Method and apparatus for real-time monitoring of charging service based on service probe

Abstract

The embodiment of the application provides a kind of based on the real-time monitoring method and device of charging service of service probe, through the construction of multilayer data analysis mechanism, through the data of application layer, session layer and network layer, the accurate construction of service event chain is realized.Design based on the abnormality identification strategy of multidimensional feature fusion, combine hardware state feature and scene feature, establish neural network classifier to carry out abnormal event analysis.Introduce real-time monitoring engine, through hierarchical analysis and correlation analysis, dynamically early warning is carried out to service anomaly.The method effectively solves the deficiency of traditional technology in data analysis, feature analysis and real-time monitoring etc., significantly improves the intelligent level and early warning effect of charging service monitoring.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, in particular to a charging service real-time monitoring method and device based on a business probe. BACKGROUND

[0002] The existing charging service monitoring method has obvious defects. The traditional system lacks systematicness and real-time in data analysis, and it is difficult to effectively integrate multi-dimensional data of application layer, transmission layer, network layer and link layer, affecting the comprehensiveness of monitoring.

[0003] In addition, the existing technology has bottlenecks in feature analysis. Most systems fail to consider hardware status and scene features comprehensively, lack of abnormal identification mechanism based on multi-dimensional feature fusion, resulting in inaccurate early warning.

[0004] The existing system has technical shortcomings in real-time monitoring. It lacks dynamic analysis capability of business event chain, and it is difficult to realize timely discovery of abnormalities through inter-layer data mapping, affecting the monitoring effect. Solving these problems is of great significance to improve the level of business monitoring. SUMMARY

[0005] In view of the problems in the prior art, the present application provides a charging service real-time monitoring method and device based on a business probe, which can effectively solve the deficiencies of traditional technology in data analysis, feature analysis and real-time monitoring, and significantly improve the intelligent level and early warning effect of charging service monitoring.

[0006] In order to solve at least one of the above problems, the present application provides the following technical scheme:

[0007] In a first aspect, the present application provides a charging service real-time monitoring method based on a business probe, comprising:

[0008] Deploying a network traffic collection device, deploying a network traffic collection device, acquiring data link layer network data stream from the charging station core switch through the network traffic collection device, layering and analyzing the network data stream according to application layer and transmission layer, extracting transaction flow information and business management information from the application layer, extracting device interaction information and vehicle identification information from the transmission layer, extracting business data transmission state information from the network layer, time sequence correlation of the extracted multi-layer data based on inter-layer data mapping relationship, generating business event chain, and constructing charging service portrait model from the business event chain;

[0009] Obtaining toll station device operation data and real-time business data, extracting hardware state features from the device operation data, extracting traffic flow distribution, toll peak regularity, and scene features of toll business indicators from the business data, performing feature fusion on the hardware state features and the scene features to obtain a multi-dimensional feature vector, training a neural network classifier using the multi-dimensional feature vector to obtain a business anomaly recognition model, analyzing abnormal events in the business event chain based on the business anomaly recognition model, and generating an abnormal event description vector;

[0010] A business real-time monitoring engine is constructed, and the business real-time monitoring engine is used to perform hierarchical analysis and correlation analysis on newly collected network data streams, extract hardware state features and scene features for feature fusion, input the fused feature vector into the business anomaly recognition model for abnormal analysis, and generate business anomaly warning information when an abnormal event is identified.

[0011] Further, it also includes: establishing a physical connection between the network traffic collection device and the mirror port of the toll station core switch, configuring the data cache size and sampling time interval of the network traffic collection device, starting the data collection process of the network traffic collection device, writing the collected real-time network data stream into the data cache area, performing packet fragmentation and reassembly on the network data stream in the data cache area, and constructing a complete network data stream;

[0012] An application layer analysis unit is constructed to extract transaction flow information and business management information, a transport layer analysis unit is constructed to extract device interaction information and vehicle identification information, and a data packet transmission state information is extracted by the application layer analysis unit. Based on the network layer analysis unit, the application layer analysis unit, the transport layer analysis unit, and the network layer analysis unit are connected in series to form a protocol analysis processing chain, the network data stream is input into each layer analysis unit in the protocol analysis processing chain in sequence, hierarchical analysis results are obtained, and the hierarchical analysis results are written into a data storage area according to a preset data format.

[0013] Further, it also includes: constructing an application layer to transport layer mapping matrix and a transport layer to network layer mapping matrix, calculating the correlation degree between different level data based on the mapping matrix, establishing a time sequence correlation relationship for data with a correlation degree higher than a preset threshold, combining multi-layer data with a time sequence correlation relationship to form a data link, sorting and merging the data link according to a time stamp, and generating a business event chain containing a complete business process;

[0014] According to the business event chain, four types of feature parameters of business type identification, business operation sequence, business processing time length and business state change are extracted, the feature parameters are input into a pre-trained deep learning model for feature vector conversion, a business portrait feature space is constructed based on the feature vector, business similarity clustering is calculated in the feature space, a business portrait clustering model is generated, and the business portrait clustering model is stored in a model library.

[0015] Further, the monitoring probe is connected to the toll station device system, the processor usage rate, memory occupancy rate, disk read-write rate and network traffic data in the device are acquired, the data are analyzed and normalized, hardware state feature indexes are constructed, the hardware state feature indexes are constructed into a feature matrix, and the feature matrix is processed to generate a hardware state feature vector.

[0016] The traffic flow distribution density and spatial distribution density are calculated from the real-time business database, the toll peak and valley period rules are identified, the ETC transaction success rate, ETC transaction time consumption, vehicle passing time, lane service incapability, billing accuracy, entrance information accuracy, license plate recognition accuracy, vehicle type recognition accuracy and data transmission integrity rate are extracted, the traffic flow distribution data, toll peak rule data and toll business index data are standardized, the hardware state feature vector and the standardized scene feature data are fused by using a feature weighting method, and a multi-dimensional feature vector is generated.

[0017] Further, a three-layer neural network structure is constructed, the multi-dimensional feature vector is input into the input layer of the neural network, a plurality of convolution kernels are set in the hidden layer to extract feature combinations, a softmax classifier is set in the output layer, a back propagation algorithm is used to iteratively optimize the neural network weights, the classification accuracy is calculated based on a verification data set, and the trained neural network classifier is saved as a business anomaly recognition model.

[0018] The business data in the business event chain are read, the multi-dimensional feature vector is input into the business anomaly recognition model, the type identification and confidence score of the abnormal event are acquired, the type identification and confidence score and the timestamp, device identification and operation sequence of the business event are combined to generate an abnormal event description vector, the abnormal event description vector is sorted according to the confidence score, and the sorting result is written into an abnormal event data table.

[0019] Further, further comprising: creating a data collection thread pool, a parsing processing thread pool and an analysis processing thread pool, starting a network data stream collection task in the data collection thread pool, distributing the collected network data stream to the parsing processing thread pool, calling the protocol parsing processing chain to perform hierarchical parsing on the network data stream, writing the parsing result to the shared memory area, reading the parsing result in the analysis processing thread pool for data correlation analysis;

[0020] Reading the parsed service data from the shared memory area, extracting the processor usage rate, memory occupancy rate, disk read-write rate and network traffic data in the device to construct a hardware state feature vector, extracting traffic distribution data, toll peak regularity data and toll service index data to construct a scene feature vector, and fusing the hardware state feature vector and the scene feature vector by using a feature weighting method to generate a multi-dimensional feature vector for real-time monitoring.

[0021] Further, further comprising: inputting the fused feature vector into the service anomaly recognition model in batches, obtaining a type identifier and a confidence score of an abnormal event, performing normalization processing on the confidence score, comparing the normalized score with a preset abnormal threshold, marking an event higher than the abnormal threshold as an abnormal event, and writing the feature vector, type identifier and confidence score of the abnormal event into an abnormal event cache area;

[0022] Reading the abnormal event data from the abnormal event cache area, extracting attribute information of the abnormal event such as occurrence time, device identifier, abnormal type and abnormal degree, matching the attribute information with a preset abnormal event description template, generating a standardized abnormal event description text, constructing a service anomaly early warning message containing the abnormal event description text, and pushing the service anomaly early warning message to an early warning information processing module.

[0023] In a second aspect, the application provides a toll service real-time monitoring device based on a service probe, comprising:

[0024] A model construction module is configured to deploy a network traffic collection device, acquire data link layer network data stream from a toll station core switch through the network traffic collection device, perform hierarchical parsing on the network data stream according to an application layer and a transport layer, extract transaction flow information and service management information from the application layer, extract device interaction information and vehicle identifier information from the transport layer, extract service data transmission state information from a network layer, perform time sequence correlation on the extracted multi-layer data based on an inter-layer data mapping relationship, generate a service event chain, and construct a toll service portrait model from the service event chain.

[0025] The abnormality description module is configured to acquire toll station equipment operation data and real-time service data, extract hardware state features from the equipment operation data, extract traffic flow distribution, toll peak regularity, and scene features of toll service indicators from the service data, perform feature fusion on the hardware state features and the scene features to obtain a multi-dimensional feature vector, train a neural network classifier using the multi-dimensional feature vector to obtain a service abnormality recognition model, analyze abnormal events in the service event chain based on the service abnormality recognition model, and generate an abnormal event description vector.

[0026] The service detection module is configured to construct a service real-time monitoring engine, perform hierarchical analysis and correlation analysis on newly collected network data streams using the service real-time monitoring engine, extract hardware state features and scene features for feature fusion, input the fused feature vector into the service abnormality recognition model for abnormality analysis, and generate service abnormality early warning information when an abnormal event is identified.

