A business alarm method and system based on artificial intelligence

Abstract

The application relates to an artificial intelligence-based business alarm method and system, and relates to the technical field of data processing; the method mainly comprises the following steps: acquiring infrastructure layer data, service layer data and network layer data of a target network; preprocessing the infrastructure layer data, the service layer data and the network layer data of the target network; the preprocessing at least comprises normalization and abnormal value filtering; constructing a resource dependency graph and a virtual network topology graph according to the preprocessed infrastructure layer data, the service layer data and the network layer data; inputting real-time business index data and the resource dependency graph into a network prediction model to obtain an abnormal prediction result, wherein the abnormal prediction result comprises an abnormal node list; determining a network abnormal reason positioning result according to the abnormal prediction result, the resource dependency graph and the virtual network topology graph; and outputting and displaying the abnormal reason of the target network and the position of the abnormal reason on a screen display interface through the abnormal reason positioning result.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an artificial intelligence-based service alarm method and system. Background Art

[0002] With the widespread use of the internet, network security is becoming increasingly challenging. It's no secret that network failures can degrade network performance and even paralyze the entire network. To ensure the security of computers and network systems within internal networks, alarm management for network failures has been developed. Alarm management monitors the status of each network device, providing real-time insights into the overall network's operational status.

[0003] Traditional alarm methods rely on manual experience and troubleshooting, which cannot quickly identify the propagation path and root node of faults in complex systems. In addition, fault handling is highly dependent on manual operations, such as manually restarting services and adjusting configurations, resulting in long MTTR (mean time to repair) and high business continuity risks. Summary of the Invention

[0004] The present invention aims to provide an artificial intelligence-based service alarm method and system to address the deficiencies in the prior art. The technical problems to be solved by the present invention are achieved through the following technical solutions.

[0005] An embodiment of the present invention provides an artificial intelligence-based service alarm method, the method comprising:

[0006] Obtain the target network's infrastructure layer data, service layer data, and network layer data;

[0007] Preprocessing the infrastructure layer data, service layer data, and network layer data of the target network; the preprocessing includes at least normalization and outlier filtering;

[0008] Constructing a resource dependency graph and a virtual network topology graph based on the pre-processed infrastructure layer data, the service layer data, and the network layer data;

[0009] Inputting the real-time business indicator data and the resource dependency graph into a network prediction model to obtain an abnormality prediction result, wherein the abnormality prediction result includes a list of abnormal nodes;

[0010] Determine the network anomaly cause location result based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph;

[0011] The abnormality cause location result is output on a screen display interface to display the abnormality cause of the target network and the location of the abnormality cause.

[0012] In an optional embodiment, constructing a resource dependency graph and a virtual network topology graph based on the pre-processed infrastructure layer data, the service layer data, and the network layer data includes:

[0013] Constructing a resource dependency graph based on the pre-processed infrastructure layer data and the service layer data;

[0014] A virtual network topology diagram is constructed based on the pre-processed infrastructure layer data and the network layer data.

[0015] In an optional embodiment, constructing a resource dependency graph based on the pre-processed infrastructure layer data and the service layer data includes:

[0016] Extracting business entity nodes and service nodes from the pre-processed infrastructure layer data and the service layer data respectively;

[0017] Determining the association relationship between the business entity node and the service node, and the relationship weight of each association relationship;

[0018] The resource dependency graph is constructed according to the association relationship between the business entity nodes and the service nodes and their corresponding relationship weights.

[0019] In an optional embodiment, constructing a virtual network topology map based on the pre-processed infrastructure layer data and the network layer data includes:

[0020] Extracting network entity nodes and network nodes from the pre-processed infrastructure layer data and the network layer data respectively;

[0021] Determining associations between the business entity nodes and the network nodes, and relationship weights of each association;

[0022] The resource dependency graph is constructed according to the association relationships between the business entity nodes and the network nodes and their corresponding relationship weights.

[0023] In an optional embodiment, inputting the real-time business indicator data and the resource dependency graph into a network prediction model to obtain an abnormality prediction result includes:

[0024] Inputting the real-time business indicator data and the resource dependency graph into a network prediction model, and mapping the real-time business indicator data to the resource dependency graph through a mapping module in the network prediction model to obtain a resource dependency graph carrying the business indicator data;

[0025] Inputting the resource dependency graph carrying the business indicator data into a feature extraction module for feature extraction to obtain a business dependency graph data feature vector;

[0026] The abnormality prediction result is obtained through the business dependency graph data feature vector.

