An interactive event processing method for emergency mode switching in a smart terminal

Abstract

The application discloses an interactive event processing method for emergency mode switching in an intelligent terminal, and relates to the technical field of computers, and comprises the following steps: S1, a time sequence database is used to store a multi-dimensional index sequence, a current index sequence is obtained according to a preset sampling interval, and a deviation value is calculated by using an abnormality detection model to obtain a first abnormal index set; S2, if the deviation value in the first abnormal index set exceeds a preset threshold value, a historical index sequence is extracted from the time sequence database, a multi-index correlation is analyzed by using a causal reasoning model to determine a second abnormal root path, and a root node is obtained by traversing and judging a causal chain between indexes in an information processing link of the causal reasoning model; the interactive event processing method for emergency mode switching in the intelligent terminal realizes accurate positioning and automatic repair of an abnormal root by fusing abnormality detection, causal reasoning and a knowledge graph, and improves stability and operation and maintenance efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer technology, and in particular to an interactive event processing method for emergency mode switching in an intelligent terminal. BACKGROUND

[0002] Interaction plays a crucial role in modern information society, widely applied in financial transactions, online education, e-commerce, etc. Its stability and reliability directly affect user experience and business continuity. Real-time monitoring of interaction running status ensures stable operation in abnormal conditions, which is the core of service quality and user trust.

[0003] However, current solutions have significant limitations in dealing with complex interaction scenarios. Existing methods rely on manual intervention or preset rules for monitoring and repair, which are difficult to adapt to dynamic interaction environments, especially in high concurrency or sudden abnormal conditions. Response lag or misjudgment often leads to service interruption. In addition, existing solutions lack the ability to locate problems and automatically repair, often requiring a large amount of manual intervention, which is inefficient and costly. The core challenge is how to achieve real-time state monitoring and accurate positioning of abnormalities for interactions, while ensuring the effectiveness of automated repair. Real-time monitoring needs to dynamically capture changes in response time, error rate and resource occupation, etc. These indicators often interact in high-load scenarios. For example, a surge in resource occupation can lead to an increase in response time, which in turn causes an increase in error rate. The complex interdependence between these multiple indicators makes it difficult for a single monitoring mechanism to comprehensively cover abnormal scenarios. Furthermore, abnormal positioning and automatic repair require accurate identification of problem sources and effective measures within a short period of time. For example, in an e-commerce platform payment, if the database connection pool is exhausted, causing payment requests to timeout, not only does it need to quickly detect the abnormality, but also to automatically analyze whether it is due to insufficient connection pool configuration or external traffic attack, and try to restore service by adjusting resource allocation or isolating abnormal traffic. Existing technologies lack dynamic adaptability and automation in such scenarios, making it difficult to achieve fast and accurate abnormal handling. SUMMARY

[0004] The purpose of the present application is to provide an interactive event processing method for emergency mode switching in an intelligent terminal, which designs a mechanism that can monitor multiple dimensions of interaction in real time, accurately locate the root cause of the abnormality and automatically execute repair strategies, ensuring stable and reliable operation of interaction in emergency mode.

[0005] To achieve the above object, the application provides the following technical scheme: an interactive event processing method for emergency mode switching in an intelligent terminal, comprising the following steps: S1, storing a multi-dimensional index sequence by using a time series database, obtaining a current index sequence according to a preset sampling interval, and calculating a deviation value by an abnormality detection model to obtain a first abnormal index set; S2, if the deviation value in the first abnormal index set exceeds a preset threshold, extracting a historical index sequence from the time series database, analyzing a multi-index correlation by a causal reasoning model to determine a second abnormal root path, and obtaining a root node by traversing and judging the causal chain between indexes by the causal reasoning model; S3, querying an associated repair rule from a preset knowledge graph according to the second abnormal root path, processing the root node attribute by a rule matching engine to obtain a third repair instruction sequence; S4, executing the third repair instruction sequence by a resource allocation module, processing the database root by dynamically adjusting the size of the connection pool, obtaining an adjusted index sequence, and recalculating the deviation value by the abnormality detection model to obtain a fourth verification index set; S5, if the deviation value in the fourth verification index set is lower than the preset threshold, storing the repair process data by a log recording module, updating the multi-dimensional index sequence from the time series database, and obtaining a fifth optimized model version by optimizing the parameters of the causal reasoning model using a feedback learning mechanism; the feedback learning mechanism fuses the information processing link to batch train and judge the historical root path to determine the parameter increment; S6, according to the fifth optimized model version, expanding a new repair rule from the preset knowledge graph, processing the expanded rule by the rule matching engine to obtain a sixth rule library update, and obtaining an integrated rule set by the rule matching engine using the information processing link to judge the compatibility of the new rule and the existing path; S7, processing the subsequent collected index sequence by using the integrated rule set, and obtaining a seventh abnormality processing chain by jointly calculating the deviation value and the root path by the abnormality detection model and the causal reasoning model.

[0006] Preferably, the step S1 comprises collecting response time indexes and resource occupation indexes, storing them in the time series database, and generating a multi-dimensional index sequence; obtaining the index sequence of the preset sampling interval from the time series database to generate a current sequence data set; analyzing the current sequence data set by using the isolated forest algorithm, calculating the sequence deviation value, and obtaining a deviation value set; if the deviation value exceeds the preset threshold, extracting the sequence fluctuation characteristics by the information processing link to generate a fluctuation feature set; according to the fluctuation feature set, smoothing the sequence by using the moving average method to generate a smoothed sequence data; classifying the smoothed sequence data by using the K-means clustering algorithm to obtain an abnormal index set; and updating the monitoring rules of the time series database in real time for the abnormal index set to generate an updated monitoring strategy.

[0007] Preferably, the step S2 comprises obtaining a historical index sequence corresponding to the first abnormal index from the time series database, analyzing the dependency relationship between the sequences by using a causal inference model to obtain a causal correlation matrix, if the correlation strength of an index pair in the causal correlation matrix exceeds a preset threshold, extracting the time series features of the index pair through the information processing link to obtain a feature vector set, performing dimension reduction processing on the feature vector set by using a principal component analysis algorithm to generate a feature dataset, grouping the indexes according to the feature dataset by using a K-means clustering algorithm to obtain an abnormal index grouping set, if the variance of the indexes in the abnormal index grouping set exceeds a preset threshold, calculating the fluctuation frequency of the indexes in the group through the information processing link to obtain a fluctuation frequency set, extracting the corresponding historical index sequence from the time series database according to the fluctuation frequency set, and calculating the dynamic change trend of the sequence by using a sliding window method to obtain a trend dataset, and updating the weight parameters of the causal inference model through the trend dataset to generate an updated root node set.

[0008] Preferably, the step S3 comprises obtaining a set of associated nodes from the second abnormal root path, extracting the time series features of the nodes through the information processing link to obtain a feature vector set, performing dimension reduction processing on the feature vector set by using a principal component analysis algorithm to generate a feature dataset, querying a repair rule in a preset knowledge graph by using a rule matching engine through the feature dataset to obtain a matching rule set, if the correlation strength of a rule in the matching rule set exceeds a preset threshold, calculating the node attribute mapping of the rule through the information processing link to determine a repair instruction sequence, analyzing the time sequence execution trend of the instructions by using a sliding window method according to the repair instruction sequence to obtain a dynamic trend dataset, updating the weight parameters of the rule matching engine through the dynamic trend dataset to generate an optimized instruction priority set, and extracting the final repair instruction sequence from the preset knowledge graph according to the optimized instruction priority set to determine the execution order.

[0009] Preferably, the step S4 comprises loading the third repair instruction sequence by the resource allocation module, optimizing the database connection pool size by a dynamic adjustment strategy, generating an adjusted index sequence; extracting time sequence features from the adjusted index sequence, grouping the features by a K-means clustering algorithm to obtain a feature grouping set; if the center point of a certain group in the feature grouping set deviates from a preset threshold, calculating the abnormality degree of the group whose center point deviates from the preset threshold by the information processing link, generating an abnormality degree dataset; according to the abnormality degree dataset, classifying the abnormal groups by a support vector machine algorithm to obtain a classified abnormality set; analyzing the resource occupation state by a real-time monitoring mechanism through the classified abnormality set, generating a resource occupation trend dataset; if the peak value in the resource occupation trend dataset exceeds a preset threshold, adjusting the allocation parameters of the database connection pool by the information processing link, generating an optimized parameter set; updating the configuration of the resource allocation module according to the optimized parameter set, and judging the stable state.