[0027] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the toll service real-time monitoring method based on the service probe.

[0028] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executable on a processor to implement the steps of the toll service real-time monitoring method based on the service probe.

[0029] In a fifth aspect, the present application provides a computer program product comprising a computer program / instruction, wherein the computer program / instruction is executable on a processor to implement the steps of the toll service real-time monitoring method based on the service probe.

[0030] As can be seen from the above technical solutions, the present application provides a toll service real-time monitoring method and device based on a service probe, which constructs a multi-layer data analysis mechanism, integrates data of application layer, session layer, and network layer, and realizes accurate construction of a service event chain. An abnormality recognition strategy based on multi-dimensional feature fusion is designed, hardware state features and scene features are combined, a neural network classifier is established for abnormal event analysis. A real-time monitoring engine is introduced, hierarchical analysis and correlation analysis are performed to dynamically early warn service abnormalities. The method effectively solves the deficiencies of traditional technologies in data analysis, feature analysis, and real-time monitoring, and significantly improves the intelligent level and early warning effect of toll service monitoring. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0032] Figure 1 The flowchart of the method for real-time monitoring of charging service based on service probe in the embodiments of the present application;

[0033] Figure 2 The structural diagram of the device for real-time monitoring of charging service based on service probe in the embodiments of the present application;

[0034] Figure 3 The structural diagram of the electronic device in the embodiments of the present application.

[0035] Reference signs:

[0036] Electronic device 9600, central processor 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver program storage unit 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0038] The acquisition, storage, use, processing and the like of data in the technical solutions of the present application all conform to the relevant provisions of national laws and regulations.

[0039] Taking into account the problems existing in the prior art, the present application provides a method and device for real-time monitoring of charging services based on business probes. By building a multi-layer data analysis mechanism and integrating data from the application layer, transport layer, and network layer, the precise construction of the business event chain is achieved. An anomaly identification strategy based on multi-dimensional feature fusion is designed, and a neural network classifier is established to analyze abnormal events in combination with hardware status features and scenario features. A real-time monitoring engine is introduced to dynamically warn of business anomalies through hierarchical analysis and correlation analysis. This method effectively solves the shortcomings of traditional technologies in data analysis, feature analysis, and real-time monitoring, and significantly improves the intelligence level and warning effect of charging business monitoring.

[0040] In order to effectively solve the deficiencies of traditional technologies in data parsing, feature analysis and real-time monitoring, and significantly improve the intelligence level and early warning effect of toll service monitoring, this application provides an embodiment of a toll service real-time monitoring method based on a service probe, see Figure 1 The real-time monitoring method for charging services based on service probes specifically includes the following contents:

[0041] Step S101: Deploy a network traffic collection device, obtain data link layer network data streams from the toll station core switch through the network traffic collection device, perform layered parsing on the network data streams according to the application layer and transport layer, extract transaction flow information and business management information from the application layer, extract device interaction information and vehicle identification information from the transport layer, extract business data transmission status information from the network layer, perform temporal correlation on the extracted multi-layer data based on the inter-layer data mapping relationship, generate a business event chain, and construct a toll business profile model from the business event chain;

[0042] Optionally, this embodiment addresses the issues of incomplete data collection, insufficient protocol parsing, and insufficient service relevance analysis in traditional toll service monitoring by innovatively designing a service monitoring solution based on multi-layer protocol analysis. This embodiment first deploys a high-performance network traffic collection device on the toll station core switch, using professional-grade network adapters and a large-capacity data cache to ensure stable collection of network data streams in high-concurrency scenarios. The device establishes a physical connection to the switch via a mirrored port and uses zero-packet-loss technology to capture network data packets in real time.

[0043] The embodiment deeply optimizes the protocol analysis mechanism. A layered analysis strategy is adopted to process network data flow: Protocol(data) = {App_layer, Session_layer, Network_layer}, where each layer represents the application layer, session layer and network layer protocol. The protocol recognition engine accurately identifies the protocol type of each layer, and customizes the protocol analysis rules for the charging business scenario. In particular, for encrypted communication, the system realizes data decryption through certificate management and key negotiation mechanism.

[0044] The embodiment innovatively realizes the application layer data extraction strategy. For transaction flow information, the system analyzes HTTP / HTTPS request response packets, extracts transaction amount, vehicle type category, payment method and other business fields. For business management information, by analyzing the application layer command word and status code, the system identifies the business operation type and processing result. The system pays special attention to abnormal status codes and timeout requests, which are of great value for discovering business exceptions.

[0045] The embodiment optimizes the session layer data analysis mechanism. By analyzing TCP / UDP session data, the system extracts the communication mode and interaction sequence between devices. The system records the complete process of session establishment, data transmission and session termination, and constructs a device interaction relationship graph. For vehicle identification information, the system extracts license plate number, ETC card number and other identity identifiers by analyzing session data, and establishes vehicle pass records.

[0046] The embodiment innovatively designs a network layer monitoring scheme. The system analyzes the transmission status of IP packets, including packet size, transmission delay, packet loss rate and other network performance indicators: Performance = Statistics(packet_size, delay, loss_rate), where each parameter represents packet size, transmission delay and packet loss rate. Through these indicators, the system can timely discover network congestion and transmission anomalies.

[0047] The embodiment deeply optimizes the data correlation mechanism. The system constructs inter-layer data mapping relationships, and establishes the correlation between different levels of data through session identification, timestamp, business identification and other key fields. The system uses a sliding window method to handle data time sequence, ensuring the integrity and continuity of business events. For complex multi-device interaction scenarios, the system analyzes and establishes a global data correlation view through a graph model.

[0048] The embodiment innovatively realizes the business portrait modeling strategy. Based on the correlation analysis results, the system constructs a business event chain and records the complete business processing flow. Through deep learning model analysis of business features in the event chain, including processing time sequence, operation mode, state transition and other features, the system establishes a multi-dimensional business portrait feature space and identifies typical business patterns through clustering analysis.

[0049] The embodiment realizes accurate profiling of tolling services through deep learning technology. Especially in handling complex business scenarios, it shows strong analysis capability. Through multi-level data collection and deep protocol analysis, the system can accurately restore the business processing process and provide reliable data foundation for abnormal monitoring. This monitoring scheme based on multi-level analysis significantly improves the accuracy and real-time performance of business monitoring.

[0050] The innovative design of the embodiment not only solves the data collection and analysis problem in traditional methods, but also establishes a sustainable optimization monitoring framework. Through continuous accumulation of data and dynamic optimization of models, the system can continuously improve the analysis capability of various business scenarios, providing strong support for tolling business management. This intelligent monitoring mechanism ensures that the system always maintains efficient monitoring capability and reliable analysis effect when facing complex and variable business scenarios.

[0051] Step S102: Obtain toll station equipment operation data and real-time business data, extract hardware state features from the equipment operation data, extract traffic flow distribution, toll peak regularity, and scene features of toll business indicators from the business data, perform feature fusion on the hardware state features and scene features to obtain a multi-dimensional feature vector, train a neural network classifier using the multi-dimensional feature vector to obtain a business anomaly recognition model, analyze abnormal events in the business event chain based on the business anomaly recognition model, and generate an abnormal event description vector;

[0052] Optionally, the embodiment innovatively designs an abnormality recognition scheme based on multi-dimensional feature fusion to solve the problems of incomplete feature extraction, insufficient scene analysis, and inaccurate anomaly recognition in traditional toll business monitoring. The embodiment first accesses various key devices of the toll station through monitoring probes, including toll terminals, servers, network devices, etc., to collect real-time device operation state data. At the same time, real-time business records are extracted from the business database to ensure the completeness and timeliness of the data.

[0053] The embodiment optimizes the hardware state feature extraction mechanism. Key performance indicators are extracted from the device operation data: Performance = Monitor(CPU, Memory, Disk, Network), where each parameter represents the processor usage, memory occupancy, disk read / write speed, and network traffic. By establishing a performance baseline, the system can timely detect device state abnormalities. Especially for high-load scenarios, by analyzing the trend of performance indicators, potential device failures can be predicted.

[0054] The embodiment innovatively realizes the scene feature analysis strategy. For the traffic flow distribution characteristics, the system uses time series analysis method to identify the flow change law of different time periods and different road sections. Through statistical modeling, the system finds the charging peak law, including typical scenes such as morning and evening peak, holiday peak, etc. For the charging business index factors, the system analyzes the impact of precipitation, visibility, temperature and other parameters on the business: Impact = Analysis(weather, visibility, temperature), wherein each parameter represents the influence degree of meteorological conditions on the charging business.

[0055] The embodiment optimizes the feature fusion mechanism. The attention mechanism is used to adaptively weight the fusion of hardware state features and scene features. The fusion process considers the importance and timeliness of different features, and ensures the accuracy of feature representation through dynamic weight adjustment. The system pays special attention to the correlation between features, such as the relationship between device load and traffic flow, the correlation between environmental factors and device performance, etc. This multi-dimensional feature fusion provides comprehensive data support for anomaly identification.

[0056] The embodiment innovatively designs the anomaly identification model training scheme. A deep neural network classifier is constructed, and a multi-layer perceptron structure is used to process high-dimensional feature data. The network structure includes feature extraction layer, attention layer and classification layer, and the automatic learning of abnormal patterns is realized through end-to-end training. Cross-validation method is used to evaluate the model performance during training, and the recognition accuracy is improved by adjusting network parameters.

