A timestamp-based cross-day file arrival monitoring method

Abstract

The application provides a timestamp-based cross-day file arrival monitoring method, relates to the technical field of file transmission and comprises the following steps: receiving a time zone identifier and an expected arrival time parameter, determining a time zone offset, and calculating a monitoring reference time; dividing a business peak period and a regular period based on historical operation data, and determining a dynamic waiting duration; adjusting the waiting duration according to a current operation index, generating a file arrival deadline timestamp; and periodically calculating a time difference value and triggering an alarm. The application can accurately process cross-day file monitoring, improve monitoring accuracy and reduce false positives.

Description

Technical Field

[0001] This invention relates to file transfer technology, and more particularly to a time-stamp-based method for monitoring the arrival of files across days. Background Technology

[0002] In current enterprise-level information systems in industries such as finance, telecommunications, and energy, it is often necessary to transfer large amounts of data files across systems to support business operations. Existing file arrival monitoring methods typically employ a fixed-point-of-time check mechanism based on local time. These monitoring systems check whether the target file has arrived at a pre-set time point, triggering an alarm if it is not detected. However, in actual business operations, especially in scenarios involving cross-timezone and cross-day file transfers, existing technologies have the following shortcomings:

[0003] Existing monitoring methods lack effective adaptability to systems in different time zones. Because the sending and receiving systems may be located in different time zones and use their respective local times, discrepancies arise in the understanding of expected arrival times, leading to false alarms or missed alarms. File transfer tasks, especially those near date change points, are more prone to monitoring errors due to time zone differences.

[0004] Existing monitoring systems generally use static, fixed waiting times, which cannot be dynamically adjusted according to the real-time load of the business system. During peak business periods, when system resources are scarce and network congestion occurs, file transfers often take longer, and fixed waiting time settings cannot reflect this difference, easily leading to premature alarms.

[0005] Existing monitoring methods lack the ability to perceive the operating environment of business systems and cannot intelligently adjust monitoring parameters based on historical data. Fluctuations in key indicators such as system resource utilization and network conditions directly affect file transfer efficiency, and existing technologies struggle to incorporate these factors into the monitoring logic, resulting in insufficient alarm accuracy and difficulty in providing effective decision support for operations and maintenance personnel. Summary of the Invention

[0006] This invention provides a time-stamp-based method for monitoring cross-day file arrivals, which can solve the problems in the prior art.

[0007] A first aspect of this invention provides a method for monitoring the arrival of files across days based on timestamps, comprising:

[0008] The system receives the time zone identifier and expected file arrival time parameter of the business system to be monitored, and determines the time zone offset based on the time zone identifier. After receiving the time zone offset, the master node of the business system to be monitored sends a UTC timestamp to the child nodes registered by the master node, and calculates the monitoring reference time based on the UTC timestamp and the time zone offset.

[0009] Collect system resource utilization, concurrent request count, network latency, and packet loss rate of the monitored business system as historical operating data; based on the historical operating data, divide the daily time period into peak business period and regular period, and determine the dynamic waiting time benchmark value for different time periods;

[0010] Obtain the current operating indicators of the business system to be monitored, calculate the deviation value from the historical operating data, adjust the dynamic waiting time benchmark value based on the deviation value to generate the real-time dynamic waiting time; compare the expected file arrival time parameter with the monitoring benchmark time to determine the date identifier and convert it into an expected arrival timestamp, and add it to the real-time dynamic waiting time to generate the file arrival deadline timestamp;

[0011] The time difference between the current timestamp and the file arrival deadline timestamp is periodically calculated, and an alarm threshold is set based on the historical operation data to trigger alarm processing; alarm data is recorded to update the dynamic waiting time baseline value and the division rules of the business peak period and normal period.

[0012] In one alternative implementation,

[0013] After receiving the time zone offset, the master node of the monitored business system sends a UTC timestamp to the child nodes registered with the master node. The steps for calculating the monitoring reference time based on the UTC timestamp and the time zone offset include:

[0014] The master node synchronizes with the network time protocol server to obtain the UTC timestamp, and corrects the UTC timestamp based on the network delay compensation value to obtain the master node's reference timestamp. The network delay compensation value is obtained through multiple synchronization measurements.

[0015] The master node broadcasts a time synchronization message to the distributed nodes. The time synchronization message includes the master node's base timestamp, synchronization sequence number, and timestamp accuracy index. The distributed nodes receive the time synchronization message.

[0016] The distributed nodes use a sliding window to record the time difference between the local timestamp and the master node's reference timestamp multiple times, and calculate the average of the time differences to obtain the clock drift compensation value; the monitoring reference time is calculated based on the master node's reference timestamp, the time zone offset, and the clock drift compensation value.

[0017] Calculate the standard deviation of the time difference. When the standard deviation exceeds a preset synchronization threshold, trigger resynchronization and record the trigger time and reason for resynchronization.

[0018] In one alternative implementation,

[0019] The steps of collecting system resource utilization, concurrent request count, network latency, and packet loss rate of the monitored business system as historical operating data, and dividing the daily time period into peak and normal periods based on the historical operating data, and determining the dynamic waiting time baseline value for different time periods, include:

[0020] The size of the time window is determined based on the local fluctuation intensity of the historical operating data. Short-term features, medium-term features, and long-term features are extracted within the time window. The short-term features, medium-term features, and long-term features correspond to feature vector sets of different time spans.

[0021] The dynamic temporal similarity between the feature vector sets is calculated. The dynamic temporal similarity is obtained by a weighted combination of Euclidean distance similarity, dynamic time warp distance similarity, and trend similarity. The weights are adaptively adjusted according to historical data.

[0022] Based on the dynamic time series similarity, the time period determination result is calculated by weighting the real-time load determination value, historical pattern determination value and trend prediction determination value. The weight coefficient of the weighted combination is dynamically adjusted with the load volatility index.

[0023] Calculate the local mean and local standard deviation of the time period determination results, determine an adaptive threshold based on the local mean, local standard deviation and load volatility index, and perform preliminary division of the time period according to the adaptive threshold;

[0024] A Markov decision process is used to optimize the time period boundary. The state transition probability of the Markov decision process is calculated based on the current state, historical transition patterns and time correlation factors, and the final business time period division result is output.

[0025] For the defined peak and regular business periods, a baseline waiting time is calculated based on the product of the basic waiting time and the time period determination result. The dynamic waiting time baseline value is obtained by weighted combination of the baseline waiting time and the historical waiting time, and the weight of the historical waiting time decays over time.

[0026] In one alternative implementation,

[0027] The optimization of time period boundaries using a Markov decision process, wherein the state transition probabilities of the Markov decision process are calculated based on the current state, historical transition patterns, and time correlation factors, and the steps to output the final business time period division result include:

[0028] Construct a multidimensional state vector, which includes the current state vector, the time period determination result vector, the time feature vector, and the historical conversion mode;

[0029] The immediate reward is calculated based on a weighted combination of boundary stability reward, load balancing reward, and time continuity reward. The boundary stability reward is calculated based on the sum of squares of boundary adjustments in the set of boundary time points. The load balancing reward is calculated based on the ratio of the load standard deviation to the load mean. The time continuity reward is calculated based on the variance of the interval between adjacent time points. The weights of the weighted combination are dynamically adjusted based on state characteristics.

[0030] The basic transition probability is calculated based on the state distance. The transition probability after historical pattern adjustment is obtained by multiplying the basic transition probability with the historical similarity. The time correlation adjustment factor is calculated based on the state timestamp, expected time interval and time tolerance. The final state transition probability is obtained by multiplying the transition probability after historical pattern adjustment with the time correlation adjustment factor.

[0031] Calculate the state value function based on the final state transition probability and the immediate reward, select the optimal decision strategy based on the state value function, and optimize the optimal decision strategy using an adaptive learning rate.

[0032] Based on the optimal decision-making strategy, the time period boundaries are adjusted, and the final business time period division results are output according to the evaluation indicators of boundary stability, load balancing and time continuity.

[0033] In one alternative implementation,

[0034] The steps of periodically calculating the time difference between the current timestamp and the file arrival deadline timestamp, and setting an alarm threshold based on the historical running data to trigger alarm processing include:

[0035] Construct a multidimensional feature including a time difference vector, a system load state vector, and a performance index vector; calculate the mean and standard deviation of the time difference vector; construct a basic layer alarm threshold; the basic layer alarm threshold is calculated by multiplying the confidence coefficient and the standard deviation.

[0036] The overall load score is calculated based on the system load state vector. The dynamic layer alarm threshold is obtained by multiplying the basic layer alarm threshold by the dynamic adjustment coefficient of the overall load score. The dynamic adjustment coefficient is adaptively adjusted as the overall load score changes.

[0037] The trend prediction function is used to predict the change trend of the dynamic layer alarm threshold within the prediction time window to obtain the prediction layer alarm threshold. The time difference, system status and processing result of each alarm are recorded. The alarm accuracy rate is obtained by calculating the ratio of the number of valid alarms to the number of false alarms.

[0038] The confidence coefficient is updated based on the deviation between the alarm accuracy rate and the target accuracy rate. The alarm duration and business impact are weighted and combined to classify the alarms. Different processing strategies are adopted for alarms of different levels.

[0039] Calculate the temporal and spatial correlations among multiple alarms, identify the root causes of alarms based on the temporal and spatial correlations, merge alarms with correlation, statistically analyze alarm response time and system overhead, evaluate the alarm processing effect based on a weighted combination of alarm accuracy, response time, and system overhead, and use the evaluation results to optimize the parameters of the dynamic adjustment coefficient and the trend prediction function.

[0040] In one alternative implementation,

[0041] The step of calculating a comprehensive load score based on the system load state vector, and multiplying the basic layer alarm threshold by the dynamic adjustment coefficient of the comprehensive load score to obtain a dynamic layer alarm threshold, wherein the dynamic adjustment coefficient is adaptively adjusted as the comprehensive load score changes includes:

[0042] The load values ​​of each dimension in the system load state vector are normalized, and the comprehensive load score is calculated based on the weight coefficients of each dimension and the normalized load values.