[0027] In an optional embodiment, inputting the resource dependency graph carrying the business indicator data into a feature extraction module for feature extraction to obtain a business dependency graph data feature vector includes:

[0028] Performing data feature extraction on the real-time business indicator data by a first feature extraction module to obtain a business feature vector matrix, wherein each row in the business feature vector matrix represents a business data feature of a time unit;

[0029] Performing feature extraction on the resource dependency graph by a second feature extraction module to obtain a dependency graph feature vector;

[0030] Feature fusion is performed on the business feature vector matrix and the dependency graph feature vector to obtain a business dependency graph data feature vector.

[0031] In an optional embodiment, determining the network anomaly cause location result based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph includes:

[0032] Perform abnormal time filtering according to the abnormal node list in the abnormal prediction result to obtain an abnormal node cluster set;

[0033] Constructing an abnormal propagation path graph through the abnormal node cluster set and the resource dependency graph, wherein each abnormal node in the abnormal propagation path graph corresponds to an abnormal value;

[0034] The network anomaly cause locating result is determined based on the anomaly propagation path diagram and the virtual network topology diagram.

[0035] In an optional embodiment, performing abnormal time filtering according to the abnormal node list in the abnormal prediction result to obtain the abnormal node cluster set includes:

[0036] Calculate the correlation between abnormal nodes in the abnormal node list through time correlation, spatial correlation and logical correlation;

[0037] Abnormal nodes in the abnormal node list whose confidence is less than a preset value and have no correlation with other abnormal nodes are filtered out to obtain an abnormal node cluster set.

[0038] In an optional embodiment, determining the network anomaly cause location result according to the anomaly propagation path diagram and the virtual network topology diagram includes:

[0039] Calculating the suspiciousness of each abnormal node in the abnormal propagation path graph, and adding the abnormal nodes whose suspiciousness meets the preset conditions to the suspicious node list;

[0040] Mapping the abnormal nodes in the suspicious node list to the virtual network topology map, and checking the network status of the network location where the abnormal nodes are located in the virtual network topology map;

[0041] If the network status of the network location where the abnormal node is located is abnormal, the network abnormality cause location result is determined based on the system log, the real-time business indicator data, the abnormal propagation path diagram and the virtual network topology diagram.

[0042] An embodiment of the present invention provides an artificial intelligence-based service alarm system, the system comprising:

[0043] An acquisition module is used to obtain the infrastructure layer data, service layer data, and network layer data of the target network;

[0044] A preprocessing module, configured to preprocess the infrastructure layer data, service layer data, and network layer data of the target network; the preprocessing includes at least normalization and outlier filtering;

[0045] A construction module, configured to construct a resource dependency graph and a virtual network topology graph based on the pre-processed infrastructure layer data, the service layer data, and the network layer data;

[0046] A prediction module, configured to input real-time business indicator data and the resource dependency graph into a network prediction model to obtain an abnormality prediction result, wherein the abnormality prediction result includes a list of abnormal nodes;

[0047] A determination module, configured to determine a result of locating the cause of the network anomaly based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph;

[0048] The output module is used to output the abnormality cause of the target network and the location of the abnormality cause on a screen display interface based on the abnormality cause positioning result.

[0049] The embodiments of the present invention include the following advantages:

[0050] An embodiment of the present invention provides an artificial intelligence-based business alarm method and system, which first obtains the infrastructure layer data, service layer data, and network layer data of the target network; then preprocesses the infrastructure layer data, service layer data, and network layer data of the target network; the preprocessing includes at least normalization and outlier filtering; then, a resource dependency graph and a virtual network topology graph are constructed based on the preprocessed infrastructure layer data, service layer data, and network layer data; real-time business indicator data and the resource dependency graph are input into a network prediction model to obtain anomaly prediction results, and finally, a network anomaly cause location result is determined based on the anomaly prediction results, the resource dependency graph, and the virtual network topology graph; and the anomaly cause location result is output on a screen display interface to display the anomaly cause of the target network and the location of the anomaly cause. Compared with the existing technology that relies on manual experience to troubleshoot alarms, this application generates a resource dependency graph and a virtual network topology graph based on relevant data, and then obtains the anomaly prediction results through the network prediction model. Based on the anomaly prediction results, the resource dependency graph and the virtual network topology graph are generated to determine the cause of the network anomaly. Therefore, this application can quickly identify the propagation path and root node of the fault in a complex system, thereby improving the accuracy and efficiency of business alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a flow chart of an artificial intelligence-based service alarm method provided by an embodiment of the present invention;

[0052] Figure 2 This is a flow chart of a method for determining an abnormal prediction result provided by an embodiment of the present invention;

[0053] Figure 3 This is a structural diagram of an artificial intelligence-based business alarm system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0055] See also Figure 1 , an artificial intelligence-based service alarm method provided by an embodiment of the present invention, the method specifically includes S101-S106:

[0056] S101, obtaining infrastructure layer data, service layer data, and network layer data of a target network.