[0057] The embodiment deeply optimizes the abnormal event analysis mechanism. The data in the business event chain is input into the trained anomaly identification model, and the model identifies potential abnormal situations by analyzing the feature patterns of event sequences. The system focuses on multiple types of anomalies, including device failure, network anomaly, business interruption, etc. For detected anomalies, the system generates detailed description vectors, recording key information such as anomaly type, occurrence time, impact range, etc.

[0058] The embodiment innovatively realizes the anomaly warning strategy. Based on the anomaly event description vector, the system constructs a warning mechanism, generates different levels of warning information according to the severity and impact range of the anomaly. The system establishes a warning rule library, which can flexibly adjust the warning threshold according to the specific scene. For urgent abnormal situations, the system pushes warning messages through multiple channels to ensure that operation and maintenance personnel can respond in time.

[0059] This embodiment realizes accurate identification of business exceptions through deep learning technology. Especially in handling complex scenarios, it shows strong analytical ability. Through multi-dimensional feature extraction and deep feature fusion, the system can accurately discover various abnormal situations, providing reliable guarantee for the stable operation of toll collection business. This recognition scheme based on deep learning significantly improves the accuracy and real-time performance of exception detection.

[0060] The innovative design of this embodiment not only solves the problem of exception identification in traditional methods, but also establishes a sustainable optimization monitoring framework. Through continuous accumulation of data and dynamic optimization of models, the system can continuously improve the identification ability of various abnormal scenarios, providing strong support for toll collection business management. This intelligent monitoring mechanism ensures that the system always maintains efficient monitoring ability and reliable early warning effect when facing complex and variable business scenarios.

[0061] Step S103: Construct a business real-time monitoring engine, use the business real-time monitoring engine to perform hierarchical analysis and correlation analysis on newly collected network data streams, extract hardware state features and scene features for feature fusion, input the fused feature vector into the business exception identification model for exception analysis, and generate business exception warning information when an abnormal event is identified.

[0062] Optionally, to solve the problems of poor real-time performance, low analysis efficiency, and untimely warning in traditional toll collection business monitoring, this embodiment innovatively designs a real-time monitoring scheme based on multi-threading. This embodiment first constructs a high-performance business monitoring engine, adopts a multi-thread parallel processing architecture, including a data acquisition thread pool, an analysis processing thread pool, and an analysis processing thread pool. Each thread pool dynamically adjusts the number of threads according to the CPU core number and business load to ensure optimal resource utilization.

[0063] This embodiment optimizes the data processing mechanism. The zero-copy technology is used to realize efficient collection of network data streams: Data_Flow = Capture(network, buffer), where network is the network interface and buffer is the data buffer. Shared memory is used to realize data transmission between threads, minimizing data copy overhead. The system uses batch processing mode to organize continuous collected data packets into data batches, improving processing throughput.

[0064] This embodiment innovatively realizes the protocol analysis strategy. In the analysis processing thread pool, multiple protocol analysis tasks are executed in parallel, including application layer, session layer and network layer data extraction. For different protocol types, the system dynamically loads the corresponding analysis module to improve the analysis efficiency. Especially for encrypted traffic, the system reduces the decryption overhead through the session key cache mechanism. For abnormal data packets, fault-tolerant processing is used to ensure the stability of the analysis process.

[0065] This embodiment optimizes the feature extraction mechanism. Parallel acquisition of device operation data and scene data, real-time calculation of hardware status features: Hardware = Status(CPU, Memory, Disk, Network), where each parameter represents processor usage, memory occupancy, disk read / write speed and network traffic. The system smooths the performance indicators by sliding window method, reducing the impact of instantaneous fluctuations. At the same time, continuously monitor traffic changes and environmental conditions, update scene feature information.

[0066] This embodiment innovatively designs a feature fusion scheme. Adaptive weight mechanism is used to fuse hardware status features and scene features, and the weight coefficient is dynamically adjusted according to the importance of the features. The system considers the correlation between features and optimizes feature combination through correlation analysis. For different types of abnormal patterns, use differentiated feature weight configuration to improve the accuracy of anomaly identification.

[0067] This embodiment deeply optimizes the anomaly analysis mechanism. The fused feature vector is batch input into the pre-trained anomaly recognition model, and GPU acceleration is used to realize fast inference. The model outputs the anomaly type and confidence score, and the system filters low-confidence anomaly events through a dynamic threshold mechanism. For continuous occurrence of similar anomalies, use event aggregation strategy to reduce redundant warnings.

[0068] This embodiment innovatively realizes the warning generation strategy. The system generates standardized warning text according to the attribute information of the anomaly event and the preset template, including event occurrence time, device location, anomaly type and processing suggestions. The warning message is delivered reliably through the message queue mechanism to ensure that critical warnings are not lost. The system supports dynamic adjustment of warning levels, and sets different warning priorities according to the impact range and urgency of the anomaly event.

[0069] This embodiment realizes real-time monitoring of tolling services through multi-thread parallel technology. Especially in high-concurrency business scenarios, it shows strong processing capacity. Through efficient data processing and real-time anomaly analysis, the system can quickly discover and warn business anomalies, providing timely decision support for tolling business management. This monitoring scheme based on parallel processing significantly improves the real-time performance and reliability of business monitoring.

[0070] The innovative design of this embodiment not only solves the real-time processing problem in traditional methods, but also establishes a scalable monitoring framework. By optimizing the multi-threaded architecture and improving the processing flow, the system can adapt to the ever-growing business scale and provide reliable guarantees for the stable operation of charging services. This intelligent monitoring mechanism ensures that the system always maintains efficient monitoring capabilities and rapid response effects when facing complex and changing business scenarios. In particular, through parallel processing and real-time early warning, the system can issue timely warnings at the early stages of anomalies, effectively reducing business risks.

[0071] As can be seen from the above description, the real-time monitoring method for charging services based on business probes provided in the embodiment of the present application can realize the accurate construction of the business event chain by building a multi-layer data analysis mechanism and integrating data from the application layer, session layer and network layer. An anomaly identification strategy based on multi-dimensional feature fusion is designed, and a neural network classifier is established to analyze abnormal events in combination with hardware status features and scenario features. A real-time monitoring engine is introduced to dynamically warn of business anomalies through hierarchical analysis and correlation analysis. This method effectively solves the shortcomings of traditional technologies in data analysis, feature analysis and real-time monitoring, and significantly improves the intelligence level and warning effect of charging service monitoring.

[0072] In one embodiment of the method for real-time monitoring of charging services based on service probes of the present application, the following contents may also be specifically included:

[0073] Step S201: Establishing a physical connection between a network traffic collection device and a mirror port of a core switch at a toll station, configuring a data cache size and a sampling interval for the network traffic collection device, starting a data collection process for the network traffic collection device, writing the collected real-time network data stream into a data cache area, and performing data packet fragmentation and reassembly on the network data stream in the data cache area to construct a complete network data stream;

[0074] Step S202: construct an application layer parsing unit to extract transaction flow information and business management information, construct a transport layer parsing unit to extract device interaction information and vehicle identification information, construct a network layer parsing unit to extract data packet transmission status information, connect the application layer parsing unit, transport layer parsing unit, and network layer parsing unit in series to form a protocol parsing processing chain, input the network data stream into each layer parsing unit in the protocol parsing processing chain in turn, obtain a layered parsing result, and write the layered parsing result into the data storage area according to a preset data format.

[0075] Optionally, the embodiment is directed to the problems of unstable data collection, incomplete data analysis, and insufficient protocol analysis in traditional toll business monitoring, and a data collection and analysis scheme based on multi-layer protocol is innovatively designed. The embodiment first deploys a high-performance network traffic collection device at the toll station, uses a professional network adapter to support 10 Gbps high-speed data collection. The collection device is physically connected to the mirror port of the core switch through an optical fiber cable to ensure the stability and reliability of data transmission.

[0076] The embodiment deeply optimizes the data caching mechanism. The data cache size is dynamically adjusted based on real-time traffic monitoring results: Buffer_Size = Base_Size × (1 + α × Flow_Rate), where Base_Size is the basic cache size, α is the adjustment coefficient, and Flow_Rate is the current traffic rate. The sampling time interval is adaptively adjusted according to the business peak and valley characteristics, the sampling interval is shortened during the business peak period, and the interval is appropriately lengthened during the trough period, which ensures data integrity and optimizes storage efficiency.

[0077] The embodiment innovatively realizes the data fragment reorganization strategy. For large-scale network data flow, a multi-level cache structure is used, and independent receiving and processing buffers are set. The system identifies fragment packets through packet header information and establishes a fragment mapping table to record fragment sequence numbers and offsets: Fragment_Map = {Packet_ID, Offset, Length,Flag}, where each field represents the packet identifier, offset, length, and integrity flag. Based on the mapping table information, accurate fragment reorganization is performed.

[0078] The embodiment optimizes the application layer analysis mechanism. An application layer analysis unit is constructed to specifically handle application layer protocols related to toll business. The protocol recognition engine analyzes the data packet content to extract business information such as transaction amount, vehicle type, and payment method. For encrypted communication, the system implements data decryption through certificate management and key negotiation mechanisms. The analysis unit can also identify business command words and status codes to analyze business processing results.

[0079] The embodiment innovatively designs a session layer analysis scheme. The transport layer analysis unit establishes a complete device interaction view by tracking TCP / UDP session status. The system records the process of session establishment, data transmission, and session termination, and extracts key information such as device identification, communication timing, and interaction mode. For vehicle identification information, special analysis rules are used to extract license plate numbers and ETC card numbers.

[0080] The embodiment deeply optimizes the network layer monitoring mechanism. The network layer analysis unit is responsible for analyzing the transmission state of IP packets, including packet size, transmission delay, packet loss rate and other performance indicators. The system monitors the network state changes in real time by establishing a performance baseline model. It pays special attention to network congestion, transmission interruption and other abnormal situations, providing network environment reference for upper layer business analysis.

