A platform performance evaluation method and system based on collaborative intelligent analysis

Abstract

A platform operation performance evaluation method and system based on collaborative intelligent analysis, relating to the field of electronic digital data processing, is disclosed. The method includes: establishing a directed data dependency graph based on data relationships; arranging operation performance data in chronological order to form a performance fluctuation sequence; calculating the correlation importance of monitored objects in the directed data dependency graph; analyzing the performance fluctuation sequence; calculating the propagation consistency factor of performance data exceeding a preset performance threshold and the temporal tightness factor of related performance data in the performance fluctuation sequence; calculating the propagation weight value between any two monitored objects and constructing a performance fluctuation propagation sequence for the monitored objects based on the propagation weight value; calculating the abnormal impact degree of the monitored objects based on the performance fluctuation propagation sequence and the directed data dependency graph; and identifying monitored objects with an abnormal impact degree exceeding a preset impact degree threshold as target abnormal objects. Implementing this method can improve the accuracy of platform operation performance anomaly evaluation.

Description

Technical Field

[0001] This application relates to the field of electronic digital data processing, and in particular to a platform performance evaluation method and system based on collaborative intelligent analysis. Background Technology

[0002] With the widespread adoption of distributed systems and microservice architectures, platforms are becoming increasingly large-scale, and the interactions between various system components are becoming more complex, placing higher demands on the evaluation of platform performance and the diagnosis of anomalies. Accurately identifying the root causes of performance anomalies and analyzing their propagation paths is of great significance for ensuring the stable operation of the platform.

[0003] In related technologies, performance monitoring probes are set up to collect performance data of each monitored object, and anomaly detection is performed based on preset performance thresholds. When a performance anomaly is detected, the possible source of the anomaly is located by analyzing the performance data at the time of the anomaly and combining it with the call relationships between monitored objects.

[0004] However, due to the complex data dependencies between the monitored objects in the platform, performance anomalies may spread among the objects. The analysis based on performance data at a single moment in the relevant technologies cannot effectively track the propagation process of anomalies among objects, which can easily lead to misjudgment or omission of the real source of the anomaly, resulting in a decrease in the accuracy of the platform's performance anomaly assessment. Summary of the Invention

[0005] This application provides a platform performance evaluation method and system based on collaborative intelligent analysis, which can improve the accuracy of platform performance anomaly evaluation.

[0006] Firstly, this application provides a platform performance evaluation method based on collaborative intelligent analysis, applied to a platform performance evaluation system. The method includes: acquiring data relationships between monitored objects in the platform to be evaluated; establishing a directed data dependency graph based on these relationships, where each edge in the graph represents a data interaction relationship between the monitored objects; collecting performance data of the monitored objects and arranging the performance data in chronological order to form a performance fluctuation sequence; calculating the importance of the associations of the monitored objects in the directed data dependency graph, where the importance is weighted based on the number of direct and indirect associations of the monitored objects; and analyzing the performance fluctuation sequence to calculate the propagation consistency factor of performance data exceeding a preset performance threshold and the temporal density of associated performance data in the performance fluctuation sequence. The propagation consistency factor represents the degree of propagation of performance data among related objects, and the time tightness factor represents the degree of temporal correlation of related performance data. The propagation weight value between any two monitored objects is calculated, and a performance fluctuation propagation sequence is constructed based on this weight value. This propagation weight value is obtained by weighting the correlation importance, propagation consistency factor, and time tightness factor. This propagation sequence represents the order in which performance anomalies are transmitted among the monitored objects. Based on the performance fluctuation propagation sequence and the directed data dependency graph, the anomaly impact degree of the monitored objects is calculated. Monitored objects whose anomaly impact degree exceeds a preset impact degree threshold are identified as target anomaly objects. This anomaly impact degree is calculated based on the monitored object's position in the propagation sequence, the number of downstream objects affected, and the correlation importance of each object.

[0007] In the above embodiments, a directed data dependency graph is established to clarify the data interaction relationships of the monitored objects. The performance fluctuation sequence arranges the running performance data in time, providing a temporal basis for anomaly analysis. The correlation importance is calculated by weighting direct and indirect correlations to quantify the importance of the object in the correlation network. The propagation consistency factor reflects the degree of anomaly propagation among the correlated objects, and the time tightness factor reflects the temporal correlation of the correlated performance data. The two factors are weighted with the correlation importance to obtain the propagation weight, and the constructed propagation sequence clarifies the anomaly transmission order. Combining the propagation sequence and the dependency graph, the anomaly impact is calculated by the position of the monitored object in the propagation sequence, the number of downstream objects, and the correlation importance, thereby identifying the target anomaly object. This enables the tracking of the anomaly propagation process, quantifies the object's importance and the scope of its impact, and improves the accuracy of platform performance evaluation and the precision of anomaly location.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the step of collecting the operating performance data of the monitored object and arranging the operating performance data in chronological order to form a performance fluctuation sequence specifically includes: collecting performance indicator data of the monitored object, the performance indicator data including at least processor utilization data and memory occupancy data; obtaining sampled values ​​of the performance indicator data according to a preset sampling time interval; associating the sampled values ​​with the corresponding sampling time to generate performance indicator time-series data, and constructing a performance fluctuation sequence based on the performance indicator time-series data, wherein each sequence element includes a time identifier and the corresponding performance indicator data.

[0009] In the above embodiments, key performance indicators such as processor utilization and memory usage are collected. Sample values ​​are obtained at preset sampling intervals, and the sample values ​​are correlated with the sampling time to generate time-series data, constructing a performance fluctuation sequence containing time markers and performance data. Key performance indicators ensure a strong correlation between data and operating status, fixed sampling intervals ensure consistency of time series, and the binding of time markers with performance data makes performance changes traceable. These features work together to accurately capture the dynamic fluctuation patterns of performance over time, providing reliable time-series data support for subsequent analysis of anomaly propagation, time correlation, etc., and improving the time-series accuracy of performance evaluation.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, the step of calculating the association importance of a monitored object in a directed data dependency graph, wherein the association importance is calculated by weighting the number of direct associations and the number of indirect associations of the monitored object, specifically includes: counting the number of adjacent nodes of the monitored object in the directed data dependency graph, and using the number of adjacent nodes as the number of direct associations; traversing the directed data dependency graph to obtain the number of all reachable nodes of the monitored object, and using the number of reachable nodes as the number of indirect associations; multiplying the number of direct associations by a first preset weight to obtain a direct association score, and multiplying the number of indirect associations by a second preset weight to obtain an indirect association score; and adding the direct association score and the indirect association score to obtain the association importance of the monitored object.

[0011] In the above embodiments, the number of direct associations (adjacent nodes) and indirect associations (reachable nodes) of a monitored object are counted, multiplied by preset weights respectively, and then summed to obtain the association importance. The number of direct associations reflects the object's immediate interactive impact, while the number of indirect associations reflects its radiating effect through other objects. The weighted calculation integrates both. This approach comprehensively considers the object's direct and indirect influence in the association network, avoiding the one-sidedness of assessments based solely on direct associations. It provides accurate quantitative basis for subsequent propagation weight calculations and anomaly impact analysis, improving the comprehensiveness of the assessment of object importance.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the step of calculating the abnormal impact degree of a monitored object based on the performance fluctuation propagation sequence and the directed data dependency graph, and identifying monitored objects whose abnormal impact degree exceeds a preset impact degree threshold as target abnormal objects, specifically includes: obtaining the sequence number of the monitored object in the performance fluctuation propagation sequence; determining the position weight value of the monitored object according to a preset position weight calculation rule; determining the number of all downstream nodes of the monitored object in the directed data dependency graph; multiplying the position weight value by the number of downstream nodes to obtain an initial impact value; calculating the sum of the association importance of the downstream nodes; multiplying the initial impact value by the sum of the association importance to obtain the abnormal impact degree of the monitored object; and determining whether the abnormal impact degree is greater than the preset impact degree threshold. If so, the monitored object is identified as a target abnormal object.

[0013] In the above embodiments, a directed data dependency graph is established to clarify the data interaction relationships of the monitored objects. The performance fluctuation sequence arranges the running performance data in time, providing a temporal basis for anomaly analysis. The correlation importance is calculated by weighting direct and indirect correlations to quantify the importance of the object in the correlation network. The propagation consistency factor reflects the degree of anomaly propagation among the correlated objects, and the time tightness factor reflects the temporal correlation of the correlated performance data. The two factors are weighted with the correlation importance to obtain the propagation weight, and the constructed propagation sequence clarifies the anomaly transmission order. Combining the propagation sequence and the dependency graph, the anomaly impact is calculated by the position of the monitored object in the propagation sequence, the number of downstream objects, and the correlation importance, thereby identifying the target anomaly object. This enables the tracking of the anomaly propagation process, quantifies the object's importance and the scope of its impact, and improves the accuracy of platform performance evaluation and the precision of anomaly location.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, after calculating the abnormal impact degree of the monitored object based on the performance fluctuation propagation sequence and the directed data dependency graph, and identifying the monitored object whose abnormal impact degree exceeds a preset impact degree threshold as the target abnormal object, the method further includes: obtaining abnormal points of performance indicators based on the performance fluctuation sequence of the target abnormal object; in the directed data dependency graph, starting from the target abnormal object, obtaining the performance fluctuation data of the associated objects of the target abnormal object according to a preset hierarchy; performing time-series alignment on the performance fluctuation data to determine the time-series relationship of performance abnormalities; determining the abnormal propagation link based on the time-series relationship and the topology of the directed data dependency graph; identifying abnormal triggering nodes on the abnormal propagation link, and generating an abnormal analysis report by statistically analyzing the abnormal characteristic parameters of the abnormal triggering nodes.