[0010] Preferably, the step S5 comprises if the deviation value in the fourth verification index set is lower than a preset threshold, storing the repair process data by the log recording module to generate a repair data set; extracting time sequence features from the repair data set, and performing dimension reduction processing on the features by a principal component analysis algorithm to obtain a dimension-reduced feature set; according to the dimension-reduced feature set, obtaining a multi-dimensional index sequence from the time series database to generate a multi-dimensional index dataset; if the abnormal value in the multi-dimensional index dataset exceeds a preset threshold, performing attribution analysis on the abnormal value by the information processing link to determine an abnormal reason set; performing batch training on the abnormal reason set by a feedback learning mechanism, optimizing the causal reasoning model parameters to obtain a fifth optimized model version; performing prediction analysis on the multi-dimensional index dataset by the fifth optimized model version to generate a prediction trend set; according to the prediction trend set, adjusting the resource allocation parameters by the information processing link to determine an optimized parameter set.

[0011] Preferably, the step S6 comprises obtaining an extension rule set from a preset knowledge graph, structurally analyzing the extension rule set by the information processing link to obtain an analysis rule set; if the rule entries in the analysis rule set conflict with the existing path, performing priority sorting on the conflict entries by a rule matching engine to generate a sorted rule set; according to the sorted rule set, extracting an associated index sequence from the time series database, and performing dimension reduction processing on the index sequence by a principal component analysis algorithm to obtain a dimension-reduced index set; if the abnormal value in the dimension-reduced index set exceeds a preset threshold, performing attribution analysis on the abnormal value by the information processing link to determine an abnormal rule set.

[0012] Preferably, the step S6 further comprises parameter optimization of the sixth rule base according to the abnormal rule set by adopting a feedback learning mechanism to obtain an optimized rule set; updating the integrated rule set through the optimized rule set, consistency checking of the updated rule set by the information processing link to obtain a checked rule set; extracting new rule items from the knowledge graph according to the checked rule set to generate a final version of the sixth rule base.

[0013] Preferably, the step S7 comprises obtaining initial data from the acquisition index sequence, structuring and analyzing the data by the information processing link to obtain a structured index set; if the indexes in the structured index set deviate from the preset threshold, classifying the deviated indexes by the abnormal detection model to obtain a classified abnormal set; correlating and analyzing the abnormal indexes by the causal reasoning model according to the classified abnormal set to determine a correlation path set; parallel verifying the correlation path set by the information processing link to obtain a verified path set; if the paths in the verified path set are inconsistent with the integrated rule set, optimizing the rule set by the feedback adjustment mechanism to obtain an optimized rule set.

[0014] Preferably, the step S7 further comprises extracting new index correlations from the acquisition index sequence according to the optimized rule set to generate a complete processing chain; consistency checking of the complete processing chain by the information processing link to obtain a final processing chain.

[0015] From the above technical solutions, the present application has the following beneficial effects:

[0016] The interactive event processing method for emergency mode switching in the intelligent terminal aims at the business scene problem that multi-dimensional index abnormality is difficult to accurately locate the root cause and automatically repair. The method acquires response time and resource occupation indexes, stores multi-dimensional index sequences by using a time series database, combines an abnormal detection model to monitor sequence fluctuations in real time, calculates deviation values to generate a first abnormal index set. When the deviation value exceeds the threshold value, a causal reasoning model is used to analyze index correlations to determine an abnormal root path, and a knowledge graph and a rule matching engine are used to generate a repair instruction sequence to dynamically adjust resource allocation to handle the root problem. After repair, the indexes are verified again, the causal reasoning model and the rule base are optimized, and a closed-loop feedback mechanism is constructed. The present application realizes accurate positioning and automatic repair of abnormal roots by the fusion of abnormal detection, causal reasoning and knowledge graph, and improves stability and operation and maintenance efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 The present application is a method flowchart. DETAILED DESCRIPTION

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, the present invention provides a technical solution: an interactive event processing method for emergency mode switching in a smart terminal, comprising: step S1, storing multi-dimensional indicator sequences using a time-series database, obtaining the current indicator sequence according to a preset sampling interval, and calculating the deviation value through an anomaly detection model to obtain a first set of abnormal indicators; step S2, if the deviation value in the first set of abnormal indicators exceeds a preset threshold, extracting historical indicator sequences from the time-series database, analyzing the multi-indicator correlation relationship through a causal reasoning model to determine a second abnormal root cause path, and using the causal reasoning model to traverse and judge the causal chain between indicators to obtain the root cause node; step S3, querying the association repair rules from a preset knowledge graph according to the second abnormal root cause path, and processing the root cause node attributes through a rule matching engine to obtain a third repair instruction sequence; step S4, executing the third repair instruction sequence using a resource allocation module, and processing the database root cause by dynamically adjusting the connection pool size to obtain the adjustment... After refining the indicator sequence, the deviation value is recalculated through the anomaly detection model to obtain the fourth verification indicator set; Step S5: If the deviation value in the fourth verification indicator set is lower than the preset threshold, the repair process data is stored through the log recording module, the multi-dimensional indicator sequence is updated from the time series database, and the parameters of the causal inference model are optimized using a feedback learning mechanism to obtain the fifth optimized model version. The feedback learning mechanism integrates the information processing link to perform batch training and judgment on the historical root path to determine the parameter increment; Step S6: According to the fifth optimized model version, new repair rules are expanded from the preset knowledge graph, and the expanded rules are processed through the rule matching engine to obtain the sixth rule base update. The rule matching engine uses the information processing link to judge the compatibility between the new rules and the existing paths to obtain the integrated rule set; Step S7: The integrated rule set is used to process the subsequent collected indicator sequences, and the deviation value and root path are jointly calculated through the anomaly detection model and the causal inference model to obtain the seventh anomaly processing chain.

[0020] The method is based on a time series database to sample and store multi-dimensional indicators in the running process of intelligent terminals in real time, uses an anomaly detection model to calculate deviation values of the sampled data to quickly identify abnormal indicators in the current running state. When the detected abnormal deviation exceeds the threshold, the causal reasoning model will perform correlation analysis on the historical indicators to extract potential abnormal propagation paths, and lock the root node of the problem by traversing the causal chain. Subsequently, according to the pre-set repair rules in the knowledge graph, the repair instructions for the root problem are matched and generated, which are executed by the resource allocation module, for example, adjusting the size of the database connection pool to quickly relieve performance bottlenecks. After repair, the effect is verified again through anomaly detection, if the performance returns to normal, the repair process and results are recorded to the log and fed back to the model training mechanism to optimize the causal reasoning parameters. The optimized model can extend new repair rules and integrate them into the rule library through rule compatibility analysis, realizing adaptive subsequent anomaly processing and ensuring the efficiency and stability of the emergency mode switching process.

[0021] The method can realize a closed-loop processing flow from anomaly detection, root cause analysis, repair instruction generation to model optimization, compared with the traditional method which only relies on manual positioning and repair, significantly improving the automation degree and processing efficiency of emergency response. By locking the root problem through the causal reasoning model and matching the repair rules with the knowledge graph, the situation of misjudgment and repeated repair can be effectively reduced. At the same time, the feedback learning mechanism can continuously optimize the reasoning and repair strategies after processing multiple similar anomalies, improving the stability and adaptability of long-term operation. The dynamic resource adjustment scheme can also quickly relieve performance bottlenecks without affecting business continuity, reduce downtime risks, and improve availability and security.

[0022] Steps S1-S2 collect and detect multi-dimensional index sequences through a time series database, and determine deviation values and root path by using an anomaly detection model and a causal reasoning model. This process corresponds to real-time monitoring of interaction events and identification of abnormal triggering conditions by the intelligent terminal during operation, which is a prerequisite for entering the emergency mode. Steps S3-S4 query repair rules in the knowledge graph according to the root path, and generate a repair instruction sequence for execution, which is equivalent to the intelligent terminal taking interaction processing measures such as resource scheduling and task reallocation according to the abnormal type after entering the emergency mode, to realize immediate response in the emergency state. Steps S5-S6 update the causal reasoning model and the rule base through log recording and feedback learning mechanism, so that the intelligent terminal can gradually optimize the decision logic according to the historical interaction and processing result after switching to the emergency mode, to ensure the adaptability and robustness of the emergency mode. Finally, step S7 applies the updated integrated rule set to subsequent index sequences to realize continuous anomaly detection and emergency processing link, thereby ensuring stable mode switching of the terminal in various complex environments. The whole process not only covers the discovery, judgment, rule matching and execution of abnormal events, but also realizes closed-loop management of interaction events in the emergency mode through feedback optimization, which can ensure the stable operation of the intelligent terminal and the continuity of user interaction in the emergency state.