[0081] The embodiment innovatively realizes the design of protocol analysis chain. The three-layer analysis unit is connected in series according to the protocol level, building a complete analysis processing pipeline. The data stream passes through the network layer, session layer and application layer in turn, and each layer of analysis result saves the necessary context information, which is convenient for subsequent correlation analysis. The system uses multi-thread parallel processing mechanism to improve the analysis efficiency.

[0082] The embodiment realizes the accurate extraction of business data through hierarchical analysis technology. Especially in the processing of complex business scenarios, it shows strong analysis ability. Through multi-level protocol analysis and data correlation, the system can accurately restore the business processing process and provide reliable data basis for abnormal monitoring. This monitoring scheme based on multi-layer analysis significantly improves the completeness of data collection and the accuracy of analysis.

[0083] The innovative design of the embodiment not only solves the problems of data collection and analysis in traditional methods, but also establishes a sustainable optimization processing framework. Through continuous accumulation of data and dynamic optimization of analysis rules, the system can continuously improve the analysis ability of various business scenarios, providing strong support for charging business management. This intelligent analysis mechanism ensures that the system always maintains efficient collection ability and reliable analysis effect when facing complex and variable business scenarios. At the same time, the pre-set data format specification ensures the standardized storage of analysis results, which is convenient for subsequent data analysis and application.

[0084] In an embodiment of the charging business real-time monitoring method based on business probe provided in the present application, the following contents can be specifically included:

[0085] Step S301: Construct the mapping matrix from application layer to session layer and the mapping matrix from session layer to network layer, calculate the correlation degree between data at different levels based on the mapping matrix, establish time sequence correlation relationship for data with correlation degree higher than the preset threshold, combine multi-layer data with time sequence correlation relationship to form data link, sort and merge the data link according to time stamp, and generate business event chain containing complete business process;

[0086] Step S302: According to the service event chain, four types of feature parameters of service type identification, service operation sequence, service processing time length, and service state change are extracted, the feature parameters are input into a pre-trained deep learning model for feature vector conversion, a service portrait feature space is constructed based on the feature vector, service similarity clustering is calculated in the feature space, a service portrait clustering model is generated, and the service portrait clustering model is stored in a model library.

[0087] Optionally, the embodiment innovatively designs a service portrait construction scheme based on multi-layer mapping to solve the problems of poor data correlation, incomplete service feature extraction, and inaccurate portrait modeling in traditional charging service monitoring. The embodiment first establishes a mapping relationship of multi-layer protocol data, and constructs an inter-layer mapping matrix using a sparse matrix representation method: M(i,j) = Correlation(Layer_i, Layer_j), where Layer_i and Layer_j represent data items of adjacent protocol layers, and Correlation represents the correlation strength between data items.

[0088] The embodiment optimizes the correlation degree calculation mechanism. By analyzing the time sequence dependence, content association, and business logic between data items, a multi-dimensional correlation evaluation model is established. The model considers multiple factors such as service field mapping, session identification association, and data packet sequence relationship. For example, when analyzing transaction flow, the system associates transaction information at the application layer with device interaction records at the session layer through session identification, and then incorporates related network layer transmission state data into the association link through timestamps.

[0089] The embodiment innovatively realizes the time sequence correlation strategy. The sliding window method is used to process the time sequence of data, and the window size is dynamically adjusted according to the business processing delay. The system aligns data at different levels through timestamps to establish accurate time sequence relationships. For data items with a correlation degree exceeding a preset threshold, the system establishes a time sequence association link to form a complete data processing link. This time sequence-based correlation method can accurately restore the complete process of business processing.

[0090] The embodiment optimizes the service event chain generation mechanism. The associated data link is sorted according to the timestamp, and a merging algorithm is used to process overlapping time windows. The system tracks the business processing flow through a state machine model to ensure the continuity and integrity of the event chain. Especially for complex business scenarios such as distributed processing or asynchronous operations, the system ensures the accuracy of the event chain through context association.

[0091] This embodiment innovatively designs a feature parameter extraction scheme. It extracts four key feature parameters from the business event chain: the business type identifier reflects the nature of the business, the operation sequence records the processing steps, the processing duration indicates execution efficiency, and the state change indicates the processing results. The system uses a feature extractor to standardize these parameters and construct a standardized feature representation. Specifically for abnormal business processes, anomalous patterns are identified by analyzing the state change sequence.

[0092] This embodiment deeply optimizes the feature vector conversion mechanism. A pre-trained deep learning model is used to convert feature parameters into fixed-dimensional feature vectors. The model uses a multi-layer neural network to learn the intrinsic representation of features, capturing key patterns in business processing. The conversion process considers the correlation between features and uses an attention mechanism to highlight the impact of important features. For example, higher attention weight is assigned to state changes in key business steps.

[0093] This embodiment innovatively implements a business profiling modeling strategy. It uses an improved clustering algorithm in the feature space to analyze business patterns and identify typical business processing patterns. The system calculates the similarity between feature vectors and clusters similar business processes. The clustering results reflect the main patterns and variations of business processing, providing a benchmark for anomaly detection.

[0094] This embodiment uses deep learning technology to accurately profile business processes. It demonstrates powerful feature extraction and pattern recognition capabilities, particularly when handling complex business scenarios. Through multi-level data association and deep feature learning, the system accurately captures key features of business processes and provides reliable model support for anomaly monitoring. This deep learning-based profiling solution significantly improves the accuracy and efficiency of business analysis.

[0095] The innovative design of this embodiment not only solves the feature extraction and modeling issues of traditional methods, but also establishes a continuously optimized portrait framework. Through the continuous accumulation of data and dynamic optimization of models, the system can continuously improve its analysis capabilities for various business scenarios, providing strong support for fee-based business management. This intelligent portrait mechanism ensures that the system maintains efficient analysis capabilities and reliable modeling results when facing complex and changing business scenarios.

[0096] In one embodiment of the method for real-time monitoring of charging services based on service probes of the present application, the following contents may also be specifically included:

[0097] Step S401: Connect the monitoring probe to the toll station equipment system, obtain the equipment processor usage rate, memory occupancy rate, disk read and write rate, and network traffic data in real time, construct hardware status characteristic indicators, construct the hardware status characteristic indicators into a characteristic matrix, and perform dimensionality reduction processing on the characteristic matrix to generate a hardware status characteristic vector;

[0098] Step S402: read the service flow table data from the real-time service database, calculate the time distribution density and spatial distribution density of the traffic flow, identify the charging peak and valley period rules, extract the precipitation, visibility, temperature data in the meteorological monitoring data, standardize the traffic flow distribution data, charging peak rule data, and charging service index data, fuse the hardware state feature vector and the standardized scene feature data by using the feature weighting method, and generate a multi-dimensional feature vector.

[0099] Optionally, the embodiment innovatively designs a data processing scheme based on multi-dimensional feature fusion to solve the problems of incomplete feature extraction, non-standard data processing, and insufficient scene analysis in traditional charging service monitoring. The embodiment first accesses various key devices of the toll station, including charging terminals, servers, network devices, etc. through special monitoring probes. The probe adopts a lightweight design to minimize the impact on the business system and collects device operation data in real time through a standard interface.

[0100] The embodiment optimizes the hardware state monitoring mechanism. A multi-dimensional performance index collection strategy is adopted: Performance = Monitor(CPU, Memory, Disk, Network), where each parameter represents the processor usage, memory occupancy, disk read / write speed, and network traffic. The system performs smoothing processing on the performance data through a sliding window method to eliminate the impact of transient fluctuations. For sudden performance fluctuations, an outlier detection algorithm is used for identification and processing.

[0101] The embodiment innovatively implements a data normalization strategy. For data differences of different devices and different indicators, an adaptive normalization method is adopted: Normalized = (Raw - Min) / (Max - Min), where Raw is the original data, Min and Max are the real-time minimum and maximum values of the indicator respectively. By establishing a dynamic baseline, the system can accurately reflect the relative level of device performance. In particular, for newly deployed devices, the performance baseline is gradually established through incremental learning.

[0102] The embodiment optimizes the feature matrix construction mechanism. The normalized hardware state indicators are organized into a multi-dimensional feature matrix, with each row representing a state snapshot at a time point and each column corresponding to a performance indicator. Through principal component analysis, the feature matrix is reduced in dimension, retaining the main feature information while reducing data redundancy. The system pays special attention to the correlation between indicators and optimizes feature selection through correlation analysis.

[0103] The embodiment innovatively designs a scene feature analysis scheme. Traffic flow distribution features are extracted from real-time business data, and time series analysis methods are used to identify the spatio-temporal distribution rules of traffic flow. The system uses a density clustering algorithm to analyze the spatial distribution characteristics of traffic flow and identifies dense and sparse areas of traffic flow. For peak charging rules, periodic analysis methods are used to find traffic characteristics at different times.

[0104] The embodiment deeply optimizes the meteorological data processing mechanism. The system analyzes the impact of environmental factors such as precipitation, visibility, and temperature on charging business. By establishing a meteorological impact model, the influence of different weather conditions on business processing efficiency is quantified. In particular, for adverse weather conditions, the system improves the reliability of environmental features through multi-source data fusion.

[0105] The embodiment innovatively realizes a feature fusion strategy. An adaptive weight mechanism is used to fuse hardware state features and scene features: Fusion = w1 Hardware + w2 Scene, where w1, w2 are dynamic weight coefficients, Hardware is the hardware state feature vector, and Scene is the scene feature vector. The weight coefficients are automatically adjusted through machine learning methods to ensure that the fused features accurately reflect the overall state of the business scene.

