An enterprise-level device as a service (DaaS) system

Abstract

The application relates to the technical field of device management services, in particular to an enterprise-level device as a service (DaaS) system, which comprises a remote memory monitoring module, a device usage identification module, a usage cycle mapping module, an abnormal state identification module and a phased service label module.In the application, memory usage data of a device is collected in real time, and memory utilization is calculated, so that resource abnormalities can be identified in a timely manner; the start and end times of a device session are analyzed, and a benchmark of a service level agreement is compared, so that the device usage is finely classified; through deviation comparison with baseline data such as device usage frequency and task throughput, abnormal behaviors can be found in advance; through multi-dimensional feature cross verification, abnormal behaviors can be identified, the accuracy of abnormal detection can be greatly improved, the accuracy, response speed and early warning capability of device resource management can be significantly improved, the operation and maintenance cost can be effectively reduced, and the device usage life cycle can be prolonged.

Description

Technical Field

[0001] The present invention relates to the technical field of device management services, and in particular to an enterprise-level Device as a Service (DaaS) system. Background Art

[0002] The technical area of ​​device management services encompasses integrated management services for the procurement, deployment, management, maintenance, and recycling of computing equipment throughout its lifecycle. Core to this is the efficient management and dynamic allocation of internal enterprise device resources through the synergy of hardware and software, thereby optimizing device utilization and lifecycle management. This service encompasses device configuration management, remote monitoring and management, fault diagnosis and troubleshooting, software distribution, and upgrade maintenance, aiming to provide orderly, standardized operational management of a large number of dispersed enterprise devices through centralized and automated means.

[0003] Among them, the enterprise-level Device as a Service DaaS system refers to a system that provides enterprises with full life cycle management services such as hardware equipment leasing, configuration distribution, remote maintenance, and asset recovery through a centralized platform. It mainly targets technical issues such as complex equipment procurement processes, high operation and maintenance costs, and difficult equipment update cycle management. It adopts a unified resource scheduling method, relies on the equipment management server to perform equipment initialization configuration and usage permission settings, combines the remote management command execution system to push equipment usage policies, manages the equipment throughout the process through the life cycle asset tracking module, and implements recycling and data clearing according to preset recycling standards after the equipment is used.

[0004] Existing equipment management relies primarily on regular monitoring and manually set fixed thresholds to determine memory usage. This results in a failure to promptly detect abnormalities in equipment resources, which can easily lead to resource waste or equipment overload. Existing technologies fail to incorporate the refined requirements of different service levels when identifying equipment usage status, and are unable to provide personalized support for allocating equipment resources to meet different service requirements, resulting in inefficient resource scheduling. Traditional methods lack dynamic deviation comparison based on historical data when analyzing equipment usage cycles, making it impossible to accurately identify subtle changes in equipment usage behavior, leading to slow identification of abnormal behavior. Existing technologies typically rely on a single monitoring indicator to determine abnormal equipment status, lacking cross-validation of multi-dimensional features. This results in low identification accuracy and increases the workload of operations and maintenance personnel. For example, even if a device's usage frequency suddenly increases but does not exceed the load range, it may still be misjudged as an abnormality, leading to unnecessary manual intervention and increased operations and maintenance costs. Summary of the Invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose an enterprise-level Device as a Service (DaaS) system.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: An enterprise-level Device as a Service (DaaS) system includes:

[0007] The remote memory monitoring module obtains real-time operating data from devices connected to the enterprise's DaaS platform, collects current memory usage and total available capacity, calculates memory utilization, and combines the device number and time point that exceeded the memory watermark threshold to generate DaaS device resource usage anomaly items;

[0008] The device usage identification module collects the start and end timestamps of the same DaaS session of the device based on the abnormal DaaS device resource usage, calculates the session duration and compares it with the SLA tiered time benchmark, marks the corresponding service level, and generates a DaaS service level attribution tag;

[0009] The usage cycle mapping module compares the current usage duration with the device usage frequency baseline and the task throughput baseline based on the DaaS service level attribution tag, filters out data that deviates from the preset standard, maps the device usage feature trajectory, and generates a DaaS device usage deviation trajectory;

[0010] The abnormal state identification module performs synchronous mapping processing based on the DaaS device usage offset trajectory and the device information in the DaaS device resource occupancy abnormal item through time window alignment, determines whether the resource excess condition and the behavior deviation condition are met at the same time, extracts the data items that meet the conditions, and generates a DaaS remote device abnormal behavior cycle identifier.

[0011] As a further solution of the present invention, the DaaS device resource usage anomaly items include device number, anomaly occurrence time, and memory utilization deviation amplitude; the DaaS service level attribution mark includes service level type, session duration, and SLA benchmark correspondence; the DaaS device usage deviation trajectory includes device usage time deviation, device usage frequency deviation, and device task throughput deviation; the DaaS remote device abnormal behavior cycle identifier includes resource excess status mark, behavior deviation status mark, and time window matching result.

[0012] As a further solution of the present invention, the remote memory monitoring module includes:

[0013] The memory data collection submodule obtains the device number and current time point connected to the enterprise DaaS platform, detects the device's operating status information, monitors the current usage and total available capacity of the device system memory, performs a preliminary comparison between the current usage and the total available capacity, and generates memory usage collection data;

[0014] The memory utilization calculation submodule calculates the memory utilization of each device based on the memory usage collection data, calls the current memory usage and the total available capacity of the device, analyzes the memory utilization of each device at a fixed time point, and calculates the memory utilization;

[0015] The resource anomaly generation submodule performs interval judgment operation based on the memory utilization, the high watermark threshold and the low watermark threshold, combines the device number exceeding the threshold interval with the corresponding time point, filters the anomaly records, and obtains the DaaS device resource occupancy anomaly items.

[0016] As a further solution of the present invention, the device usage identification module includes:

[0017] The session time collection submodule obtains the device number in the DaaS device resource usage anomaly item, collects the session start timestamp and session end timestamp within the same DaaS session corresponding to the device number, checks the integrity of the start timestamp and end timestamp, and organizes them into a time pair data set corresponding to the device number to generate a device session time pair;

[0018] The session duration calculation submodule reads the start timestamp and the end timestamp data based on the device session time pair, calculates the session duration of each device, adjusts the abnormal negative value to zero, and obtains the device session duration;

[0019] The service level marking submodule compares the duration of the device session with the platinum, gold, and silver SLA tiered time reference values ​​set by the enterprise side, marks the devices that meet the service level standards, and establishes a DaaS service level attribution mark.