[0015] In the above embodiments, key performance indicators such as processor utilization and memory usage are collected. Sample values ​​are obtained at preset sampling intervals, and the sample values ​​are correlated with the sampling time to generate time-series data, constructing a performance fluctuation sequence containing time markers and performance data. Key performance indicators ensure a strong correlation between data and operating status, fixed sampling intervals ensure consistency of time series, and the binding of time markers with performance data makes performance changes traceable. These features work together to accurately capture the dynamic fluctuation patterns of performance over time, providing reliable time-series data support for subsequent analysis of anomaly propagation, time correlation, etc., and improving the time-series accuracy of performance evaluation.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, the step of determining the anomaly propagation path based on temporal relationships and the topology of the directed data dependency graph specifically includes: obtaining the fluctuation trend of performance indicators, and determining an analysis time window based on the fluctuation trend; within the analysis time window, extracting the performance indicator change characteristics of the associated objects of the target anomaly object; constructing the propagation path of performance fluctuation based on the topology of the directed data dependency graph and the performance indicator change characteristics; calculating the propagation order of the associated objects in the propagation path of performance fluctuation, and determining the anomaly propagation path based on the propagation order.

[0017] In the above embodiments, the analysis time window is determined based on the fluctuation trend of performance indicators, focusing on key periods related to anomalies; within the window, the performance indicator change characteristics of related objects are extracted to capture anomaly patterns; the propagation path is constructed by combining the dependency graph topology and change characteristics to ensure that the path conforms to the data interaction logic; and the propagation order is calculated to determine the anomaly propagation link. These features work together to make the determination of the propagation link more closely match the actual anomaly spread situation, improving the accuracy of anomaly propagation path location.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, the step of identifying anomaly triggering nodes on an anomaly propagation path and generating an anomaly analysis report by statistically analyzing the anomaly characteristic parameters of the anomaly triggering nodes specifically includes: determining the starting node of the anomaly propagation path as the anomaly triggering node based on the propagation direction of the anomaly propagation path; extracting the performance fluctuation characteristics of the anomaly triggering node and statistically analyzing the fluctuation frequency, fluctuation amplitude, and fluctuation duration of the anomaly triggering node; using the fluctuation frequency, fluctuation amplitude, and fluctuation duration as anomaly characteristic parameters, and generating an anomaly analysis report based on the anomaly characteristic parameters.

[0019] In the above embodiments, the starting node is determined as the anomaly trigger node based on the propagation direction of the anomaly propagation chain, thus clarifying the source of the anomaly. Its performance fluctuation characteristics are extracted, and the frequency, amplitude, and duration of fluctuations are statistically analyzed as anomaly characteristic parameters. The propagation direction ensures accurate location of the trigger node, the fluctuation frequency reflects the frequency of anomaly occurrence, the amplitude reflects the severity of the anomaly, and the duration indicates the duration of the impact. These parameters are combined to generate an anomaly analysis report, comprehensively presenting the characteristics of the anomaly trigger node, providing specific and quantitative evidence for anomaly root cause analysis, and improving the accuracy of anomaly analysis and the practicality of the report.

[0020] In a second aspect, embodiments of this application provide a platform performance evaluation system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, which includes computer instructions, and the one or more processors call the computer instructions to cause the platform performance evaluation system to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a platform performance evaluation system, cause the platform performance evaluation system to execute the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a platform performance evaluation system, cause the platform performance evaluation system to perform the method described in the first aspect and any possible implementation thereof.

[0023] Understandably, the platform performance evaluation system provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. This application clarifies the data interaction relationships of monitored objects by establishing a directed data dependency graph. The performance fluctuation sequence arranges the running performance data in time, providing a temporal basis for anomaly analysis. The correlation importance is calculated by weighting direct and indirect correlations to quantify the importance of objects in the correlation network. The propagation consistency factor reflects the degree of anomaly propagation among related objects, and the time tightness factor reflects the temporal correlation of related performance data. The two factors are weighted with the correlation importance to obtain the propagation weight, and the constructed propagation sequence clarifies the anomaly transmission order. Combining the propagation sequence and the dependency graph, the anomaly impact is calculated by the position of the monitored object in the propagation sequence, the number of downstream objects, and the correlation importance, thereby identifying the target anomaly object. This enables the tracking of the anomaly propagation process, quantifies the object's importance and scope of influence, and improves the accuracy of platform performance evaluation and the precision of anomaly location.

[0026] 2. This application collects key performance indicator data such as processor utilization and memory usage, obtains sampled values ​​at preset sampling intervals, and correlates these sampled values ​​with sampling time to generate time-series data, constructing a performance fluctuation sequence containing time markers and performance data. Key performance indicators ensure a strong correlation between the data and the operating state, fixed sampling intervals ensure time-series consistency, and the binding of time markers with performance data makes performance changes traceable. These features work together to accurately capture the dynamic fluctuation patterns of performance over time, providing reliable time-series data support for subsequent analysis of anomaly propagation and time correlation, thus improving the time-series accuracy of performance evaluation.

[0027] 3. This application calculates the importance of an object's association by multiplying the number of direct associations (adjacent nodes) and indirect associations (reachable nodes) of the monitored object by preset weights and then summing the results. The number of direct associations reflects the object's immediate interactive impact, while the number of indirect associations reflects its radiating effect through other objects. The weighted calculation integrates both. This approach comprehensively considers both the direct and indirect influence of an object in the association network, avoiding the bias of assessments based solely on direct associations. It provides accurate quantitative evidence of importance for subsequent propagation weight calculations and anomaly impact analysis, thereby improving the comprehensiveness of the assessment of object importance. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating a platform performance evaluation method based on collaborative intelligent analysis in an embodiment of this application.

[0029] Figure 2 This is another flowchart illustrating the platform performance evaluation method based on collaborative intelligent analysis in this application embodiment;

[0030] Figure 3 This is a schematic diagram of the physical device structure of the platform operation performance evaluation system in the embodiments of this application. Detailed Implementation

[0031] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0032] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0033] To facilitate understanding, the application scenarios of the embodiments of this application are described below.

[0034] In a large data center, a cluster of dozens of servers is deployed to run the enterprise's core business systems. This cluster includes multiple application servers, database servers, load balancers, and other servers. These servers interact with each other in complex ways: application servers need to read data from the database server, load balancers distribute requests to application servers, and database servers synchronize data with backup servers. As business grows, the server cluster expands, and the dependencies between servers become increasingly complex. During peak business periods, some servers often experience response delays. However, operations and maintenance personnel often struggle to determine whether the problem stems from a server malfunction or is caused by other related servers, and they are unable to pinpoint the propagation path and scope of the anomaly. This makes troubleshooting difficult and severely impacts business continuity.

[0035] In existing technology, this data center uses traditional performance monitoring methods, setting independent performance thresholds for each server. For example, alarms are triggered when CPU utilization exceeds 85% or memory usage exceeds 90%, and real-time performance data is collected via probes. During a peak business period, the application server triggered a CPU utilization alarm. After inspection, maintenance personnel found its memory usage was normal and restarted the application server, temporarily alleviating the response latency. However, shortly afterward, the application server triggered another alarm, and the database server also experienced slow response times. Only then did maintenance personnel check the database server and find a significant increase in interaction time with the application server. However, because the database server's own CPU utilization did not reach the threshold, no alarm was triggered. Further investigation revealed that the backup server was experiencing an anomaly during data synchronization, causing database server resources to be consumed, which in turn affected the application server. Existing technology cannot correlate the dependencies between servers; it can only monitor single-point indicators and cannot trace the anomaly propagation path, leading to a delay in locating the root cause of the fault.

[0036] After adopting this solution, the server performance evaluation of the data center was improved. The system first acquires the data relationships between servers, establishing a directed data dependency graph to clearly present the direction of data interaction between servers. Then, it collects operational performance data such as CPU utilization and memory usage of each server, forming a performance fluctuation sequence in chronological order. By calculating the importance of server associations, it was found that the load balancer server has a high association importance due to its direct association with multiple application servers and indirect association with the database server. Analyzing the performance fluctuation sequence, the propagation consistency factor and time tightness factor of performance data exceeding thresholds were calculated. It was found that shortly after an application server anomaly, the database server also experienced anomalies, and both exhibited high propagation consistency and time tightness. Based on these factors, propagation weight values ​​were calculated, constructing a performance fluctuation propagation sequence that clarifies the order in which the anomaly propagated from the backup server through the database server to the application server. Combining this with the directed data dependency graph, the impact of the anomaly was calculated, identifying the backup server as the target anomaly object. Based on this, operations and maintenance personnel can quickly locate the root cause of the fault, handle it promptly, effectively shorten the fault investigation time, prevent further spread of the fault, and ensure the stable operation of the business.