[0043] The basic adjustment coefficient is calculated based on the ratio of the comprehensive load score to the reference load value; historical load pattern data is obtained, and the product of the historical load pattern data and the time decay weight is accumulated within a time window to obtain the historical pattern influence factor; the combination product of the basic adjustment coefficient and the historical pattern influence factor is used to generate the dynamic adjustment coefficient, and the alarm threshold of the basic layer is dynamically adjusted based on the dynamic adjustment coefficient.

[0044] The weighted sum of the degree of component dependency and the severity of the failure is used to obtain the direct impact.

[0045] An alarm propagation model is constructed, and the propagation impact is obtained by combining the product of the direct impact degree and the decay function with the product of the historical propagation impact degree and the propagation probability; the alarm relevance matrix is ​​calculated based on the alarm time difference and topological distance.

[0046] The root cause probability is calculated by multiplying the propagation impact degree, the alarm relevance matrix and the alarm weight coefficient. The root cause probability is then weighted and combined with the historical accuracy to obtain the confidence evaluation value. Performance evaluation indicators are calculated based on the positioning accuracy, response timeliness and system resource consumption.

[0047] The alarm propagation model parameters are iteratively updated based on the gradient of the performance evaluation index, and the updated model parameters are used to optimize the weight coefficients of each dimension, the time decay weight, and the alarm weight coefficient.

[0048] In one alternative implementation,

[0049] The steps for recording alarm data to update the dynamic waiting time baseline value and the rules for dividing peak and normal business periods include:

[0050] The alarm data is classified and statistically analyzed according to time difference, system status and processing results. The distribution density of each type of alarm in different time periods is calculated, and high-frequency alarm periods are identified based on the distribution density.

[0051] The time overlap between the high-frequency alarm period and the existing business peak period is calculated. When the time overlap is lower than the preset overlap threshold, the start and end times of the business peak period are corrected based on the high-frequency alarm period.

[0052] The time difference sequence in the alarm data is statistically analyzed, and the mean and standard deviation of the time difference sequence in different time periods are calculated. The weighted combination is used as the evaluation benchmark for dynamic waiting time. An adjustment coefficient is calculated based on the deviation between the evaluation benchmark and the current dynamic waiting time benchmark. The adjustment coefficient decays over time. The product of the adjustment coefficient and the current dynamic waiting time benchmark is used as the updated dynamic waiting time benchmark.

[0053] Calculate the change in alarm trigger frequency before and after the update. When the alarm trigger frequency decreases, record the adjustment strategy adopted in this update and increase the weight of the adjustment strategy adopted in this update in subsequent optimizations.

[0054] A second aspect of the present invention provides an electronic device, comprising:

[0055] processor;

[0056] Memory used to store processor-executable instructions;

[0057] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0058] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0059] The beneficial effects of this application are as follows:

[0060] This invention solves the problem of time zone differences in file arrival monitoring in cross-time zone business systems by receiving the time zone identifier and expected file arrival time parameters of the business system to be monitored, and calculating the Coordinated Universal Time (UTC) timestamp, thus realizing unified monitoring and management of file arrival status globally.

[0061] This invention divides daily time periods into peak and regular periods based on historical operational data, determines dynamic waiting time benchmarks for different time periods, and dynamically adjusts waiting times in conjunction with real-time operational indicators. This adapts to the characteristics of load fluctuations in business systems at different times, improving monitoring accuracy and system adaptability.

[0062] This invention periodically calculates the time difference between the current timestamp and the file arrival deadline timestamp, sets alarm thresholds based on historical data, and records alarm data to update the dynamic waiting time baseline and time segmentation rules, forming a closed-loop feedback mechanism. This enables the monitoring system to self-optimize and learn, reduces the false alarm rate, and improves the accuracy and reliability of file monitoring. Attached Figure Description

[0063] Figure 1 This is a flowchart illustrating a cross-day file arrival monitoring method based on timestamps, according to an embodiment of the present invention.

[0064] Figure 2 Comparative analysis of the optimization effects of different methods;

[0065] Figure 3 This is a simulation diagram showing the alarm propagation model and root cause analysis of the present invention;

[0066] Figure 4 This is an overall architecture diagram of an embodiment of the present invention. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0069] Figure 1 This is a flowchart illustrating a cross-day file arrival monitoring method based on timestamps, as described in an embodiment of the present invention. Figure 1As shown, the method includes:

[0070] The system receives the time zone identifier and expected file arrival time parameter of the business system to be monitored, and determines the time zone offset based on the time zone identifier. After receiving the time zone offset, the master node of the business system to be monitored sends a UTC timestamp to the child nodes registered by the master node, and calculates the monitoring reference time based on the UTC timestamp and the time zone offset.

[0071] Collect system resource utilization, concurrent request count, network latency, and packet loss rate of the monitored business system as historical operating data; based on the historical operating data, divide the daily time period into peak business period and regular period, and determine the dynamic waiting time benchmark value for different time periods;

[0072] Obtain the current operating indicators of the business system to be monitored, calculate the deviation value from the historical operating data, adjust the dynamic waiting time benchmark value based on the deviation value to generate the real-time dynamic waiting time; compare the expected file arrival time parameter with the monitoring benchmark time to determine the date identifier and convert it into an expected arrival timestamp, and add it to the real-time dynamic waiting time to generate the file arrival deadline timestamp;

[0073] The time difference between the current timestamp and the file arrival deadline timestamp is periodically calculated, and an alarm threshold is set based on the historical operation data to trigger alarm processing; alarm data is recorded to update the dynamic waiting time baseline value and the division rules of the business peak period and normal period.

[0074] In one optional implementation, after receiving the time zone offset, the master node of the monitored business system sends a UTC timestamp to the child nodes registered with the master node. The step of calculating the monitoring reference time based on the UTC timestamp and the time zone offset includes:

[0075] Receive the time zone identifier and expected file arrival time parameter of the business system to be monitored, and determine the time zone offset based on the time zone identifier;

[0076] The master node synchronizes with the network time protocol server to obtain the UTC timestamp, and corrects the UTC timestamp based on the network delay compensation value to obtain the master node's reference timestamp. The network delay compensation value is obtained through multiple synchronization measurements.

[0077] The master node broadcasts a time synchronization message to the distributed nodes. The time synchronization message includes the master node's base timestamp, synchronization sequence number, and timestamp accuracy index. The distributed nodes receive the time synchronization message.

[0078] The distributed nodes use a sliding window to record the time difference between the local timestamp and the master node's reference timestamp multiple times, and calculate the average of the time differences to obtain the clock drift compensation value; the monitoring reference time is calculated based on the master node's reference timestamp, the time zone offset, and the clock drift compensation value.

[0079] Calculate the standard deviation of the time difference. When the standard deviation exceeds a preset synchronization threshold, trigger resynchronization and record the trigger time and reason for resynchronization.

[0080] For example, the monitored business system receives the time zone identifier and expected file arrival time parameters through a preset network interface. The time zone identifier can be a standard time zone code, such as "Asia / Shanghai", "America / New_York", or "UTC+8". The system maintains a time zone mapping table, which contains the time zone offset (in minutes) corresponding to each time zone identifier. For example, for the "UTC+8" time zone, the offset is 480 minutes (8 hours); for the "America / New_York" time zone (Eastern Time), depending on daylight saving time, the offset may be -300 minutes (-5 hours) or -240 minutes (-4 hours). By querying this mapping table, the time zone offset of 480 minutes is determined based on the received time zone identifier "UTC+8".

[0081] When the master node synchronizes time with the Network Time Protocol (NTP) server, a multi-request response mechanism is used to calculate the network latency compensation value. The master node sends a time synchronization request to the NTP server, recording the local timestamp T1 of the request. Upon receiving the request, the NTP server returns its server timestamp T2. Upon receiving the response, the master node records the local timestamp T3 of the received response. Thus, the round-trip latency can be calculated using (T3-T1). Assuming the network latency is symmetrical, the one-way network latency compensation value can be calculated as (T3-T1) / 2. To improve accuracy, the master node performs multiple (e.g., 10) synchronization measurements, removes outliers, and takes the average as the network latency compensation value. In practice, assuming the one-way latency obtained from the 10 measurements are 12 milliseconds, 15 milliseconds, 14 milliseconds, 20 milliseconds, 13 milliseconds, 14 milliseconds, 15 milliseconds, 13 milliseconds, 14 milliseconds, 15 milliseconds, 13 milliseconds, 14 milliseconds, and 60 milliseconds, the system will automatically identify and remove the outlier of 60 milliseconds, and then calculate the average of the remaining 9 measurements, approximately 14.44 milliseconds, as the network latency compensation value.

[0082] After obtaining the timestamp from the Network Time Protocol (NTP) server, the master node applies a network latency compensation value for correction. For example, if the Coordinated Universal Time (UTC) timestamp obtained from the server is 1620000000000 (milliseconds representation of May 3, 2021, 10:40:00 UTC), and the network latency compensation value is 14.44 milliseconds, then the corrected master node base timestamp is 1620000000014.

[0083] The master node prepares to broadcast a time synchronization message to the distributed nodes. This message contains three key pieces of information: the master node's base timestamp (1620000000014), the synchronization sequence number (an integer starting from 1 and incrementing, e.g., currently 42), and the timestamp precision (e.g., 1 millisecond). The master node sends this synchronization message to all registered distributed nodes via a pre-defined network broadcast channel.

[0084] After receiving a time synchronization message, a distributed node records the local timestamp of the message reception. Assuming a distributed node's local timestamp is 1620000000214, the time difference with the master node's base timestamp 1620000000014 is 200 milliseconds. The distributed node uses a sliding window mechanism to record the most recent N (e.g., N=20) time differences. Whenever a new time synchronization message is received, the distributed node adds the new time difference to the sliding window and removes the oldest time difference. Assuming the 20 time differences (in milliseconds) stored in the sliding window are: 200,202,198,201,199,200,203,197,200,201,199,202,198,201,199,200,202,198,201,199. The distributed nodes calculate the average of these time differences: (200+202+...+199) / 20=200 milliseconds, as the clock drift compensation value.