[0020] As a further solution of the present invention, the usage cycle mapping module includes:

[0021] The baseline data collection submodule obtains the device number corresponding to the DaaS service level attribution tag, collects the current usage time of the device, and simultaneously monitors the device usage frequency baseline and task throughput baseline. The device usage time, device usage frequency baseline, and task throughput baseline data are collated and merged to generate a device usage baseline data set.

[0022] The numerical deviation screening submodule reads the device usage duration, the device usage frequency baseline, and the task throughput baseline based on the device usage baseline dataset, calculates the device numerical offset, compares it with a preset deviation range, screens out data items that exceed the standard, and obtains a screening offset dataset;

[0023] The feature trajectory mapping submodule performs time sequence aggregation and feature trajectory reconstruction for each device number based on the filtered offset dataset, maps the filtered offset dataset into a usage trajectory trend, and establishes a DaaS device usage offset trajectory.

[0024] As a further solution of the present invention, the abnormal state identification module includes:

[0025] The time window alignment submodule collects the device ID and timestamp data from the DaaS device usage offset trace and the DaaS device resource usage anomaly item, monitors the time series distribution of the two sets of data, uses a sliding time window mechanism to align the time bases of the two sets of data, adjusts the recording step size under different time sources, and establishes a synchronized time series dataset;

[0026] The deviation condition determination submodule, based on the synchronized time series data set, calls the resource occupancy anomaly data item and the behavior deviation data item, extracts the resource usage value, resource baseline value, behavior actual usage value and behavior standard deviation value respectively, calculates the device synchronization offset, determines whether the resource limit condition and the behavior deviation condition are simultaneously met, filters the data items that meet the dual conditions, and generates a data set of qualified devices;

[0027] The abnormal period extraction submodule collects the data points that continuously meet the conditions according to the device number and time stamp sequence based on the qualified device data set, extracts the start and end time of the continuous abnormal segment, and establishes the abnormal behavior period identification of the DaaS remote device.

[0028] As a further embodiment of the present invention, the system further comprises:

[0029] The phased service tag module tracks the API call chain, IOPS indicators and resource allocation records of the device within the cycle according to the abnormal behavior cycle of the DaaS remote device, marks the service mode classification to which it belongs, binds the device number and phase type, and generates a DaaS service phase identification tag;

[0030] The DaaS service stage identification tags include API call chain characteristics, IOPS change trends, and resource allocation patterns.

[0031] As a further solution of the present invention, the phased service label module includes:

[0032] The periodic data tracking submodule obtains the device number and time period information in the abnormal behavior period identifier of the DaaS remote device, collects the API call chain data, IOPS indicator data and resource allocation record data of the device in the corresponding period, detects the timestamp sequence of each indicator, and organizes it into a complete indicator data chain corresponding to the device number to generate a device periodic indicator data set;

[0033] The service mode classification submodule uses the device API call frequency, IOPS average, and resource allocation fluctuation data based on the device cycle indicator dataset to extract features from the three indicators of each device, summarize the device usage behavior patterns within the cycle, set service mode classification standards based on the feature extraction results, screen devices that meet each service mode range, and generate a device stage type dataset;

[0034] The stage identification label generation submodule extracts the device number and the corresponding stage classification result based on the device stage type dataset, binds the device number and stage type information, marks the service stage category corresponding to each device in the cycle, and establishes a DaaS service stage identification label.

[0035] Compared with the prior art, the advantages and positive effects of the present invention are:

[0036] In the present invention, by collecting the memory usage data of the device in real time and calculating the memory utilization rate, resource anomalies can be identified in time, and the real-time and accuracy of management can be significantly improved; by analyzing the start and end time of the device session and comparing it with the benchmark of the service level agreement, the device usage can be finely classified and resource allocation can be effectively optimized; by comparing the deviation with baseline data such as device usage frequency and task throughput, the changing trend of device usage pattern can be identified and abnormal behavior can be discovered in advance; abnormal behavior identification through multi-dimensional feature cross-validation can greatly improve the accuracy of anomaly detection and reduce false alarms and missed alarms; the overall accuracy, response speed and early warning capability of device resource management are significantly improved, the operation and maintenance costs are effectively reduced, and the equipment life cycle is extended. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 is a system flow chart of the present invention;

[0038] Figure 2 This is a flow chart of the remote memory monitoring module of the present invention;

[0039] Figure 3 Flowchart of the identification module used by the device of the present invention;

[0040] Figure 4 The present invention uses a periodic mapping module flow chart;

[0041] Figure 5 This is a flow chart of the abnormal state identification module of the present invention;

[0042] Figure 6 This is a flow chart of the phased service label module of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0044] In the description of the present invention, it should be understood that the terms "length," "width," "up," "down," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inside," "outside," and the like, indicating positions or relationships, are based on the positions or relationships shown in the accompanying drawings and are intended only to facilitate the description of the present invention and simplify the description. They do not indicate or imply that the devices or elements referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limiting the present invention. Furthermore, in the description of the present invention, "plurality" means two or more, unless otherwise expressly and specifically defined.

[0045] See also Figure 1 , an enterprise-level Device as a Service (DaaS) system includes:

[0046] The remote memory monitoring module obtains real-time operating data from devices connected to the enterprise DaaS platform. It collects the current system memory usage and total available capacity at fixed points in time through polling, calculates memory utilization, and compares it with the memory watermark thresholds (high and low watermarks are predefined warning values ​​for system resource management, set by the operations team based on historical load data, with the high watermark at 80% and the low watermark at 10%). It then combines the device number and time point that exceeded the memory watermark threshold to generate an exception for DaaS device resource usage.

[0047] The device usage identification module collects the device ID in the DaaS device resource usage anomaly item and the session start and end timestamps of the device in the same DaaS session. It calculates the session duration and compares it with the SLA tiered time benchmark set by the enterprise (the minimum service duration standards corresponding to the platinum, gold, and silver tiers defined in the service level agreement). It then tags the corresponding service tier and generates a DaaS service tier attribution tag.

[0048] The usage cycle mapping module compares the current usage duration with the device usage frequency baseline and task throughput baseline (the usage frequency baseline refers to the historical average number of times a device is used per day; the task throughput baseline refers to the statistical mean of the number of tasks processed by the device per unit time) based on the DaaS service level attribution tag. It then filters out data that deviates from the preset standards, maps the device usage feature trajectory, and generates a DaaS device usage deviation trajectory.