[0023] Step S1 includes collecting response time indicators and resource occupation indicators, storing them in a time series database, and generating multi-dimensional index sequences; obtaining index sequences of a preset sampling interval from the time series database to generate a current sequence data set; analyzing the current sequence data set using the Isolation Forest algorithm, calculating sequence deviation values, and obtaining a deviation value set; if the deviation value exceeds a preset threshold, extracting sequence fluctuation features through an information processing link to generate a fluctuation feature set; smoothing the sequence using the moving average method according to the fluctuation feature set to generate a smoothed sequence data; classifying the smoothed sequence data using the K-means clustering algorithm to obtain an abnormal index set; and updating the monitoring rules of the time series database in real time for the abnormal index set to generate an updated monitoring strategy.

[0024] First, the intelligent terminal collects response time indicators and resource occupation indicators at a fixed sampling frequency. The two types of indicators are recorded as numerical time series, each record containing a terminal identifier, a timestamp, a response time value, and a resource occupation value. The time series database is written in chronological order to form a multi-dimensional index sequence. Then, the index sequences within the observation window are extracted from the time series database at a preset sampling interval to form a current sequence data set. The observation window is divided into several equal-length segments in chronological order, and each segment covers several records.

[0025] Isolation forest algorithm modeling and scoring on current sequence dataset: In the modeling stage, random subsampling is performed from the dataset, and several binary split trees are constructed. Each split is performed on a randomly selected index dimension and separates the samples into left and right branches according to a random threshold, until the samples are single or the maximum split depth is reached. In the scoring stage, the path length to the leaf node is calculated for each new data. The shorter the path, the easier it is to be isolated. The abnormal score is calculated based on the path length and the number of trees, and standardized to a deviation value, resulting in a deviation value set.

[0026] Threshold determination is performed on the deviation value set. When any deviation value exceeds the preset threshold, the information processing link is entered. In the information processing link, sequence fluctuation features are extracted from the original sequence corresponding to the deviation value. The fluctuation features include short-term fluctuation amplitude, short-term average change rate, peak-to-valley interval, continuous rising duration, continuous falling duration, and short-term variance. The extraction method is to calculate the above quantities in the sliding window and output the same length feature sequence, forming a fluctuation feature set.

[0027] After obtaining the fluctuation feature set, moving average smoothing is performed on the original sequence and the feature sequence. The arithmetic mean in the sliding window is taken as the smoothing value, and the window is generated by sliding step by step to generate a smoothed sequence data. Then, the K-means clustering algorithm is performed on the smoothed sequence data. In the initialization stage, several initial centers are selected from the data in a distance dispersion manner. In the iteration stage, each sample is assigned to the cluster containing the nearest center according to the principle of minimizing the sum of squared differences, and the center is updated by the arithmetic mean in each cluster at the end of each round. When the center movement changes less than the convergence threshold or reaches the maximum iteration round, the iteration is ended, and the cluster to which each data belongs and the center of each cluster are output.

[0028] According to the clustering results, the abnormal cluster is marked. The abnormal cluster determination criteria are that the cluster center corresponds to a high deviation value, the sample size in the cluster is less than a certain proportion of the total sample, and the fluctuation feature corresponding to the cluster shows high amplitude or long-term abnormal change. Finally, the data corresponding to the abnormal cluster is marked as an abnormal index set. For these abnormal indexes, the monitoring rules in the time series database will be dynamically updated to form an optimized monitoring strategy for subsequent collection and determination.

[0029] The sampling interval is a fixed time length between single collections. The determination method is to read the historical records of the latest consecutive days in the timing database before deployment, to calculate the missing rate, short-time variance and peak capture rate of the response time and resource occupancy under different sampling intervals respectively, to select the minimum sampling interval that meets the stability of the missing rate below the set proportion, the short-time variance drop amplitude and the peak capture rate, and to take the final value. The observation window length is the time span of the current sequence data set, and the determination method is to ensure that the window contains at least several business cycles and the sample size of the isolated forest subsampling reaches the preset scale, and to take the minimum length that can cover the complete business cycle without introducing expired data. The number of isolated forest trees is the number of split trees participating in scoring, and the determination method is to perform grid evaluation on historical data with different tree numbers, and to select the value that balances the stability indicators and computing overhead. The maximum split depth is the maximum number of layers of a single split tree, and the determination method is to set an upper limit according to the order of magnitude of the sample size and verify it on historical data, to ensure that noise amplification caused by excessive splitting does not occur. The subsampling size is the number of random samples for training each tree, and the determination method is to ensure that each tree has sufficient diversity and representativeness, and the total computing time is within an acceptable range. The deviation value is the normalized value of the anomaly score output by the isolated forest after interval mapping, and the value range is fixed in the closed interval from the minimum value to the maximum value, and the larger the value, the higher the abnormality. The preset threshold is the numerical boundary for determining whether to enter the information processing link, and the determination method is to select the upper limit of the deviation value distribution of the business anomaly-free period on historical data and add a safety margin, so that the probability of normal data crossing the threshold is lower than the set proportion, and the proportion of abnormal data crossing the threshold is not lower than the set proportion.

[0030] The sliding window length is the window size for fluctuation feature extraction and moving average smoothing, and the determination method is to compare the influence of different window lengths on short-time noise suppression and mutation preservation on historical data, to select the length that achieves the optimal trade-off between the two, and to maintain an integer multiple relationship with the sampling interval. The step length is the time span of the sliding window moving each time, and the determination method is to set it as the sampling interval to avoid missing any sampling point. The thresholds of each item of the fluctuation feature are the boundaries for mapping the feature value to the abnormal signal, and the determination method is to obtain the upper and lower limits of the feature on historical normal data and add a safety margin. The generation of the smoothed sequence does not introduce new parameters, and is determined only by the sliding window length and the step length. The number of clusters of mean clustering is the number of categories that need to be divided, and the determination method is to compare offline on historical data with the sum of silhouette scores and intra-cluster sum of squares as evaluation indicators, to select the position that achieves a relatively optimal balance between the two indicators, and to keep consistent with the number of business states that can be distinguished in the monitoring rules. The maximum iteration round and the convergence threshold are used for the clustering stop condition, the former is determined as the minimum number of iterations required for convergence on historical data plus a safety margin, and the latter is determined as the change of the center between two rounds being less than the set proportion.

[0031] The high position interval boundary used for anomaly cluster determination is the upper quantile point of the deviation value distribution, and the upper limit of the cluster size is the total sample multiplied by a set proportion, both of which are determined offline from historical data. The alarm threshold in the monitoring rule is taken from the center of the anomaly cluster or the upper quantile point in the anomaly cluster and added with a safety margin, the continuous triggering number condition is obtained by converting the lower quantile point of the anomaly duration distribution, the alarm suppression interval is set by the upper quantile point of the historical false alarm interval distribution, and the adjustment value of the observation window length and the sampling interval is calculated from the short-time variance change rate and the peak density before the anomaly occurs, so as to strengthen the capture of rapid fluctuations in subsequent sampling.

[0032] The collection step triggers the collection task at a fixed sampling interval by the terminal, reads the original values of the response time and resource occupation respectively, writes the terminal identifier and timestamp into the index table of the time series database, and the fields are terminal identifier, timestamp, response time, and resource occupation in turn, and takes the timestamp and terminal identifier as a composite index to ensure the order and retrievability. The step of generating the current sequence dataset obtains the continuous records in the observation window according to the start time and end time range by a query statement, loads them into the memory data structure in ascending order of time, and interpolates the missing records according to the last valid value to maintain equal intervals. The isolated forest analysis step first randomly extracts an equal number of subsamples from the current sequence dataset to construct a number of split trees, each tree randomly selects a dimension from the root node and randomly selects a split threshold in the value range of the dimension, and divides the samples into left and right branches, and repeats the process until the sample is single or reaches the maximum split depth. After modeling is completed, each record in the window is sequentially dropped to the leaf node of each tree, the path length is counted and the original anomaly score is obtained by averaging all trees, and the score is normalized by the minimum value and the maximum value to obtain the deviation value set. The threshold determination step scans the deviation value set in order, and as soon as any deviation value exceeds the preset threshold, it enters the information processing link and records the time position corresponding to the deviation value. The information processing link calculates the fluctuation characteristics in the sliding window centered on the time position: the short-time fluctuation amplitude takes the difference between the maximum and minimum values in the window, the short-time average change rate takes the window average of the difference between adjacent sampling points, the peak-to-valley interval takes the time difference between the nearest peak and valley, the continuous rising duration and the continuous falling duration are obtained by counting the continuous length of the adjacent difference sign, and the short-time variance is obtained by averaging the squared difference between the window value and the window average. Each feature is output point by point as the window slides to form the fluctuation feature set. The smoothing processing step takes the arithmetic mean in each window as the smoothed value at the end time point of the window under the same window length and step, thereby generating a smoothed sequence data with the same frequency as the original sequence.