[0106] The embodiment realizes accurate modeling of business scenes through deep learning technology. In particular, in handling complex scenes, it shows strong feature expression ability. Through multi-dimensional feature extraction and deep feature fusion, the system can accurately depict the business running state and provide a reliable data basis for anomaly monitoring. This multi-dimensional feature-based analysis scheme significantly improves the accuracy and comprehensiveness of business monitoring.

[0107] The innovative design of the embodiment not only solves the feature extraction and fusion problem in traditional methods, but also establishes a sustainable optimization feature analysis framework. Through continuous accumulation of data and dynamic optimization of features, the system can continuously improve the expression ability of various business scenes, providing strong support for charging business management. This intelligent feature processing mechanism ensures that the system always maintains efficient feature extraction and reliable fusion effect when facing complex and variable business scenes.

[0108] In an embodiment of the charging business real-time monitoring method based on business probes in the present application, the following content can also be specifically included:

[0109] Step S501: A three-layer neural network structure is constructed, the multi-dimensional feature vector is input into the input layer of the neural network, a plurality of convolution kernels are set in the hidden layer to extract feature combinations, a softmax classifier is set in the output layer, an iterative optimization is performed on the neural network weight by using a back propagation algorithm, a classification accuracy is calculated based on a verification data set, and the trained neural network classifier is saved as a service exception identification model;

[0110] Step S502: The service data in the service event chain is read, a multi-dimensional feature vector is extracted to input the service exception identification model, a type identification and a confidence score of an abnormal event are obtained, the type identification and the confidence score are combined with a time stamp, a device identification, and an operation sequence of the service event to generate an abnormal event description vector, the abnormal event description vector is sorted according to the confidence score, and the sorting result is written into an abnormal event data table.

[0111] Optionally, the embodiment innovatively designs an abnormality identification scheme based on deep learning to solve the problems of incomplete feature extraction, inaccurate abnormality identification, and untimely early warning in traditional charging service monitoring. The embodiment first constructs a three-layer neural network structure, the dimension of the input layer is matched with the dimension of the feature vector, the hidden layer adopts a multi-channel convolution structure, and the output layer uses a softmax classifier. The network structure design follows the characteristics of abnormality identification, and the recognition accuracy is improved through deep feature extraction.

[0112] The embodiment optimizes the feature learning mechanism. A multi-scale convolution kernel is set in the hidden layer: Conv(x) = σ(W× x + b), where W is the convolution kernel weight, b is the bias term, σ is the activation function, and x is the input feature. The local correlation of the feature is captured through convolution kernels of different sizes to realize multi-granularity feature extraction. For example, a small-size convolution kernel focuses on the instantaneous change of the hardware state, and a large-size convolution kernel captures the long-term trend of the service traffic.

[0113] The embodiment innovatively realizes the classifier optimization strategy. A softmax classifier is used in the output layer to calculate the probability distribution of each type of abnormality, and the model training is guided by the cross-entropy loss function. An adaptive learning rate adjustment strategy is adopted in the back propagation process to dynamically adjust the parameter update step according to the loss change. The system accelerates the training convergence through the batch normalization technology, and prevents overfitting by using the dropout mechanism.

[0114] The embodiment optimizes the model verification mechanism. The K-fold cross-validation method is used to evaluate the model performance, and the recognition effect of different types of abnormalities is analyzed through the confusion matrix. The system pays special attention to the recognition accuracy of high-risk abnormalities, and improves the recognition performance of key abnormalities by adjusting the class weight. For newly emerging abnormal patterns, the model parameters are updated through the incremental learning method.

[0115] The embodiment innovatively designs an abnormal event description scheme. The type identification and confidence score output by the model are combined with the context information of the business event to construct a structured abnormal event description. The description vector contains complete information in the time, space, and business dimensions, facilitating subsequent analysis and processing. The system determines the processing priority of the abnormality through confidence sorting.

[0116] The embodiment deeply optimizes the feature extraction mechanism. Real-time monitoring of hardware state indicators, including processor usage, memory occupancy, disk read / write rate, and network traffic. Through data cleaning and normalization processing, a standardized hardware state feature matrix is constructed. The system uses principal component analysis method for dimension reduction, retaining key feature dimensions while reducing redundant information.

[0117] The embodiment innovatively realizes scene feature analysis. From real-time data, traffic distribution patterns are mined to identify peak and valley periods of toll collection. External factor influences are analyzed in combination with toll business indicator data, and comparability of different dimension features is ensured through standardization processing. The system uses a weighted fusion method to integrate hardware state and scene features to generate a comprehensive feature representation.

[0118] The embodiment realizes accurate identification of business anomalies through deep learning technology. In particular, in handling complex scenarios, it shows strong feature learning and pattern recognition capabilities. Through multi-level feature extraction and deep neural network learning, the system can accurately identify various abnormal situations, providing reliable decision support for toll business management. This deep learning-based identification scheme significantly improves the accuracy and real-time performance of anomaly detection.

[0119] The innovative design of the embodiment not only solves the problems of feature extraction and anomaly identification in traditional methods, but also establishes a sustainable optimization monitoring framework. Through continuous accumulation of data and dynamic optimization of models, the system can continuously improve its ability to identify various abnormal scenarios, providing reliable protection for the stable operation of toll business. This intelligent monitoring mechanism ensures that the system always maintains efficient recognition ability and reliable early warning effect when facing complex and variable business scenarios.

[0120] In an embodiment of the toll business real-time monitoring method based on business probes in the present application, the following content can be specifically included:

[0121] Step S601: Create a data collection thread pool, a parsing processing thread pool, and an analysis processing thread pool, start a network data stream collection task in the data collection thread pool, distribute the collected network data stream to the parsing processing thread pool, call the protocol parsing processing chain to perform hierarchical parsing on the network data stream, and write the parsing result to a shared memory area. In the analysis processing thread pool, read the parsing result for data correlation analysis;

[0122] Step S602: reading the parsed service data from the shared memory area, extracting the processor usage, memory occupancy, disk read / write rate, and network traffic data in the device to construct a hardware state feature vector, extracting the traffic distribution data, toll peak regularity data, and toll service index data to construct a scene feature vector, and fusing the hardware state feature vector and the scene feature vector by using a feature weighting method to generate a multi-dimensional feature vector for real-time monitoring.

[0123] Optionally, the embodiment innovatively designs a real-time processing scheme based on multi-threading to solve the problems of low processing efficiency, unreasonable resource utilization, and untimely feature extraction in traditional toll service monitoring. The embodiment first constructs an efficient thread pool management architecture, including three independent thread pools for data collection, parsing processing, and analysis processing. The size of the thread pool is dynamically configured according to the number of CPU cores: Pool_Size = CPU_Cores × (1 + Load_Factor), where CPU_Cores is the number of processor cores and Load_Factor is the load factor.

[0124] The embodiment deeply optimizes the data collection mechanism. The zero-copy data collection strategy is implemented in the data collection thread pool, and the data transmission overhead is minimized through the direct memory access technology. The collection thread monitors the network interface in a polling manner, and triggers the collection operation immediately when new data is detected. The system manages the collection requests through a task queue to ensure the stability of data collection in a high-concurrency scenario. In particular, for sudden data traffic, the number of collection threads is dynamically adjusted to adapt to changes in load.

[0125] The embodiment innovatively implements the parsing processing strategy. The parsing processing thread pool is responsible for executing protocol parsing tasks, and the processing efficiency is improved by using a pipeline design. Each parsing thread is equipped with an independent parsing context, and concurrent parsing requests are processed through a context switching mechanism. The system uses task fragmentation technology to decompose large-scale data streams into appropriate size data blocks for parallel parsing. For complex protocol parsing, the parsing speed is improved by caching parsing rules.

[0126] The embodiment optimizes the memory management mechanism. The parsed results are stored in a shared memory area, and the data sharing is efficiently implemented through the memory mapping technology: Memory_Map = Map(Shared_Memory, Access_Mode), where Shared_Memory is the shared memory area and Access_Mode is the access mode. The system uses the read-write lock mechanism to protect shared data and ensures the thread safety of data access. In particular, for frequently accessed data, the memory pre-allocation strategy is used to reduce the dynamic allocation overhead.

[0127] The data analysis scheme is innovatively designed in this embodiment. The analysis processing thread pool is responsible for executing data correlation analysis tasks, and the data access efficiency is optimized through multi-level caching. The system extracts hardware state features in real time, including processor usage, memory occupancy, disk read / write speed, network traffic and other performance indicators. Through the sliding window method, the performance data is aggregated in real time to generate a feature vector reflecting the device state.

[0128] The scene feature construction mechanism is deeply optimized in this embodiment. The system processes traffic distribution data, peak charging rule data and charging business indicator data in parallel, and identifies business features through time series analysis method. For traffic data, the density estimation algorithm is used to calculate the spatio-temporal distribution features. The system pays special attention to the influence of environmental factors, and improves the reliability of scene features through multi-source data fusion.

[0129] The feature fusion strategy is innovatively implemented in this embodiment. The adaptive weight mechanism is used to fuse hardware state features and scene features, and the weight coefficient is dynamically adjusted through real-time performance evaluation. The system considers the timeliness of features, and gives greater weight to features with high real-time requirements. The feature fusion process uses parallel computing method to ensure real-time performance in large-scale data processing scenarios.