[0049] The abnormal state identification module uses time window alignment (using a sliding time window mechanism to match time series data) to synchronize mapping data with the device information in the DaaS device usage deviation trajectory and the DaaS device resource usage anomaly items. It then determines whether both resource overlimit conditions and behavior deviation conditions are met (behavior deviation conditions refer to deviations between the device's actual usage pattern and historical baseline data exceeding twice the standard deviation of the device's historical usage pattern data (e.g., usage frequency, task throughput, etc.)). It then extracts data items that meet these conditions and generates a DaaS remote device abnormal behavior cycle identifier.

[0050] The phased service tag module identifies the abnormal behavior cycle of DaaS remote devices, tracks the API call chain, IOPS indicators and resource allocation records of the device within the cycle, marks the service mode classification (such as batch processing / real-time interaction), binds the device number and stage type, and generates a DaaS service stage identification tag.

[0051] Abnormal items of DaaS device resource usage include device number, abnormal occurrence time, and memory utilization deviation amplitude. DaaS service level attribution tags include service level type, session duration, and SLA benchmark correspondence. DaaS device usage deviation trajectory includes device usage time deviation, device usage frequency deviation, and device task throughput deviation. DaaS remote device abnormal behavior cycle identification includes resource excess status tag, behavior deviation status tag, and time window matching result. DaaS service stage identification tags include API call chain characteristics, IOPS change trend, and resource allocation pattern.

[0052] See also Figure 2 ,The remote memory monitoring module includes a memory data acquisition submodule, a memory ,utilization calculation submodule, and a resource anomaly generation submodule;

[0053] The memory data collection submodule obtains the device number and current time point connected to the enterprise DaaS platform, detects the device's operating status information, monitors the current usage and total available capacity of the device system memory, performs a preliminary comparison between the current usage and the total available capacity, and generates memory usage collection data;

[0054] Obtain the device number and current time point of the device connected to the enterprise DaaS platform, and record the number for each device, such as D001, D002, D003, etc. The collection time is based on Beijing time. The example time is 12:00 on April 28, 2025. When detecting the device operation status information, it is necessary to call the real-time status signal output by the device sensor module. The status signal value of 0 indicates that the device is turned off, and the status signal value of 1 indicates that the device is turned on. Monitor the current usage and total available capacity of the device system memory, and record the current memory usage value and total capacity value respectively. For example, for device D001, The current usage of the device at 12:00 on April 28, 2025 is 3.2GB, and the total capacity is 8GB. A preliminary comparison is performed between the current usage and the total available capacity. The comparison rule is that the current usage is less than the total capacity. If the current usage is higher than the total capacity, the abnormal device is recorded. When collecting memory usage data and total capacity data, an array is formed for all devices, such as device D001: [3.2GB, 8GB], device D002: [5.5GB, 16GB], and device D003: [7.0GB, 8GB]. The above data is summarized in a table as shown below:

[0055] Table 1 Device memory usage data table:

[0056] ;

[0057] See Table 1, which clearly lists the memory usage and total capacity information of each device at the sampling time point. Based on this data, through logical judgment rules, when the current usage exceeds the total capacity, it is marked as an abnormality. In this example, the D003 device does not trigger the abnormality flag because 7.0GB is less than 8GB. After the above collection and preliminary judgment, the memory usage collection data is finally generated, which includes the usage and total capacity arrays of all normal recording devices and their corresponding time points.

[0058] The memory utilization calculation submodule collects memory usage data, calls the current memory usage and total available capacity of the device, analyzes the memory utilization of each device at a fixed time point, and calculates the memory utilization;

[0059] Based on the memory usage data collection, we first call the current memory usage and total available capacity of each device, extract and combine each set of data. For example, for device D001, we extract 3.2GB of usage and 8GB of total capacity. Based on the data relationship between memory usage and total capacity, we calculate the memory utilization of each device at a fixed time point by dividing the usage by the total capacity. During the specific execution process, we take out the data pairs of each device in turn and perform calculations item by item. For example, the memory utilization of device D001 is calculated as , which is 40%. The memory utilization of device D002 is calculated as , which is 34.375%. The memory utilization of device D003 is calculated as , i.e. 87.5%. The above data is calculated to form a preliminary result array, namely D001: [40%], D002: [34.375%], D003: [87.5%]. To ensure the consistency and accuracy of the data, it is necessary to set the number of digits to be retained. In this embodiment, the rule of retaining two decimal places is adopted, i.e. D001: 40.00%, D002: 34.38%, D003: 87.50%. In addition, in the process of data processing, in order to avoid decimal point offset or rounding error, it is necessary to introduce memory capacity and usage. Quantity standardization verification, for example, uses the standard unit GB for unified processing. If there are different units such as MB and TB that need to be uniformly converted, this embodiment assumes that all data units are GB and no conversion is required, so a direct ratio operation can be performed. Furthermore, during the data storage process, the device number, sampling time, and memory utilization are combined into a record. An example record is {device number: D001, time: April 28, 2025 12:00, memory utilization: 40.00%}, forming a standardized device memory utilization record table as follows:

[0060] Table 2 Device memory utilization record table:

[0061] ;

[0062] See Table 2, which clearly shows the memory utilization of each device at the corresponding time point.

[0063] The resource anomaly generation submodule performs interval judgment based on memory utilization, according to the high watermark threshold of 80% and the low watermark threshold of 10%. It combines the device numbers that exceed the threshold interval with the corresponding time points, filters the anomaly records, and obtains the DaaS device resource usage anomaly items;

[0064] Based on the obtained memory utilization, first extract the memory utilization data corresponding to each device, for example, the D001 device is 40.00%, the D002 device is 34.38%, and the D003 device is 87.50%. According to the set high water mark threshold of 80% and the low water mark threshold of 10%, perform the interval judgment operation. The specific execution steps are to take out the device memory utilization in turn and judge whether it meets the threshold interval condition, that is, the memory utilization is less than 10% or greater than 80%. For each device, judge separately. The memory utilization of device D001 is 40.00%, which is within the range of 10% to 80%. The memory utilization of device D002 is 34.38%, which is within the range of 10% to 80% and is judged to be normal. The memory utilization of device D003 is 87.50%, which is higher than the 80% threshold and is judged to be abnormal. According to the abnormal judgment result, the device number that exceeds the threshold interval is combined with the corresponding time point to form an abnormal record example {device number: D003, time: April 28, 2025 12:00, memory utilization: 87.50%}. Furthermore, to facilitate subsequent query and statistics, the abnormal records are sorted in ascending order according to the device number. An abnormal record table can be formed within a single sampling period as follows:

[0065] Table 3 DaaS equipment resource exception record table:

[0066] ;

[0067] As shown in Table 3, during this sampling period, only device D003 was recorded as abnormal because its memory utilization exceeded the high-water mark threshold. It is worth noting that in actual applications, to prevent occasional errors, it can be set that the abnormality is only officially marked when the threshold is exceeded multiple times in a row. In this embodiment, multi-cycle verification is not introduced for the time being, and only single-cycle data is used as the judgment basis. Therefore, the abnormal devices in the current cycle are directly filtered out to obtain the abnormal DaaS device resource usage items. There is no new formula calculation in the above screening process. All interval comparisons and judgments are based on the existing memory utilization values, and the final record is generated in combination with the time point and device number.