[0033] The mean clustering step first selects several initial centers in a distance dispersion manner, and then performs iteration. In each round, the sum of squared differences of each smooth data to each center is calculated and classified into the cluster where the nearest center is located, and after classification, the arithmetic mean of the data in each cluster is calculated to obtain new centers. The difference between the new and old centers is compared, and when the difference is lower than the convergence threshold or the maximum iteration round is reached, the cluster label of each data and the cluster center are output. The generation step of the anomaly indicator set takes whether the deviation value corresponding to the cluster center is located in the high interval, whether the cluster size is lower than the size upper limit, and whether the fluctuation feature shows high amplitude or long time anomaly as the criterion. If all the criteria are met, the cluster is identified as an anomaly cluster, and the indicator name corresponding to the cluster is added to the anomaly indicator set. The time series database monitoring rule updating step writes new rules in a transaction manner, including setting new alarm thresholds for the indicator, setting continuous trigger number conditions, setting alarm suppression intervals, setting new observation window lengths and sampling intervals, and writing effective times. After the transaction is committed, the new rule is immediately used for subsequent collection and judgment, forming the updated monitoring strategy.

[0034] Step S2 includes obtaining the historical indicator sequence corresponding to the first anomaly indicator from the time series database, analyzing the dependency relationship between the sequences using a causal reasoning model to obtain a causal correlation matrix; if the correlation strength of a certain indicator pair in the causal correlation matrix exceeds a preset threshold, extracting the time series features of the indicator pair through the information processing link to obtain a feature vector set; using principal component analysis algorithm to reduce the dimension of the feature vector set to generate a feature data set; using K-means clustering algorithm to group the indicators according to the feature data set to obtain an anomaly indicator grouping set; if the variance of the indicators in the anomaly indicator grouping set exceeds a preset threshold, calculating the fluctuation frequency of the indicators in the group through the information processing link to obtain a fluctuation frequency set; according to the fluctuation frequency set, extracting the corresponding historical indicator sequence from the time series database, and using the sliding window method to calculate the dynamic trend of the sequence to obtain a trend data set; updating the weight parameters of the causal reasoning model through the trend data set to generate an updated root node set.

[0035] After detecting the first anomaly indicator, historical indicator sequence data is extracted from the time series database according to the identifier of the anomaly indicator and a preset observation period. The selected observation period needs to cover one complete business cycle before and after the anomaly occurs to ensure the integrity of the data. At the same time, the historical sequences of other indicators that have business association with the anomaly indicator are also extracted synchronously. All data are arranged in ascending order of timestamp, and missing points are filled with previous values to maintain the equal interval characteristics of the time series. Then the sorted historical data set is input into the causal reasoning model for analysis. The model calculates the directional dependence of each pair of indicator sequences. The specific method is to establish baseline prediction and out-of-band prediction under multiple fixed time delays, and calculate the difference between the prediction errors of the two, which represents the directional dependence strength under the corresponding delay.

[0036] The model selects the maximum dependence strength among all time delays as the causal relationship strength of the indicator pair, and fills the result into the causal relationship matrix, with the row and column of the matrix being the indicator names, and the numerical value of the cell being the causal relationship strength of the indicator pair. When the causal relationship strength of any indicator pair in the matrix is greater than or equal to the set correlation strength threshold, the information processing link is entered, and the original time series of the indicator pair is extracted, including position characteristics, discrete characteristics, extreme value characteristics, and morphological characteristics. The position characteristics include mean and median, the discrete characteristics include variance and short-time variance, the extreme value characteristics include peak value number, valley value number, and peak-valley interval, and the morphological characteristics include continuous rising time, continuous falling time, mutation number, and short-time change rate. All characteristics are calculated in a fixed length and fixed step sliding window, and the output is a feature vector set. The set is then input into the principal component analysis process, the covariance matrix is calculated and eigenvalue decomposition is performed, the eigenvalues are sorted from large to small and accumulated until the variance contribution rate reaches the set threshold, the corresponding principal component direction is selected, and the original feature vector is projected into the principal component space to obtain the reduced feature data set.

[0037] Then, K-means clustering is performed on the feature data set, the initial center is selected by the distance dispersion method, and then sample assignment and center update are iteratively performed until the center movement is less than the convergence threshold or the maximum iteration round is reached, and finally the abnormal indicator grouping set is obtained. For each group in the grouping set, the intra-group variance is calculated, and if the variance is greater than or equal to the set variance threshold, the fluctuation frequency calculation link is entered, and the number of value direction switches in the fluctuation frequency window is counted for each indicator sequence in the group and divided by the time length to obtain the fluctuation frequency value and aggregate it into a fluctuation frequency set. Subsequently, the historical sequences of the corresponding indicators are extracted from the time series database according to the fluctuation frequency set, and the dynamic change trend values are calculated by sliding with a fixed sliding window length and step, with the trend value being the window end value minus the window start value and then divided by the window span time, covering the entire time range to form a trend data set. Finally, the trend data set is input into the causal reasoning model, the corresponding weights in the causal relationship matrix are updated by adding or subtracting according to the weight adjustment proportion mapped by the trend value, after the update, the causal chain traversal is performed, the nodes with the highest weight and consistent path are selected, the updated root node set is generated and output for subsequent emergency handling.

[0038] The fusion information processing link of the causal inference model takes the indicators in the first abnormal indicator set whose deviation values exceed the threshold value as the entrance, reads all indicator sequences that have historical correlations with these entrance indicators from the time series database, takes the time range as the last 30 days, unifies the sampling interval to 1 second, fills in the missing points by linear interpolation, and then performs denoising processing, the denoising method is 3-point median filtering; then, all indicator sequences are windowed with a window of 300 seconds and a step of 10 seconds, the directional influence degree from the former to the latter is calculated for each pair of candidate indicators, the lag range is set to 1 second to 60 seconds, the directional influence degree is composed of three parts, respectively, the error reduction proportion of the former cause lag sequence to the change in the latter cause window, the stability of the same direction at different lag values, and the frequency proportion of the simultaneous occurrence of the two abnormalities in the same window, the three parts are weighted to obtain the weight of a single causal edge, and the lower limit of the error reduction proportion is set to 0.2, the lower limit of the stability is set to 0.6, and the lower limit of the simultaneous occurrence frequency is set to 0.4, any one that does not meet the requirements is discarded; the remaining causal edges are verified according to the time sequence, and the abnormal time of the cause must be at least 1 second earlier than the abnormal time of the effect, if not, the edge is removed and recorded as a conflict sample; after completing the traversal of all windows and lags, a directional weighted causal graph is generated, in which the nodes are indicators, the edges are causal relationships filtered, and the edge weight is the time average of the above weighted results; in order to fuse multi-source information, the system normalizes three types of information to the range of 0 to 1, the three types of information are the percentile ranking of the deviation value of each indicator in the current window, the proportion of the number of historical support times of the indicator as a starting edge in the past 30 days, and the average value of the edge weight of the indicator with all other indicators in the current window, the average value of the edge weight means that for a node (i.e. an indicator), take the weight value of the edge connected to it in the current time window with all other indicators, and then take the average value.The three are weighted by 4:3:3 to obtain node activation; on this basis, the causal chain traversal is performed, the traversal strategy is bounded depth-first search, which expands outward along the causal direction from each entry indicator, the maximum depth is 4, the maximum path number of single traversal is 1000, and the visited node is immediately truncated to avoid loops; the score of each path is the average value of all edge weights on the path multiplied by the length penalty coefficient, the length penalty coefficient is 1 divided by the path length, and then multiplied by the starting node activation to obtain the path comprehensive score; all paths of all entry indicators are sorted according to the comprehensive score, and the top 10 path set is selected as the candidate root path set; the system then performs root candidate screening, the screening rules are: the number of incoming edges of the path starting node is less than or equal to 1 and the number of outgoing edges is greater than or equal to 2, or the starting node is labeled as a starting point in the past 30 days Support times greater than or equal to 3, and the comprehensive score of the path is in the top 20 percent of the candidate root path set; the starting node that meets the rules is listed as a root candidate node; in order to ensure robustness, the system plays back 5 adjacent windows forward and backward around the candidate node, corresponding to 11 window root source judgment results, if at least 9 window root source judgments are consistent, the consistency rate is 0.82, which is considered to pass the robustness check; if the consistency rate is less than 0.8, the candidate is abandoned and the next candidate path is turned to; when there are multiple candidates that pass the robustness check, they are sorted from high to low according to the comprehensive score, if the score difference between the highest and the second highest is less than 0.05, the one with higher historical support times is selected as the root node, otherwise the one with the highest score is selected as the root node; the final output root node and the optimal root path corresponding thereto, and the key parameters used for judgment are recorded for subsequent feedback learning, including sampling interval 1 second, window length 300 seconds, step 10 seconds, lag range 1 second to 60 seconds, error reduction ratio lower limit 0.2, stability lower limit 0.6, simultaneous occurrence frequency lower limit 0.4, edge weight weight ratio 5:3:2, node activation weight ratio 4:3:3, maximum depth 4, maximum path number 1000, candidate path reservation number 10, candidate path top 20 percent threshold, historical support times threshold 3, consistency rate threshold 0.8 and score difference threshold 0.05; the above thresholds are determined by the percentile statistics of historical event samples and the false positive rate and hit rate of the offline verification set.