[0130] This embodiment realizes real-time processing of business data through multi-thread parallel technology. Especially in the processing of high-concurrency business scenarios, it shows strong processing capacity. Through efficient thread management and data processing, the system can quickly extract and fuse various features to provide real-time data support for anomaly monitoring. This monitoring scheme based on parallel processing significantly improves the real-time performance and accuracy of business monitoring.

[0131] The innovative design of this embodiment not only solves the processing efficiency problem in traditional methods, but also establishes a scalable real-time processing framework. Through optimization of multi-thread architecture and improvement of processing flow, the system can adapt to the growing business scale and provide reliable guarantee for real-time monitoring of toll business. This intelligent processing mechanism ensures that the system always maintains high processing capacity and reliable analysis effect when facing complex and variable business scenarios.

[0132] In an embodiment of the toll business real-time monitoring method based on business probes provided in the present application, the following contents can be specifically included:

[0133] Step S701: input the fused feature vector into the business anomaly recognition model in batches, obtain the type identification and confidence score of the abnormal event, normalize the confidence score, compare the normalized score with the preset abnormal threshold, mark the events higher than the abnormal threshold as abnormal events, and write the feature vector, type identification and confidence score of the abnormal event into the abnormal event cache area;

[0134] Step S702: reading abnormal event data from the abnormal event cache area, extracting the occurrence time, device identifier, abnormal type, abnormal degree, and other attribute information of the abnormal event, matching the attribute information with a preset abnormal event description template, generating a standardized abnormal event description text, constructing a business abnormality early warning message containing the abnormal event description text, and pushing the business abnormality early warning message to the early warning information processing module.

[0135] Optionally, the embodiment innovatively designs a batch processing-based abnormality early warning scheme to address the low abnormality recognition efficiency, non-standard early warning description, and untimely response in traditional charging business monitoring. The embodiment first performs batch processing on the fused feature vectors, uses an efficient data batch processing mechanism, and realizes fast model inference through GPU acceleration. The batch processing size is dynamically adjusted according to real-time business load, which optimizes the utilization of computing resources while ensuring real-time performance.

[0136] The embodiment deeply optimizes the confidence evaluation mechanism. The confidence score is mapped to a unified interval through normalization processing: Score_norm = (Score - Min_score) / (Max_score - Min_score), where Score is the original confidence score, and Min_score and Max_score are the real-time minimum and maximum scores, respectively. The system uses an adaptive threshold strategy to dynamically adjust the abnormality determination standard according to the characteristics of the business scenario. For example, the threshold is appropriately increased during the business peak period to reduce false positives, and the threshold is reduced during the trough period to improve sensitivity.

[0137] The embodiment innovatively realizes the abnormal event cache strategy. A hierarchical storage structure is used to manage abnormal event data, with high-priority events stored in a fast access area to ensure fast response to critical abnormalities. The cache area uses a ring buffer design and manages the life cycle of event data through a sliding window method. The system optimizes storage space utilization through data compression techniques and periodically archives real-time event data.

[0138] The embodiment optimizes the event attribute extraction mechanism. Multi-dimensional attribute information is extracted from abnormal event data, including time dimension (occurrence time, duration), spatial dimension (device location, impact range), business dimension (abnormal type, severity), and the like. The system discovers the causal relationship between events through attribute association analysis and identifies chain failures and potential risks.

[0139] The embodiment innovatively designs an event description generation scheme. A multi-level abnormal event description template is constructed, and a description format is customized for different types of abnormalities. The template includes fixed fields and variable fields, and accurate and standardized description text is generated through parameter substitution: Description = Template(Time, Device, Type, Level), where each parameter represents the abnormal event time, device identifier, abnormal type, and severity level.

[0140] The embodiment deeply optimizes the early warning message construction mechanism. The event description text is integrated with related context information to form a structured early warning message. The early warning message contains multiple information levels, from summary to detail, facilitating quick understanding of abnormal situations by receivers with different roles. The system sets message priority according to the severity of the abnormality, ensuring that important early warnings are handled first.

[0141] The embodiment innovatively realizes the early warning push strategy. Based on the message queue mechanism, reliable early warning delivery is realized, and multi-level caching is used to ensure that messages are not lost. The system supports multi-channel push, including system internal notification, SMS, email, etc., and selects the appropriate push method according to the role and scenario of the receiver. For emergency abnormalities, the system ensures timely delivery of early warning information through backup channels.

[0142] The embodiment realizes efficient processing of abnormal events through pipeline processing technology. In particular, in the processing of high-concurrency abnormalities, it shows strong processing capacity. Through multi-stage data processing and intelligent early warning generation, the system can quickly respond to various abnormal situations, providing timely early warning support for toll business management. This pipeline-based processing scheme significantly improves the real-time and reliability of abnormal early warning.

[0143] The innovative design of the embodiment not only solves the problem of early warning processing in traditional methods, but also establishes an extensible early warning framework. Through continuous optimization of early warning templates and improvement of push mechanisms, the system can continuously improve its response capability to various abnormal scenarios, providing reliable protection for the stable operation of toll businesses. This intelligent early warning mechanism ensures that the system always maintains efficient processing capacity and reliable early warning effect when facing complex and variable business scenarios.

[0144] In order to effectively solve the deficiencies of traditional technology in data analysis, feature analysis, and real-time monitoring, and significantly improve the intelligent level and early warning effect of toll business monitoring, the present application provides an embodiment of a business probe-based toll business real-time monitoring device for implementing all or part of the content of the business probe-based toll business real-time monitoring method, as shown in Figure 2 , the business probe-based toll business real-time monitoring device specifically includes the following content:

[0145] a model construction module 10 configured to deploy a network traffic collection device, acquire data link layer network data streams from a toll station core switch through the network traffic collection device, perform hierarchical analysis on the network data streams according to application layers and transport layers, extract transaction flow information and service management information from the application layers, extract device interaction information and vehicle identification information from the transport layers, extract service data transmission state information from network layers, perform time sequence correlation on the extracted multi-layer data based on inter-layer data mapping relationships, generate a service event chain, and construct a toll service portrait model from the service event chain;

[0146] an anomaly description module 20 configured to acquire toll station device operation data and real-time service data, extract hardware state features from the device operation data, extract traffic flow distribution, toll peak regularity, and scene features of toll service indicators from the service data, perform feature fusion on the hardware state features and the scene features to obtain a multi-dimensional feature vector, train a neural network classifier using the multi-dimensional feature vector to obtain a service anomaly recognition model, analyze abnormal events in the service event chain based on the service anomaly recognition model, and generate an abnormal event description vector;

[0147] a service detection module 30 configured to construct a service real-time monitoring engine, perform hierarchical analysis and correlation analysis on newly collected network data streams using the service real-time monitoring engine, extract hardware state features and scene features for feature fusion, input the fused feature vector into the service anomaly recognition model for anomaly analysis, and generate service anomaly early warning information when an abnormal event is identified.

[0148] As can be seen from the above description, the toll service real-time monitoring device based on a service probe provided by the embodiments of the present application can accurately construct a service event chain by constructing a multi-layer data analysis mechanism and integrating data of application layers, session layers, and network layers. An abnormal event analysis is performed by designing an abnormal recognition strategy based on multi-dimensional feature fusion, combining hardware state features and scene features, and establishing a neural network classifier. A real-time monitoring engine is introduced to dynamically warn of service anomalies through hierarchical analysis and correlation analysis. This method effectively solves the deficiencies of traditional technologies in data analysis, feature analysis, and real-time monitoring, and significantly improves the intelligent level and early warning effect of toll service monitoring.

[0149] From the hardware aspect, in order to effectively solve the deficiencies of traditional technologies in data analysis, feature analysis, and real-time monitoring, and significantly improve the intelligent level and early warning effect of toll service monitoring, the present application provides an embodiment of an electronic device for implementing all or part of the contents of the toll service real-time monitoring method based on a service probe, which specifically includes the following contents:

[0150] The processor, the memory, the communications interface, and the bus; wherein the processor, the memory, the communications interface complete the mutual communication through the bus; the communications interface is used for realizing the information transmission between the service probe based charging service real-time monitoring device and the core service system, the user terminal, and the related database and other related equipment; the logic controller can be a desktop computer, a tablet computer, a mobile terminal and the like, and the embodiment is not limited thereto. In the embodiment, the logic controller can be implemented with reference to the embodiment of the service probe based charging service real-time monitoring method and the embodiment of the service probe based charging service real-time monitoring device, the contents of which are incorporated herein, and the repeated parts will not be described herein.

[0151] It can be understood that the user terminal can include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, and the like. The smart wearable device can include smart glasses, a smart watch, a smart bracelet, and the like.

[0152] In actual application, part of the service probe based charging service real-time monitoring method can be executed on the electronic device as described above, or all operations can be completed in the client device. Specifically, the selection can be made according to the processing capability of the client device and the use scenario of the user, and the like. The present application is not limited thereto. If all operations are completed in the client device, the client device can further include a processor.

[0153] The client device described above can have a communication module (i.e., a communication unit) and can be communicatively connected with a remote server to realize data transmission with the server. The server can include a server of the task scheduling center side, and can further include a server of an intermediate platform in other implementation scenarios, such as a server of a third-party server platform communicatively connected with the server of the task scheduling center. The server can include a single computer device, or a server cluster composed of multiple servers, or a server structure of a distributed device.