[0068] See also Figure 3 ,The device usage identification module includes a session time collection submodule, a session duration calculation submodule, and a service level marking submodule;

[0069] The session time collection submodule obtains the device number from the DaaS device resource usage anomaly item, collects the session start timestamp and session end timestamp within the same DaaS session corresponding to the device number, checks the integrity of the start timestamp and end timestamp, and organizes them into a time pair dataset corresponding to the device number to generate the device session time pair.

[0070] The session time collection submodule is based on the device number in the DaaS device resource usage anomaly item. First, it extracts the associated records of each device number and collects the start timestamp and end timestamp data of each device in the DaaS session management system. For device number A1234, its session start time is 10:00:00 on April 15, 2024, and the end time is 14:15:00 on April 15, 2024. The start time Tsi=10:00:00 and the end time Tei=14:15:00 are recorded to detect the start and end times. Check whether the time data is missing or in reverse order. If so, for example, the start time of device number B5678 is later than the end time, correct the abnormal data or remove the record. At the same time, organize all normal timestamp data in a table structure. Each record corresponds to the three fields of device number, start time, and end time. For the device number in the record set, if there are multiple session records, sort them in ascending order by session start time to ensure that the session times under the same device number do not overlap. Generate a standardized data set. The data sorting results after collection are shown in the table below:

[0071] Table 4 Device session time table:

[0072] ;

[0073] As shown in Table 4, device number A1234 starts a session at 10:00 on April 15, 2024, and ends at 14:15. Device number B5678 starts at 9:00 and ends at 12:30. Device number C9101 starts at 11:20 and ends at 13:00. Through the above collection process, the device session time pairs are standardized and organized.

[0074] The session duration calculation submodule reads the start timestamp and end timestamp data based on the device session time pair, calculates the session duration of each device, adjusts abnormal negative values ​​to zero, and obtains the device session duration;

[0075] The session duration calculation submodule is based on the device session time pair generated by the session time collection submodule, and calls the start timestamp and end timestamp data of each device. First, the timestamp is converted into a unified standard time format such as seconds for calculation. For device number A1234, the start time 10:00:00 corresponds to 36000 seconds, and the end time 14:15:00 corresponds to 51300 seconds. The duration is 51300-36000=15300 seconds, which is converted to hours. It is 4.25 hours. For the calculated duration, if a negative value appears, it is determined to be a time delay. The time stamp records the exception and sets the duration to 0 hours. Then, the duration value of each device number is recorded. During this process, the time difference is divided into intervals, and sessions with a duration of less than 1 hour are marked as short sessions, sessions with a duration between 1 and 3 hours are marked as medium sessions, and sessions with a duration of more than 3 hours are marked as long sessions. For example, the session time of device number C9101 is from 11:20 to 13:00, which is converted to a duration of 1 hour and 40 minutes, or 1.6667 hours, which is classified as a medium session. This forms a duration data set, and ultimately the device session duration is obtained.

[0076] The service level marking submodule compares the duration of device sessions with the platinum, gold, and silver SLA time base values ​​set by the enterprise side, assigns a tag to devices that meet the service level standards, and establishes a DaaS service level tag.

[0077] The service-level marking submodule uses the device session duration obtained by the session duration calculation submodule and the SLA grading time benchmark set by the enterprise to compare the session duration of each device with the service duration standards corresponding to the platinum, gold, and silver levels. The benchmark values ​​are set as follows: the platinum standard is a duration greater than 4 hours, the gold standard is 2 to 4 hours, and the silver standard is 1 to 2 hours. Referring to these standards, for device number A1234, its duration is 4.25 hours, which exceeds 4 hours, and it is classified as platinum level. The duration of device number C9101 is 1.6667 hours, which is between 1 and 2 hours and is classified as silver level. The duration of device number B5678 is 3.5 hours and is classified as gold level. During the differentiation process, if the duration is less than 1 hour, it is recorded as no level affiliation. Through the above judgment, the service-level tag corresponding to each device is generated, and finally the DaaS service-level affiliation tag is established.

[0078] See also Figure 4 ,The use period mapping module includes a baseline data acquisition submodule, a numerical deviation screening submodule, and a ,feature trajectory mapping submodule;

[0079] The baseline data collection submodule obtains the device number corresponding to the DaaS service level attribution tag, collects the current usage time of the device, and simultaneously monitors the device usage frequency baseline and task throughput baseline. It organizes and merges the device usage time, device usage frequency baseline, and task throughput baseline data to generate a device usage baseline dataset.

[0080] Based on the device number corresponding to the DaaS service level attribution tag, the current usage time of the device is collected, the device usage frequency baseline and the task throughput baseline are monitored, and the device usage time, device usage frequency baseline and task throughput baseline data are sorted and merged. First, the device list needs to be read from the DaaS management system, such as device numbers A001, A002, A003, etc. For the A001 device, its most recent DaaS service level attribution information is extracted. Assuming it is gold level, its daily usage time data in the past 30 days is obtained. For example, the daily usage time of A001 is 5 hours, 6 hours, 4 hours and 7 hours respectively. Through cumulative The total usage time is calculated to be 180 hours. Then, the usage frequency data of device A001 in the past 30 days are extracted. Assuming that A001 starts DaaS sessions 5 times, 6 times, 4 times, and 5 times per day, the cumulative usage frequency baseline of device A001 is 5 times per day. Then, the task throughput data of A001 is extracted. Assuming that the number of tasks completed per day is 30 times, 28 times, 32 times, and 31 times respectively, its 30-day average task throughput is calculated to be 30.25 times. After collecting the above data, the fields are uniformly merged according to the device number, usage time, usage frequency baseline, and task throughput baseline to form the device usage baseline data set. The sample data is shown in Table 5.