[0085] The calculation process for the monitoring baseline time is as follows: Monitoring Baseline Time = Master Node Baseline Timestamp + Time Zone Offset - Clock Drift Compensation Value. For example, if the master node baseline timestamp is 1620000000014, the time zone offset is 480 minutes (i.e., 28800000 milliseconds), and the clock drift compensation value is 200 milliseconds, then the monitoring baseline time is 1620000000014 + 28800000 - 200 = 1620028799814 milliseconds, which corresponds to the local time of May 3, 2021, 18:40:00 (UTC+8 time zone) minus 200 milliseconds.

[0086] Distributed nodes calculate the standard deviation of time differences within a sliding window to assess the stability of time synchronization. Based on the 20 time difference values ​​mentioned above, the calculated standard deviation is approximately 1.67 milliseconds. The system presets a synchronization threshold, for example, 5 milliseconds. Since the current standard deviation of 1.67 milliseconds is less than the preset threshold of 5 milliseconds, time synchronization is considered stable. If the standard deviation exceeds the preset threshold, for example, suddenly increasing to 6 milliseconds, the system will trigger a resynchronization operation and record the trigger time (e.g., May 3, 2021, 18:45:30) and the reason ("standard deviation of 6 milliseconds exceeds threshold of 5 milliseconds") in the log. This mechanism ensures that timely adjustments can be made to maintain accurate time synchronization when network conditions change or node clock drift is severe.

[0087] This invention achieves high-precision unification of the monitoring reference time among distributed nodes by synchronizing the master node with the Network Time Protocol (NTP) server to obtain Coordinated Universal Time (UTC) and performing network latency compensation. The sliding window recording time difference calculation method ensures that all nodes use a consistent time base for file arrival monitoring. The mechanism of triggering resynchronization when the standard deviation exceeds a threshold enhances adaptability to network fluctuations and clock skew, guaranteeing the accuracy and reliability of the monitoring reference time during long-term operation.

[0088] In one optional implementation, the steps of collecting system resource utilization, concurrent request count, network latency, and packet loss rate of the monitored business system as historical operating data, and dividing the daily time period into peak and regular periods based on the historical operating data, and determining the dynamic waiting time benchmark value for different time periods, include:

[0089] The system resource utilization rate is a weighted ratio of the usage of various resources to the maximum capacity of the corresponding resources, and the network performance index includes a weighted combination of network latency and packet loss rate.

[0090] The size of the time window is determined based on the local fluctuation intensity of the historical operating data. Short-term features, medium-term features, and long-term features are extracted within the time window. The short-term features, medium-term features, and long-term features correspond to feature vector sets of different time spans.

[0091] The dynamic temporal similarity between the feature vector sets is calculated. The dynamic temporal similarity is obtained by a weighted combination of Euclidean distance similarity, dynamic time warp distance similarity, and trend similarity. The weights are adaptively adjusted according to historical data.

[0092] Based on the dynamic time series similarity, the time period determination result is calculated by weighting the real-time load determination value, historical pattern determination value and trend prediction determination value. The weight coefficient of the weighted combination is dynamically adjusted with the load volatility index.

[0093] Calculate the local mean and local standard deviation of the time period determination results, determine an adaptive threshold based on the local mean, local standard deviation and load volatility index, and perform preliminary division of the time period according to the adaptive threshold;

[0094] A Markov decision process is used to optimize the time period boundary. The state transition probability of the Markov decision process is calculated based on the current state, historical transition patterns and time correlation factors, and the final business time period division result is output.

[0095] For the defined peak and regular business periods, a baseline waiting time is calculated based on the product of the basic waiting time and the time period determination result. The dynamic waiting time baseline value is obtained by weighted combination of the baseline waiting time and the historical waiting time, and the weight of the historical waiting time decays over time.

[0096] For example, historical operational data of the business system to be monitored is collected. System resource utilization is calculated as a weighted sum of: CPU utilization multiplied by 0.4, memory utilization multiplied by 0.3, storage utilization multiplied by 0.2, and bandwidth utilization multiplied by 0.1. For instance, if at a certain moment CPU utilization is 75%, memory utilization is 60%, storage utilization is 40%, and bandwidth utilization is 30%, then the system resource utilization is 75%×0.4 + 60%×0.3 + 40%×0.2 + 30%×0.1 = 60.5%. Network performance metrics are calculated as: network latency percentage multiplied by 0.6 plus packet loss rate multiplied by 0.4. For example, if the network latency is 200ms (40% of the baseline value of 500ms) and the packet loss rate is 2%, then the network performance metric is 40%×0.6 + 2%×0.4 = 24.8%.

[0097] When determining the time window size, the intensity of local fluctuations in historical data is calculated. When load fluctuations are large (standard deviation exceeding 30% of the mean), a smaller time window, such as 5 minutes, is used; when load fluctuations are moderate (standard deviation between 15% and 30% of the mean), a 15-minute window is used; and when load fluctuations are small (standard deviation below 15% of the mean), a 30-minute window is used. Within the defined time window, the system extracts short-term features (data from the most recent hour), medium-term features (data from the most recent 6 hours), and long-term features (data from the most recent 24 hours). The feature vector includes five dimensions: mean system resource utilization, peak value, fluctuation amplitude, mean number of concurrent requests, and network performance metrics.

[0098] When calculating the dynamic temporal similarity between feature vector sets, the weights for Euclidean distance similarity are 0.3, dynamic time warping distance similarity are 0.5, and trend similarity are 0.2. When historical data shows significant load fluctuations, the weight of dynamic time warping distance similarity increases to 0.6, while the weight of Euclidean distance similarity decreases to 0.2. Euclidean distance similarity is obtained by taking the square root of the sum of the squares of the differences in each dimension of the two feature vectors, and then subtracting the normalized Euclidean distance from 1. Dynamic time warping distance similarity uses the DTW algorithm to calculate the optimal alignment distance between the two time series, obtained by subtracting the normalized DTW distance from 1. Trend similarity is obtained by calculating the cosine similarity after the first-order differences in each dimension of the two feature vectors, reflecting the consistency of the sequence's trend. For example, if the Euclidean distance similarity of the feature vectors of two time periods is 0.85, the dynamic time regularization distance similarity is 0.75, and the trend similarity is 0.9, then the dynamic time series similarity is 0.85×0.3+0.75×0.5+0.9×0.2=0.81.

[0099] In the calculation of the time period determination result, the real-time load determination value is derived by comparing the current system resource utilization rate with a threshold (e.g., 70%); the historical pattern determination value is obtained by comparing the current load with the historical average load for the same period; and the trend prediction determination value is obtained by predicting future load based on the load change trend of the previous 30 minutes. When the system load is stable (volatility index less than 20%), the weights of the three are 0.3, 0.5, and 0.2, respectively; when the system load fluctuates significantly (volatility index greater than 50%), the weights are adjusted to 0.5, 0.3, and 0.2. For example, if the real-time load determination value for a certain time period is 0.9 (approaching high load), the historical pattern determination value is 0.8 (historically, this time period is usually high load), the trend prediction determination value is 0.7 (predicting that the load will continue to increase), and the load volatility index is 15%, then the time period determination result is 0.9 × 0.3 + 0.8 × 0.5 + 0.7 × 0.2 = 0.81.

[0100] During the adaptive threshold determination process, the local mean and local standard deviation of the time period judgment results are calculated. Assuming the local mean is 0.75, the local standard deviation is 0.15, and the load volatility index is 20%, the adaptive threshold is set as the local mean plus the local standard deviation multiplied by (1 + load volatility index), i.e., 0.75 + 0.15 × (1 + 20%) = 0.93. The system uses this threshold to initially divide the time period; periods with judgment results greater than or equal to the threshold are considered peak business periods, while those less than the threshold are considered regular periods.

[0101] The time-period boundary optimization employs a Markov decision process, with states including "peak period" and "normal period." State transition probabilities are calculated based on the current load status, historical transition frequency for the same time period, and a time continuity factor. For example, the probability of transitioning from a normal period to a peak period is influenced by the frequency of that period transitioning to a peak period in historical data, while also considering the correlation between adjacent time periods. Historical data shows that the 9:00-10:00 period has an 85% probability of being a peak period, and since the current 8:30-9:00 period is already identified as a peak period, the probability of the 9:00-10:00 period transitioning to a peak period will increase to 92%. This method eliminates abrupt changes in time-period division, resulting in a consistent and stable business time-period division.

[0102] In the calculation of the dynamic waiting time baseline, the base waiting time is set to 10 seconds for peak business periods and 5 seconds for regular periods. The baseline waiting time is the product of the base waiting time and the time period determination result. The historical waiting time is obtained by weighted averaging of the waiting times for the same period over the past 7 days, with the weight decreasing by the number of days. For example, the weight of the most recent day is 0.4, the second day is 0.25, the third day is 0.15, the fourth day is 0.1, and the fifth to seventh days are each 0.033. For instance, if the determination result for a certain time period during a peak business period is 0.85, and the weighted average of the historical waiting time over the past 7 days is 12 seconds, then the dynamic waiting time baseline for that time period is 10 × 0.85 × 0.6 + 12 × 0.4 = 5.1 + 4.8 = 9.9 seconds.

[0103] This invention employs a dynamic temporal similarity calculation method that integrates Euclidean distance, dynamic time warping distance, and trend similarity. The weights are adaptively adjusted based on historical data, significantly improving the accuracy of time period segmentation. A Markov decision process optimizes the time period boundaries, resolving the instability issue of traditional methods. By combining the time period determination results with a time decay-weighted combination of historical waiting times, accurate calculation of the dynamic waiting time baseline is achieved. This allows for automatic adjustment of monitoring parameters based on business load characteristics, improving the accuracy and adaptability of monitoring.

[0104] In one optional implementation, a Markov decision process is used to optimize the time period boundaries. The state transition probabilities of the Markov decision process are calculated based on the current state, historical transition patterns, and time correlation factors. The steps for outputting the final business time period division result include:

[0105] A multidimensional state vector is constructed, which includes a current state vector, a time period determination result vector, a time feature vector, and a historical conversion pattern. The current state vector includes system resource utilization, concurrent request count, and network performance indicators. The system resource utilization is a weighted ratio of the usage of various resources to the maximum capacity of the corresponding resources. The network performance indicators are a weighted combination of network latency and packet loss rate. The time period determination result vector includes real-time load determination value, historical pattern determination value, and trend prediction determination value.