[0154] Figure 3 A schematic block diagram of a system configuration of the electronic device 9600 of the embodiment of the present application is shown in FIG. 9. As shown in FIG. 9, the electronic device 9600 can include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that the structure shown in FIG. 9 is exemplary; other types of structures can also be used to supplement or replace the structure to realize telecommunication functions or other functions. Figure 3 The central processor 9100 can be a general purpose processor, a special purpose processor, or a combination of a general purpose processor and a special purpose processor. The central processor 9100 can include a plurality of processing units, a plurality of processor cores, or a combination thereof. The central processor 9100 can be a single core processor, a multi-core processor, or a plurality of processors. Figure 3 The central processor 9100 can be a general purpose processor, a special purpose processor, or a combination of a general purpose processor and a special purpose processor. The central processor 9100 can include a plurality of processing units, a plurality of processor cores, or a combination thereof. The central processor 9100 can be a single core processor, a multi-core processor, or a plurality of processors. The central processor 9100 can be a general purpose processor, a special purpose processor, or a combination of a general purpose processor and a special purpose processor. The central processor 9100 can include a plurality of processing units, a plurality of processor cores, or a combination thereof. The central processor 9100 can be a single core processor, a multi-core processor, or a plurality of processors.

[0155] In an embodiment, the charging service real-time monitoring method based on the service probe can be integrated into the central processor 9100. The central processor 9100 can be configured to control as follows:

[0156] Step S101: Deploy a network traffic collection device, obtain data link layer network data stream from the charging station core switch through the network traffic collection device, hierarchically analyze the network data stream according to the application layer and the transport layer, extract transaction flow information and service management information from the application layer, extract device interaction information and vehicle identification information from the transport layer, extract service data transmission state information from the network layer, time sequence correlate the extracted multi-layer data based on the inter-layer data mapping relationship, generate a service event chain, and construct a charging service portrait model from the service event chain.

[0157] Step S102: Obtain charging station device operation data and real-time service data, extract hardware state features from the device operation data, extract traffic flow distribution, charging peak regularity, and scene features of charging service indicators from the service data, perform feature fusion on the hardware state features and the scene features to obtain a multi-dimensional feature vector, train a neural network classifier using the multi-dimensional feature vector to obtain a service anomaly recognition model, analyze abnormal events in the service event chain based on the service anomaly recognition model, and generate an abnormal event description vector.

[0158] Step S103: Construct a service real-time monitoring engine, use the service real-time monitoring engine to perform hierarchical analysis and correlation analysis on newly collected network data stream, extract hardware state features and scene features for feature fusion, input the fused feature vector into the service anomaly recognition model for anomaly analysis, and generate service anomaly warning information when an abnormal event is identified.

[0159] As can be seen from the above description, the electronic device provided by the embodiments of the present application constructs a multi-layer data analysis mechanism, integrates the data of the application layer, the session layer and the network layer, and realizes accurate construction of the service event chain. An abnormality recognition strategy based on multi-dimensional feature fusion is designed, the hardware state features and the scene features are combined, a neural network classifier is established for abnormal event analysis. A real-time monitoring engine is introduced, and the service anomaly is dynamically warned through hierarchical analysis and correlation analysis. This method effectively solves the deficiencies of traditional technologies in data analysis, feature analysis and real-time monitoring, and significantly improves the intelligent level and warning effect of the charging service monitoring.

[0160] In another embodiment, the real-time monitoring device for charging services based on service probes can be configured separately from the central processor 9100. For example, the real-time monitoring device for charging services based on service probes can be configured as a chip connected to the central processor 9100, and the function of the real-time monitoring method for charging services based on service probes can be realized through the control of the central processor.

[0161] like Figure 3 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Figure 3 In addition, the electronic device 9600 may also include all components shown in Figure 3 For components not shown, reference may be made to the prior art.

[0162] like Figure 3 As shown, the central processing unit 9100 is sometimes also referred to as a controller or operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0163] Memory 9140 can be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It can store the aforementioned failure-related information and also store programs that execute the relevant information. The CPU 9100 can execute the programs stored in memory 9140 to implement information storage or processing.

[0164] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 may be, for example, a keypad or touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0165] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), or SIM card. Alternatively, it may be a memory that retains information even when power is off, can be selectively erased, and is capable of storing additional data. Examples of such memory are sometimes referred to as EPROMs. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs, or processes used by the central processing unit 9100 to execute operations of the electronic device 9600.

[0166] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, images, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various driver programs for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0167] The communication module 9110 is a transmitter / receiver that transmits and receives signals via the antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0168] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless local area network modules. The communication module 9110 (transmitter / receiver) is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130, providing audio output via the speaker 9131 and receiving audio input from the microphone 9132, thereby implementing common telecommunication functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 9130 is coupled to the central processing unit 9100, enabling local recording via the microphone 9132 and playback of stored audio via the speaker 9131.

[0169] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the method for real-time monitoring of toll-charging services based on a service probe, where the execution subject is a server or a client, in the above-mentioned embodiments. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, all steps of the method for real-time monitoring of toll-charging services based on a service probe, where the execution subject is a server or a client, in the above-mentioned embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0170] Step S101: Deploy a network traffic collection device, obtain data link layer network data streams from the toll station core switch through the network traffic collection device, perform layered parsing on the network data streams according to the application layer and transport layer, extract transaction flow information and business management information from the application layer, extract device interaction information and vehicle identification information from the transport layer, extract business data transmission status information from the network layer, perform temporal correlation on the extracted multi-layer data based on the inter-layer data mapping relationship, generate a business event chain, and construct a toll business profile model from the business event chain;

[0171] Step S102: Obtain toll station device operation data and real-time business data, extract hardware state features from the device operation data, extract traffic flow distribution, toll peak regularity, and scene features of toll business indicators from the business data, perform feature fusion on the hardware state features and the scene features to obtain a multi-dimensional feature vector, train a neural network classifier using the multi-dimensional feature vector to obtain a business anomaly recognition model, analyze abnormal events in the business event chain based on the business anomaly recognition model, and generate an abnormal event description vector;

[0172] Step S103: Construct a business real-time monitoring engine, perform hierarchical analysis and correlation analysis on newly collected network data streams using the business real-time monitoring engine, extract hardware state features and scene features for feature fusion, input the fused feature vector into the business anomaly recognition model for anomaly analysis, and generate business anomaly warning information when an abnormal event is identified.

[0173] As can be seen from the above description, the computer readable storage medium provided by the embodiments of the present application realizes accurate construction of a business event chain by constructing a multi-layer data analysis mechanism and integrating data of application layer, session layer and network layer. An abnormality recognition strategy based on multi-dimensional feature fusion is designed, hardware state features and scene features are combined, a neural network classifier is established for abnormal event analysis. A real-time monitoring engine is introduced, and business anomalies are dynamically warned through hierarchical analysis and correlation analysis. This method effectively solves the deficiencies of traditional technologies in data analysis, feature analysis and real-time monitoring, and significantly improves the intelligent level and warning effect of toll business monitoring.

[0174] Embodiments of the present application also provide a computer program product capable of implementing all steps of the above-mentioned business probe-based real-time monitoring method of toll business, wherein the execution subject is a server or a client. The computer program / instructions are executed by a processor to implement the steps of the business probe-based real-time monitoring method of toll business, for example, the computer program / instructions implement the following steps:

[0175] Step S101: Deploy a network traffic collection device, obtain data link layer network data streams from a toll station core switch through the network traffic collection device, perform hierarchical analysis on the network data streams according to application layer, transport layer, extract transaction flow information and business management information from the application layer, extract device interaction information and vehicle identification information from the transport layer, extract business data transmission state information from the network layer, perform time sequence correlation on the extracted multi-layer data based on inter-layer data mapping relationship, generate a business event chain, and construct a toll business portrait model from the business event chain;

[0176] Step S102: Obtain toll station equipment operation data and real-time service data, extract hardware state features from the equipment operation data, extract traffic flow distribution, toll peak regularity, and scene features of toll service indicators from the service data, perform feature fusion on the hardware state features and the scene features to obtain a multi-dimensional feature vector, train a neural network classifier using the multi-dimensional feature vector to obtain a service anomaly recognition model, analyze abnormal events in the service event chain based on the service anomaly recognition model, and generate an abnormal event description vector;

[0177] Step S103: Construct a service real-time monitoring engine, perform hierarchical analysis and correlation analysis on a newly collected network data stream using the service real-time monitoring engine, extract hardware state features and scene features for feature fusion, input the fused feature vector into the service anomaly recognition model for abnormality analysis, and generate service anomaly early warning information when an abnormal event is identified.

[0178] As can be seen from the above description, the computer program product provided by the embodiments of the present application realizes accurate construction of a service event chain by constructing a multi-layer data analysis mechanism and integrating data of application layer, session layer, and network layer. An abnormality recognition strategy based on multi-dimensional feature fusion is designed, hardware state features and scene features are combined, a neural network classifier is established for abnormal event analysis. A real-time monitoring engine is introduced, and hierarchical analysis and correlation analysis are performed to dynamically early warn service anomalies. This method effectively solves the deficiencies of traditional technologies in data analysis, feature analysis, and real-time monitoring, and significantly improves the intelligent level and early warning effect of toll service monitoring.

[0179] Those skilled in the art will understand that embodiments of the present application can be provided as methods, apparatuses, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0180] The present application is described with reference to flowcharts and / or block diagrams of methods, devices (apparatuses), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the flowcharts and / or block diagrams. Figure 1 one flow or multiple flows and / or blocksFigure 1 means for performing the function specified by the block or blocks.

[0181] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 flow or flows and / or blocks Figure 1 means for performing the function specified by the block or blocks.

[0182] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 flow or flows and / or blocks Figure 1 steps for performing the function specified by the block or blocks.

[0183] The principles and implementations of the present application have been described in the specific embodiments, the above description of the embodiments is only for the purpose of understanding the method of the present application and its core idea; at the same time, for the general skilled in the art, according to the idea of the present application, there will be changes in the specific implementation and application range, and the above description should not be understood as the limitation of the present application.