[0081] Table 5 Equipment usage baseline data table:

[0082] ;

[0083] As shown in Table 5, the equipment number and baseline data set were collected and organized. The usage time of equipment A001 was 180 hours, the usage frequency baseline was 5 times per day, and the task throughput baseline was 30.25 times per hour. By merging the above data, the equipment usage baseline data set was obtained.

[0084] The numerical deviation screening submodule reads the device usage duration, device usage frequency baseline, and task throughput baseline based on the device usage baseline data set, and calculates the numerical deviation between the usage duration and the baseline data using the formula:

[0085] ;

[0086] Calculate device numerical offset , compare with the preset deviation range, filter out the data items that exceed the standard, and obtain the filtered offset data set, where, Representative equipment Current usage time, Representative equipment Baseline frequency of use, Representative equipment The task throughput baseline;

[0087] Based on the device usage baseline data set, the device usage time, device usage frequency baseline and task throughput baseline are called to calculate the numerical deviation. First, the data of device A001 is extracted. It is known that the device usage time of A001 is 180 hours, the usage frequency baseline is 5 times / day, and the task throughput baseline is 30.25 times / h. Substitute them into the formula in sequence. 、 、 Substitute in and calculate the first part first:

[0088] ;

[0089] Calculate the second part:

[0090] ;

[0091] Take the absolute value and add the two terms:

[0092] ;

[0093] The numerical offset of device A001 is thus obtained to be 31.96. The numerical offsets of devices A002 and A003 are calculated using the same method, and the obtained values ​​are 28.23 and 33.50, respectively. See Table 6.

[0094] Table 6 Numerical offset calculation table:

[0095] ;

[0096] As shown in Table 6, the device numerical offset is compared with the offset standard set by the enterprise. Assuming the offset standard is within 30 (the offset standard of 30 is determined based on the fluctuation range of the device's maximum daily task volume within the past 30 days, specifically referring to the fluctuation range between the maximum and minimum daily task throughput values. A fluctuation range of no more than 25% is used as a reasonable limit in the calculation. By statistically analyzing the maximum daily usage frequency and task throughput of each device and normalizing their fluctuations, we found that most devices have offsets within the normal range of 25 to 30. Therefore, the offset standard is set to within 30. This value fluctuates with the number of tasks completed per day and the daily usage time of the device. When the device usage time increases or the daily task volume surges, the offset tends to increase, and vice versa. This standard effectively reflects the impact of device load changes on overall stability). Devices with an offset exceeding 30, namely A001 and A003, are filtered out to obtain the filtered offset dataset.

[0097] The device numerical offset is a numerical indicator used to quantify the degree of change in the device's current usage status compared to its historical baseline characteristics. This value comprehensively considers the deviation relationship between the device's current usage time and its usage frequency baseline, as well as the deviation relationship between the usage frequency baseline and the task throughput baseline. It is obtained by standardizing and accumulating the two sets of deviations after absolute value processing. It is used to comprehensively reflect the degree of consistency between the device's current operating load mode, operating intensity and processing capacity and the historical stable state. Among them, the larger the device numerical offset value, the more obvious the deviation of the device's current usage behavior from the previous baseline. There may be phenomena such as sudden increase in usage frequency, abnormal extension of usage cycle, and increased task load fluctuation. The smaller the value, the closer the device usage status is to the historical pattern and remains within the normal fluctuation range. Therefore, in practical applications, the device numerical offset value is mainly used as an important reference for judging device status stability, monitoring load anomalies, and adjusting operation and maintenance strategies.

[0098] The overall operational logic of the formula is to comprehensively measure the numerical deviations between the device usage duration, usage frequency baseline, and task throughput baseline. First, the difference between the current usage duration and the usage frequency baseline is calculated and normalized by the square root of the task throughput baseline. The square root operation is used to reduce the direct amplification effect of the deviation results when the task throughput baseline value is large, ensuring a relatively stable deviation magnitude. Next, the direct difference between the device usage frequency baseline and the task throughput baseline is calculated and normalized using the current usage duration as the denominator. The current duration is used in the denominator because the device usage duration directly affects the task processing capacity per unit time. Therefore, a normalized method is used to measure the relative proportion of the deviation. Then, the deviation results of the two items after absolute value processing are accumulated. The absolute value operation ensures that the direction of the deviation (increase or decrease) has no effect on the final result. The accumulation operation reflects the combined effect of the usage duration deviation and the frequency and throughput deviations, thus comprehensively reflecting the overall numerical deviation between the current device usage characteristics and the historical baseline. Finally, the overall quantified numerical deviation is used as an important indicator of the change in device usage characteristics.

[0099] The feature trajectory mapping submodule performs chronological aggregation and feature trajectory reconstruction for each device number based on the filtered offset dataset, maps the filtered offset dataset into usage trajectory trends, and establishes the DaaS device usage offset trajectory;

[0100] Based on the filtered offset dataset, feature trajectory mapping is performed for device numbers A001 and A003. First, the daily usage duration trends for A001 and A003 over the past 30 days are summarized chronologically, and trajectory lines are plotted. For example, the usage duration for device A001 over the past 30 days is 5 hours, 6 hours, 4 hours, and 7 hours, respectively. This data is aggregated to form a trajectory array [5, 6, 4, 7, ...]. The same process is performed for device A003, resulting in trajectory arrays. Subsequently, by combining the filtered offset dataset with the trajectory array, dates with deviations exceeding the standard are marked as outliers. For example, on the 10th day, the usage duration for A001 drops to 3 hours, and the numerical deviation is greater than the deviation standard of 30. Therefore, the 10th day is marked as an outlier. Ultimately, the offset trajectory data corresponding to the device number is generated, and the DaaS device usage deviation trajectory is established.

[0101] See also Figure 5 ,The abnormal state recognition module includes a time window alignment submodule, a deviation ,condition determination submodule, and an abnormal period extraction submodule;

[0102] The time window alignment submodule collects device ID and timestamp data from DaaS device usage offset trajectories and DaaS device resource usage anomaly items, monitors the time series distribution of the two sets of data, and uses a sliding time window mechanism to align the time bases of the two sets of data. It adjusts the recording step size under different time sources to establish a synchronized time series dataset.