[0037] To facilitate understanding, the method provided in this implementation will be described in detail below, using the above scenario as an example. Please refer to [link / reference]. Figure 1 This is a flowchart illustrating a platform performance evaluation method based on collaborative intelligent analysis in this application embodiment.

[0038] S101. Obtain the data association relationship between the monitored objects in the platform to be evaluated, and establish a directed data dependency graph based on the data association relationship. Each edge in the directed data dependency graph represents the data interaction relationship between the monitored objects.

[0039] Here, "platform to be evaluated" refers to a collection of systems or architectures that require performance evaluation, such as a distributed platform consisting of multiple servers and service components; "monitored object" refers to the unit within the platform that is being monitored, which may include components with independent functions such as servers, databases, and applications; "data relationship" refers to the dependency relationship formed between monitored objects through data interaction, such as the call relationship formed when server A sends a data request to server B; "directed data dependency graph" is a model that graphically displays monitored objects and their data relationships, where nodes represent monitored objects and edges represent the direction of data interaction; edges are the connecting elements in the directed data dependency graph, used to represent the direction and existence of data interaction between monitored objects, for example, an edge from node X to node Y indicates that X sends data to Y.

[0040] This step is typically performed during the initial stage of platform operation, after architecture adjustments, or during regular maintenance. Its purpose is to establish a foundational relational model for subsequent performance evaluation. Specifically, the system first collects data interaction information between all monitored objects through log analysis and API call records. For example, server A transmits user data to server B every 5 minutes, and database C receives query requests from application D. Then, this information is analyzed to clarify the interaction direction and content between each monitored object and other objects, determining the data relationships. Finally, a directed data dependency graph is constructed based on these relationships. For instance, when the monitored objects include application servers, database servers, and cache servers, if the application server needs to write data to the database server, and the database server needs to synchronize data to the cache server, then a directed edge "Application Server → Database Server → Cache Server" will be formed in the graph, clearly showing the data flow path.

[0041] In some embodiments, this step can be implemented in several ways: Optionally, the system deploys a log collection tool to collect interaction logs (such as interface call logs and data transmission logs) of each monitored object, extracts the identifiers and directions of the interacting parties (such as "object A → object B") from the logs, and after statistically analyzing all interaction relationships, constructs a directed data dependency graph using a graph database (such as Neo4j); Optionally, probes are embedded in each monitored object to record the communication protocols (such as HTTP requests and TCP connections) and data flow between objects in real time, and the recorded interaction information is sent to the analysis module. The analysis module organizes the information according to the "source object - target object" format and uses a visualization tool (such as Gephi) to generate a directed data dependency graph. It is understood that other methods can also be used to obtain data relationships and construct graphs, such as manually entering the relationships into the system after manually reviewing the platform architecture document. This is not limited here.

[0042] S102. Collect the operating performance data of the monitored object and arrange the operating performance data in chronological order to form a performance fluctuation sequence.

[0043] Among them, operational performance data refers to quantitative indicators that reflect the operational status of the monitored object, including at least processor utilization (such as the proportion of CPU cores occupied) and memory utilization (such as the ratio of used memory to total memory), and may also include disk I / O rate, network bandwidth utilization, etc.; time order refers to the order in which the data is arranged according to the time of its generation or collection, such as arranged in the order of "10:00, 10:01, 10:02"; performance fluctuation sequence refers to an ordered set of operational performance data organized in chronological order, where each element contains corresponding time information and performance data, used to reflect the trend of performance changes over time.

[0044] This step is performed continuously or periodically during platform operation to provide a time-series data foundation for subsequent analysis of performance fluctuation patterns and anomaly identification. Specifically, the system first determines the performance indicators to be collected. In addition to processor utilization and memory usage, indicators such as database query response time and application concurrent connections can be added based on platform characteristics. Then, the sampling time interval (e.g., 10 seconds, 1 minute) is set, and the performance indicator values ​​of each monitored object are collected periodically according to this interval. For example, the CPU utilization of server A is recorded every 10 seconds. Next, each collected value is associated with the corresponding sampling time (e.g., "2025-07-12 10:00:00") to form a "time-performance value" key-value pair. These key-value pairs are then arranged in chronological order to form a performance fluctuation sequence. For example, the CPU utilization sequence of server A might be "(10:00:00, 60%) → (10:00:10, 65%) → (10:00:20, 80%)", which visually displays the dynamic changes in performance.

[0045] In some embodiments, this step can be implemented in several ways: Optionally, the system uses Prometheus as a monitoring tool, configured to collect metrics such as CPU utilization and memory usage of each monitored object at a sampling interval of 30 seconds. Prometheus stores the collected data as time-series data by timestamp. After the system reads this data from Prometheus, it sorts it in ascending order by timestamp to form a performance fluctuation sequence. Each sequence element contains a timestamp (accurate to milliseconds) and the corresponding metric value. Optionally, a script (such as a Python script) can be written to periodically obtain sampled values ​​of performance metrics using operating system commands (such as the Linux `top` and `free` commands). The script binds the sampled values ​​to the current system time (e.g., obtained through the `datetime` module) and stores them as a CSV file (each row contains "time, CPU utilization, and memory usage"). When reading the file later, it is sorted by the time column to construct the performance fluctuation sequence. It is understood that other methods can also be used to collect performance data and construct sequences, such as using a Zabbix monitoring system to collect data and then obtaining and processing time-series data through an API interface. This is not limited here.

[0046] In some embodiments, this step specifically includes:

[0047] The system collects performance indicator data of the monitored objects, including at least processor utilization data and memory usage data; it obtains sampled values ​​of the performance indicator data according to a preset sampling time interval; it associates the sampled values ​​with the corresponding sampling time to generate time-series performance indicator data, and constructs a performance fluctuation sequence based on the time-series performance indicator data, where each sequence element includes a time identifier and the corresponding performance indicator data.

[0048] The monitored objects refer to the functional units within the platform that are monitored, such as servers, databases, and applications. Performance metrics data are quantitative information reflecting the operating status of the monitored objects. Processor utilization data refers to the percentage of non-idle time the processor spends per unit of time (e.g., if a server's processor is in working state for 45 seconds within 1 minute, the utilization rate is 75%). Memory usage data refers to the ratio of used memory capacity to total memory capacity (e.g., if the total memory is 16GB and 12GB is used, the usage rate is 75%). The preset sampling interval is a fixed time period for collecting data (e.g., 10 seconds / time, 1 minute / time) to ensure the temporal regularity of the data. The sampled value is the specific value of the performance metric collected at each sampling time point. Performance metric time-series data is data that binds the sampled value to its corresponding sampling time (e.g., "10:00:00, processor utilization 70%, memory usage 60%)". The performance fluctuation sequence is a set of performance metric time-series data arranged in chronological order. Each element contains a time identifier (e.g., a specific time point) and the corresponding performance metric data to reflect the performance trend over time. For example, if an application server is sampled at 10-second intervals, the resulting performance fluctuation sequence might be [(10:00:00, 70%, 60%), (10:00:10, 75%, 62%), (10:00:20, 80%, 65%)].

[0049] The specific implementation process of this step is as follows: First, determine the monitoring objects (such as 3 application servers and 2 database servers in the cluster) and clarify the performance indicators to be collected, including at least processor utilization and memory usage. Raw data can be obtained through the server's built-in monitoring tools (such as the top command in Linux to view processor utilization in real time, and the free command to view memory usage) or the API interface of professional monitoring software (such as Zabbix). Second, set the sampling time interval according to the sensitivity of the platform's performance fluctuations (such as 1 second for high-frequency trading platforms and 10 seconds for ordinary business platforms). The system will automatically trigger the collection action at this interval, recording the specific values ​​of processor utilization and memory usage (i.e., sampled values) at each time point. Next, associate each sampled value with the corresponding sampling time (accurate to milliseconds, such as "2025-07-12 14:30:00.000") to generate a performance indicator time series data, in the format of (time identifier, processor utilization, memory usage). Finally, sort all the time series data in chronological order of the time identifiers (such as from morning to night) to form a performance fluctuation sequence. For example, a database server's sequence is [(14:30:00, 65%, 50%), (14:30:10, 68%, 52%), (14:30:20, 72%, 55%)]. Each element completely records the performance status at the corresponding time point, providing structured data for subsequent analysis of performance fluctuation patterns over time.

[0050] S103. Calculate the association importance of the monitored objects in the directed data dependency graph. The association importance is calculated by weighting the number of direct associations and the number of indirect associations of the monitored objects.

[0051] Among them, the importance of association refers to a quantitative indicator used to measure the importance of a monitored object in a directed data dependency graph based on its association relationships. The higher the value, the more critical the object is in the data interaction network. The number of direct associations refers to the number of directly connected adjacent nodes of a monitored object in a directed data dependency graph. For example, if monitored object A has direct data interaction with objects B and C, then the number of direct associations of A is 2. The number of indirect associations refers to the number of all nodes that a monitored object can indirectly reach through other nodes in a directed data dependency graph. For example, if object A is directly associated with B, and B is associated with C, then the number of indirect associations of A includes at least C. Weighted calculation refers to the calculation method of assigning preset weights to the number of direct associations and the number of indirect associations, and then obtaining a comprehensive result through multiplication and addition operations. For example, assigning a weight of 0.6 to the number of direct associations and a weight of 0.4 to the number of indirect associations before calculation.