[0057] Infrastructure layer data refers to the underlying hardware and virtualized resource status data that supports business system operations, focusing on resource supply capabilities, health status, and capacity utilization. Infrastructure layer data types can include specific operational data and usage of physical servers, network devices, storage devices, virtualized resources, and container resources. For example, specific operational data for physical servers may include CPU utilization, number of cores, and temperature; memory usage, total amount, and error rate; disk IOPS, utilization, and health status; and power supply status and fan speed.

[0058] Service-layer data consists of business metrics and performance data generated during application execution, focusing on transaction integrity, user experience, and service quality. Service-layer data types can include service performance, application logs, message queues, database services, business metrics, and other specific data. For example, specific business metric data might include payment success rate, order creation volume, user logins, shopping cart abandonment rate, and inventory turnover rate. Specific database service data might include query latency, connection pool utilization, lock wait time, and cache hit rate.

[0059] Network layer data refers to the connection status and data transmission metrics of communications between network devices, focusing on connectivity, transmission quality, and security policies. Network layer data types may include operational data such as physical connections, traffic metrics, virtual networks, protocol analysis, and security policies. For example, operational data for traffic metrics may include bandwidth utilization, packet loss rate, packet error rate, network latency, and TCP retransmission rate. This embodiment does not limit the specific data formats of infrastructure layer data, service layer data, and network layer data.

[0060] S102: Preprocess the infrastructure layer data, service layer data, and network layer data of the target network.

[0061] The purpose of preprocessing is to unify the formats of multi-source data and improve data quality. Preprocessing in this embodiment includes at least normalization, outlier filtering, feature enhancement, and relationship completion, which are not specifically limited in this embodiment. For example, the Prophet algorithm or the Z-Score algorithm can be used to detect and eliminate sensor noise (e.g., a momentary CPU spike to 100% followed by recovery); network link data can be filtered for transient interruptions (e.g., port jitter < 1 second); physical servers can be associated with containers running on them by IP address (e.g., Pod IP 10.0.0.2 corresponds to host IP 10.0.0.1); and virtual machines can be associated with underlying physical network devices by VxLAN tunnel ID.

[0062] S103: Construct a resource dependency graph and a virtual network topology graph based on the pre-processed infrastructure layer data, the service layer data, and the network layer data.

[0063] The resource dependency graph is used to analyze dependencies and fault propagation paths between services and resources, while the virtual network topology is used to monitor physical / logical network connection status and traffic paths. In this embodiment, a resource dependency graph (stored using graph databases such as Neo4j or JanusGraph) can be automatically constructed based on service call chains (such as OpenTelemetry), database transaction links, and microservice dependencies. A virtual network topology is generated by capturing real-time network device connectivity through SNMP, NetFlow data, or SDN controllers (such as OpenDaylight).

[0064] In an optional embodiment provided by the present application, constructing a resource dependency graph and a virtual network topology graph based on the pre-processed infrastructure layer data, the service layer data, and the network layer data includes:

[0065] S1031: Construct a resource dependency graph based on the pre-processed infrastructure layer data and the service layer data.

[0066] Specifically, the constructing of a resource dependency graph based on the preprocessed infrastructure layer data and the service layer data includes: extracting business entity nodes and service nodes from the preprocessed infrastructure layer data and the service layer data respectively; determining the association relationship between the business entity nodes and the service nodes, and the relationship weight of each association relationship; and constructing the resource dependency graph based on the association relationship between the business entity nodes and the service nodes and their corresponding relationship weights.

[0067] Business entity nodes are nodes at the infrastructure layer, while service nodes are nodes at the service layer. Business entity nodes provide the operating environment for service nodes. Business entity nodes can be server IP addresses, switch / router ports, network bandwidth, storage devices, and more. Service nodes can be database tables, message queue topics, and other related entities. Attributes include QPS and SLA (Service Level Agreement) requirements. The relationships between business entity nodes represent the physical links between devices. For example, server A is connected to the core switch via switch port Gig0 / 1. Business entity nodes are the entities that run service nodes. Service nodes are represented by service dependencies, and their relationships are expressed through call relationships between service nodes.