[0103] Obtain the device number and timestamp data from the DaaS device usage offset trajectory and the DaaS device resource usage anomaly item, collect the device number and corresponding timestamp data from the device usage offset trajectory, synchronously collect the device number and recording time for the device resource usage anomaly item, monitor the arrangement and time accuracy of the two sets of data time axes, set the sliding time window width to 5 minutes, and the sliding step to 1 minute. Taking device A as an example, if the offset trajectory recording time is 10:00, 10:01, and 10:03 on April 1, 2024, and the resource anomaly recording time is 10:02, 10:03, and 10:04 on April 1, 2024, then compare them in a sliding window every minute and calculate and The difference is 2 minutes, 2 minutes, and 1 minute respectively, which are all less than the 5-minute window width. They are recorded as synchronous alignment data. During the synchronous matching process, the starting time of the sliding window is first detected. ,Then advance the time window according to the step size, update and compare the offset trajectory and resource anomaly time in real time, and complete the synchronization mark if the difference meets the condition of less than or equal to 5 minutes. Assume that the offset trajectory recording time of device B is 11:00 on April 1, 2024, and the resource anomaly time is 11:10 on April 1, 2024. The difference between the two is 10 minutes, which exceeds the window width and no synchronization processing is performed. When establishing the synchronized time series dataset, the successfully matched device numbers and timestamps are collected one by one and sorted in chronological order to generate a preliminary synchronization mapping table, as shown in Table 7:

[0104] Table 7 Synchronous time series sample table:

[0105] ;

[0106] As shown in Table 7, the 0-minute offset trajectory of device A matches the 2-minute resource anomaly, the 1-minute offset trajectory matches the 3-minute resource anomaly, and the 3-minute offset trajectory matches the 4-minute resource anomaly. All of these meet the synchronization conditions, and a synchronized time series dataset is finally established.

[0107] The deviation condition determination submodule is based on the synchronous time series data set, calls the resource occupancy anomaly data item and the behavior deviation data item, extracts the resource usage value, resource baseline value, behavior actual usage value and behavior standard deviation value respectively, and performs joint calculation by combining difference and multiplication accumulation. The formula is:

[0108] ;

[0109] Calculating device synchronization offset , determine whether the resource overlimit condition and the behavior deviation condition are met at the same time, filter out the data items that meet the dual conditions, and generate a data set of qualified devices, where, Representative equipment The resource usage, Representative equipment The resource baseline value, Representative equipment The actual usage value, Representative equipment The historical standard deviation of

[0110] Based on the synchronous time series data set, the resource occupancy abnormal data item and the behavior deviation data item are called to extract the resource usage value, resource baseline value, behavior actual usage value and behavior standard deviation value respectively, and perform the resource and behavior joint deviation analysis. First, the resource occupancy deviation is calculated. Assuming that the resource occupancy of device A is 60%, the resource baseline value is 45%, the behavior usage frequency is 8 times, and the historical standard deviation is 2 times, the difference offset calculation is performed. The calculation steps are as follows: First, calculate , then take the square root to get , then calculate It is definitely worth it , adding the two parts gives , that is, the synchronization offset value of device A is 43.49. According to the offset threshold setting standard, a synchronization offset exceeding 30 is considered a serious offset. In this example, the offset of device A is 43.49, which exceeds 30, so it is marked as abnormal. The specific data is shown in Table 8:

[0111] Table 8 Synchronization offset calculation table:

[0112] ;

[0113] As shown in Table 8, device A calculates the synchronization offset to be 43.49, which meets the offset condition and is extracted to the eligible device data set.

[0114] Device synchronization offset represents a comprehensive quantitative indicator of resource usage anomalies and behavioral deviations for a single DaaS device within the same time window. Specifically, this value combines the difference between resource usage and the resource baseline value, and the degree of deviation between the actual usage frequency and the historical standard deviation, quantifying the degree of anomalies in both the resource and behavioral dimensions by taking the square root of the product and the absolute value of the fraction. These two anomaly values ​​are then superimposed into a unified value, reflecting the overall offset strength of the device's resource load pressure and behavioral variation within the current time period. A larger device synchronization offset indicates a greater overall deviation between the device's current state and its historical normal usage pattern. This deviation manifests itself in both increased resource consumption anomalies and amplified operational behavior anomalies. This value can be used to screen out devices experiencing resource and behavioral synchronization anomalies within a specific time window, providing a direct quantitative basis for subsequent cycle anomaly identification, fault prediction, or maintenance priority allocation.

[0115] The calculation logic of the formula is as follows: First, Partially by calculating resource usage and resource baseline values The difference between the actual usage value of the behavior and behavioral standard deviation The difference between the two deviations is multiplied to quantify the degree of combination of resource anomaly and behavior deviation. The product can reflect the superposition effect of the two deviation degrees. Then, the absolute value of the product is taken and the square root is taken. It aims to reduce the amplification effect of extreme outliers on the overall offset, while ensuring that the final quantization result is positive regardless of whether the deviation direction is positive or negative. Then, Partially through resource usage Using values ​​with behavior divided by the historical standard deviation , quantify the degree of abnormality of the total deviation of resources and behaviors relative to the normal fluctuation range. This score can intuitively reflect the proportional relationship between the overall abnormal magnitude and the historical stability of the device. Then take the absolute value of the score , ensuring that both exceeding the standard and decreasing fluctuations can be handled uniformly, and finally adding the two parts of the results, By superimposing the independent contributions of resource deviation and behavior deviation, the overall deviation degree of the device in the current time window is comprehensively evaluated to form a unified device synchronization offset value. ,This design can not only reflect the severity of a single abnormality, but also comprehensively ,consider the deviation conditions in all aspects, thus enhancing the ,overall recognition capability of double deviation abnormalities.