[0039] The observation period is used to determine the extraction range of historical data, and its value should be able to cover at least one complete business cycle, while ensuring that the sample size in the causal reasoning and clustering process meets the minimum analysis requirements. The correlation strength threshold is used to determine whether to enter the feature extraction link, and its value is the high quantile of the causal strength distribution of the historical normal interval plus a fixed safety margin, and ensures that the proportion of historical known anomalies exceeding the threshold is not lower than the set recall rate. The sliding window length is used for feature extraction and trend calculation, and the value is determined by testing the comprehensive effect of different window lengths on mutation capture rate and random noise suppression rate in historical data, and selecting the value with the highest comprehensive score and an integer multiple of the sampling interval. The sliding step is the time interval of window movement, and is fixed as the sampling interval to ensure that no sampling point is missed. The mutation threshold is used to determine whether the difference between adjacent sampling points constitutes a mutation, and its value is the high quantile of the adjacent difference distribution of the historical normal interval plus a fixed safety margin. The variance threshold is used to determine whether the fluctuation of the index within the group is significant, and its value is the high quantile of the variance distribution of the historical normal group plus a fixed safety margin. The variance contribution rate threshold is used for principal component selection in principal component analysis, and its value is the proportion corresponding to the optimal clustering stability and intra-class compactness in historical data. The cluster number is the number of categories of K-means clustering, and its value is the comprehensive optimal value of the sum of the silhouette coefficient and the intra-class sum of squares in historical data and does not exceed the number of actual distinguishable business states. The maximum iteration round is the maximum number of iterations allowed for clustering, and its value is the number of rounds required for convergence of historical data plus a fixed margin. The convergence threshold is the stopping condition for the displacement of cluster centers, and its value is the minimum displacement corresponding to stable category assignment. The fluctuation frequency window is used to count the number of direction switches, and its value should cover at least one typical fluctuation period. The trend window and the trend step are equal to the sliding window length and the sliding step respectively, to ensure the consistency of time series processing. The weight adjustment ratio is the increase or decrease ratio of each causal weight update, and its value is verified in historical data to be able to improve the root cause positioning accuracy and not to damage the stability of the causal chain, and the upper and lower limits of the weight are set to prevent value overflow.

[0040] In the historical sequence acquisition stage, the corresponding records are pulled through the time series database interval query interface with the abnormal index identifier and the start and end time of the observation period as conditions, and the data of the business-related indicators are pulled synchronously. The results are arranged in ascending order of timestamp and the last valid value is used to fill in the missing positions. The calculation of the causal correlation matrix is performed by traversing the indicator pairs. The baseline prediction and the prediction with external influence are constructed respectively at multiple fixed time delays. The baseline prediction uses the historical values of the explained indicators as input, and the prediction with external influence adds the lag values of another indicator as additional input on this basis. The prediction errors of the two are calculated respectively. The error reduction ratio is obtained by subtracting the external influence error from the baseline error and dividing the baseline error. The maximum value among all time delays is taken as the directional dependence strength of the indicator pair and filled into the corresponding position of the causal correlation matrix. In the judgment stage, the strength values in the matrix are checked in turn. If it is greater than or equal to the correlation strength threshold, the indicator pair is sent to the feature extraction link. In the feature extraction process, the mean, median, variance, short-term variance, peak value number, valley value number, peak-valley interval, continuous rising duration, continuous falling duration, mutation number, and short-term change rate are calculated in a sliding window. The calculation results are arranged in a fixed order to form a feature vector set. In the principal component analysis stage, the covariance matrix of the feature set is calculated first. The eigenvalue decomposition is performed and the principal components are selected according to the variance contribution rate threshold. The original feature vector is projected to generate a reduced dimension feature dataset. In the K-means clustering stage, the initial center is selected using the distance dispersion method. Iterative sample assignment and center updating are performed until the convergence threshold is met or the maximum iteration round is reached. In the grouping variance determination stage, the intra-group variance is calculated and compared with the variance threshold. If it exceeds the threshold, the direction switching frequency of each indicator in the group within the fluctuation frequency window is counted and the fluctuation frequency is calculated. In the trend calculation stage, the trend value is calculated using the trend window and trend step sliding. The trend dataset is formed by covering the entire sequence. In the causal weight update stage, the weights in the causal correlation matrix are adjusted according to the trend value and the fluctuation frequency, and are limited within the upper and lower limits. After the update, the causal chain traversal is performed, and the node set with the highest weight and consistent path is output as the updated root node set.

[0041] Step S3 includes obtaining a set of associated nodes from the second abnormal root path, extracting the time sequence characteristics of the nodes through the information processing link to obtain a set of feature vectors; using a principal component analysis algorithm to reduce the dimension of the set of feature vectors to generate a feature data set; using the feature data set, a rule matching engine queries the repair rules in the preset knowledge graph to obtain a set of matching rules; if the correlation strength of a rule in the set of matching rules exceeds a preset threshold, the node attribute mapping of the rule is calculated through the information processing link to determine a repair instruction sequence; according to the repair instruction sequence, the sliding window method is used to analyze the time sequence execution trend of the instruction to obtain a dynamic trend data set; the weight parameters of the rule matching engine are updated through the dynamic trend data set to generate an optimized instruction priority set; according to the optimized instruction priority set, the final repair instruction sequence is extracted from the preset knowledge graph to determine the execution order.

[0042] After entering this step, the set of associated nodes is read from the second abnormal root path, and the historical time sequence of each node is extracted from the time sequence database in order according to the node identifier, all sequences are arranged in ascending order of timestamp and filled with the latest valid value to ensure equal interval sampling. In the fixed length and fixed step sliding window, the position feature, discrete feature, extreme value feature and morphological feature of each node sequence are calculated window by window. The position feature includes mean and median, the discrete feature includes variance and short-term variance, the extreme value feature includes maximum, minimum, peak value number, valley value number and peak valley interval, and the morphological feature includes continuous rising time, continuous falling time, mutation number and short-term change rate; each window outputs a set of determined feature values, all windows are spliced in time sequence as the feature vector sequence of the node, and the vectors of all nodes are combined into a set of feature vectors.

[0043] The principal component analysis is performed on the set of feature vectors. First, the cooperative variation measure between the features is calculated and decomposed, the feature importance is sorted from large to small and accumulated to reach the variance contribution rate threshold, the corresponding principal component direction is selected, and each feature vector is mapped to the selected principal component space in a linear projection manner to output the reduced feature data set. The rule matching engine receives the feature data set, and each rule in the preset knowledge graph includes the fields of precondition feature, applicable range, parameter value interval and historical effectiveness statistics. The engine calculates the correlation strength of each rule with the target node, and the correlation strength is obtained by weighting the feature similarity score and the historical effectiveness score by a fixed weight, wherein the feature similarity score is converted into similarity by comparing the normalized distance between the target node principal component coordinates and the rule precondition principal component coordinates, and the historical effectiveness score is derived from the success rate statistics of the rule in the same or similar scene in the knowledge graph. When the correlation strength of a rule is greater than or equal to the correlation strength threshold.

[0044] The rule execution node attribute mapping is performed in the information processing link. The original characteristic value of the node is matched with the rule parameter mapping table item by item to determine the instruction type, parameter value and execution condition. A determined repair instruction sequence is generated according to the time correlation and the dependence order. Then, the sliding window analysis is performed on the historical execution record of the repair instruction sequence. The execution frequency, average execution delay, execution success rate and abnormal rollback rate are calculated in each window. The trend values are obtained by integrating the fixed weights. The window is pushed along the time axis until all records are covered. The output is a dynamic trend data set. The rule matching engine receives the dynamic trend data set. The internal weight of each instruction type is updated numerically. The weight of the instruction with high trend value, low average delay and high success rate is increased. The weight of the instruction with low trend value, high average delay or low success rate is reduced. All weights are limited within the preset boundary. After the update is completed, the engine generates an optimized instruction priority set. According to the set, the executable repair instructions are extracted from the knowledge graph again. The instructions are sorted in descending order of priority. When the same priority is encountered, the dependence order is expanded according to the rule precedence relationship field first, and then arranged in descending order of association strength. The output is the final repair instruction sequence and the execution order.