[0068] In this embodiment, the relationship weight between a business entity node and a service node can be determined based on the hardware resources occupied by the service node. The greater the hardware resources occupied, the greater the corresponding relationship weight. The relationship weight between service nodes can also be represented by the number of calls. A greater number of calls corresponds to a greater relationship weight. The relationship weight between service nodes can also be calculated using the formula: relationship weight = QPS × average latency (reflecting dependency strength). This embodiment does not limit the specific method for calculating the relationship weight.

[0069] S1032: Construct a virtual network topology map based on the pre-processed infrastructure layer data and the network layer data.

[0070] Specifically, the constructing of a virtual network topology graph based on the preprocessed infrastructure layer data and the network layer data includes: extracting network entity nodes and network nodes from the preprocessed infrastructure layer data and the network layer data respectively; determining the association relationship between the business entity nodes and the network nodes, and the relationship weight of each association relationship; and constructing the resource dependency graph based on the association relationship between the business entity nodes and the network nodes and their corresponding relationship weights.

[0071] A network node is a node of a network entity, which can specifically be a switch, firewall, etc. The relationship between network entity nodes and network nodes can be a physical connection, such as a port connection from a switch to a server or a router to a firewall. The relationship between network nodes can be network policies or connection relationships, such as VxLAN tunnels, network policies between Kubernetes pods, source IP to destination IP traffic flow and bandwidth usage, etc., which are not specifically limited in this embodiment.

[0072] In this embodiment, the relationship weight between network nodes may be determined by network connection edge weight = used bandwidth / total bandwidth (reflecting the degree of congestion).

[0073] S104: Input the real-time business indicator data and the resource dependency graph into a network prediction model to obtain an abnormality prediction result, wherein the abnormality prediction result includes an abnormal node list.

[0074] like Figure 2 In an optional embodiment provided by the present application, real-time business indicator data and the resource dependency graph are input into a network prediction model to obtain an abnormality prediction result, including:

[0075] The network prediction model is a pre-trained network model, which is trained based on sample data and corresponding sample labels. Specifically, the sample data is the sample indicator data and the sample resource dependency graph, and the sample label is the corresponding abnormal result list.

[0076] S1041, input the real-time business indicator data and the resource dependency graph into the network prediction model, and map the real-time business indicator data to the resource dependency graph through the mapping module in the network prediction model to obtain a resource dependency graph carrying the business indicator data.

[0077] Among them, real-time business indicator data is the operating data of various types of nodes, such as CPU / memory / disk usage, business QPS, response time, error rate, network bandwidth / packet loss / delay, TCP retransmission rate, etc. This embodiment does not limit the specific form of real-time business data indicator data.

[0078] S1042: Input the resource dependency graph carrying the business indicator data into a feature extraction module for feature extraction to obtain a business dependency graph data feature vector.

[0079] Specifically, the resource dependency graph carrying the business indicator data is input into the feature extraction module for feature extraction to obtain a business dependency graph data feature vector, including: performing data feature extraction on the real-time business indicator data through a first feature extraction module to obtain a business feature vector matrix, wherein each row in the business feature vector matrix represents the business data feature of a time unit; performing feature extraction on the resource dependency graph through a second feature extraction module to obtain a dependency graph feature vector; and performing feature fusion on the business feature vector matrix and the dependency graph feature vector to obtain a business dependency graph data feature vector.

[0080] In another embodiment of the present invention, the first feature extraction module is a time convolution module. In this embodiment, the calculation formula of the time convolution module is: ,in, The output value at time t, is the weight parameter of the convolution kernel, which can be a mean weight, such as 1 / k; is the value of the time series at time t−k, K is the convolution kernel size (time window length), which can be set according to the business cycle, such as short-term fluctuations: K=5 (5 minutes), long-term trends K=2424 hours).

[0081] The second feature extraction module is a graph convolution module. The calculation formula of the graph convolution module in this embodiment is: ,in, For the The node feature matrix of the layer, is the adjacency matrix for adding self-connection, A is the adjacency matrix of the resource dependency graph, for The degree matrix of is the negative half power of the degree matrix, For the The trainable weight matrix of the layer, is the activation function.

[0082] S1043, obtaining the abnormality prediction result through the business dependency graph data feature vector.