[0116] The abnormal cycle extraction submodule collects data points that continuously meet the conditions based on the device data set and the device number and timestamp sequence, extracts the start and end times of the continuous abnormal segments, and establishes the abnormal behavior cycle identification of the DaaS remote device;

[0117] Based on the dataset of eligible devices, time series aggregation is performed for each device ID. Data records that continuously meet the offset condition are merged into a continuous segment. The segment start and end times are extracted to form an abnormal period identifier. For example, if device A meets the offset condition at 10:00, 10:01, and 10:03 on April 1, 2024, they are merged into an abnormal period starting at 10:00 on April 1, 2024, and ending at 10:03 on April 1, 2024. If device B meets the offset condition at 11:00 on April 1, 2024, but the next abnormality occurs at 11:10, the two are divided into different abnormal periods. During the period extraction process, the interval between consecutive offset records that does not exceed 5 minutes is considered the same period. If it exceeds 5 minutes, it is divided into a new period. When setting the standard interval value, refer to the regular usage interval standard of DaaS devices. The interval between continuous access operations between regular devices is less than 3 minutes, so 5 minutes is used as a reasonable upper limit. In this way, the abnormal behavior data of all devices are merged to generate a period table, as shown in Table 9:

[0118] Table 9 Abnormal cycle extraction table:

[0119] ;

[0120] As shown in Table 9, device A is merged to form a complete abnormal cycle, and device B is divided into a separate cycle because the interval exceeds 5 minutes. Finally, the DaaS remote device abnormal behavior cycle identification is established.

[0121] See also Figure 6 ,The phased service label module includes a period data tracking submodule, a service mode classification submodule, and a phase identification label generation submodule;

[0122] The periodic data tracking submodule obtains the device number and time period information in the abnormal behavior cycle identifier of the DaaS remote device, collects the API call chain data, IOPS indicator data and resource allocation record data of the device in the corresponding period, detects the timestamp sequence of each indicator, and organizes it into a complete indicator data chain corresponding to the device number to generate the device periodic indicator data set;

[0123] When collecting the device number and time period information in the abnormal behavior cycle identifier of the DaaS remote device, it is first necessary to retrieve the unique number of the corresponding device and the start and end time of the recorded abnormal cycle from the background database. For example, select the device number D001, the start time is 00:00:00 on May 1, 2024, and the end time is 00:00:00 on May 2, 2024. For this time range, extract all API call records of the device in the DaaS platform one by one. The record fields include API name, call start time, and call end time. Assuming that the extracted call records are 250 times a day, then collect the IO of the device in the corresponding time period. IOPS refers to the number of input and output operations per second. Assume that the average IOPS of the device is 600 and the peak is 900 according to log reading. Finally, the resource allocation record of the device is collected. The resource allocation record includes the number of CPU cores allocated, the amount of memory allocated, and the amount of disk allocated. For example, the average number of CPU cores allocated to the device is 2, the amount of memory allocated is 8GB, and the amount of disk allocated is 200GB. By aligning the timestamps of each type of data and processing it as a data synchronization node every 5 minutes, the data fields are merged into a synchronization table, as shown in Table 1. Table 1 lists the various synchronization data of device D001 at a sampling point.

[0124] Table 10: Synchronous data of indicators within the equipment D001 cycle:

[0125] ;

[0126] As shown in Table 10, the collection results show the number of API calls and IOPS fluctuations at different time points within the cycle. Through the above method, the indicator data is collected and the timeline is synchronized to generate a device cycle indicator dataset.

[0127] The service mode classification submodule uses the device cycle indicator dataset to call device API call frequency, IOPS average, and resource allocation fluctuation data. It extracts features from these three indicators for each device, summarizes the device's usage behavior patterns within the cycle, and sets service mode classification standards based on the feature extraction results. It then selects devices that meet each service mode range and generates a device stage type dataset.

[0128] Based on the device periodic indicator dataset generated by the periodic data tracking submodule, the device API call frequency indicator is first called. For the API call count data within the sampling period, the average number of calls per hour is calculated and aggregated in hours. For example, the total number of calls for device D001 from 00:00 to 01:00 on May 1st is 280. The hourly call frequency is 280 times / 1 hour = 280 times / hour. Then, the IOPS average is processed and the IOPS data of each 5-minute point is extracted to calculate the average. Assuming that a total of 12 data points are obtained from 00:00 to 01:00 on May 1st, namely 600, 620, 590, 610, 580, 600, 610, 590, 600, 610, 580, and 600, the average IOPS is (600+620+590+......+ 610 + 580 + 600) / 12 = 599.17. Next, we process the resource allocation fluctuation amplitude and obtain the degree of fluctuation by calculating the standard deviation. Assuming that the memory allocation remains stable at 8GB throughout the cycle, the standard deviation is 0. If there is fluctuation, the standard deviation formula is calculated based on the sampled data, and the fluctuation threshold is set to 1GB. When the standard deviation is greater than 1GB, it is considered that there is significant fluctuation. Then, the API call frequency, IOPS mean, and resource fluctuation standard deviation are summarized and compared with the set service mode classification standard. For example, devices with an API call frequency higher than 200 times / hour, an IOPS mean higher than 500, and a resource fluctuation less than 1GB are classified as "real-time interaction mode", otherwise they are classified as "batch processing mode". Taking device D001 as an example, it meets the real-time interaction mode standard and is classified as real-time interaction. The results are sorted to generate a device stage type dataset.

[0129] The stage identification label generation submodule extracts the device number and the corresponding stage classification results based on the device stage type dataset, binds the device number and stage type information, marks the corresponding service stage category of each device within the cycle, and establishes the DaaS service stage identification label;

[0130] Based on the equipment phase type dataset generated by the service mode classification submodule, the equipment number and the corresponding phase classification results are extracted, and the equipment number D001 is bound to the belonging phase type "real-time interaction". The service mode identification of each cycle is recorded. Assuming that the equipment phase type changes in the subsequent time period, such as the phase changes to "batch processing" after 00:00 on May 2, the binding information of the timestamp and phase type is added to the record. A three-field structure of equipment number + time period + phase type is used for storage. At the same time, each record is checked for whether there is any overlap in time. If there is overlap, it is segmented according to time priority. Finally, the phase label table shown in Table 2 is generated in a standardized format. Table 2 lists the phase identification information of the D001 device during the monitoring period.

[0131] Table 11D001 Equipment Phase Identification Label Table:

[0132] ;

[0133] As shown in Table 11, the service stage status of device D001 in different time periods is marked and a DaaS service stage identification tag is established.

[0134] The above are merely preferred embodiments of the present invention and do not limit the present invention in any other form. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the scope of protection of the technical solution of the present invention.