[0045] The sliding window length is used for the time span of feature extraction and trend analysis, the determination method is to compare the comprehensive score of mutation capture rate, random noise suppression rate and calculation time consumption on historical data with different lengths, and the minimum length that is the integer multiple of the sampling interval and has the highest comprehensive score is selected; the sliding step is the time interval of window movement, which is fixedly set as the sampling interval to ensure covering each sampling point; the variance contribution rate threshold is used for the cumulative proportion of principal component selection, the determination method is to compare the comprehensive performance of rule search accuracy and sorting stability under different proportions on historical data, and the minimum proportion that meets the stable interval of both indicators is selected; the correlation strength threshold is the numerical boundary of whether the rule enters the node attribute mapping link, the determination method is to take the high quantile point of the correlation strength distribution in the historical normal operation interval and add a fixed safety margin, and at the same time, the proportion of exceeding on the known effective rule is checked not to be lower than the set recall rate; the feature similarity weight and the historical effectiveness weight are the component weights of the correlation strength, the determination method is to perform grid evaluation on historical samples with rule hit accuracy as the target and take the weight combination with the highest accuracy; the node attribute mapping table is generated offline by the knowledge graph, and the parameter interval and the feature interval are one-to-one corresponding, the determination method is to perform segmented statistics on the corresponding relationship between parameters and features in the historical effective samples and take each stable interval as the mapping interval; the trend synthesis weight is used to synthesize execution frequency, average delay, success rate and abnormal rollback rate into a single trend value, the determination method is to search for weights with the criterion of double-target improvement of disposal time and success rate in the final execution order and select the minimum weight set that can shorten disposal time and improve success rate at the same time; the weight adjustment proportion is used to update the increase and decrease amplitude of the weight in the rule matching engine, the determination method is to make the minimum effective increment that makes the ranking converge and does not oscillate in historical playback, and set the upper limit of weight and the lower limit of weight to avoid numerical overflow; the priority level number is the discrete number of instruction priority levels, the determination method is to ensure that instructions in the same layer can be scheduled in parallel and the difference between layers is enough to distinguish the order, and the minimum number of layers is selected; the dependency order field is maintained by the knowledge graph, which records the precedence and posteriority relationship between instructions, and the field is strictly followed during sorting to ensure executability; the abnormal rollback rate threshold is used to mark high-risk instructions, the determination method is to take the high quantile point of the rollback proportion in historical execution and add a fixed safety margin, when the rollback rate of a certain instruction in the trend window is not lower than the threshold, the weight of the instruction is adjusted downward by the adjustment proportion.

[0046] The node set acquisition reads a node identification list directly from a data structure of the second abnormal root path, and calls a time series database interface to batch pull the historical sequence of each node with a time range parameter. The query result is arranged in ascending order of timestamp, and the missing points are filled with the latest valid value. The feature extraction moves a sliding window on each node sequence from the starting time to the rear in sections, calculates the mean and median in each window as the position feature, calculates the square difference average of each point in the window relative to the mean of the window as the variance, calculates the square difference average of the short-time difference in the window as the short-time variance, takes the maximum and minimum values in the window as the extreme value, counts the number of peak values and valley values and calculates the time interval of the nearest pair of peak and valley, counts the number of consecutive points with positive difference value between adjacent sampling points and multiplies the sampling interval to obtain the continuous rising time length, counts the number of consecutive points with negative difference value between adjacent sampling points and multiplies the sampling interval to obtain the continuous falling time length, counts the number of times that the absolute value of the difference value between adjacent sampling points is not less than the mutation threshold as the mutation times, calculates the window average of the difference value between adjacent sampling points as the short-time change rate, concatenates all the features into a feature vector in a fixed order, and outputs the feature vector to the feature vector set.

[0047] The principal component analysis calculates the collaborative change measure of all feature vectors and decomposes the feature importance from large to small, accumulates to the threshold of variance contribution rate to determine the number of principal components, and linearly projects each feature vector to the principal component space to form the reduced dimension feature data set; in the rule retrieval stage, the rule matching engine reads the rule precondition features in the knowledge graph one by one and calculates the normalized distance with the principal component coordinates of the target node, converts the distance into similarity and weights the historical effectiveness recorded in the knowledge graph according to the corresponding weight as the association strength, and generates a matching rule set; in the threshold determination stage, the matching rule set is compared with the association strength threshold one by one, when the strength is not lower than the threshold, the node attribute mapping is entered, the node original feature value is substituted into the parameter mapping table in the knowledge graph, the instruction type, parameter value and execution condition are output one by one, and the repair instruction sequence is formed according to the dependency field; in the trend analysis stage, the start time, end time, execution result and rollback flag of each instruction are read from the historical execution record, the execution frequency, average execution delay, execution success rate and abnormal rollback rate in each window are calculated according to the trend window and trend step, and the single trend value is synthesized according to the trend synthesis weight, and the dynamic trend data set is output in sequence; in the weight updating stage, the rule matching engine aggregates the trend value according to the instruction type, when the trend value of a certain type in the window is high, the average delay is low, the success rate is high, and the abnormal rollback rate is lower than the abnormal rollback rate threshold, the weight of the type is adjusted by the weight adjustment proportion and does not exceed the weight upper limit, when the trend value is low or the average delay is high or the success rate is low or the abnormal rollback rate is not lower than the threshold, the weight of the type is adjusted by the weight adjustment proportion and does not exceed the weight lower limit, and the optimized instruction priority set is output after the weight of all types is updated; in the final sorting stage, the execution order is generated from high to low according to the priority, the execution chain is expanded according to the precondition relationship field of the knowledge graph in the same priority layer, and the final repair instruction sequence is obtained and submitted to the subsequent step.

[0048] The step S4 comprises loading the third repair instruction sequence by the resource allocation module, optimizing the database connection pool size by the dynamic adjustment strategy to generate an adjusted index sequence; extracting a time sequence feature from the adjusted index sequence, grouping the feature by using the K-means clustering algorithm to obtain a feature grouping set; if the center point of a group in the feature grouping set deviates from a preset threshold, calculating the abnormal degree of the group whose center point deviates from the preset threshold by the information processing link to generate an abnormal degree data set; classifying the abnormal group by using the support vector machine algorithm according to the abnormal degree data set to obtain a classified abnormal set; analyzing the resource occupation state by using the real-time monitoring mechanism through the classified abnormal set to generate a resource occupation trend data set; if the peak value in the resource occupation trend data set exceeds the preset threshold, adjusting the allocation parameters of the database connection pool by the information processing link to generate an optimized parameter set; updating the configuration of the resource allocation module according to the optimized parameter set, and judging the stable state.

[0049] When the third repair instruction sequence is loaded, the resource allocation module reads each instruction in turn and extracts the parameter target, adjustment direction and adjustment amplitude related to the connection pool, reads the current active connection number, waiting queue length, connection acquisition timeout proportion, connection utilization rate, idle connection proportion and average request delay from the internal index interface, and compares them with the target interval item by item. When the connection utilization rate is higher than the target upper limit or the connection acquisition timeout proportion and the average request delay are close to the limit threshold, the maximum connection number is increased by the maximum connection number increment and ensured not to exceed the maximum connection number upper limit. When the connection utilization rate is lower than the target lower limit and the idle connection proportion is higher than the target upper limit, the maximum connection number is decreased by the maximum connection number decrement and ensured not to be lower than the minimum allowed value. At the same time, it is checked whether the minimum connection number is less than the minimum connection number lower limit after each adjustment, and the minimum connection number is increased when necessary to keep the difference between the minimum connection number and the maximum connection number within the lower limit. Then it is checked whether the connection retention time and the connection acquisition timeout are still within the upper and lower limits, and they are fine-tuned to the permitted range when necessary.