[0083] The abnormal prediction result includes a list of abnormal nodes, and the abnormal node list includes a confidence score corresponding to each abnormal node.

[0084] After obtaining the business dependency graph data feature vector, this embodiment predicts an anomaly prediction result based on the business dependency graph data feature vector. Since the business dependency graph data feature vector is a fusion of the business feature vector matrix and the dependency graph feature vector, the anomaly prediction result takes into account the spatial deviation and temporal deviation. Therefore, it is possible to discover anomalies caused by changes in network topology and capture indicator trend anomalies in advance (such as a continuous increase in CPU usage), thereby improving the accuracy of the anomaly prediction result prediction through this application.

[0085] S105: Determine a network anomaly cause location result based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph.

[0086] In an optional embodiment provided in the present application, determining the network anomaly cause location result based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph includes:

[0087] S1051 , performing abnormal time filtering according to the abnormal node list in the abnormal prediction result to obtain an abnormal node cluster set.

[0088] Specifically, the abnormal node list in the abnormal prediction result is filtered for abnormal time to obtain an abnormal node cluster set, including: calculating the correlation between abnormal nodes in the abnormal node list based on temporal correlation (whether they occur simultaneously), spatial correlation (whether they are in the same physical location), and logical correlation (whether there is a dependency relationship); and filtering out abnormal nodes in the abnormal node list whose confidence level is less than a preset value and whose correlation with other abnormal nodes is not obtained to obtain an abnormal node cluster set. The preset value can be set based on actual needs. For example, abnormal nodes with a confidence level less than 0.7 and no correlation with other abnormal nodes are filtered out to obtain an abnormal node cluster set.

[0089] S1053: Construct an abnormal propagation path graph through the abnormal node cluster set and the resource dependency graph, wherein each abnormal node in the abnormal propagation path graph corresponds to an abnormal value.

[0090] Abnormal nodes in the abnormal node cluster set are marked in the resource dependency graph to obtain the abnormal propagation path diagram of the abnormal node. Based on the resource dependency graph, bidirectional expansion is carried out along the dependency relationship: upstream tracing to identify parent nodes that may affect the abnormal node; downstream extension is carried out to identify child nodes that may be affected. Propagation weights are then added to the abnormal nodes. These propagation weights can be calculated based on data such as historical failure frequency, real-time indicator correlation, and topological distance.

[0091] S1054: Determine the network anomaly cause location result based on the anomaly propagation path diagram and the virtual network topology diagram.

[0092] Specifically, determining the network anomaly cause location result based on the anomaly propagation path diagram and the virtual network topology diagram includes: calculating the suspicion of each abnormal node in the anomaly propagation path diagram, and adding the abnormal nodes whose suspicion meets a preset condition to a suspicious node list; mapping the abnormal nodes in the suspicious node list to the virtual network topology diagram, and checking the network status of the network location where the abnormal node is located in the virtual network topology diagram; if the network status of the network location where the abnormal node is located is abnormal, determining the network anomaly cause location result based on the system log, the real-time business indicator data, the anomaly propagation path diagram, and the virtual network topology diagram. If the network status of the network location where the abnormal node is located is normal, focus on the application layer problem.

[0093] In this embodiment, the suspicion level of each abnormal node is calculated by weighting centrality, deviation, and spread. Centrality uses the PageRank algorithm to identify key hub nodes; deviation compares the difference between real-time indicators and baselines; and spread calculates the number of downstream nodes affected. For example, suspicion level = 0.4 × centrality + 0.3 × deviation + 0.3 × spread. The top three abnormal nodes with the highest suspicion levels are then added to the list of suspicious nodes.

[0094] For example, move the top three abnormal nodes to their corresponding locations in the virtual network topology, such as service node → container IP → host machine → physical port; database node → storage network path. Then, check the network status of the abnormal node's location in the virtual network topology, such as physical connection status (port up / down), bandwidth utilization (whether it exceeds the threshold), error packet rate (whether it is abnormally high), and policy compliance (security group / ACL rules). This implementation does not specify these requirements.

[0095] In this embodiment, the specific process of determining the network anomaly cause location result based on the system log, the real-time business indicator data, the anomaly propagation path diagram and the virtual network topology diagram can be: extracting the indicator anomaly strength, topological centrality, network verification results and historical similar faults from the system log, the real-time business indicator data, the anomaly propagation path diagram and the virtual network topology diagram, and then performing weighted calculation based on the anomaly strength, topological centrality, network verification results and historical similar faults to obtain the network root cause probability value, and determining the problem of the network node based on the probability value.

