the spirit and principle of one or more embodiments of the application should be included in the protection scope of the application.

Claims

1. A terminal operation and maintenance management method for a medical big data platform, characterized in that, Comprising the following steps: Collecting multi-modal historical operation and maintenance data of the platform terminal in a normal working flow mode; Time aligning and data parsing processing the multi-modal historical operation and maintenance data in a unified sampling time interval, and obtaining key information fields of the multi-modal historical operation and maintenance data by parsing; Calculating and extracting derived correlation features representing the instant interaction relationship between different modal data; Fusing the key information fields and the derived correlation features into a single high-dimensional feature vector after encoding processing, and arranging the high-dimensional feature vector in time sequence to form a historical time sequence feature vector sequence; Mapping the historical time sequence feature vector sequence to a latent representation space by using an encoder in a preset deep sequence learning model; Training the deep sequence learning model to perform multi-task learning, and the learning tasks at least include: reconstructing the original input sequence based on a decoder in the deep sequence learning model and according to a latent context representation in the latent representation space to minimize the model reconstruction error; and predicting the time sequence feature vector at the next time step based on the latent context representation to minimize the model prediction error; After the multi-task learning of the deep sequence learning model is completed, retaining the encoder for real-time extraction of the latent context representation, and retaining the reconstruction task part as a baseline model; According to the real-time operation and maintenance data of the platform terminal currently acquired, constructing a real-time time sequence feature vector sequence, extracting the latent context representation of the real-time time sequence feature vector sequence by using the trained deep sequence learning model, and calculating the reconstruction error of the real-time time sequence feature vector sequence by using the baseline model; Identifying the inferred working flow state of the platform terminal currently based on the latent context representation, and calculating the context-aware abnormality metric value combining the inferred working flow state and the reconstruction error; Analyzing the time evolution characteristics of the abnormality metric value, and comparing the time evolution characteristics with a preset abnormality pattern criterion to determine whether the platform terminal has a working flow mode abnormality, and if the platform terminal has a working flow mode abnormality, generating an early warning signal containing an abnormal evolution characteristic description of the platform terminal. 2.The terminal operation and maintenance management method for a medical big data platform according to claim 1, characterized in that, The step of identifying the inferred working flow state of the platform terminal currently based on the latent context representation comprises the following steps: Performing cluster analysis on the latent context representation in the latent representation space, and defining discrete inferred working flow state clusters according to the cluster analysis result; Calculating the spatial distance between the latent context representation of the real-time time sequence feature vector sequence and the center of each inferred working flow state cluster; Statistically analyzing the local density and adjacent sample distribution characteristics of the latent context representation of the real-time time sequence feature vector sequence in the latent representation space; Assigning the current target inferred working flow state of the platform terminal combining the spatial distance, the local density, and the adjacent sample distribution characteristics. 3.The terminal operation and maintenance management method for a medical big data platform according to claim 2, characterized in that, The step of calculating the context-aware abnormality metric value combining the inferred working flow state and the reconstruction error comprises the following steps: For each inferred working flow state, calculating and storing a multi-dimensional error statistical model under the inferred working flow state based on the reconstruction error of the samples belonging to the inferred working flow state in the historical time sequence feature vector sequence; According to the currently assigned target inferred working flow state, searching for the corresponding target multi-dimensional error statistical model; The reconstruction error of the real-time time sequence feature vector sequence is compared with the target multi-dimensional error statistical model, the statistical significance and unexpectedness in the target inferred workflow state are calculated, and the context-aware abnormality measurement value is calculated by combining the statistical significance and unexpectedness. 4.The terminal operation and maintenance management method for a medical big data platform according to claim 2, characterized in that, The time evolution characteristics of the abnormality measurement value are analyzed, and the time evolution characteristics are compared with the preset abnormality mode criterion to determine whether the platform terminal has a workflow mode abnormality, including the following steps: The abnormality measurement value is maintained as a continuous abnormality measurement value sequence within a time window; The dynamic evolution index of the abnormality measurement value sequence is calculated, and the dynamic evolution index includes a trend slope, a fluctuation amplitude change rate, and an autocorrelation change; A corresponding target evolution template is selected from a pre-defined normal evolution mode template library according to the target inferred workflow state, and the evolution templates in the normal evolution mode template library represent the normal fluctuation range and dynamic characteristics of the abnormality measurement value in different states; The dynamic evolution index is compared with the target evolution template to calculate the comprehensive deviation degree of the dynamic evolution index from the target evolution template; When the comprehensive deviation degree exceeds a preset threshold, it is determined that the platform terminal has a workflow mode abnormality, and the comprehensive deviation degree and the target evolution template are used as abnormal evolution feature descriptions. 5.The terminal operation and maintenance management method for a medical big data platform according to claim 1, characterized in that, After the generation of the early warning signal containing the platform terminal abnormal evolution feature description, the following steps are further included: The abnormal evolution feature description and the current inferred workflow state of the platform terminal are integrated into a comprehensive abnormal feature; The real-time time sequence feature vector sequence is analyzed based on the reconstruction error, and the original feature dimension with the highest correlation degree with the comprehensive abnormal feature is obtained; The comprehensive abnormal feature and the original feature dimension are combined, and a set of potential fault roots are inferred and output in a possibility order by using a pre-constructed platform correlation knowledge graph. 6.The terminal operation and maintenance management method for a medical big data platform according to claim 5, characterized in that, The comprehensive abnormal feature and the original feature dimension are combined, and a set of potential fault roots are inferred and output in a possibility order by using a pre-constructed platform correlation knowledge graph, including the following steps: The comprehensive abnormal feature and the original feature dimension are used as query conditions; The target nodes and target paths with the highest correlation degree with the query conditions are searched in the pre-constructed platform correlation knowledge graph, the target nodes include terminal components, terminal service ports, or terminal resource ports, and the target paths represent the dependency relationship or influence relationship between the target nodes; The target nodes are used as potential fault roots, and the correlation scores of the potential fault roots are calculated according to the target paths, and the potential fault roots are sorted by the correlation scores. 7.A terminal operation and maintenance management platform for a medical big data platform, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the terminal operation and maintenance management method for a medical big data platform as claimed in any one of claims 1 to 6.

8. A computer-readable storage medium having stored thereon instructions, the computer-readable storage medium comprising: The instructions, when executed by the processor, cause the processor to be configured to perform the terminal operation and maintenance management method for a medical big data platform as claimed in any one of claims 1 to 6.

Images