[0050] After the adjustment, the above indicators are written into the adjusted indicator sequence according to the timestamp. During feature extraction, a sliding window is used to advance in segments on the adjusted indicator sequence, the mean and median are calculated as position features in each window, the squared difference average of each point relative to the window mean is calculated as variance, the extreme values and their number in the window are counted, and the time difference between the nearest pair of peaks and valleys is calculated as the peak-valley interval, the number of consecutive points with positive difference between adjacent sampling points is multiplied by the sampling interval as the continuous rising duration, the number of consecutive points with negative difference between adjacent sampling points is multiplied by the sampling interval as the continuous falling duration, the number of times the absolute value of the difference between adjacent sampling points is not less than the mutation threshold is counted as the mutation number, and the window average of the difference between adjacent sampling points is calculated as the short-term change rate, and the feature vectors are concatenated in a fixed order; during mean clustering, the initial center is selected from the feature vector set using the distance dispersion method, then the iteration is entered, in each round, the distance of each vector to each center is calculated in turn and assigned to the nearest center group, and the center is updated with the arithmetic mean of the vectors in the group, when the maximum displacement of the center is less than the convergence threshold or the maximum iteration round is reached, the feature group set is output; during deviation determination, the distance of each center point to the normal operation center point is calculated and compared with the deviation value threshold, when the distance is not less than the threshold, the group is regarded as a deviation group, and the dimensionless distance between the samples in the group and the normal operation center point is weighted and averaged according to the preset weight to obtain the abnormality degree score, which is sorted in time order to form the abnormality degree dataset; during classification, the abnormality degree dataset is input into the trained support vector machine classification model for inference, the model uses historical normal samples and abnormal samples to complete parameter selection and fixes the kernel type, kernel width and penalty parameter during the training stage, and outputs the label according to the classification probability threshold during the inference stage to form the classified abnormality set.

[0051] During real-time monitoring, the processor usage rate, memory occupancy rate, disk read-write throughput and network bandwidth occupancy are read at the sampling interval, the peak value, peak interval and peak duration of each window are calculated according to the sliding window, and the resource occupancy trend dataset is obtained, when the peak value of any window is not less than the resource occupancy peak threshold, the parameter adjustment direction is determined according to the bottleneck source, the connection keep-alive time is reduced preferentially and the maximum connection number is reduced moderately to release resources when the processor or memory is limited, the maximum connection number is increased preferentially and the connection acquisition timeout is increased moderately to reduce the timeout proportion when the queue length is increased due to external service waiting, and the minimum connection number, maximum connection number, connection keep-alive time and connection acquisition timeout are combined to form the optimized parameter set; when the parameters take effect, the optimized parameter set is written into the configuration of the resource allocation module and applied immediately, the connection acquisition timeout proportion, average request delay and feature group center point distance are continuously monitored in the validation window, when all of them are not higher than their respective upper limits and no continuous abnormal group appears in the entire validation window, it is determined to be stable, otherwise, the adjustment and analysis process is continued until the stable standard is met.

[0052] The target and limit parameters of the dynamic adjustment strategy include connection utilization rate target lower and upper limits, idle connection proportion target lower and upper limits, connection acquisition timeout limit threshold, average request delay limit threshold, maximum connection number increment and decrement, maximum connection number upper and lower limits, minimum connection number lower limit, connection retention time upper and lower limits, and connection acquisition timeout upper and lower limits. These parameters are obtained through performance playback and stress testing of historical peak and trough periods, so that the response time is kept within the limit and the resource utilization rate is kept within the target range when the load changes. The sliding window length and sliding step are used for feature extraction and trend analysis. The window length is the minimum time span that can capture the performance change trend and suppress short-term noise, and is an integer multiple of the sampling interval. The step is the sampling interval to ensure that no point is missed. The cluster number of mean clustering is determined by comparing the silhouette score and the sum of intra-class squared deviations of different cluster numbers on historical data. The value is taken when both indicators reach a balance. The convergence threshold is the minimum displacement corresponding to the stable class assignment when the maximum displacement of the adjacent two rounds of centers is taken. The maximum iteration round is the maximum value of the number of historical clustering convergence rounds plus a fixed margin.

[0053] The normal operation center point is obtained by the arithmetic mean of the feature vectors of the historical stable period and is re-evaluated after each strategy change. The deviation threshold is determined by the high quantile of the center point distance distribution of the historical stable period plus a fixed safety margin. The abnormality degree weight is set according to the influence of each feature on performance degradation. The sum of the weights is a constant, and the abnormality detection rate and false alarm rate are selected in the historical playback according to the principle of comprehensive optimization. The kernel type of the support vector machine is selected from the radial basis kernel and the polynomial kernel through cross-validation, with the weighted score of classification accuracy and recall rate as the target. The kernel width and penalty parameter are selected by grid search to make the classification score reach the peak on the validation set and the model not sensitive to noise.

[0054] The classification probability threshold is used for the final judgment of the output label, and the probability quantile that minimizes the weighted sum of the misclassification cost and the missed detection cost on the historical validation set is taken. The sampling interval of real-time monitoring is equal to the sliding step of feature extraction to maintain the time sequence. The resource occupation peak threshold is determined by the high quantile of the resource occupation peak distribution of the historical stable period plus a fixed safety margin. The boundaries of the optimized parameter set are taken from the minimum and maximum allowed values that ensure no connection starvation and connection storm under stress testing. The stability criteria consist of the validation window length, the upper limit of the connection acquisition timeout proportion, the upper limit of the average request delay, and the upper limit of the group center point distance. The validation window length is not less than one complete business cycle, and the three upper limits are taken from the high quantile of the historical stable period plus a fixed safety margin.

[0055] Step S5 includes: if the deviation value in the fourth verification index set is lower than the preset threshold value, storing the repair process data by the log recording module, generating a repair data set; extracting time sequence features from the repair data set, and performing dimension reduction processing on the features by using a principal component analysis algorithm to obtain a dimension-reduced feature set; according to the dimension-reduced feature set, obtaining a multi-dimensional index sequence from a time sequence database to generate a multi-dimensional index data set; if the abnormal value in the multi-dimensional index data set exceeds the preset threshold value, performing attribution analysis on the abnormal value by an information processing link to determine an abnormal reason set; performing batch training on the abnormal reason set by using a feedback learning mechanism, optimizing the causal reasoning model parameters to obtain a fifth optimized model version; performing prediction analysis on the multi-dimensional index data set by the fifth optimized model version to generate a prediction trend set; according to the prediction trend set, adjusting the resource allocation parameters by the information processing link to determine an optimized parameter set.

[0056] When collecting the repair data, after detecting that the maximum deviation value of the fourth verification index set is lower than the deviation value threshold, a log recording module is immediately called to write an operation session record and write the instruction identifier, start time, end time, execution time, execution result, and corresponding resource parameter value and key performance indicator value in the session one by one to form a repair data set; when extracting features, a sliding window is used to advance on the repair data set in segments, the arithmetic mean and median in each window are calculated as position features, the square difference average of each point relative to the window average is calculated as variance, the square difference average of the short interval difference is calculated as short-time variance, the maximum and minimum values in the window are read and the number of peak values and valley values is counted, the time interval of the nearest pair of peaks and valleys is calculated, the number of consecutive points with positive difference values between adjacent sampling points is counted and multiplied by the sampling interval as the continuous rising time length, the number of consecutive points with negative difference values between adjacent sampling points is counted and multiplied by the sampling interval as the continuous falling time length, the number of times that the absolute value of the difference value between adjacent sampling points is not less than the mutation threshold value is counted as the mutation number, the arithmetic average of the difference value between adjacent sampling points in the window is calculated as the short-time change rate, and the above features are concatenated into a feature vector in a fixed order and added to a feature vector set.

[0057] In principal component analysis, the degree of co-variation is calculated for all eigenvectors and decomposed, the number of principal components is determined according to the variance contribution rate threshold, and each eigenvector is linearly projected into the principal component space to output a reduced dimension feature set; in multi-dimensional index data set construction, the index list corresponding to the principal components in the reduced dimension feature set is read, and a batch query is performed from the time series database according to the unified start and end time, and the multi-dimensional index data set is obtained by aligning and merging according to the timestamp; in anomaly detection, the deviation of each index is calculated in a sliding window, and compared with the anomaly judgment threshold, the abnormal points are marked, and the proportion of abnormal points in the window is calculated; when the proportion is not less than the abnormal proportion threshold, the attribution analysis is entered; in attribution analysis, the abnormal point time is taken as the center to backtrack to the start point of the backtracking range, the associated index sequence with known dependency relationship is read, and the relative change rate, fluctuation amplitude and time sequence relationship strength are calculated one by one, and the quantities are matched with the causal adjacency relationship table one by one, and the matched items are written into the abnormal reason set; in feedback learning, samples are loaded from the abnormal reason set according to batches, and the weights of the causal reasoning model are increased or decreased, the weight upper and lower limit constraints are met, and the prediction error rate is calculated on the validation set after completing a batch of sample updates; when the error rate does not decrease or the learning round reaches the upper limit, the training is stopped and the fifth optimization model version is output;

[0058] In prediction analysis, the fifth optimization model version is used to perform rolling prediction on the multi-dimensional index data set, the window length is equal to the prediction time window length, the window start point is pushed forward according to the sliding step, and the trend direction, trend slope and fluctuation interval of each window are output to obtain a prediction trend set; in parameter optimization, the prediction trend set is input into the information processing link, the trend direction and slope are converted into the increase and decrease amplitude of the resource allocation parameter according to the fixed mapping, and the optimization parameter set is generated within the parameter boundary, the parameters include connection pool capacity related items, connection holding time and connection acquisition waiting time, etc. Resource allocation items, finally output the optimization parameter set for subsequent execution steps.