[0052] This step is performed after the directed data dependency graph is constructed. Its purpose is to quantify the importance of each monitored object in the associated network, providing a basis for subsequent calculations of propagation weights and anomaly impact. Specifically, the system first traverses the directed data dependency graph, counts the number of adjacent nodes for each monitored object, and determines this as the number of direct associations. For example, in a graph containing "application server → database server → cache server", the number of direct associations for the database server is 2 (application server and cache server). Next, the system traverses the graph using a depth-first or breadth-first algorithm to obtain the number of all reachable nodes for the monitored object as the number of indirect associations. For example, the database server can be associated with the log server through the cache server, so its indirect associations include the log server. Then, according to preset first and second weights (e.g., first weight 0.7, second weight 0.3), the number of direct associations and the number of indirect associations are weighted and calculated to obtain the direct association score and the indirect association score. Finally, the two scores are added together to obtain the association importance of the monitored object. For example, if the number of direct associations is 3 and the first weight is 0.6, and the number of indirect associations is 5 and the second weight is 0.4, then the association importance = 3 × 0.6 + 5 × 0.4 = 1.8 + 2 = 3.8.

[0053] In some embodiments, this step can be implemented in several ways: Optionally, the system uses a graph traversal tool (such as NetworkX) to load a directed data dependency graph, calls the tool's "neighbors" method to obtain the neighboring nodes of each monitored object, and counts the number to obtain the number of direct associations; then, it uses the "reachable_nodes" method to obtain all reachable nodes and counts the number to obtain the number of indirect associations; then, it reads the first preset weight (e.g., 0.5) and the second preset weight (e.g., 0.5) from the configuration file, multiplies them by the number of direct and indirect associations respectively, and sums them to obtain the association importance; Optionally, graph traversal can be implemented programmatically, for example, using Python code to traverse the adjacency list of the directed graph. For each monitored object, it iterates and counts the number of directly connected nodes as the number of direct associations; then, it recursively traverses all reachable nodes, records and removes duplicates, and counts the number as the number of indirect associations; finally, it calculates the association importance using the formula "association importance = number of direct associations × w1 + number of indirect associations × w2" (where w1 and w2 are preset weights, such as w1=0.6, w2=0.4). It is understandable that other methods can be used to calculate the importance of associations, such as adjusting the weight value based on the interaction frequency of nodes, which is not limited here.

[0054] In some embodiments, this step specifically includes: counting the number of adjacent nodes of the monitored object in the directed data dependency graph, and using the number of adjacent nodes as the number of direct associations; traversing the directed data dependency graph to obtain the number of all reachable nodes of the monitored object, and using the number of reachable nodes as the number of indirect associations; multiplying the number of direct associations by a first preset weight to obtain a direct association score, and multiplying the number of indirect associations by a second preset weight to obtain an indirect association score; and adding the direct association score and the indirect association score to obtain the association importance of the monitored object.

[0055] In this context, a directed data dependency graph is a graphical model where nodes represent monitored objects and directed edges represent the direction of data interaction between objects. For example, the edge "Server A → Server B" indicates that A sends data to B. Adjacent nodes are those nodes directly connected to the current monitored object in the directed data dependency graph (including upstream nodes sending data and downstream nodes receiving data). For instance, if server A is directly connected to B and C, then B and C are adjacent nodes of A. The number of direct associations refers to the total number of adjacent nodes. Reachable nodes are all nodes (excluding themselves) that can be indirectly reached from the current monitored object through directed edges. For example, in A → B → C, C is a reachable node of A. The number of indirect associations refers to the total number of reachable nodes. The first and second preset weights are pre-set coefficients used for weighted calculations (the sum of the two is usually 1, such as 0.6 for the first weight and 0.4 for the second weight). The direct association score is the product of the number of direct associations and the first preset weight. The indirect association score is the product of the number of indirect associations and the second preset weight. The association importance is the sum of the direct association score and the indirect association score, used to quantify the importance of the monitored object in the dependency graph. For example, if the number of direct associations of monitored object A is 2 (adjacent nodes B and C), and the number of indirect associations is 3 (reachable nodes D, E, and F), with a first weight of 0.5 and a second weight of 0.5, then the direct association score = 2 × 0.5 = 1, the indirect association score = 3 × 0.5 = 1.5, and the association importance = 1 + 1.5 = 2.5.

[0056] The specific implementation process of this step is as follows: For each monitored object (node) in the directed data dependency graph, traverse all edges in the graph and count the number of directly connected neighboring nodes (including upstream nodes pointed to by incoming edges and downstream nodes pointed to by outgoing edges). This number is determined as the number of direct associations. For example, if node X has 3 incoming edges (from A, B, C) and 2 outgoing edges (pointing to D, E), then it has 5 neighboring nodes, and the number of direct associations is 5. Alternatively, use Depth-First Search (DFS) or Breadth-First Search (BFS) to traverse the directed data dependency graph: Starting from the current monitored object, visit all reachable nodes along the directed edges, record and remove duplicates (to avoid double counting), and count the total number of these nodes, which is the number of indirect associations. For example, if node Y can reach F, G, and H via the path Y→F→G→H, and reach I via Y→I, then it has 4 reachable nodes, and the number of indirect associations is 4. The system reads a first preset weight (e.g., 0.6) and a second preset weight (e.g., 0.4) from the system configuration. The number of direct associations is multiplied by the first preset weight to obtain the direct association score (e.g., if the number of direct associations is 3, then 3 × 0.6 = 1.8). The number of indirect associations is multiplied by the second preset weight to obtain the indirect association score (e.g., if the number of indirect associations is 5, then 5 × 0.4 = 2). The direct and indirect association scores are added together to obtain the association importance of the monitored object (e.g., 1.8 + 2 = 3.8). This method considers both the direct influence (direct association) and the radiating power generated through indirect relationships (indirect association), achieving a comprehensive quantification of node importance.

[0057] S104. Analyze the performance fluctuation sequence, calculate the propagation consistency factor of performance data exceeding the preset performance threshold and the time tightness factor of related performance data in the performance fluctuation sequence. The propagation consistency factor represents the degree of propagation of performance data among related objects, and the time tightness factor represents the degree of time correlation of related performance data.

[0058] Among them, the propagation consistency factor is a quantitative indicator used to represent the degree of propagation of performance data exceeding the preset performance threshold among related objects. The higher the value, the stronger the consistency of the propagation of abnormal data among related objects. For example, if an anomaly occurs in 80% of related objects, the propagation consistency factor may be 0.8. The time tightness factor is a quantitative indicator used to represent the degree of temporal correlation of related performance data. The higher the value, the closer the performance data anomalies of related objects are in time. For example, if the time difference between the occurrence of anomalies in two related objects is 1 second, their time tightness factor may be higher than that of a time difference of 10 seconds. The preset performance threshold is a pre-set critical value used to judge whether performance data is abnormal. For example, the preset threshold for CPU utilization is 85%, and exceeding it is considered abnormal. Related performance data refers to the performance data of monitoring objects that have data correlation relationships in the directed data dependency graph. For example, if objects A and B have data interaction, then the performance data of A and B are related performance data.

[0059] This step is executed after the performance fluctuation sequence is formed. Its purpose is to provide a basis for constructing the performance fluctuation propagation sequence by quantifying the propagation characteristics and temporal correlation characteristics of abnormal data. Specifically, the system first performs element-by-element analysis on the performance fluctuation sequence to filter out all performance data that exceeds the preset performance threshold (i.e., abnormal data). Then, for these abnormal data, the system calculates the proportion of their occurrence in related objects (e.g., what proportion of related objects also have the same type of abnormality), and uses this to calculate the propagation consistency factor. The higher the proportion, the larger the factor value. At the same time, the system extracts the time points of the abnormality occurrence in the related performance data and calculates the time difference (e.g., the difference between the abnormal time of object A and the abnormal time of object B). The time tightness factor is obtained by reciprocal or normalization of the time difference. The smaller the time difference, the larger the factor value, thus reflecting the degree of temporal correlation.

[0060] In some embodiments, this step can be implemented in several ways: Optionally, the system extracts abnormal data exceeding a preset threshold from the performance fluctuation sequence, determines all related objects of the monitored object to which the data belongs, and counts the proportion of the number of related objects with the same type of abnormality (such as all exceeding the CPU utilization threshold). This proportion is used as the propagation consistency factor (e.g., if there are 5 related objects and 4 of them are abnormal, the factor is 4 / 5 = 0.8). Simultaneously, the system records the occurrence time of the abnormal object and the related objects, calculates the time difference Δt, and uses the formula "Time density factor = 1 / ( The factor is calculated as "1 + Δt" (e.g., if Δt = 2 seconds, then the factor = 1 / 3 ≈ 0.33). The smaller Δt is, the closer the factor is to 1. Optionally, the propagation consistency factor can be obtained by calculating the distribution similarity of abnormal data in related objects (e.g., using a cosine similarity algorithm). The higher the similarity, the stronger the propagation consistency. For the time tightness factor, a fixed time window is set (e.g., 30 seconds), and the overlap duration of abnormal times in the related performance data within the window is statistically analyzed. The ratio of the overlap duration to the total window duration is used as the factor (e.g., if the overlap duration is 20 seconds, then the factor = 20 / 30 ≈ 0.67). It is understood that other methods can also be used to calculate the two factors, such as obtaining the consistency factor by fitting the propagation law through a machine learning model, which is not limited here.