[0106] The immediate reward is calculated based on a weighted combination of boundary stability reward, load balancing reward, and time continuity reward. The boundary stability reward is calculated based on the sum of squares of boundary adjustments in the set of boundary time points. The load balancing reward is calculated based on the ratio of the load standard deviation to the load mean. The time continuity reward is calculated based on the variance of the interval between adjacent time points. The weights of the weighted combination are dynamically adjusted based on state characteristics.

[0107] The basic transition probability is calculated based on the state distance. The transition probability after historical pattern adjustment is obtained by multiplying the basic transition probability with the historical similarity. The time correlation adjustment factor is calculated based on the state timestamp, expected time interval and time tolerance. The final state transition probability is obtained by multiplying the transition probability after historical pattern adjustment with the time correlation adjustment factor.

[0108] Calculate the state value function based on the final state transition probability and the immediate reward, select the optimal decision strategy based on the state value function, and optimize the optimal decision strategy using an adaptive learning rate.

[0109] Based on the optimal decision-making strategy, the time period boundaries are adjusted, and the final business time period division results are output according to the evaluation indicators of boundary stability, load balancing and time continuity.

[0110] For example, the multidimensional state vector contains comprehensive information about the current system's operating state. Specifically, the current state vector includes CPU utilization, memory usage, disk I / O utilization, concurrent requests, network latency, and packet loss rate. When calculating system resource utilization, CPU utilization has a weight of 0.4, memory usage has a weight of 0.35, and disk I / O usage has a weight of 0.25. For instance, if CPU utilization is 75%, memory usage is 60%, and disk I / O usage is 50%, then the system resource utilization is 0.4 × 75% + 0.35 × 60% + 0.25 × 50% = 63.5%. When calculating network performance metrics, network latency has a weight of 0.6, and packet loss rate has a weight of 0.4. For instance, if the network latency is 120 milliseconds and the packet loss rate is 2%, standardizing the latency to 120 / 200 = 0.6, then the network performance metric is 0.6 × 0.6 + 0.4 × 2% = 0.368.

[0111] The time period determination result vector contains three components. The real-time load determination value is obtained by comparing the current resource utilization rate with a preset threshold. When the resource utilization rate exceeds 80%, the value is 1; otherwise, it is 0. The historical pattern determination value is obtained by comparing the historical load pattern at the current time point. When the consistency with the historical peak period exceeds 85%, the value is 1; otherwise, it is 0. The trend prediction determination value is obtained by analyzing the load change trend over the past 30 minutes. When the predicted load growth rate exceeds 10%, the value is 1; otherwise, it is 0.

[0112] When calculating immediate rewards, three aspects are considered comprehensively: boundary stability, load balancing, and time continuity. Boundary stability rewards are calculated as the sum of squares of adjustments at boundary time points. For example, when there are three boundary points with adjustments of 5 minutes, 0 minutes, and 10 minutes respectively, the sum of squares is 25 + 0 + 100 = 125, and the boundary stability reward is -125 × 0.05 = -6.25. Load balancing rewards are calculated based on the ratio of the load standard deviation to the load mean. For example, when the load mean for each time period is 65% and the standard deviation is 13%, the ratio is 13% ÷ 65% = 0.2, and the load balancing reward is (1 - 0.2) × 10 = 8. Time continuity rewards are calculated using the variance of the intervals between adjacent time points. For example, when the intervals between adjacent boundary points are 120 minutes, 180 minutes, and 240 minutes, the variance is 2400, and the time continuity reward is -2400 × 0.002 = -4.8. The weights of each reward item are dynamically adjusted according to the current system status. Under high load conditions, the weights for boundary stability are 0.3, load balancing is 0.5, and time continuity is 0.2; under low load conditions, the weights are 0.5, 0.3, and 0.2, respectively.

[0113] The state transition probability calculation consists of three steps. First, a base transition probability is calculated based on state distance, using Euclidean distance. When the distance is 5, the base transition probability is 0.8; when the distance is 10, the transition probability is 0.5; and when the distance is 15, the transition probability is 0.2. Second, the transition probability is adjusted based on historical similarity. Historical similarity is calculated by comparing the current state with historical states. When the similarity is 90%, the transition probability is adjusted to 0.8 × 0.9 = 0.72. Finally, an adjustment is made based on time association. The time association adjustment factor is calculated using the state timestamp, the expected time interval, and the time tolerance. When the current time is 30 minutes away from the expected time and the tolerance is 60 minutes, the time association adjustment factor is 1 - (30 ÷ 60). 2 =0.75, and the final state transition probability is 0.72 × 0.75 = 0.54.

[0114] The state-value function is calculated using an iterative method, with an initial value set to 0. For each state s, the expected reward after choosing decision a is calculated. For example, choosing decision a1 from state s1 may lead to states s2, s3, or s4, with transition probabilities of 0.54, 0.32, and 0.14, respectively, and immediate rewards of 5, 3, and 1, respectively. With a discount factor of 0.9, the state value V is 0.54×(5+0.9×V(s2))+0.32×(3+0.9×V(s3))+0.14×(1+0.9×V(s4)). After multiple iterations, convergence is considered achieved when the change in state value is less than 0.01, yielding the final state-value function. Based on the state-value function, the decision that maximizes the state value is selected as the optimal decision strategy.

[0115] The optimization process employs an adaptive learning rate, initially set at 0.1. When the state value improvement is less than 0.5% after five consecutive iterations, the learning rate is halved; when the state value improvement is greater than 5%, the learning rate is increased by 0.05, but not exceeding 0.3. After optimization, the system adjusts the time period boundaries based on the optimal decision-making strategy. For example, the original three boundary points of 9:00, 13:00, and 18:00 are adjusted to 8:30, 13:30, and 19:00.

[0116] The adjusted boundary is evaluated based on three indicators: boundary stability reaches 85%, indicating a moderate adjustment; load balance reaches 78%, indicating a more balanced load distribution across time periods; and time continuity reaches 92%, indicating reasonable duration of each time period. The final time period division result is output when all three indicators exceed 75%.

[0117] Figure 2 For the comparative analysis of the optimization effects of different methods, the horizontal axis represents three key evaluation indicators: boundary stability, load balancing, and time continuity, while the vertical axis represents the optimization effect as a percentage. The comparison shows that the Markov decision optimization method of this invention outperforms the other two methods in all three key indicators, especially in time continuity, where it achieves a high efficiency of 93.0%. This indicates that the method of this invention can effectively solve the problem of frequent boundary fluctuations in traditional time period division, significantly improve the stability and rationality of time period division, and provide a reliable basis for calculating the dynamic waiting time benchmark value.

[0118] This invention solves the problem of frequent boundary fluctuations in traditional time period division, significantly improving the stability and rationality of time period division. By comprehensively considering business load characteristics and time continuity, it achieves a peak period and regular period division that better reflects actual business patterns, providing a reliable basis for calculating dynamic waiting time benchmark values ​​and enhancing the overall performance of the monitoring system.

[0119] In one optional implementation, the step of periodically calculating the time difference between the current timestamp and the file arrival deadline timestamp, and setting an alarm threshold based on the historical running data to trigger alarm processing includes:

[0120] Construct a multidimensional feature that includes a time difference vector, a system load state vector, and a performance index vector; calculate the mean and standard deviation of the time difference vector; construct a basic layer alarm threshold based on the mean and standard deviation; the basic layer alarm threshold is calculated by multiplying the confidence coefficient and the standard deviation.

[0121] The overall load score is calculated based on the system load state vector. The dynamic layer alarm threshold is obtained by multiplying the basic layer alarm threshold by the dynamic adjustment coefficient of the overall load score. The dynamic adjustment coefficient is adaptively adjusted as the overall load score changes.

[0122] The trend prediction function is used to predict the change trend of the dynamic layer alarm threshold within the prediction time window to obtain the prediction layer alarm threshold. The time difference, system status and processing result of each alarm are recorded. The alarm accuracy rate is obtained by calculating the ratio of the number of valid alarms to the number of false alarms.

[0123] The confidence coefficient is updated based on the deviation between the alarm accuracy rate and the target accuracy rate. The alarm duration and business impact are weighted and combined to classify the alarms. Different processing strategies are adopted for alarms of different levels.

[0124] Calculate the temporal and spatial correlations among multiple alarms, identify the root causes of alarms based on the temporal and spatial correlations, merge alarms with correlation, statistically analyze alarm response time and system overhead, evaluate the alarm processing effect based on a weighted combination of alarm accuracy, response time, and system overhead, and use the evaluation results to optimize the parameters of the dynamic adjustment coefficient and the trend prediction function.

[0125] For example, the data acquisition module collects file arrival time information, records the actual arrival timestamp and the expected arrival deadline timestamp for each file, and calculates the time difference between the two. For a specific business scenario, data collected over 30 days shows that the average file latency is 120 seconds, with a standard deviation of 25 seconds. The system constructs these differences into a time difference vector, and simultaneously collects corresponding system CPU utilization, memory usage, network throughput, and other indicators to form a system load status vector, as well as file processing speed, queue length, and other metrics to form a performance indicator vector. These three together constitute the multi-dimensional features of the monitoring.

[0126] The base-level alarm threshold is constructed based on the mean and standard deviation of the time difference vector. In this embodiment, the confidence coefficient is initially set to 2.5. The base-level alarm threshold is calculated by multiplying the confidence coefficient by the standard deviation and then adding it to the mean. For example, if the mean is 120 seconds, the standard deviation is 25 seconds, and the confidence coefficient is 2.5, then the base-level alarm threshold is 120 + 2.5 × 25 = 182.5 seconds. This means that an alarm will be triggered when the file delay exceeds 182.5 seconds.