[0096] In another optional embodiment provided by the present application, the root cause prediction probability value can be obtained respectively through system logs, real-time business indicator data, abnormal propagation path diagram and virtual network topology, and then all the root cause probability values ​​are weighted and fused to obtain the final root cause probability value.

[0097] In addition, the network root cause probability value can also be calculated using the following formula:

[0098] P(C|E)=

[0099] in, P(C|E) is the posterior probability (the final decision basis that needs to be calculated), that is, the probability that the root cause C occurs under the condition that evidence E is observed; is the likelihood probability, that is, the probability of evidence E appearing under the condition that root cause C occurs; is the prior probability (obtained through learning from historical training data), that is, the initial probability of the root cause C occurring (calculated based on historical failure statistics); P ( E ) is the evidence probability, that is, the marginal probability of the occurrence of evidence E, which is calculated by the total probability formula: Among them, the root cause of the incident The content can be shown in Table 1 below:

[0100] Table 1

[0101]

[0102] S106: Outputting the abnormality cause of the target network and the location of the abnormality cause on a screen display interface based on the abnormality cause location result.

[0103] This embodiment provides an artificial intelligence-based business alarm method, which first obtains the infrastructure layer data, service layer data, and network layer data of the target network; then preprocesses the infrastructure layer data, service layer data, and network layer data of the target network; the preprocessing includes at least normalization and outlier filtering; then, a resource dependency graph and a virtual network topology graph are constructed based on the preprocessed infrastructure layer data, service layer data, and network layer data; real-time business indicator data and the resource dependency graph are input into a network prediction model to obtain anomaly prediction results, and finally, a network anomaly cause location result is determined based on the anomaly prediction results, the resource dependency graph, and the virtual network topology graph; and the anomaly cause location result is output on a screen display interface to display the anomaly cause of the target network and the location of the anomaly cause. Compared with the existing technology that relies on manual experience to troubleshoot alarms, this application generates a resource dependency graph and a virtual network topology graph based on relevant data, and then obtains the anomaly prediction results through the network prediction model. Based on the anomaly prediction results, the resource dependency graph and the virtual network topology graph are generated to determine the cause of the network anomaly. Therefore, this application can quickly identify the propagation path and root node of the fault in a complex system, thereby improving the accuracy and efficiency of business alarms.

[0104] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0105] In one embodiment, a service alarm system based on artificial intelligence is provided. Figure 3 As shown, the functional modules of the artificial intelligence-based business alarm system are described in detail as follows:

[0106] An acquisition module 31 is used to acquire infrastructure layer data, service layer data, and network layer data of a target network;

[0107] A preprocessing module 32 is configured to preprocess the infrastructure layer data, service layer data, and network layer data of the target network; the preprocessing includes at least normalization and outlier filtering;

[0108] A construction module 33 is configured to construct a resource dependency graph and a virtual network topology graph based on the pre-processed infrastructure layer data, the service layer data, and the network layer data;

[0109] A prediction module 34 is configured to input the real-time business indicator data and the resource dependency graph into a network prediction model to obtain an abnormality prediction result, wherein the abnormality prediction result includes a list of abnormal nodes;

[0110] A determination module 35 is configured to determine a result of locating the cause of the network anomaly based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph;

[0111] The output module 36 is configured to output the abnormality cause of the target network and the location of the abnormality cause on a screen display interface based on the abnormality cause location result.

[0112] In an optional embodiment, the construction module 33 is specifically configured to:

[0113] Constructing a resource dependency graph based on the pre-processed infrastructure layer data and the service layer data;

[0114] A virtual network topology diagram is constructed based on the pre-processed infrastructure layer data and the network layer data.

[0115] In an optional embodiment, the construction module 33 is specifically configured to:

[0116] Extracting business entity nodes and service nodes from the pre-processed infrastructure layer data and the service layer data respectively;

[0117] Determining the association relationship between the business entity node and the service node, and the relationship weight of each association relationship;

[0118] The resource dependency graph is constructed according to the association relationship between the business entity nodes and the service nodes and their corresponding relationship weights.

[0119] In an optional embodiment, the construction module 33 is specifically configured to:

[0120] Extracting network entity nodes and network nodes from the pre-processed infrastructure layer data and the network layer data respectively;

[0121] Determining associations between the business entity nodes and the network nodes, and relationship weights of each association;

[0122] The resource dependency graph is constructed according to the association relationships between the business entity nodes and the network nodes and their corresponding relationship weights.