Claims

1. A real-time monitoring method for charging services based on service probes, characterized in that: The method comprises: Deploy a network traffic collection device, use the network traffic collection device to obtain data link layer network data streams from the toll station core switch, perform layered parsing on the network data streams according to the application layer and transport layer, extract transaction flow information and business management information from the application layer, extract device interaction information and vehicle identification information from the transport layer, extract business data transmission status information from the network layer, perform temporal correlation on the extracted multi-layer data based on the inter-layer data mapping relationship, generate a business event chain, and construct a toll business profile model from the business event chain; The step of performing temporal correlation on the extracted multi-layer data based on the inter-layer data mapping relationship to generate a business event chain includes: constructing a mapping matrix from the application layer to the transport layer and a mapping matrix from the transport layer to the network layer, calculating the correlation between data at different layers based on the mapping matrix, establishing a temporal correlation relationship for data with a correlation higher than a preset threshold, combining the multi-layer data with the temporal correlation relationship to form a data link, sorting and merging the data links according to timestamps, and generating a business event chain containing a complete business process; Acquire toll station equipment operation data and real-time business data, extract hardware status features from the equipment operation data, extract scenario features such as traffic flow distribution, toll peak patterns, and toll service indicators from the business data, fuse the hardware status features with the scenario features to obtain a multidimensional feature vector, use the multidimensional feature vector to train a neural network classifier to obtain a business anomaly recognition model, analyze abnormal events in the business event chain based on the business anomaly recognition model, and generate an abnormal event description vector; Build a real-time business monitoring engine, use it to perform layered parsing and correlation analysis on newly collected network data streams, extract hardware status features and scenario features for feature fusion, input the fused feature vector into the business anomaly recognition model for anomaly analysis, and generate business anomaly warning information when an abnormal event is identified.

2. The method for real-time monitoring of charging services based on service probes according to claim 1, characterized in that: The network traffic collection device is deployed, and network data streams are obtained from the core switch of the toll station through the network traffic collection device. The network data streams are analyzed in layers according to the application layer and the transport layer, transaction flow information and business management information are extracted from the application layer, device interaction information and vehicle identification information are extracted from the transport layer, and data packet transmission status information is extracted from the network layer. Establishing a physical connection between a network traffic collection device and a mirror port of a core switch at a toll station, configuring a data cache size and a sampling interval for the network traffic collection device, starting a data collection process for the network traffic collection device, writing the collected real-time network data stream into a data cache area, and performing data packet fragmentation and reassembly on the network data stream in the data cache area to construct a complete network data stream; Construct an application layer parsing unit to extract transaction flow information and business management information, construct a transport layer parsing unit to extract device interaction information and vehicle identification information, construct a network layer parsing unit to extract data packet transmission status information, connect the application layer parsing unit and the transport layer parsing unit in series to form a protocol parsing processing chain, input the network data stream into each layer parsing unit in the protocol parsing processing chain in turn, obtain a layered parsing result, and write the layered parsing result into the data storage area according to a preset data format.

3. The real-time monitoring method for charging services based on service probes according to claim 1, characterized in that: The constructing of a charging service profile model from the service event chain includes: According to the business event chain, four types of feature parameters are extracted, including business type identification, business operation sequence, business processing time, and business status change. The feature parameters are input into the pre-trained deep learning model for feature vector conversion. Based on the feature vector, a business portrait feature space is constructed, and business similarity clustering is calculated in the feature space to generate a business portrait clustering model. The business portrait clustering model is stored in the model library.

4. The real-time monitoring method for charging services based on service probes according to claim 1, characterized in that: The toll station equipment operation data and real-time business data are obtained, hardware status features are extracted from the equipment operation data, and scene features of traffic flow distribution, toll peak patterns, and toll business indicators are extracted from the real-time business data. The hardware status features and scene features are fused to obtain Multidimensional feature vectors, including: Connecting the monitoring probe to the toll station equipment system to obtain real-time data on the processor usage, memory occupancy, disk read / write rate, and network traffic in the equipment, parsing and normalizing the operating data, constructing hardware status feature indicators, constructing the hardware status feature indicators into a feature matrix, and performing dimensionality reduction processing on the feature matrix to generate a hardware status feature vector; Business flow meter data is read from the real-time business database, the temporal and spatial distribution densities of vehicle flow are calculated, the patterns of peak and off-peak charging periods are identified, precipitation, visibility, and temperature data are extracted from meteorological monitoring data, the vehicle flow distribution data, peak charging pattern data, and charging business indicator data are standardized, and the feature weighting method is used to fuse the hardware state feature vector with the standardized scene feature data to generate a multidimensional feature vector.

5. The real-time monitoring method for charging services based on service probes according to claim 1, characterized in that: The method of using the multidimensional feature vector to train a neural network classifier to obtain a business anomaly recognition model, analyzing abnormal events in the business event chain based on the business anomaly recognition model, and generating an abnormal event description vector includes: Construct a three-layer neural network structure, input the multidimensional feature vector into the input layer of the neural network, set multiple convolution kernels in the hidden layer to extract feature combinations, set a softmax classifier in the output layer, use the backpropagation algorithm to iteratively optimize the neural network weights, calculate the classification accuracy based on the validation data set, and save the trained neural network classifier as a business anomaly recognition model; Read the business data in the business event chain, extract the multidimensional feature vector and input it into the business anomaly recognition model, obtain the type identification and confidence score of the abnormal event, combine the type identification and confidence score with the timestamp, device identification, and operation sequence of the business event to generate an abnormal event description vector, sort the abnormal event description vector according to the confidence score, and write the sorting result into the abnormal event data table.

6. The method for real-time monitoring of charging services based on service probes according to claim 1, characterized in that: The construction of a real-time business monitoring engine, using the real-time business monitoring engine to perform layered parsing and correlation analysis on newly collected network data streams, extracting hardware status features and scene features for feature fusion, includes: Create a data acquisition thread pool, a parsing processing thread pool, and an analysis processing thread pool; start the network data stream acquisition task in the data acquisition thread pool; assign the collected network data stream to the parsing processing thread pool; call the protocol parsing processing chain to perform hierarchical parsing on the network data stream; write the parsing results to the shared memory area; and read the parsing results in the analysis processing thread pool to perform data association analysis; The parsed business data is read from the shared memory area, and the processor usage rate, memory occupancy rate, disk read and write rate, and network traffic data in the device are extracted to construct a hardware status feature vector. The traffic flow distribution data, toll peak pattern data, and toll business indicator data are extracted to construct a scene feature vector. The feature weighting method is used to fuse the hardware status feature vector with the scene feature vector to generate a multi-dimensional feature vector for real-time monitoring.

7. The method for real-time monitoring of charging services based on service probes according to claim 1, characterized in that: The step of inputting the fused feature vector into the business anomaly recognition model for anomaly analysis and generating business anomaly warning information when an abnormal event is identified includes: Input the fused feature vectors into the business anomaly recognition model in batches, obtain the type identification and confidence score of the abnormal event, normalize the confidence score, compare the normalized score with a preset abnormal threshold, mark events above the abnormal threshold as abnormal events, and write the feature vector, type identification, and confidence score of the abnormal event into the abnormal event buffer; Read abnormal event data from the abnormal event cache area, extract the attribute information of the abnormal event, which includes the occurrence time, device identification, abnormality type, and abnormality degree, match the attribute information with the preset abnormal event description template, generate a standardized abnormal event description text, construct a business abnormality warning message containing the abnormal event description text, and push the business abnormality warning message to the warning information processing module.

8. A real-time monitoring device for charging services based on service probes, characterized in that: The device comprises: A model building module is used to deploy a network traffic collection device, obtain data link layer network data streams from the toll station core switch through the network traffic collection device, perform layered analysis on the network data streams according to the application layer and transport layer, extract transaction flow information and business management information from the application layer, extract device interaction information and vehicle identification information from the transport layer, extract business data transmission status information from the network layer, perform temporal correlation on the extracted multi-layer data based on the inter-layer data mapping relationship, generate a business event chain, and construct a toll business profile model from the business event chain; The step of performing temporal correlation on the extracted multi-layer data based on the inter-layer data mapping relationship to generate a business event chain includes: constructing a mapping matrix from the application layer to the transport layer and a mapping matrix from the transport layer to the network layer, calculating the correlation between data at different layers based on the mapping matrix, establishing a temporal correlation relationship for data with a correlation higher than a preset threshold, combining the multi-layer data with the temporal correlation relationship to form a data link, sorting and merging the data links according to timestamps, and generating a business event chain containing a complete business process; An anomaly description module is configured to obtain toll station equipment operation data and real-time business data, extract hardware status features from the equipment operation data, extract scenario features such as traffic flow distribution, toll peak patterns, and toll service indicators from the business data, fuse the hardware status features with the scenario features to obtain a multidimensional feature vector, use the multidimensional feature vector to train a neural network classifier to obtain a business anomaly recognition model, analyze abnormal events in the business event chain based on the business anomaly recognition model, and generate an abnormal event description vector; The business detection module is used to build a real-time business monitoring engine, use the real-time business monitoring engine to perform layered parsing and correlation analysis on newly collected network data streams, extract hardware status features and scenario features for feature fusion, input the fused feature vector into the business anomaly recognition model for anomaly analysis, and generate business anomaly warning information when an abnormal event is identified.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the real-time monitoring method for charging services based on service probes according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for real-time monitoring of charging services based on service probes according to any one of claims 1 to 7 are implemented.

Images