[0127] The overall load score is obtained by weighting metrics such as CPU utilization, memory usage, and network throughput with different weights. For example, if at a certain moment CPU utilization is 75%, memory usage is 60%, and network throughput is 80% of its peak, and weights of 0.5, 0.3, and 0.2 are assigned respectively, the overall load score is 75% × 0.5 + 60% × 0.3 + 80% × 0.2 = 71.5%. Mapping this overall load score to a dynamic adjustment coefficient, the corresponding dynamic adjustment coefficient is 1.2 when the overall load score is 71.5%. The dynamic layer alarm threshold is obtained by multiplying the base layer alarm threshold by the dynamic adjustment coefficient, i.e., 182.5 × 1.2 = 219 seconds. This means that under high system load, the maximum allowable file latency is appropriately relaxed to 219 seconds.

[0128] A trend prediction function is used to predict the changing trend of the dynamic layer alarm threshold within the prediction time window. The system uses an exponential smoothing prediction model as the trend prediction function, specifically in the form Ft+1=α×At+(1-α)×Ft, where Ft+1 is the predicted value for the next moment, At is the current actual value, Ft is the current predicted value, and α is the smoothing coefficient (valued at 0.3). The prediction time window is set to the next 30 minutes. Analyzing the load change pattern over the past 2 hours and combining it with historical data from the same period, it is predicted that the system load may increase by 10% within the next 30 minutes. The corresponding dynamic adjustment coefficient will increase to 1.3, and the predicted layer alarm threshold will be 182.5×1.3=237.25 seconds. Real-time monitoring of file arrival status is implemented. When a file delay of 230 seconds is detected, although it exceeds the dynamic layer alarm threshold of 219 seconds, it does not exceed the predicted layer alarm threshold of 237.25 seconds, and the trend prediction indicates that the system load is increasing. Therefore, no alarm is triggered temporarily, avoiding possible false alarms.

[0129] Record the time difference, system status, and processing result for each alarm, and calculate the ratio of valid alarms to false alarms. Assuming 100 alarms are generated in a week, with 85 confirmed as valid alarms and 15 as false alarms, the alarm accuracy rate is 85%. If the target accuracy rate is set to 90%, a 5% negative deviation will automatically adjust the confidence coefficient from 2.5 to 2.7, slightly increasing the alarm threshold and reducing the false alarm rate.

[0130] For triggered alarms, alarms are classified according to their duration and business impact. For example, if the delay exceeds the threshold but lasts for less than 5 minutes and the affected business has a low priority, it is classified as a Level 3 alarm, and relevant personnel are notified via email; if the delay exceeds the threshold and lasts for more than 15 minutes, or affects core business processes, it is classified as a Level 1 alarm, and the system automatically sends SMS and telephone notifications and activates the emergency plan.

[0131] The system calculates the temporal and spatial correlations among multiple alarms to identify the root cause and merge related alarms. Temporal correlation is determined by calculating the distribution characteristics of alarm time intervals; alarms with intervals less than 5 minutes have high temporal correlation. Spatial correlation is calculated by comparing the similarity of functional modules in the system where the alarm occurred. The correlation is 0.9 for modules of the same type, 0.7 for upstream and downstream modules, and 0.3 for modules with no direct connection. For example, a file transfer delay alarm and a network connection alarm from 3 minutes prior have a temporal correlation of 0.9 and a spatial correlation of 0.7 (belonging to an upstream / downstream relationship), resulting in a combined correlation of 0.83, exceeding the merging threshold of 0.7. Therefore, these two alarms are merged, and the network connection problem is identified as the root cause. Statistics show that the average alarm response time decreased from 15 minutes to 8 minutes, system processing overhead decreased by 30%, and alarm accuracy improved to 92%. Based on these performance indicators, the system automatically adjusts the weighting coefficients in the dynamic adjustment coefficient calculation formula and the smoothing parameter α of the trend prediction function using gradient descent, optimizing α from 0.3 to 0.35, further improving prediction accuracy.

[0132] This invention constructs a three-layer threshold structure, dynamically updates the confidence coefficient by analyzing alarm accuracy, classifies alarms based on alarm duration and business impact, and identifies the root cause of alarms using temporal and spatial correlation. This multi-layered alarm mechanism significantly improves the accuracy and timeliness of alarms, reduces the false alarm rate, and achieves intelligent alarm classification and root cause localization, enabling the monitoring system to adopt corresponding processing strategies for different types of file arrival delays.

[0133] In one optional implementation, the step of calculating a comprehensive load score based on the system load state vector, and multiplying the basic layer alarm threshold by the dynamic adjustment coefficient of the comprehensive load score to obtain a dynamic layer alarm threshold, wherein the dynamic adjustment coefficient is adaptively adjusted as the comprehensive load score changes, includes:

[0134] The load values ​​of each dimension in the system load state vector are normalized, and the comprehensive load score is calculated based on the weight coefficients of each dimension and the normalized load values.

[0135] The basic adjustment coefficient is calculated based on the ratio of the comprehensive load score to the reference load value; historical load pattern data is obtained, and the product of the historical load pattern data and the time decay weight is accumulated within a time window to obtain the historical pattern influence factor; the combination product of the basic adjustment coefficient and the historical pattern influence factor is used to generate the dynamic adjustment coefficient, and the alarm threshold of the basic layer is dynamically adjusted based on the dynamic adjustment coefficient.

[0136] The weighted sum of the degree of component dependency and the severity of the failure is used to obtain the direct impact.

[0137] An alarm propagation model is constructed, and the propagation impact is obtained by combining the product of the direct impact degree and the decay function with the product of the historical propagation impact degree and the propagation probability; the alarm relevance matrix is ​​calculated based on the alarm time difference and topological distance.

[0138] The root cause probability is calculated by multiplying the propagation impact degree, the alarm relevance matrix and the alarm weight coefficient. The root cause probability is then weighted and combined with the historical accuracy to obtain the confidence evaluation value. Performance evaluation indicators are calculated based on the positioning accuracy, response timeliness and system resource consumption.

[0139] The alarm propagation model parameters are iteratively updated based on the gradient of the performance evaluation index, and the updated model parameters are used to optimize the weight coefficients of each dimension, the time decay weight, and the alarm weight coefficient.

[0140] For example, the acquired system load status vector is normalized so that the data for each dimension is between 0 and 1 for easy comprehensive calculation. Weight coefficients are assigned to each load dimension, such as CPU utilization weighted at 0.35, memory usage weighted at 0.25, network traffic weighted at 0.20, and disk I / O weighted at 0.20. The comprehensive load score is obtained by weighted summation of the normalized values ​​of each dimension and their corresponding weights. In the example above, the comprehensive load score is 0.75×0.35+0.60×0.25+0.80×0.20+0.40×0.20=0.655. A reference load value is set to 0.5, and a base adjustment coefficient is calculated by comparing the current comprehensive load score with the reference value. In this example, the base adjustment coefficient is 0.655 / 0.5=1.31. When the comprehensive load score is greater than the reference value, the base adjustment coefficient is greater than 1, indicating a high system load, requiring a reduction in alarm sensitivity to decrease false alarms; conversely, a lower score requires an increase in sensitivity to detect potential problems earlier.

[0141] Obtain historical load pattern data from the past 30 days and apply time-decay weights. For example, the weight for data from 1 day ago is 0.95, and the weight for data from 2 days ago is 0.95. 2And so on. The system accumulates these weighted historical data within a specific time window to form a historical pattern influence factor. Assuming the calculated historical pattern influence factor is 0.85, it indicates that the load was relatively low during this historical period. Multiplying the base adjustment coefficient by the historical pattern influence factor generates the final dynamic adjustment coefficient, which in this example is 1.31 × 0.85 = 1.11. Assuming the base alarm threshold for CPU utilization of a certain service is 80%, the dynamically adjusted alarm threshold is 80% × 1.11 = 88.8%. This means that when the overall system load is high and historical data shows that the load is usually low during this period, the alarm threshold will be increased to reduce the false alarm rate.

[0142] When an alarm event is detected, the system assesses the dependencies between components and the severity of the fault. The system calculates component dependencies based on a service call graph; for example, the file processing service's dependency on the database service is 0.8 (representing 80% functional dependence). Fault severity is calculated based on business impact analysis; for example, a database service fault severity of 0.7 (representing impact on 70% of business operations) is calculated. Therefore, the direct impact is 0.8 × 0.6 + 0.7 × 0.4 = 0.76 (assuming a dependency weight of 0.6 and a severity weight of 0.4).

[0143] The alarm propagation model is a directed graph structure where nodes represent system components, edges represent dependencies between components, and edge weights represent the strength of those dependencies. The model construction steps are as follows: First, an initial structure is established based on the system topology graph; second, the edge weights are trained using historical alarm data; finally, the Markov propagation algorithm is applied to calculate the probability of fault propagation between components. For a component with a direct impact degree of 0.76, the impact decay is calculated using the exponential decay function f(d) = e^(-λd) (where d is the topological distance and λ is the decay coefficient of 0.2). For example, the impact decay to a first-level adjacent component (d=1) is 0.76 × e^(-0.2 × 1) ≈ 0.76 × 0.819 = 0.622. Taking into account both historical dissemination impact and dissemination probability, if the historical dissemination impact is 0.6 and the dissemination probability is 0.75, then the final dissemination impact is 0.622×0.7+0.6×0.75×0.3=0.5704 (assuming the direct impact weight is 0.7 and the historical impact weight is 0.3).

[0144] An alarm correlation matrix is ​​constructed based on alarm time difference and topology distance. Time correlation is calculated using the function g(t) = e^(-t / T), where t is the time difference and T is the time constant (set to 300 seconds). Topology correlation is calculated using the function h(d) = e^(-d / D), where d is the topology distance and D is the distance constant (set to 3). For example, for two alarm events with a time difference of 10 seconds and a topology distance of 2 hops, the time correlation is e^(-10 / 300) ≈ 0.967, and the topology correlation is e^(-2 / 3) ≈ 0.513. The overall correlation is 0.967 × 0.6 + 0.513 × 0.4 = 0.7862 (time weight 0.6, topology weight 0.4). The correlation of each pair of alarm events is calculated to form an n × n correlation matrix (n is the number of alarms).