[0061] S105. Calculate the propagation weight value between any two monitored objects and construct the performance fluctuation propagation sequence of the monitored objects based on the propagation weight value. The propagation weight value is obtained by weighting the correlation importance, propagation consistency factor and time tightness factor. The propagation sequence represents the order in which performance anomalies are transmitted between the monitored objects.

[0062] Among them, the propagation weight value is a quantitative indicator used to measure the probability of performance anomaly propagation between any two monitored objects. It is obtained by weighting the correlation importance, propagation consistency factor, and time tightness factor. The higher the value, the greater the probability that the anomaly will be propagated from one object to another. The performance fluctuation propagation sequence is a sequence of monitored objects arranged from high to low probability of anomaly propagation. It is used to represent the propagation order of performance anomalies among the monitored objects. For example, the sequence "object A → object B → object C" means that the anomaly is more likely to occur in A first, then propagate to B, and finally to C. The weighted calculation refers to the process of assigning preset weights (such as 0.4, 0.3, and 0.3) to the correlation importance, propagation consistency factor, and time tightness factor respectively, and obtaining a comprehensive result through multiplication and addition operations.

[0063] This step is executed after calculating the correlation importance, propagation consistency factor, and time tightness factor. Its purpose is to determine the priority order of anomaly propagation by integrating multiple indicators, providing a basis for subsequently locating key anomaly objects. Specifically, the system first extracts the correlation importance (e.g., X to Y is 3.8), propagation consistency factor (e.g., 0.8), and time tightness factor (e.g., 0.9) of any two monitored objects with data correlation (e.g., object X and object Y). Then, according to preset weights (e.g., correlation importance weight 0.4, propagation consistency factor 0.3, time tightness factor 0.3), the propagation weight between the two objects is calculated using the formula "propagation weight value = correlation importance × 0.4 + propagation consistency factor × 0.3 + time tightness factor × 0.3". Finally, the propagation weight values ​​of all monitored objects are sorted, and the order of anomaly propagation is determined from high to low, forming a performance fluctuation propagation sequence. For example, when the propagation weight between objects A and B is 0.8, and between B and C it is 0.6, the sequence might be "A→B→C".

[0064] In some embodiments, this step can be implemented in several ways: Optionally, the system reads preset weights (w1=0.5, w2=0.3, w3=0.2, corresponding to association importance, propagation consistency factor, and time tightness factor, respectively) from the configuration file. For any two related monitoring objects, it calls the three indicator values ​​calculated in the previous step and substitutes them into the formula "propagation weight value = w1 × association importance + w2 × propagation consistency factor + w3 × time tightness factor" to calculate. Then, it stores the propagation weight values ​​between all objects into a matrix, processes the matrix using a topological sorting algorithm (such as the Kahn algorithm), and generates a performance fluctuation propagation sequence from high to low weight values. Optionally, the system first sets differentiated weights for different types of monitoring objects (such as servers and databases) (e.g., servers have higher association importance weights), and then calculates the propagation weight value for each pair of objects. Afterward, it combines the edge directions of the directed data dependency graph, retains only the propagation weights that conform to the data flow direction (e.g., only calculates the weights from upstream objects to downstream objects), arranges them in descending order of weight values, and constructs a performance fluctuation propagation sequence to ensure that the sequence conforms to the actual direction of data interaction. It is understandable that this step can also be achieved in other ways, such as fitting historical data through a machine learning model, dynamically adjusting the weights of each factor, and then calculating the propagation weight value. This is not limited here.

[0065] S106. Based on the performance fluctuation propagation sequence and the directed data dependency graph, calculate the abnormal impact degree of the monitored object. The monitored object whose abnormal impact degree exceeds the preset impact degree threshold is identified as the target abnormal object. The abnormal impact degree is calculated based on the position of the monitored object in the propagation sequence, the number of downstream objects affected, and the correlation importance of each object.

[0066] Among them, the anomaly impact degree is a quantitative indicator used to measure the degree of impact of the performance anomaly of the monitored object on the operation of the entire platform. It comprehensively considers the position of the monitored object in the propagation sequence, the number of downstream objects affected, and the correlation importance of each object. The higher the value, the more significant the impact. The target anomaly object is the monitored object whose anomaly impact degree exceeds the preset impact degree threshold, that is, the key anomaly source that has a significant impact on the operation of the platform. The preset impact degree threshold is a critical value set in advance to judge whether the anomaly impact is significant. For example, the threshold is set to 80 (out of 100) based on the platform's historical fault data. The downstream object is the object that is directly or indirectly pointed to by the current monitored object in the directed data dependency graph, that is, the associated object that receives the data of the current object. For example, in "object A → object B → object C", B and C are downstream objects of A.

[0067] This step is executed after obtaining the performance fluctuation propagation sequence and the directed data dependency graph. Its purpose is to filter out the most impactful critical objects from multiple anomalous objects, providing precise targets for troubleshooting. Specifically, the system first determines the position of each monitored object in the performance fluctuation propagation sequence (e.g., the object at position 1 in the sequence appears abnormal earlier than the object at position 5), and assigns weights based on position (e.g., the weight of position 1 is 1.0, the weight of position 2 is 0.8, and so on, decreasing sequentially). Then, it counts the number of downstream objects (including direct and indirect downstreams) of each object in the directed data dependency graph; next, it calculates the sum of the importance of all downstream objects; finally, it calculates the anomaly impact using a formula (e.g., "anomaly impact = position weight × number of downstream objects × sum of downstream importance"), compares it to a preset threshold, and identifies objects exceeding the threshold as target anomalous objects.

[0068] In some embodiments, this step can be implemented in several ways: Optionally, the system assigns linear weights to positions in the propagation sequence (e.g., the weight of the nth position is 1-(n-1) / N, where N is the total length of the sequence), counts the number of downstream objects of the monitored object (e.g., traversing all downstream nodes through a depth-first search of the graph), and calculates the sum of the association importance of the downstream objects; then, it calculates the abnormal impact using the formula "abnormal impact = position weight × number of downstream objects × sum of downstream association importance". For example, if the position weight is 0.9, the number of downstream objects is 5, and the sum of association importance is 20, then the abnormal impact = 0.9 × 5 × 20 = 90. If the preset threshold is 70, then the object is identified as the target abnormal object. Optionally, the system uses the Analytic Hierarchy Process (AHP) to determine the weights of location, downstream quantity, and correlation importance (e.g., location weight 0.4, downstream quantity 0.3, correlation importance 0.3). For each monitored object, standardized values ​​for the three indicators are calculated (e.g., location is standardized to a value between 0 and 1). Then, the system calculates the anomaly impact using the formula "Anomaly Impact = 0.4 × Location Standardized Value + 0.3 × Downstream Quantity Standardized Value + 0.3 × Downstream Correlation Importance Standardized Value". The result is compared to a preset threshold (e.g., 0.7), and objects exceeding the threshold are identified as target anomalies. It is understood that other methods can also be used to implement this step, such as adjusting the calculation method based on platform business priorities (e.g., higher weight for payment-related objects), which is not limited here.

[0069] In some embodiments, this step specifically includes:

[0070] Obtain the sequence number of the monitored object in the performance fluctuation propagation sequence, and determine the position weight value of the monitored object according to the preset position weight calculation rules; determine the number of all downstream nodes of the monitored object in the directed data dependency graph, and multiply the position weight value by the number of downstream nodes to obtain the initial impact value; calculate the sum of the correlation importance of the downstream nodes, and multiply the initial impact value by the sum of the correlation importance to obtain the abnormal impact degree of the monitored object; determine whether the abnormal impact degree is greater than the preset impact degree threshold, and if so, determine the monitored object as the target abnormal object.

[0071] Among them, the performance fluctuation propagation sequence refers to the sequence representing the order in which performance anomalies are transmitted among various monitored objects. For example, [object A, object B, object C] means that the anomaly first appears in A, then propagates to B, and finally to C. The sequence number refers to the position number of the monitored object in the performance fluctuation propagation sequence. For example, in the above sequence, the sequence number of object A is 1 and the sequence number of object B is 2. The preset position weight calculation rule refers to the pre-set rule that determines the position weight value according to the sequence number. Generally, the earlier the sequence number (the earlier the anomaly occurs), the higher the weight value. For example, the rule is "position weight value = 1 - (sequence number - 1) / total sequence length". The position weight value is a value calculated according to the above rule that reflects the importance of the monitored object's position in the propagation sequence. The range is usually between 0 and 1. The directed data dependency graph is a graph in which nodes represent monitored objects and directed edges represent the direction of data interaction. The model; downstream nodes refer to nodes that are directly or indirectly pointed to by the currently monitored object in a directed data dependency graph (i.e., nodes that receive data from the current object), such as in "object M → object N → object P", where N and P are downstream nodes of M; the number of downstream nodes refers to the total number of all downstream nodes; the initial impact value is the product of the position weight value and the number of downstream nodes, reflecting the combined impact of position and the number of downstream nodes; the sum of association importance refers to the sum of the association importance of all downstream nodes (association importance is the indicator calculated in S103); the anomaly impact degree is a quantitative indicator reflecting the degree of impact of the anomaly of the monitored object on the platform, obtained by multiplying the initial impact value by the sum of association importance; the preset impact degree threshold is a pre-set critical value for judging whether the anomaly impact is significant, such as 80; the target anomaly object refers to the monitored object whose anomaly impact degree is greater than the preset impact degree threshold.