[0123] In an optional embodiment, the prediction module 34 is specifically configured to:

[0124] Inputting the real-time business indicator data and the resource dependency graph into a network prediction model, and mapping the real-time business indicator data to the resource dependency graph through a mapping module in the network prediction model to obtain a resource dependency graph carrying the business indicator data;

[0125] Inputting the resource dependency graph carrying the business indicator data into a feature extraction module for feature extraction to obtain a business dependency graph data feature vector;

[0126] The abnormality prediction result is obtained through the business dependency graph data feature vector.

[0127] In an optional embodiment, the prediction module 34 is specifically configured to:

[0128] Performing data feature extraction on the real-time business indicator data by a first feature extraction module to obtain a business feature vector matrix, wherein each row in the business feature vector matrix represents a business data feature of a time unit;

[0129] Performing feature extraction on the resource dependency graph by a second feature extraction module to obtain a dependency graph feature vector;

[0130] Feature fusion is performed on the business feature vector matrix and the dependency graph feature vector to obtain a business dependency graph data feature vector.

[0131] In an optional embodiment, the determination module 35 is specifically configured to:

[0132] Perform abnormal time filtering according to the abnormal node list in the abnormal prediction result to obtain an abnormal node cluster set;

[0133] Constructing an abnormal propagation path graph through the abnormal node cluster set and the resource dependency graph, wherein each abnormal node in the abnormal propagation path graph corresponds to an abnormal value;

[0134] The network anomaly cause locating result is determined based on the anomaly propagation path diagram and the virtual network topology diagram.

[0135] In an optional embodiment, the determination module 35 is specifically configured to:

[0136] Calculate the correlation between abnormal nodes in the abnormal node list through time correlation, spatial correlation and logical correlation;

[0137] Abnormal nodes in the abnormal node list whose confidence is less than a preset value and have no correlation with other abnormal nodes are filtered out to obtain an abnormal node cluster set.

[0138] In an optional embodiment, the determination module 35 is specifically configured to:

[0139] Calculating the suspiciousness of each abnormal node in the abnormal propagation path graph, and adding the abnormal nodes whose suspiciousness meets the preset conditions to the suspicious node list;

[0140] Mapping the abnormal nodes in the suspicious node list to the virtual network topology map, and checking the network status of the network location where the abnormal nodes are located in the virtual network topology map;

[0141] If the network status of the network location where the abnormal node is located is abnormal, the network abnormality cause location result is determined based on the system log, the real-time business indicator data, the abnormal propagation path diagram and the virtual network topology diagram.

[0142] It should be noted that the above detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs.

[0143] For the specific limitations of the AI-based business alarm system, please refer to the limitations of the AI-based business alarm method above and will not be repeated here. Each module in the above-mentioned device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each of the above modules.

[0144] Those skilled in the art will clearly understand that for the sake of convenience and brevity in description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above.

[0145] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A business alarm method based on artificial intelligence, characterized in that: The method comprises: Obtain the target network's infrastructure layer data, service layer data, and network layer data; Preprocessing the infrastructure layer data, service layer data, and network layer data of the target network; the preprocessing includes at least normalization and outlier filtering; A resource dependency graph is constructed based on the pre-processed infrastructure layer data and the service layer data; a virtual network topology graph is constructed based on the pre-processed infrastructure layer data and the network layer data; the resource dependency graph is used to analyze the dependencies and fault propagation paths between services and resources, and the virtual network topology graph is used to monitor the physical / logical network connection status and traffic paths; Inputting the real-time business indicator data and the resource dependency graph into a network prediction model to obtain an abnormality prediction result, wherein the abnormality prediction result includes a list of abnormal nodes; Determine the network anomaly cause location result based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph; Outputting the abnormality cause of the target network and the location of the abnormality cause on a screen display interface based on the abnormality cause location result; Inputting the real-time business indicator data and the resource dependency graph into the network prediction model to obtain an abnormality prediction result includes: Inputting the real-time business indicator data and the resource dependency graph into a network prediction model, and mapping the real-time business indicator data to the resource dependency graph through a mapping module in the network prediction model to obtain a resource dependency graph carrying the business indicator data; Inputting the resource dependency graph carrying the business indicator data into a feature extraction module for feature extraction to obtain a business dependency graph data feature vector; Obtaining the abnormality prediction result through the business dependency graph data feature vector; The determining of the network anomaly cause location result based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph includes: Perform abnormal time filtering according to the abnormal node list in the abnormal prediction result to obtain an abnormal node cluster set; Constructing an abnormal propagation path graph through the abnormal node cluster set and the resource dependency graph, wherein each abnormal node in the abnormal propagation path graph corresponds to an abnormal value; The network anomaly cause locating result is determined based on the anomaly propagation path diagram and the virtual network topology diagram.