[0145] The probability of each alarm event being the root cause is calculated by multiplying the propagation impact matrix, alarm relevance matrix, and preset alarm weighting coefficients. The alarm weighting coefficients are determined based on the alarm type, severity, and historical accuracy. For example, for an alarm event, if the propagation impact is 0.5704, the average alarm relevance is 0.7862, and the alarm weighting coefficient is 1.2, then the root cause probability is 0.5704 × 0.7862 × 1.2 = 0.5386. The root cause probability is then weighted and combined with the historical accuracy (e.g., 0.82) to obtain the confidence assessment value: 0.5386 × 0.7 + 0.82 × 0.3 = 0.6233 (assuming the current weight is 0.7 and the historical weight is 0.3).

[0146] Performance evaluation metrics are calculated based on positioning accuracy, response timeliness, and system resource consumption. Positioning accuracy is obtained by comparing with manually confirmed root causes; response timeliness is the time from alarm triggering to root cause determination; system resource consumption is the CPU and memory usage during algorithm execution. Assuming a positioning accuracy of 92%, an average response time of 1.5 seconds, and an additional CPU consumption of 3% in the test, the performance evaluation metric is 0.92×0.5+(1-1.5 / 10)×0.3+(1-0.03)×0.2=0.46+0.255+0.194=0.909 (assuming an accuracy weight of 0.5, a response time weight of 0.3, a resource consumption weight of 0.2, and a response time baseline of 10 seconds).

[0147] The model parameters are iteratively updated based on the performance evaluation metric using gradient descent: the partial derivatives of the performance evaluation metric E with respect to each parameter θ are calculated as ∂E / ∂θ; the parameters θ are updated along the inverse gradient direction with a learning rate α. new =θ old-α·∂E / ∂θ; Repeat the iteration until the performance evaluation metric converges. For example, if increasing the CPU utilization weight improves the performance metric, adjust it from 0.35 to 0.38, and adjust other weights accordingly to keep the sum of 1. Similarly, optimize the time decay weight, alarm weight coefficient, and decay parameter λ in the alarm propagation model to maximize the performance evaluation metric. The optimization of each parameter is interrelated; for example, the optimization result of load calculation will affect the dynamic threshold adjustment, which in turn will affect the accuracy of alarm triggering, ultimately reflected in the performance of root cause analysis.

[0148] Figure 3 This diagram illustrates the simulation results of the alarm propagation model and root cause analysis of this invention, showcasing the alarm propagation model and root cause analysis technology based on Markov decision processes. The diagram presents a typical service failure scenario, where the database service, as the root cause (probability 0.92), propagates alarms to other service components through dependencies. The diagram includes three types of components: root cause component (dark): database service, probability 0.92; intermediate propagation components (medium gray): file processing service (probability 0.31), API service (probability 0.27), and user authentication service (probability 0.18); edge components (light gray): Web frontend 1 (probability 0.08) and Web frontend 2 (probability 0.06). Solid lines represent dependencies between components and their strength, with numerical values ​​indicating the degree of dependency. For example, the dependency of the file processing service on the database service is 0.8, and the dependency of the API service on the database service is 0.7. Dashed arrows represent alarm propagation paths, with the arrow thickness representing the intensity of the propagation impact, gradually weakening as the propagation distance increases. The timestamps (t=0s to t=60s) show the temporal order in which alarms were triggered on each component, reflecting the temporal characteristics of fault propagation. The model successfully identified the database service as the root cause and demonstrated how alarms propagate and decay along dependencies. By calculating the weighted sum of component dependencies and fault severity to obtain the direct impact, and then combining alarm time differences and topology distances to calculate alarm relevance, the root cause was accurately located, significantly reducing the risk of alarm storms and improving problem localization efficiency.

[0149] This invention achieves highly adaptive adjustment of alarm thresholds, enabling alarm sensitivity to intelligently change according to system load status, significantly improving alarm accuracy. Simultaneously, through an alarm propagation model, it achieves accurate location of the root cause of faults in complex systems, reducing the risk of alarm storms, alleviating the burden on maintenance personnel, improving problem-solving efficiency, and providing more reliable decision support for file arrival monitoring.

[0150] In one optional implementation, the step of recording alarm data to update the dynamic waiting time baseline value and the rules for dividing peak and normal business periods includes:

[0151] The alarm data is classified and statistically analyzed according to time difference, system status and processing results. The distribution density of each type of alarm in different time periods is calculated, and high-frequency alarm periods are identified based on the distribution density.

[0152] The time overlap between the high-frequency alarm period and the existing business peak period is calculated. When the time overlap is lower than the preset overlap threshold, the start and end times of the business peak period are corrected based on the high-frequency alarm period.

[0153] The time difference sequence in the alarm data is statistically analyzed, and the mean and standard deviation of the time difference sequence in different time periods are calculated. The weighted combination of the mean and standard deviation is used as the evaluation benchmark for dynamic waiting time. An adjustment coefficient is calculated based on the deviation between the evaluation benchmark and the current dynamic waiting time benchmark value. The adjustment coefficient decays over time. The product of the adjustment coefficient and the current dynamic waiting time benchmark value is used as the updated dynamic waiting time benchmark value.

[0154] Calculate the change in alarm trigger frequency before and after the update. When the alarm trigger frequency decreases, record the adjustment strategy adopted in this update and increase the weight of the adjustment strategy adopted in this update in subsequent optimizations.

[0155] For example, the collected alarm data is categorized and statistically analyzed according to time difference, system status, and processing results. Time difference refers to the time interval from alarm triggering to processing completion. System status includes high load, medium load, and low load. Processing results include automatic recovery, manual intervention, and timeout processing. For each type of alarm, the system calculates its distribution density for each hourly segment within a 24-hour period, which is the frequency of occurrence of that type of alarm within a specific time period divided by the total number of alarms. For instance, if "network connection timeout" alarms occur 15 times between 9:00 and 10:00, and this type of alarm occurs a total of 100 times throughout the day, then the distribution density for that time period is 0.15. When the distribution density of a certain time period exceeds a preset threshold of 0.08, that time period is marked as a high-frequency alarm period for that type of alarm. By summarizing the high-frequency periods of various alarm types, the overall high-frequency alarm periods can be identified, such as 8:00-11:00 and 14:00-17:00.

[0156] After identifying high-frequency alarm periods, the system calculates their time overlap with the existing peak business periods. The time overlap is defined as the ratio of the duration of the overlapping portion of the two periods to the duration of the high-frequency alarm period. For example, if the existing peak business periods are 9:00-12:00 and 13:00-16:00, compared to the identified high-frequency alarm periods 8:00-11:00 and 14:00-17:00, the overlap is 9:00-11:00 and 14:00-16:00, totaling 4 hours. The high-frequency alarm periods total 6 hours, so the time overlap is approximately 4 / 6 ≈ 0.67. If this overlap is lower than the preset overlap threshold of 0.75, the system will adjust the peak business periods based on the high-frequency alarm periods. The adjustment strategy is to extend the boundaries of the existing peak business periods to include the high-frequency alarm periods. In this example, the adjusted peak business periods are 8:00-12:00 and 13:00-17:00.

[0157] The system analyzes the time difference sequence in the statistical alarm data, calculating the mean and standard deviation of the time difference during peak and normal periods. For example, during the corrected peak period, the mean time difference is 45 seconds and the standard deviation is 15 seconds; during the normal period, the mean time difference is 30 seconds and the standard deviation is 10 seconds. The system uses a weighted combination method to calculate the benchmark for dynamic waiting time, specifically the mean plus the standard deviation multiplied by a weighting factor. The default weighting factor is 1.5, which can be adjusted according to system fault tolerance requirements. Taking the peak period as an example, the benchmark is 45 + 15 × 1.5 = 67.5 seconds, rounded to 68 seconds; the benchmark for the normal period is 30 + 10 × 1.5 = 45 seconds.

[0158] The adjustment factor is calculated based on the deviation between the evaluation benchmark and the current dynamic waiting time benchmark. Assuming the current peak waiting time benchmark is 60 seconds and the normal waiting time is 40 seconds, then the peak period deviation is (68-60) / 60≈0.133, and the normal period deviation is (45-40) / 40=0.125. The adjustment factor is calculated by adding 1 to the deviation value multiplied by the time decay factor. The time decay factor is determined based on the last update interval; the longer the interval, the smaller the decay. Assuming the peak period time decay factor is 0.9 and the normal period time decay factor is 0.8, then the peak period adjustment factor is 1+0.133×0.9≈1.12, and the normal period adjustment factor is 1+0.125×0.8=1.1. Multiplying the adjustment factor by the current benchmark value yields the updated dynamic waiting time benchmark: peak period 60×1.12≈67 seconds, normal period 40×1.1=44 seconds.

[0159] After updating the baseline value, the change in alarm triggering frequency before and after the update was calculated. In the week prior to the update, an average of 25 alarms were triggered per hour during peak periods and 12 per hour during normal periods. One week after the update, the average number of alarms triggered per hour during peak periods decreased to 18, and during normal periods to 9. The alarm triggering frequency reduction rates were (25-18) / 25=28% and (12-9) / 12=25%, respectively. Due to the significant reduction in frequency, the system recorded the adjustment strategies used in this update, including the peak period boundary expansion strategy and the baseline value adjustment strategy, and increased the weights of these strategies by 0.2 in subsequent optimizations. Specifically, a strategy weight dictionary was maintained, with all strategy weights initially set to 1.0. After this update, the weight of the "peak period boundary expansion" strategy was updated to 1.2, and the weight of the "baseline value increase" strategy was updated to 1.2, giving these strategies a higher probability of being selected in future optimization decisions.

[0160] This invention achieves self-learning and self-optimization of the monitoring system by recording effective adjustment strategies and increasing their weight in subsequent optimizations. This closed-loop optimization mechanism enables the system to continuously improve the division of business periods and the calculation of waiting time based on actual operating results, significantly improving the adaptive capability and accuracy of the monitoring system, reducing the need for manual intervention, lowering maintenance costs, and enabling file arrival monitoring to adapt to changes in the long-term evolution of the business system.