[0072] For example, the performance fluctuation propagation sequence is [X, Y, Z] (total length 3), and the index of X is 1. According to the rule "position weight value = 1 - (index - 1) / 3", its position weight value = 1 - 0 / 3 = 1. In the directed data dependency graph, the downstream nodes of X are Y, Z, and W, a total of 3 (number of downstream nodes = 3). The association importance of Y is 2.5, Z is 3.0, and W is 1.5. The sum of the association importance of the downstream nodes = 2.5 + 3.0 + 1.5 = 7. Then the initial impact value = 1 × 3 = 3, and the abnormal impact value = 3 × 7 = 21. If the preset impact value threshold is 15, the abnormal impact value of X 21 > 15, so X is identified as the target abnormal object.

[0073] The specific implementation process of this step is as follows: Obtain the position number (i.e., sequence number) of the monitored object in the performance fluctuation propagation sequence, substitute it into the preset position weight calculation rule (e.g., "position weight value = 1 - (sequence number - 1) / total sequence length"), and calculate the position weight value. In the directed data dependency graph, by traversing all directed edges originating from the current monitored object, determine all nodes that directly and indirectly receive its data (i.e., downstream nodes), and count the total number of these nodes to obtain the number of downstream nodes. Multiply the position weight value by the number of downstream nodes, and the result is the initial impact value. Extract the correlation importance of all downstream nodes (the result calculated in S103), and sum these values ​​to obtain the sum of the correlation importance of downstream nodes. Multiply the initial impact value by the sum of correlation importance to obtain the abnormal impact degree of the monitored object. Compare the abnormal impact degree with the preset impact degree threshold. If the abnormal impact degree is greater than the threshold, the monitored object is identified as the target abnormal object. In this way, by comprehensively considering the order of the abnormal occurrence, the size of the impact range, and the importance of the affected object, the abnormal source that has a significant impact on the platform operation can be accurately located.

[0074] The following provides a more detailed description of the process of the method provided in this implementation. Please refer to [link / reference]. Figure 2 This is another flowchart illustrating the platform performance evaluation method based on collaborative intelligent analysis in this application embodiment.

[0075] S201. Based on the performance fluctuation sequence of the target abnormal object, obtain the outlier points of the performance indicators.

[0076] Here, the target anomaly object refers to a monitored object whose anomaly impact exceeds a preset impact threshold, i.e., an anomaly source that significantly affects the platform's operation; the performance fluctuation sequence refers to an ordered set of the monitored object's operational performance data arranged chronologically, with each element containing a time stamp and corresponding performance metric data; performance metrics are parameters reflecting the monitored object's operational status, including at least processor utilization and memory usage; anomalies refer to the time points when the performance metric values ​​exceed preset thresholds and the corresponding performance data. For example, if the target anomaly object is a database server, and its performance fluctuation sequence contains elements such as (10:05:00, memory usage 92%) and (10:05:10, memory usage 93%), and the preset memory usage threshold is 90%, then these two time points and their corresponding memory usage data are both anomalies.

[0077] The specific implementation process of this step is as follows: First, identify the performance fluctuation sequence corresponding to the target abnormal object. This sequence contains the performance indicator data of the object at different times. Second, set a preset threshold for each performance indicator, such as a processor utilization threshold of 85% and a memory utilization threshold of 90%. Then, traverse each element in the performance fluctuation sequence, extract the performance indicator data in the element, and compare it with the corresponding preset threshold. Finally, filter out all elements whose performance indicator data exceeds the preset threshold; these elements are the outliers of the performance indicators. For example, if the target abnormal object is a cache server, and its performance fluctuation sequence is (9:50:00, CPU utilization 80%), (9:50:10, CPU utilization 87%), and (9:50:20, CPU utilization 89%), with a preset CPU utilization threshold of 85%, then after traversal, (9:50:10, 87%) and (9:50:20, 89%) are identified as outliers.

[0078] S202. In a directed data dependency graph, starting from the target abnormal object, obtain the performance fluctuation data of the associated objects of the target abnormal object according to the preset hierarchy.

[0079] In this context, a directed data dependency graph refers to a graphical model where nodes represent monitored objects and directed edges represent the direction of data interaction between monitored objects. A preset level refers to the number of levels at which associated objects are acquired, used to limit the scope of associated objects. For example, level 1 means acquiring only directly associated objects, and level 2 means acquiring both directly associated objects and their associated objects. Associated objects refer to monitored objects in the directed data dependency graph that have a direct or indirect data interaction relationship with the target abnormal object, including upstream objects (sending data to the target object) and downstream objects (receiving data sent by the target object). Performance fluctuation data refers to a performance fluctuation sequence formed by arranging the runtime performance data of associated objects in chronological order. For example, if the target abnormal object is an application server, and its level 1 associated objects in the directed data dependency graph are a load balancer (upstream) and a database server (downstream), with a preset level of 1, then the performance fluctuation sequence of the load balancer and the database server would be acquired as performance fluctuation data.

[0080] The specific implementation process of this step is as follows: First, locate the node corresponding to the target anomaly object in the directed data dependency graph; second, based on the preset level (e.g., level 2), starting from the target anomaly object node, find the level 1 related objects, that is, the upstream and downstream nodes directly connected to the target anomaly object; next, starting from the level 1 related objects, find the level 2 related objects, that is, the direct upstream and downstream nodes of the level 1 related objects; then, collect all related objects that meet the preset level; finally, obtain the performance fluctuation sequence of these related objects, which is the required performance fluctuation data. For example, if the target anomaly object is A, the level 1 related objects of A in the directed data dependency graph are B (A→B) and C (C→A), and the level 1 related object of B is D (B→D), and the preset level is 2, then the performance fluctuation sequences of B, C (level 1), and D (level 2) need to be obtained.

[0081] S203. Perform time-series alignment on the performance fluctuation data to determine the time-series relationship of performance anomalies.

[0082] Time alignment refers to adjusting the performance fluctuation data of different related objects according to a unified time base, so that the performance data of each object can be directly compared in the time dimension. The time sequence relationship of performance anomalies refers to the chronological order of the anomalies of related objects, that is, which object anomaly occurred first and which object anomaly occurred later. For example, if the anomaly time of related object B is 14:30:02 and the anomaly time of related object C is 14:30:00, after time alignment, it can be determined that the anomaly of C occurred before that of B, and the time sequence relationship between the two is C→B.

[0083] The specific implementation process of this step is as follows: First, collect performance fluctuation data of the target abnormal object and related objects, and extract the time identifier (such as timestamp) from each data element; second, convert all time identifiers into a unified format (such as Unix timestamp, accurate to milliseconds) to ensure consistent time base; then, sort all performance fluctuation data based on timestamps, so that the performance data of different objects at the same point in time form a corresponding relationship; next, filter out all abnormal points from the aligned performance fluctuation data and extract the timestamps of the abnormal points; finally, compare the timestamp values ​​of these abnormal points. The smaller the timestamp value, the earlier the abnormality occurred, thereby determining the order of the abnormal points of each object, that is, the temporal relationship of the performance abnormality. For example, the timestamp of the abnormal point of object D is 1689000000000 (15:00:00), and the timestamp of the abnormal point of object E is 1689000001000 (15:00:01). After time alignment, it can be determined that the abnormality of D occurred before that of E, and the temporal relationship is D→E.

[0084] S204. Obtain the fluctuation trend of performance indicators and determine an analysis time window based on the fluctuation trend.

[0085] Among them, the fluctuation trend of performance indicators refers to the overall change trend of performance indicators (such as CPU utilization and memory usage) over a period of time, including patterns such as rising, falling, stabilizing, and sudden rises and falls; the analysis time window refers to a specific time interval defined for concentrated analysis of the propagation process of performance anomalies, which needs to cover the key stages of the occurrence, development, and spread of anomalies. For example, if the CPU utilization of a server suddenly rises from 60% to 95% between 10:00 and 10:05 and continues to fluctuate, and gradually falls back after 10:10, its fluctuation trend is "sudden rise-fluctuation-fallback", and the corresponding analysis time window can be set to 10:00-10:10.

[0086] The specific implementation process of this step is as follows: First, based on the performance fluctuation sequence, the fluctuation trend of the performance index is identified by plotting a time-series curve or calculating the sliding window mean, such as determining the anomaly start time (the index first exceeds the threshold), the peak time (the index reaches its highest value), and the plateau time (the index tends to stabilize). Then, taking the anomaly start time as the starting point, a certain buffer time is reserved forward (e.g., 30 seconds, to capture the precursors of the anomaly), and taking the plateau time as the end point, a certain buffer time is reserved backward (e.g., 1 minute, to capture the aftershocks of the anomaly). The interval from the starting buffer time to the ending buffer time is determined as the analysis time window. For example, if the anomaly starts at 10:00:00, peaks at 10:02:30, and plateaus at 10:05:00, then the analysis time window can be set to 09:59:30-10:06:00.