2. The method according to claim 1, characterized in that The constructing of a resource dependency graph based on the pre-processed infrastructure layer data and the service layer data includes: Extracting business entity nodes and service nodes from the pre-processed infrastructure layer data and the service layer data respectively; Determining the association relationship between the business entity node and the service node, and the relationship weight of each association relationship; The resource dependency graph is constructed according to the association relationship between the business entity nodes and the service nodes and their corresponding relationship weights.

3. The method according to claim 1, characterized in that The step of inputting the resource dependency graph carrying the business indicator data into a feature extraction module for feature extraction to obtain a business dependency graph data feature vector includes: Performing data feature extraction on the real-time business indicator data by a first feature extraction module to obtain a business feature vector matrix, wherein each row in the business feature vector matrix represents a business data feature of a time unit; Performing feature extraction on the resource dependency graph by a second feature extraction module to obtain a dependency graph feature vector; Feature fusion is performed on the business feature vector matrix and the dependency graph feature vector to obtain a business dependency graph data feature vector.

4. The method according to claim 1, wherein The abnormal node list in the abnormal prediction result is filtered by abnormal time to obtain an abnormal node cluster set, including: Calculate the correlation between abnormal nodes in the abnormal node list through time correlation, spatial correlation and logical correlation; Abnormal nodes in the abnormal node list whose confidence is less than a preset value and have no correlation with other abnormal nodes are filtered out to obtain an abnormal node cluster set.

5. The method according to claim 4, characterized in that The determining the network anomaly cause location result according to the anomaly propagation path diagram and the virtual network topology diagram includes: Calculating the suspiciousness of each abnormal node in the abnormal propagation path graph, and adding the abnormal nodes whose suspiciousness meets the preset conditions to the suspicious node list; Mapping the abnormal nodes in the suspicious node list to the virtual network topology map, and checking the network status of the network location where the abnormal nodes are located in the virtual network topology map; If the network status of the network location where the abnormal node is located is abnormal, the network abnormality cause location result is determined based on the system log, the real-time business indicator data, the abnormal propagation path diagram and the virtual network topology diagram.

6. An artificial intelligence-based business alarm system, characterized in that: The system comprises: An acquisition module is used to obtain the infrastructure layer data, service layer data, and network layer data of the target network; A preprocessing module is configured to construct a resource dependency graph based on the preprocessed infrastructure layer data and the service layer data; and to construct a virtual network topology graph based on the preprocessed infrastructure layer data and the network layer data; the resource dependency graph is used to analyze dependencies and fault propagation paths between services and resources, and the virtual network topology graph is used to monitor physical / logical network connection status and traffic paths; A construction module, configured to construct a resource dependency graph and a virtual network topology graph based on the pre-processed infrastructure layer data, the service layer data, and the network layer data; A prediction module, configured to input real-time business indicator data and the resource dependency graph into a network prediction model to obtain an abnormality prediction result, wherein the abnormality prediction result includes a list of abnormal nodes; A determination module, configured to determine a result of locating the cause of the network anomaly based on the anomaly prediction result, the resource dependency graph, and the virtual network topology graph; An output module, configured to output and display the abnormality cause of the target network and the location of the abnormality cause on a screen display interface based on the abnormality cause location result; The prediction module is specifically used to: Inputting the real-time business indicator data and the resource dependency graph into a network prediction model, and mapping the real-time business indicator data to the resource dependency graph through a mapping module in the network prediction model to obtain a resource dependency graph carrying the business indicator data; Inputting the resource dependency graph carrying the business indicator data into a feature extraction module for feature extraction to obtain a business dependency graph data feature vector; Obtaining the abnormality prediction result through the business dependency graph data feature vector; The determining module is specifically configured to: Perform abnormal time filtering according to the abnormal node list in the abnormal prediction result to obtain an abnormal node cluster set; Constructing an abnormal propagation path graph through the abnormal node cluster set and the resource dependency graph, wherein each abnormal node in the abnormal propagation path graph corresponds to an abnormal value; The network anomaly cause locating result is determined based on the anomaly propagation path diagram and the virtual network topology diagram.

Images