[0161] In one optional implementation, the steps of obtaining the current operating indicators of the business system to be monitored, calculating the deviation value from the historical operating data, adjusting the dynamic waiting time benchmark value based on the deviation value to generate a real-time dynamic waiting time, and comparing the expected file arrival time parameter with the monitoring benchmark time to determine the date identifier and converting it into an expected arrival timestamp, and adding it to the real-time dynamic waiting time to generate a file arrival deadline timestamp include:

[0162] The system obtains the current system resource utilization, concurrent request count, network latency, and packet loss rate of the business system to be monitored. The size of the time window is determined based on the intensity of local fluctuations. Short-term, medium-term, and long-term features are extracted within the time window. The dynamic time-series similarity between the features and historical operating data is calculated. The dynamic time-series similarity is obtained by a weighted combination of Euclidean distance similarity, dynamic time warp distance similarity, and trend similarity. The weights are adaptively adjusted according to historical data.

[0163] The deviation value is calculated based on dynamic time series similarity. The dynamic waiting time benchmark value is adjusted in segments according to the deviation value to obtain the real-time dynamic waiting time. The weight coefficient of the segment adjustment is dynamically adjusted according to the load volatility index.

[0164] The expected file arrival time parameter is compared with the monitoring baseline time to obtain the date identifier. Based on the date identifier and the expected file arrival time parameter, the expected arrival timestamp is calculated. The expected arrival timestamp is added to the real-time dynamic waiting time to generate the file arrival deadline timestamp.

[0165] For example, monitoring probes deployed on various nodes of the business system collect current operational metrics. These probes collect system resource utilization data every 5 seconds, including CPU utilization, memory usage percentage, disk I / O wait time, and network bandwidth utilization. The number of concurrent requests is obtained from the number of active connections in the application server's connection pool. Network latency is calculated by sending ICMP probe packets between nodes and calculating the round-trip time; typically, 20 samples are collected and the average is taken, in milliseconds. Packet loss rate is calculated by sending a fixed number of packets and counting the percentage of packets that do not receive a response. For example, if 100 probe packets are sent and 2 do not receive a response, the packet loss rate is 2%.

[0166] The calculation of local fluctuation intensity dynamically determines the time window size based on the rate of change in system resource utilization. When resource utilization fluctuates by more than 30% in a short period of time, a smaller time window, such as 5 minutes, is set; when the fluctuation is between 10% and 30%, a medium time window, such as 15 minutes, is set; and when the fluctuation is below 10%, a larger time window, such as 30 minutes, is used. Within the determined time window, the system extracts three types of time-series features: short-term features reflect the load situation in the last 5 minutes, medium-term features reflect the fluctuation trend in the past hour, and long-term features reflect the periodic patterns in the past 24 hours.

[0167] In dynamic time series similarity calculation, Euclidean distance similarity is used to measure the absolute difference between current performance metrics and historical data. For example, if the current CPU utilization is 75% and the historical average for the same period is 60%, the Euclidean distance is calculated after normalization. Dynamic time warping distance similarity is used to handle potential delays or advances in time series, allowing for flexible comparisons along the time axis. Trend similarity focuses on the direction and magnitude of data changes. For instance, if the current CPU utilization increases from 65% to 75%, and historical data also shows a similar upward trend, the trend similarity is considered high.

[0168] For example, the current CPU utilization is monitored at 85%, with 1200 concurrent requests, a network latency of 120 milliseconds, and a packet loss rate of 1.5%. Local fluctuation intensity calculations show that resource utilization fluctuates by 25% within 15 minutes; therefore, a 15-minute time window is selected. Within this window, short-term characteristics show a continuous increase in CPU utilization, medium-term characteristics indicate frequent fluctuations in concurrent requests, and long-term characteristics indicate that the current period is during the daily peak.

[0169] The calculated Euclidean distance similarity is 0.78, the dynamic time-warped distance similarity is 0.82, and the trend similarity is 0.90. Based on historical adaptive weights of 0.3, 0.3, and 0.4, the calculated dynamic time-series similarity is 0.836. The system detected that under similar load conditions over the past three months, the average file transfer latency increased by 25%, therefore the calculated deviation value is 0.25.

[0170] The deviation value is applied to the segmented adjustment of the dynamic waiting time baseline using a non-linear mapping. When the deviation value is below 0.1, the adjustment factor is 1.0; when the deviation value is between 0.1 and 0.3, the adjustment factor is 1.0 + deviation value, i.e., 1.25; when the deviation value is between 0.3 and 0.5, the adjustment factor is 1.3 + deviation value × 0.8, i.e., 1.5; when the deviation value exceeds 0.5, the adjustment factor is 1.5 + deviation value × 0.5, with a maximum of 2.0. Therefore, for a dynamic waiting time baseline of 120 minutes, the actual adjusted real-time dynamic waiting time is 120 × 1.25 = 150 minutes.

[0171] The load volatility index is calculated by dividing the standard deviation of the system resource utilization rate over the most recent hour by the average value. For example, when the volatility index exceeds 0.4, the weighting coefficient for the high deviation range is increased; when the volatility index is below 0.2, the weighting coefficient is decreased to make the adjustment more gradual.

[0172] In the expected file arrival time processing stage, the system obtains the configured expected file arrival time parameter, such as "14:30", and compares it with the monitoring baseline time (the current system time). If the current time is "2023-07-15 13:45:00" and the expected arrival time is "14:30:00" of the same day, then the date identifier is "the current day". The system combines the expected file arrival time parameter with the date identifier to convert it into a timestamp 1689405000 (corresponding to "2023-07-15 14:30:00"). This timestamp is added to the real-time dynamic waiting time of 150 minutes (9000 seconds) to obtain the file arrival deadline timestamp 1689414000, corresponding to the time "2023-07-15 17:00:00".

[0173] If the expected file arrival time is "02:30", and the current time is "2023-07-15 23:45:00", the system identifies the date as "next day", and the calculated expected arrival timestamp corresponds to "2023-07-16 02:30:00". Adding the dynamic waiting time, a file arrival deadline timestamp is generated.

[0174] By comprehensively analyzing the system's operating status and historical data, the file monitoring waiting time is dynamically adjusted, thereby improving the accuracy of file monitoring and the system's operating efficiency.

[0175] In one optional implementation, the step of setting alarm thresholds to trigger alarm processing based on historical operational data includes establishing a three-level alarm strategy, combined with a multi-channel transmission strategy and anti-jitter mechanism to achieve accurate alarms: Three-level alarm thresholds are set according to the time difference ΔT: a low-priority alarm is triggered when 30 minutes ≤ ΔT < 45 minutes; a medium-priority alarm is triggered when 45 minutes ≤ ΔT < 55 minutes; and a high-priority alarm is triggered when ΔT ≥ 55 minutes. Different alarm levels employ differentiated notification strategies, forming a multi-channel transmission mechanism: low-priority alarms are notified to operations and maintenance personnel via email and log recording, recording detailed delay information but not requiring immediate action; medium-priority alarms, in addition to sending emails, also trigger SMS notifications and change the color of the corresponding area on the monitoring dashboard to alert operations and maintenance personnel; high-priority alarms initiate a comprehensive response, including automatic outbound calls for telephone alarms, push notifications to administrator mobile devices, and automatic execution of preset emergency handling scripts.

[0176] For example, to prevent false alarms caused by short-term fluctuations in system load, an alarm anti-jitter mechanism is implemented. For high-priority alarms, the alarm process is only triggered when ΔT ≥ 55 minutes is detected three consecutive times. For instance, if a file transfer task has ΔT values ​​of 56 minutes, 57 minutes, and 55 minutes at three consecutive detection points at 10:00, 10:01, and 10:02, respectively, meeting the condition of exceeding the high-priority alarm threshold three times consecutively, the system will trigger a high-priority alarm at 10:02. However, if the ΔT value drops to 54 minutes at the 10:02 detection point, a high-priority alarm will not be triggered, and the medium-priority alarm strategy will continue to be executed.

[0177] When the file arrives successfully or the delay time returns to the normal range (ΔT < 30 minutes), the system will automatically send a recovery confirmation message to notify relevant personnel that the problem has been resolved. The recovery confirmation message will be sent through the same channel as the plaintiff's police report and will include key information such as recovery time and duration for subsequent analysis and statistics.

[0178] The generated alarm messages are in a standardized JSON format, facilitating integration with other monitoring and operations systems. For example... Figure 4As shown in the overall architecture diagram, the overall architecture of this invention consists of five core modules: a time synchronization management module, a data acquisition module, a business period analysis module, a dynamic threshold calculation module, and an alarm processing module. The time synchronization management module is responsible for maintaining time consistency among distributed nodes, ensuring that each node monitors based on a unified time benchmark; the data acquisition module obtains various system operating indicators through distributed probes and stores the data in a time-series database; the business period analysis module divides peak periods and regular periods based on historical data, generating differentiated monitoring parameters for different periods; the dynamic threshold calculation module dynamically adjusts alarm thresholds according to the current system load status, improving alarm accuracy; and the alarm processing module implements multi-level alarm strategies and reduces alarm storms through root cause analysis and alarm merging.

[0179] The data flow between modules follows a closed-loop design principle: real-time metrics collected by the data acquisition module flow simultaneously to the business period analysis module and the dynamic threshold calculation module, which respectively produce period segmentation results and dynamic waiting times, jointly influencing the decisions of the alarm processing module; alarm data generated by the alarm processing module is fed back to the business period analysis module and the dynamic threshold calculation module to optimize the period segmentation rules and threshold calculation parameters, forming a self-optimizing closed-loop mechanism. This architecture enables the system to continuously learn and adapt to business changes, improving monitoring accuracy and fault detection efficiency.

[0180] In actual deployment, the time synchronization management module is usually deployed on the master control node to keep synchronized with the network time protocol server; the probe components of the data acquisition module are distributed on each business node, and the acquisition server centrally processes the data; the business time period analysis module and the dynamic threshold calculation module are deployed on the analysis server cluster, using big data processing technology for calculation; and the alarm processing module is integrated with the enterprise's existing monitoring platform to achieve seamless connection.