[0087] S205. Within the analysis time window, extract the performance index change characteristics of the associated objects of the target abnormal object.

[0088] The analysis time window refers to the time interval for centralized analysis defined in S204; the associated objects of the target anomaly refer to the monitoring objects (such as upstream data-providing objects and downstream data-receiving objects) that have direct or indirect data interaction with the target anomaly in the directed data dependency graph; and the performance indicator change characteristics refer to the specific change patterns of the performance indicators (such as CPU utilization and response time) of the associated objects within the analysis time window, including the magnitude of change, the rate of change, and abrupt change points. For example, if the CPU utilization of a certain associated object increases from 70% to 90% within 10 seconds within the analysis time window, this "significant increase in a short period of time" is its change characteristic.

[0089] The specific implementation process of this step is as follows: First, locate the analysis time window and extract the performance fluctuation sequence of all related objects within the window; then, analyze the performance index data of each related object segment by segment, and calculate characteristic parameters: change amplitude (the difference between the maximum and minimum values ​​of the index within the window), change rate (the amount of change of the index per unit time, such as an increase of 5% per second), mutation point (the time point when the rate of change of the index exceeds a preset threshold, such as an increase of 10% within 1 second), and duration of continuous abnormality (the cumulative time for the index to exceed the threshold); finally, integrate these parameters to form the performance index change characteristics of each related object. For example, related object D's CPU utilization rate increases from 65% to 92% within the window (amplitude 27%), with an average increase of 3% per second (rate), a sudden increase occurs at 10:01:05 (mutation point), and the duration of exceeding the threshold is 4 minutes (continuous abnormality). These parameters together constitute its change characteristics.

[0090] S206. Based on the topology and performance metric change characteristics of the directed data dependency graph, construct the propagation path of performance fluctuations.

[0091] The topology of the directed data dependency graph refers to the connection methods and data flow relationships between nodes (monitored objects) in the graph, including adjacency relationships (direct connections) and hierarchical relationships (upstream and downstream) between nodes; the performance indicator change characteristics refer to the performance change patterns of the associated objects extracted in S205 within the analysis time window; the propagation path of performance fluctuations refers to the specific route by which performance anomalies are transmitted from the initial object to other associated objects, reflecting the order and direction of anomaly propagation. For example, in the topology "X→Y→Z", if X first shows a "sudden increase" characteristic, and then Y and Z show similar characteristics in sequence, then the propagation path is X→Y→Z.

[0092] The specific implementation process of this step is as follows: First, based on the topology of the directed data dependency graph, determine the potential propagation direction between related objects (e.g., only along directed edges from upstream to downstream, excluding reverse paths); then, compare the temporal sequence of performance indicator changes of each related object, taking the object with the earlier appearance time of the feature as the potential source and the object with the later appearance time of the feature as the subsequent node; next, verify whether the potential path conforms to the topology (e.g., whether there is a directed edge connecting the source to the subsequent node), if it does, include it in the propagation path; finally, connect all nodes that meet the conditions according to the order of feature appearance time to form the propagation path of performance fluctuation. For example, if the topology is A→B→C, and the feature shows that the anomaly of A appears at 10:00, B at 10:00:10, and C at 10:00:20, and all have directed edges, then the propagation path is A→B→C.

[0093] S207. Calculate the propagation order of related objects in the propagation path of performance fluctuations, and determine the abnormal propagation link based on the propagation order.

[0094] The propagation order refers to the chronological order in which related objects exhibit anomalies within the performance fluctuation propagation path, clarifying the transmission flow of anomalies between objects. The anomaly propagation chain is a chain formed by connecting the propagation orders, reflecting the complete transmission path of an anomaly from source to end; it is a concrete representation of the performance fluctuation propagation path. For example, in the propagation path, if the anomaly of related object D occurs earlier than that of E, and E occurs earlier than that of F, then the propagation order is D→E→F, and the corresponding anomaly propagation chain is D→E→F.

[0095] The specific implementation process of this step is as follows: First, extract the timestamps of all related objects' anomalies (i.e., the time when the performance metric first exceeds the threshold) from the propagation path of performance fluctuations; then, sort these timestamps in ascending order to obtain the order in which the anomalies of each related object occurred, i.e., the propagation order; finally, connect the related objects with arrows according to the propagation order to form a chain, which is the anomaly propagation link. For example, if the propagation path includes objects M, N, and P, and their anomaly timestamps are 15:01:03, 15:01:05, and 15:01:01 respectively, the propagation order after sorting is P→M→N, therefore the anomaly propagation link is determined to be P→M→N.

[0096] S208. Based on the propagation direction of the abnormal propagation link, determine the starting node of the abnormal propagation link as the abnormal trigger node.

[0097] In this context, the anomaly propagation chain refers to the chain defined in S207 that reflects the path of anomaly propagation, consisting of multiple related objects linked together in the propagation sequence. The propagation direction refers to the direction in which the anomaly is passed from the first object to the next in the chain, i.e., along the propagation sequence. The starting node is the first object in the anomaly propagation chain to experience an anomaly, marking the beginning of the anomaly propagation. The anomaly triggering node is the source object that initiates the entire anomaly propagation process, i.e., the starting node. For example, if the anomaly propagation chain is A→B→C, the propagation direction is from A to B and then to C, and the starting node is A, then A is the anomaly triggering node.

[0098] The specific implementation process of this step is as follows: First, clarify the composition of the anomaly propagation chain and the order of the objects; then, determine the propagation direction of the chain according to the propagation order (e.g., from left to right); next, locate the object at the very beginning (first position) of the chain, i.e., the starting node; finally, determine this starting node as the anomaly triggering node, because it is the initial initiator of the entire anomaly propagation process. For example, if the anomaly propagation chain is database server → application server → load balancer server, and the propagation direction is from the database server to the load balancer server, and the starting node is the database server, then the database server is determined as the anomaly triggering node.

[0099] S209. Extract the performance fluctuation characteristics of the abnormal triggering node, and count the fluctuation frequency, fluctuation amplitude and fluctuation duration of the abnormal triggering node.

[0100] In this context, the "abnormal trigger node" refers to the source object identified in S208 that causes the propagation of the abnormality; "performance fluctuation characteristics" refers to the overall change pattern of performance indicators (such as CPU utilization and memory usage) within the analysis time window of the abnormal trigger node, including the frequency, amplitude, and duration of fluctuations; "fluctuation frequency" refers to the number of times the performance indicator exceeds the preset threshold within the analysis time window; "fluctuation amplitude" refers to the maximum difference between the performance indicator and the threshold, i.e., the difference between the maximum value of the indicator and the threshold; and "fluctuation duration" refers to the total duration for which the performance indicator continuously exceeds the threshold within the analysis time window. For example, if the abnormal trigger node is a server whose CPU utilization exceeds the 85% threshold three times within 10 minutes, reaching a maximum of 95%, and the cumulative exceedance time is 5 minutes, then the fluctuation frequency is 3 times, the fluctuation amplitude is 10%, and the fluctuation duration is 5 minutes.

[0101] The specific implementation process of this step is as follows: First, extract the performance fluctuation sequence of the abnormal trigger node within the analysis time window; then, count the number of times the performance index exceeds the preset threshold in the sequence to obtain the fluctuation frequency; calculate the difference between the maximum value of the index and the preset threshold (e.g., if the threshold is 85% and the maximum value is 95%, then the amplitude is 10%) to obtain the fluctuation amplitude; accumulate all time periods exceeding the threshold (e.g., 10:00-10:02, 10:03-10:06, accumulating 3+3=6 minutes) to obtain the fluctuation duration; finally, integrate these parameters to form the performance fluctuation characteristics of the abnormal trigger node. For example, if the performance fluctuation sequence of the abnormal trigger node shows that the CPU utilization exceeded the threshold 4 times within 30 minutes, the highest value differed from the threshold by 15%, and the cumulative time exceeded the threshold was 12 minutes, then the statistical results are: fluctuation frequency 4 times, fluctuation amplitude 15%, and fluctuation duration 12 minutes.

[0102] S210. Use fluctuation frequency, fluctuation amplitude, and fluctuation duration as abnormal feature parameters, and generate an abnormal analysis report based on the abnormal feature parameters.

[0103] Among these parameters, fluctuation frequency refers to the number of times the performance index of the anomaly triggering node exceeds a preset threshold within the analysis time window, reflecting the frequency of anomalies; fluctuation amplitude refers to the difference between the maximum value of the performance index of the anomaly triggering node and the preset threshold, reflecting the severity of the anomaly; fluctuation duration refers to the cumulative duration for which the performance index of the anomaly triggering node exceeds the preset threshold, illustrating the sustained impact of the anomaly; anomaly characteristic parameters refer to the set of key parameters that characterize the abnormal state of the anomaly triggering node, which in this case are fluctuation frequency, fluctuation amplitude, and fluctuation duration; the anomaly analysis report is a document that comprehensively presents the root cause, development process, and impact of the anomaly by integrating information such as anomaly characteristic parameters, anomaly propagation links, and the scope of anomaly impact. For example, if an anomaly triggering node has a fluctuation frequency of 3 times, a fluctuation amplitude of 15%, and a fluctuation duration of 20 minutes, these parameters will be included in the report to describe the anomaly characteristics of the node.