Claims

1. An enterprise-level device-as-a-service (DaaS) system, characterized in that: The system comprises: The remote memory monitoring module obtains real-time operating data from devices connected to the enterprise's DaaS platform, collects current memory usage and total available capacity, calculates memory utilization, and combines the device number and time point that exceeded the memory watermark threshold to generate DaaS device resource usage anomaly items; The device usage identification module collects the start and end timestamps of the same DaaS session of the device based on the abnormal DaaS device resource usage, calculates the session duration and compares it with the SLA tiered time benchmark, marks the corresponding service level, and generates a DaaS service level attribution tag; The usage cycle mapping module compares the current usage duration with the device usage frequency baseline and the task throughput baseline based on the DaaS service level attribution tag, filters out data that deviates from the preset standard, maps the device usage feature trajectory, and generates a DaaS device usage deviation trajectory; The abnormal state identification module performs synchronous mapping processing based on the DaaS device usage deviation trajectory and the device information in the DaaS device resource occupancy abnormality item through time window alignment, determines whether both the resource limit excess condition and the behavior deviation condition are met, extracts the data items that meet the conditions, and generates a DaaS remote device abnormal behavior period identifier; The abnormal state recognition module includes: The time window alignment submodule collects the device ID and timestamp data from the DaaS device usage offset trace and the DaaS device resource usage anomaly item, monitors the time series distribution of the two sets of data, uses a sliding time window mechanism to align the time bases of the two sets of data, adjusts the recording step size under different time sources, and establishes a synchronized time series dataset; The deviation condition determination submodule is based on the synchronous time series data set, calls the resource occupancy anomaly data item and the behavior deviation data item, extracts the resource usage value, resource baseline value, behavior actual usage value and behavior standard deviation value respectively, and performs joint calculation by combining difference and multiplication accumulation. The formula is: ； Calculating device synchronization offset , determine whether the resource overlimit condition and the behavior deviation condition are met at the same time, filter out the data items that meet the dual conditions, and generate a data set of qualified devices, where, Representative equipment The resource usage, Representative equipment The resource baseline value, Representative equipment The actual usage value, Representative equipment The historical standard deviation of The abnormal period extraction submodule collects the data points that continuously meet the conditions according to the device number and time stamp sequence based on the qualified device data set, extracts the start and end time of the continuous abnormal segment, and establishes the abnormal behavior period identification of the DaaS remote device.

2. The enterprise-level device-as-a-service (DaaS) system according to claim 1, characterized in that: The DaaS device resource usage anomaly items include the device number, the time point of the anomaly occurrence, and the memory utilization deviation amplitude. The DaaS service level attribution mark includes the service level type, session duration, and SLA benchmark correspondence. The DaaS device usage deviation trajectory includes the device usage time deviation, the device usage frequency deviation, and the device task throughput deviation. The DaaS remote device abnormal behavior cycle identifier includes the resource excess status mark, the behavior deviation status mark, and the time window matching result.

3. The enterprise-level device-as-a-service (DaaS) system according to claim 1, characterized in that: The remote memory monitoring module includes: The memory data collection submodule obtains the device number and current time point connected to the enterprise DaaS platform, detects the device's operating status information, monitors the current usage and total available capacity of the device system memory, performs a preliminary comparison between the current usage and the total available capacity, and generates memory usage collection data; The memory utilization calculation submodule calculates the memory utilization of each device based on the memory usage collection data, calls the current memory usage and the total available capacity of the device, analyzes the memory utilization of each device at a fixed time point, and calculates the memory utilization; The resource anomaly generation submodule performs interval judgment operation based on the memory utilization, the high watermark threshold and the low watermark threshold, combines the device number exceeding the threshold interval with the corresponding time point, filters the anomaly records, and obtains the DaaS device resource occupancy anomaly items.

4. The enterprise-level device-as-a-service (DaaS) system according to claim 1, characterized in that: The device usage identification module includes: The session time collection submodule obtains the device number in the DaaS device resource usage anomaly item, collects the session start timestamp and session end timestamp within the same DaaS session corresponding to the device number, checks the integrity of the start timestamp and end timestamp, and organizes them into a time pair data set corresponding to the device number to generate a device session time pair; The session duration calculation submodule reads the start timestamp and the end timestamp data based on the device session time pair, calculates the session duration of each device, adjusts the abnormal negative value to zero, and obtains the device session duration; The service level marking submodule compares the duration of the device session with the platinum, gold, and silver SLA tiered time reference values ​​set by the enterprise side, marks the devices that meet the service level standards, and establishes a DaaS service level attribution mark.

5. The enterprise-level device-as-a-service (DaaS) system according to claim 1, characterized in that: The usage cycle mapping module includes: The baseline data collection submodule obtains the device number corresponding to the DaaS service level attribution tag, collects the current usage time of the device, and simultaneously monitors the device usage frequency baseline and task throughput baseline. The device usage time, device usage frequency baseline, and task throughput baseline data are collated and merged to generate a device usage baseline data set. The numerical deviation screening submodule reads the device usage duration, the device usage frequency baseline, and the task throughput baseline based on the device usage baseline dataset, calculates the device numerical offset, compares it with a preset deviation range, screens out data items that exceed the standard, and obtains a screening offset dataset; The feature trajectory mapping submodule performs time sequence aggregation and feature trajectory reconstruction for each device number based on the filtered offset dataset, maps the filtered offset dataset into a usage trajectory trend, and establishes a DaaS device usage offset trajectory.

6. The enterprise-level device-as-a-service (DaaS) system according to claim 1, characterized in that: The system further comprises: The phased service tag module tracks the API call chain, IOPS indicators and resource allocation records of the device within the cycle according to the abnormal behavior cycle of the DaaS remote device, marks the service mode classification to which it belongs, binds the device number and phase type, and generates a DaaS service phase identification tag; The DaaS service stage identification tags include API call chain characteristics, IOPS change trends, and resource allocation patterns.

7. The enterprise-level device-as-a-service (DaaS) system according to claim 6, characterized in that: The phased service label module includes: The periodic data tracking submodule obtains the device number and time period information in the abnormal behavior period identifier of the DaaS remote device, collects the API call chain data, IOPS indicator data and resource allocation record data of the device in the corresponding period, detects the timestamp sequence of each indicator, and organizes it into a complete indicator data chain corresponding to the device number to generate a device periodic indicator data set; The service mode classification submodule uses the device API call frequency, IOPS average, and resource allocation fluctuation data based on the device cycle indicator dataset to extract features from the three indicators of each device, summarize the device usage behavior patterns within the cycle, set service mode classification standards based on the feature extraction results, screen devices that meet each service mode range, and generate a device stage type dataset; The stage identification label generation submodule extracts the device number and the corresponding stage classification result based on the device stage type dataset, binds the device number and stage type information, marks the service stage category corresponding to each device in the cycle, and establishes a DaaS service stage identification label.

Images