[0181] A second aspect of the present invention provides an electronic device, comprising:

[0182] processor;

[0183] Memory used to store processor-executable instructions;

[0184] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0185] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0186] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0187] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for monitoring the arrival of files across days based on timestamps, characterized in that, include: Receive the time zone identifier and expected file arrival time parameter of the business system to be monitored, and determine the time zone offset based on the time zone identifier; After receiving the time zone offset, the master node of the monitored business system sends a UTC timestamp to the child nodes registered with the master node, and calculates the monitoring reference time based on the UTC timestamp and the time zone offset. Collect system resource utilization, concurrent request count, network latency, and packet loss rate of the monitored business system as historical operating data; based on the historical operating data, divide the daily time period into peak business period and regular period, and determine the dynamic waiting time benchmark value for different time periods; Obtain the current operating indicators of the business system to be monitored, calculate the deviation value from the historical operating data, and adjust the dynamic waiting time benchmark value based on the deviation value to generate a real-time dynamic waiting time; The expected file arrival time parameter is compared with the monitoring baseline time to determine the date identifier and converted into an expected arrival timestamp. This timestamp is then added to the real-time dynamic waiting time to generate the file arrival deadline timestamp. Periodically calculate the time difference between the current timestamp and the file arrival deadline timestamp, and trigger alarm processing based on the historical operation data by setting an alarm threshold. The alarm data is recorded to update the dynamic waiting time baseline value and the rules for dividing the business peak period and normal period.

2. The method according to claim 1, characterized in that, After receiving the time zone offset, the master node of the monitored business system sends a UTC timestamp to the child nodes registered with the master node. The steps for calculating the monitoring reference time based on the UTC timestamp and the time zone offset include: The master node synchronizes with the network time protocol server to obtain the UTC timestamp, and corrects the UTC timestamp based on the network delay compensation value to obtain the master node's reference timestamp. The network delay compensation value is obtained through multiple synchronization measurements. The master node broadcasts a time synchronization message to the distributed nodes. The time synchronization message includes the master node's base timestamp, synchronization sequence number, and timestamp accuracy index. The distributed nodes receive the time synchronization message. The distributed nodes use a sliding window to record the time difference between the local timestamp and the master node's reference timestamp multiple times, and calculate the average of the time differences to obtain the clock drift compensation value; the monitoring reference time is calculated based on the master node's reference timestamp, the time zone offset, and the clock drift compensation value. Calculate the standard deviation of the time difference. When the standard deviation exceeds a preset synchronization threshold, trigger resynchronization and record the trigger time and reason for resynchronization.

3. The method according to claim 1, characterized in that, Collect the system resource utilization rate, concurrent request count, network latency value, and packet loss rate of the business system to be monitored as historical operating data; Based on the historical operational data, the daily time periods are divided into peak and regular periods. The steps for determining the dynamic waiting time baseline value for different time periods include: The size of the time window is determined based on the local fluctuation intensity of the historical operating data. Short-term features, medium-term features, and long-term features are extracted within the time window. The short-term features, medium-term features, and long-term features correspond to feature vector sets of different time spans. The dynamic temporal similarity between the feature vector sets is calculated. The dynamic temporal similarity is obtained by a weighted combination of Euclidean distance similarity, dynamic time warp distance similarity, and trend similarity. The weights are adaptively adjusted according to historical data. Based on the dynamic time series similarity, the time period determination result is calculated by weighting the real-time load determination value, historical pattern determination value and trend prediction determination value. The weight coefficient of the weighted combination is dynamically adjusted with the load volatility index. Calculate the local mean and local standard deviation of the time period determination results, determine an adaptive threshold based on the local mean, local standard deviation and load volatility index, and perform preliminary division of the time period according to the adaptive threshold; A Markov decision process is used to optimize the time period boundary. The state transition probability of the Markov decision process is calculated based on the current state, historical transition patterns and time correlation factors, and the final business time period division result is output. For the defined peak and regular business periods, a baseline waiting time is calculated based on the product of the basic waiting time and the time period determination result. The dynamic waiting time baseline value is obtained by weighted combination of the baseline waiting time and the historical waiting time, and the weight of the historical waiting time decays over time.

4. The method according to claim 3, characterized in that, The optimization of time period boundaries using a Markov decision process, wherein the state transition probabilities of the Markov decision process are calculated based on the current state, historical transition patterns, and time correlation factors, and the steps to output the final business time period division result include: Construct a multidimensional state vector, which includes the current state vector, the time period determination result vector, the time feature vector, and the historical conversion mode; The immediate reward is calculated based on a weighted combination of boundary stability reward, load balancing reward, and time continuity reward. The boundary stability reward is calculated based on the sum of squares of boundary adjustments in the set of boundary time points. The load balancing reward is calculated based on the ratio of the load standard deviation to the load mean. The time continuity reward is calculated based on the variance of the interval between adjacent time points. The weights of the weighted combination are dynamically adjusted based on state characteristics. The basic transition probability is calculated based on the state distance. The transition probability after historical pattern adjustment is obtained by multiplying the basic transition probability with the historical similarity. The time correlation adjustment factor is calculated based on the state timestamp, expected time interval and time tolerance. The final state transition probability is obtained by multiplying the transition probability after historical pattern adjustment with the time correlation adjustment factor. Calculate the state value function based on the final state transition probability and the immediate reward, select the optimal decision strategy based on the state value function, and optimize the optimal decision strategy using an adaptive learning rate. Based on the optimal decision-making strategy, the time period boundaries are adjusted, and the final business time period division results are output according to the evaluation indicators of boundary stability, load balancing and time continuity.

5. The method according to claim 1, characterized in that, The steps of periodically calculating the time difference between the current timestamp and the file arrival deadline timestamp, and setting an alarm threshold based on the historical running data to trigger alarm processing include: Construct a multidimensional feature including a time difference vector, a system load state vector, and a performance index vector; calculate the mean and standard deviation of the time difference vector; construct a basic layer alarm threshold; the basic layer alarm threshold is calculated by multiplying the confidence coefficient and the standard deviation. The overall load score is calculated based on the system load state vector. The dynamic layer alarm threshold is obtained by multiplying the basic layer alarm threshold by the dynamic adjustment coefficient of the overall load score. The dynamic adjustment coefficient is adaptively adjusted as the overall load score changes. The trend prediction function is used to predict the change trend of the dynamic layer alarm threshold within the prediction time window to obtain the prediction layer alarm threshold. The time difference, system status and processing result of each alarm are recorded. The alarm accuracy rate is obtained by calculating the ratio of the number of valid alarms to the number of false alarms. The confidence coefficient is updated based on the deviation between the alarm accuracy rate and the target accuracy rate. The alarm duration and business impact are weighted and combined to classify the alarms. Different processing strategies are adopted for alarms of different levels. Calculate the temporal and spatial correlations among multiple alarms, identify the root causes of alarms based on the temporal and spatial correlations, merge alarms with correlation, statistically analyze alarm response time and system overhead, evaluate the alarm processing effect based on a weighted combination of alarm accuracy, response time, and system overhead, and use the evaluation results to optimize the parameters of the dynamic adjustment coefficient and the trend prediction function.

6. The method according to claim 5, characterized in that, The step of calculating a comprehensive load score based on the system load state vector, and multiplying the basic layer alarm threshold by the dynamic adjustment coefficient of the comprehensive load score to obtain a dynamic layer alarm threshold, wherein the dynamic adjustment coefficient is adaptively adjusted as the comprehensive load score changes includes: The load values ​​of each dimension in the system load state vector are normalized, and the comprehensive load score is calculated based on the weight coefficients of each dimension and the normalized load values. The basic adjustment coefficient is calculated based on the ratio of the comprehensive load score to the reference load value; historical load pattern data is obtained, and the product of the historical load pattern data and the time decay weight is accumulated within a time window to obtain the historical pattern influence factor; the combination product of the basic adjustment coefficient and the historical pattern influence factor is used to generate the dynamic adjustment coefficient, and the alarm threshold of the basic layer is dynamically adjusted based on the dynamic adjustment coefficient. The weighted sum of the degree of component dependency and the severity of the failure is used to obtain the direct impact. An alarm propagation model is constructed, and the propagation impact is obtained by combining the product of the direct impact degree and the decay function with the product of the historical propagation impact degree and the propagation probability; the alarm relevance matrix is ​​calculated based on the alarm time difference and topological distance. The root cause probability is calculated by multiplying the propagation impact degree, the alarm relevance matrix and the alarm weight coefficient. The root cause probability is then weighted and combined with the historical accuracy to obtain the confidence evaluation value. Performance evaluation indicators are calculated based on the positioning accuracy, response timeliness and system resource consumption. The alarm propagation model parameters are iteratively updated based on the gradient of the performance evaluation index, and the updated model parameters are used to optimize the weight coefficients of each dimension, the time decay weight, and the alarm weight coefficient.

7. The method according to claim 1, characterized in that, The steps for recording alarm data to update the dynamic waiting time baseline value and the rules for dividing peak and normal business periods include: The alarm data is classified and statistically analyzed according to time difference, system status and processing results. The distribution density of each type of alarm in different time periods is calculated, and high-frequency alarm periods are identified based on the distribution density. The time overlap between the high-frequency alarm period and the existing business peak period is calculated. When the time overlap is lower than the preset overlap threshold, the start and end times of the business peak period are corrected based on the high-frequency alarm period. The time difference sequence in the alarm data is statistically analyzed, and the mean and standard deviation of the time difference sequence in different time periods are calculated. The weighted combination is used as the evaluation benchmark for dynamic waiting time. An adjustment coefficient is calculated based on the deviation between the evaluation benchmark and the current dynamic waiting time benchmark. The adjustment coefficient decays over time. The product of the adjustment coefficient and the current dynamic waiting time benchmark is used as the updated dynamic waiting time benchmark. Calculate the change in alarm trigger frequency before and after the update. When the alarm trigger frequency decreases, record the adjustment strategy adopted in this update and increase the weight of the adjustment strategy adopted in this update in subsequent optimizations.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images