[0104] The specific implementation process of this step is as follows: First, organize the fluctuation frequency, fluctuation amplitude, and fluctuation duration obtained from S209, and clarify the specific values ​​and units of each parameter (such as frequency in "times", amplitude in "%", and time in "minutes"); then, combine the anomaly propagation chain (such as "trigger node → object A → object B"), the anomaly impact of the target anomaly object, and the performance change characteristics of related objects to construct the core content framework of the report, including the anomaly trigger node identifier, details of anomaly characteristic parameters, anomaly propagation path, list of affected objects, and degree of impact; next, arrange this information in a structured manner, for example, presenting "anomaly source analysis", "propagation process", and "impact assessment" in chapters, where the anomaly characteristic parameter section needs to list the specific values ​​of frequency, amplitude, and duration in detail, and attach a performance fluctuation curve for auxiliary explanation; finally, generate a standardized document (such as PDF format), namely the anomaly analysis report, to provide clear fault diagnosis basis for operation and maintenance personnel.

[0105] In practice, reports can be automatically generated through programming: for example, using Python's ReportLab library, abnormal feature parameter data can be read, text and charts (such as fluctuation trend charts drawn with Matplotlib) can be inserted according to preset templates, and the quantitative score of the impact of anomalies can be automatically calculated (such as weighted calculation based on frequency, amplitude, and duration). Finally, a report file containing complete analysis content can be output to ensure that the information is accurate and easy to understand.

[0106] The platform performance evaluation system in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference]. Figure 3 This is a schematic diagram of the physical device structure of the platform operation performance evaluation system in this application embodiment.

[0107] It should be noted that, Figure 3The structure of the platform performance evaluation system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0108] like Figure 3 As shown, the platform performance evaluation system includes a CPU (Central Processing Unit) 301, which can perform various appropriate actions and processes based on programs stored in ROM (Read-Only Memory) 302 or loaded from storage section 308 into RAM (Random Access Memory) 303, such as executing the methods described in the above embodiments. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0109] The following components are connected to I / O interface 305: input section 306 including audio input devices, push-button switches, etc.; output section 307 including liquid crystal display (LCD) and audio output devices, indicator lights, etc.; storage section 308 including hard disks, etc.; and communication section 309 including network interface cards such as LAN (Local Area Network) cards, modems, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0110] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by CPU 301, it performs the various functions defined in the present invention.

[0111] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0112] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings.

[0113] Specifically, the platform performance evaluation system of this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, it implements the platform performance evaluation method based on collaborative intelligent analysis provided in the above embodiment.

[0114] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the platform performance evaluation system described in the above embodiments; or it may exist independently and not assembled into the platform performance evaluation system. The storage medium carries one or more computer programs, which, when executed by a processor of the platform performance evaluation system, enable the platform performance evaluation system to implement the platform performance evaluation method based on collaborative intelligent analysis provided in the above embodiments.

[0115] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0116] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0117] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A platform performance evaluation method based on collaborative intelligent analysis, characterized in that, The method, applied to a platform performance evaluation system, includes: Obtain the data association relationships between the monitored objects in the platform to be evaluated, and establish a directed data dependency graph based on the data association relationships. Each edge in the directed data dependency graph represents the data interaction relationship between the monitored objects. Collect the operational performance data of the monitored object, and arrange the operational performance data in chronological order to form a performance fluctuation sequence; The number of adjacent nodes of the monitored object in the directed data dependency graph is counted, and the number of adjacent nodes is taken as the number of direct associations. Traverse the directed data dependency graph to obtain the total number of reachable nodes of the monitored object, and use the number of reachable nodes as the number of indirect associations; The direct association score is obtained by multiplying the number of direct associations by the first preset weight, and the indirect association score is obtained by multiplying the number of indirect associations by the second preset weight. The correlation importance of the monitored object is obtained by adding the direct correlation score and the indirect correlation score. Analyze the performance fluctuation sequence, calculate the propagation consistency factor of performance data exceeding a preset performance threshold and the time tightness factor of associated performance data in the performance fluctuation sequence. The propagation consistency factor represents the degree of propagation of the performance data among associated objects, and the time tightness factor represents the degree of temporal correlation of the associated performance data. Calculate the propagation weight value between any two monitored objects and construct a performance fluctuation propagation sequence of the monitored objects based on the propagation weight value. The propagation weight value is obtained by weighted calculation of the correlation importance, propagation consistency factor and time tightness factor. The propagation sequence represents the order in which performance anomalies are transmitted among the monitored objects. Based on the performance fluctuation propagation sequence and the directed data dependency graph, the abnormal impact degree of the monitored object is calculated. Monitored objects whose abnormal impact degree exceeds a preset impact degree threshold are identified as target abnormal objects. The abnormal impact degree is calculated based on the monitored object's position in the propagation sequence, the number of downstream objects it affects, and the correlation importance of each object. Specifically, the steps of calculating the abnormal impact degree of the monitored object based on the performance fluctuation propagation sequence and the directed data dependency graph, and identifying monitored objects whose abnormal impact degree exceeds the preset impact degree threshold as target abnormal objects, include: obtaining the sequence number of the monitored object in the performance fluctuation propagation sequence; determining the position weight value of the monitored object according to a preset position weight calculation rule; determining the number of all downstream nodes of the monitored object in the directed data dependency graph; multiplying the position weight value by the number of downstream nodes to obtain an initial impact value; calculating the sum of the correlation importance of the downstream nodes; multiplying the initial impact value by the sum of the correlation importance to obtain the abnormal impact degree of the monitored object; and determining whether the abnormal impact degree is greater than the preset impact degree threshold. If so, the monitored object is identified as the target abnormal object.

2. The method according to claim 1, characterized in that, The step of collecting the operational performance data of the monitored object and arranging the operational performance data in chronological order to form a performance fluctuation sequence specifically includes: Collect performance indicator data of the monitored object, including at least processor utilization data and memory usage data; The performance index data is sampled at preset sampling time intervals. The sampled values ​​are associated with the corresponding sampling time to generate time series data of performance indicators, and the performance fluctuation sequence is constructed based on the time series data of performance indicators, wherein each sequence element includes a time identifier and the corresponding performance indicator data.

3. The method according to claim 1, characterized in that, After the step of calculating the abnormal impact degree of the monitored object based on the performance fluctuation propagation sequence and the directed data dependency graph, and identifying monitored objects whose abnormal impact degree exceeds a preset impact degree threshold as target abnormal objects, the method further includes: Based on the performance fluctuation sequence of the target abnormal object, obtain the outlier points of the performance indicators; In the directed data dependency graph, starting from the target abnormal object, the performance fluctuation data of the associated objects of the target abnormal object are obtained according to a preset hierarchy; The performance fluctuation data is time-series aligned to determine the temporal relationship of performance anomalies; Based on the temporal relationship and the topology of the directed data dependency graph, the anomaly propagation path is determined. On the abnormal propagation chain, abnormal triggering nodes are identified, and abnormal characteristic parameters of the abnormal triggering nodes are statistically analyzed to generate an abnormal analysis report.

4. The method according to claim 3, characterized in that, The step of determining the anomaly propagation path based on the temporal relationship and the topology of the directed data dependency graph specifically includes: Obtain the fluctuation trend of the performance index, and determine an analysis time window based on the fluctuation trend; Within the analysis time window, extract the performance index change characteristics of the associated objects of the target abnormal object; Based on the topology of the directed data dependency graph and the performance metric change characteristics, construct the propagation path of performance fluctuations; Calculate the propagation order of the associated objects in the propagation path of the performance fluctuation, and determine the abnormal propagation link based on the propagation order.

5. The method according to claim 3, characterized in that, The step of identifying anomaly triggering nodes on the anomaly propagation chain and generating an anomaly analysis report by statistically analyzing the anomaly characteristic parameters of the anomaly triggering nodes specifically includes: Based on the propagation direction of the abnormal propagation link, the starting node of the abnormal propagation link is determined as the abnormal trigger node; Extract the performance fluctuation characteristics of the abnormal triggering node, and statistically analyze the fluctuation frequency, fluctuation amplitude, and fluctuation duration of the abnormal triggering node based on the performance fluctuation characteristics; The fluctuation frequency, fluctuation amplitude, and fluctuation duration are used as the abnormal feature parameters, and the abnormal analysis report is generated based on the abnormal feature parameters.

6. A platform operation performance evaluation system, characterized in that, The platform performance evaluation system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the platform performance evaluation system to perform the method as described in any one of claims 1-5.

7. A computer-readable storage medium comprising instructions, characterized in that, When the instruction is run on the platform performance evaluation system, it causes the platform performance evaluation system to perform the method as described in any one of claims 1-5.

8. A computer program product, characterized in that, When the computer program product is run on the platform performance evaluation system, the platform performance evaluation system performs the method as described in any one of claims 1-5.

Images