[0059] The deviation value threshold is used to determine whether the repair reaches a stable state, and the determination method is to take the high quantile point in the deviation value distribution of the historical stable period and add a fixed safety margin; the sliding window length is used for feature extraction and anomaly detection, and the value is the minimum time span covering at least one complete performance fluctuation period and an integer multiple of the sampling interval; the sliding step is used for window advancement, and the value is the sampling interval to ensure that no sampling points are missed; the variance contribution rate threshold is used for principal component selection, and the determination method is to test the influence of different contribution proportions on reconstruction error and subsequent anomaly detection accuracy on historical data, and the minimum proportion is selected when both indicators meet the standard, the proportion value is not less than 80 and not more than 99.

[0060] The abnormality determination threshold is used for single-point abnormality identification, and the determination method is the fluctuation upper limit of the same type index in the historical normal period plus a fixed safety margin; the abnormality proportion threshold is used to trigger attribution analysis, and the determination method is the high quantile point of the abnormality proportion distribution in the historical stable period plus a fixed safety margin; the backtracking range is the time boundary of attribution analysis, which is taken as the longest observation time from the abnormal point to cause the abnormality, and the length is not less than 1 complete business cycle; the batch size is used for training sample loading of the feedback learning mechanism, and the value is the maximum number of samples that can be processed within a single training time limit; the upper limit of learning rounds is used to prevent long training, and the value is the safety margin corresponding to the round when the error rate stops decreasing in the historical playback; the learning rate step value is used for weight update amplitude, and the value is the minimum effective increment that can improve the prediction accuracy without causing causal chain shock.

[0061] The weight upper limit and the weight lower limit are used to constrain the model parameters, and the value interval is a closed interval from 0 to 1, and the specific upper and lower limits are determined in offline verification; the prediction time window length is used for the time span of rolling prediction, and the value covers the resource scheduling period and ensures that the prediction can be consumed in time by the executable layer, and the length is not less than 10 times the sampling interval; the parameter boundary is used for the constraint of resource allocation parameters, including the minimum allowed value and the maximum allowed value, and the value is determined by stress testing to avoid resource depletion or resource waste; the parameter increase / decrease amplitude is used to map the trend slope to the parameter adjustment amount, and the value is determined by the dual-objective optimization of treatment time and stability in the historical playback.

[0062] Step S6 includes obtaining an extended rule set from a preset knowledge graph, structurally analyzing the extended rule set by an information processing link to obtain an analyzed rule set; if a rule item in the analyzed rule set conflicts with an existing path, performing priority sorting on the conflict item by a rule matching engine to generate a sorted rule set; according to the sorted rule set, extracting an associated index sequence from a time series database, and performing dimension reduction processing on the index sequence by a principal component analysis algorithm to obtain a reduced dimension index set; if the abnormal value in the reduced dimension index set exceeds a preset threshold, performing attribution analysis on the abnormal value by the information processing link to determine an abnormal rule set; according to the abnormal rule set, performing parameter optimization on the sixth rule library by a feedback learning mechanism to obtain an optimized rule set; updating the integrated rule set by the optimized rule set, and performing consistency checking on the updated rule set by the information processing link to obtain a checked rule set; according to the checked rule set, extracting a new rule item from the knowledge graph to generate a final version of the sixth rule library.

[0063] The knowledge graph interface is called to retrieve the newly added and changed rule items according to the timestamp and version number when the extended rule set is read, the triggering condition, triggering event, execution action, associated index list, dependency relationship, default priority and applicable range of each rule are parsed and written into the parsed rule set, and the parsed rule set and the existing path are traversed in a unified time window when the conflict detection is performed, and when two items propose conditions that cannot be met at the same time in the same time window for the same object, the conditions are marked as mutually exclusive, and when two items propose opposite or non-parallel execution actions for the same object, the actions are marked as contradictory, and the marked items are added to the conflict list.

[0064] When the priority is sorted, the rule matching engine calculates the conflict severity score, triggering frequency score, historical effectiveness score and influence range score for each rule in the conflict list, adds the scores according to the preset weight to obtain the sorting score, and outputs the sorted rule set in descending order of the score; when the index is extracted, the associated index list of the sorted rule set is read, the historical sequences of the corresponding indexes are batch queried in the time series database with a unified end time, and the timestamp is aligned and merged into an index sequence set; when the dimensionality reduction is processed, the index sequence set is first standardized in the information processing link, then the collaborative variation measure is calculated and sorted according to the importance and accumulated to meet the variance contribution rate threshold, the corresponding direction is selected as the principal component, and the original data is projected to obtain the reduced index set; when the anomaly detection is performed, the deviation distance of each dimension is calculated in a sliding window and compared with the abnormal value threshold, the abnormal points are marked and the proportion of abnormal points in the window is counted, and if the proportion is not less than the abnormal proportion threshold, the attribution analysis is entered.

[0065] When the attribution analysis is performed, the abnormal point time is taken as a reference to backtrack to the start point of the backtracking range, the rule triggering records and related index fluctuations related to the abnormal dimension in the time period are retrieved, the precedence relationship strength, co-occurrence frequency and fluctuation amplitude matching degree are calculated for each item, and the items with all the three not less than the respective threshold are added to the abnormal rule set; when the parameter optimization is performed, the abnormal rule set is input into the feedback learning mechanism, the sensitivity parameter, priority weight and forced order parameter in the sixth rule library are bounded and increased or decreased in batches, the matching accuracy and execution cost are calculated in the verification window after each batch is completed, and if there is no improvement or the learning round limit is reached for continuous multiple verification windows, the optimization is stopped and the optimized rule set is output; when the integration is updated, the optimized rule set replaces the corresponding items in the integrated rule set, and consistency verification is performed in the information processing link, and the syntax check, condition conflict recheck, action compatibility check and dependency integrity check are sequentially completed, and the items that pass the verification are output as the verification rule set; when the final generation is performed, the dependent but not included newly added rule items are retrieved from the knowledge graph according to the verification rule set, the items are merged and written into the sixth rule library, the version number and effective time are updated, the final version of the sixth rule library is generated, and the change log is recorded for subsequent tracing.

[0066] The structured analysis fields are trigger conditions, trigger events, execution actions, associated indicator lists, dependency relationships, default priorities and applicable scopes, which are directly given by the rule metadata in the knowledge graph; the conflict judgment rules include condition mutual exclusion judgment and action contradiction judgment, the condition mutual exclusion judgment is that the preconditions required by two rules for the same object in the same time window cannot be established at the same time, the action contradiction judgment is that two rules propose opposite or non-parallel execution actions for the same object in the same time window; the weight parameters of priority sorting include conflict severity weight, trigger frequency weight, historical effectiveness weight and impact range weight, the values are in the closed interval from 0 to 1, the sum of the four weights is equal to 1, the determination method is to use the historical rule execution log to perform grid search according to the comprehensive score of sorting accuracy and execution cost and take the combination with the highest comprehensive score; the variance contribution rate threshold is used for principal component selection, the determination method is to compare the anomaly detection accuracy and calculation overhead under different thresholds on historical data, select the minimum threshold when the accuracy and overhead meet the requirements at the same time, the threshold is not less than 80 and is usually set to 90 or above; the sliding window length is used for anomaly detection after dimension reduction, the value is the minimum time span covering at least one complete business cycle and is an integer multiple of the sampling interval, the sliding step is set to the sampling interval to ensure that no samples are missed; the anomaly value threshold is used for single-point anomaly marking, the determination method is to take the high quantile point of the deviation distance distribution of each dimension reduction dimension in the historical stable period and add a fixed safety margin; the anomaly proportion threshold is used for trigger attribution analysis, the determination method is to take the high quantile point of the proportion distribution of the window in the historical stable period and add a fixed safety margin; the backtracking range is used as the time boundary of attribution analysis, the value covers the longest observation delay from the occurrence of the potential cause to the appearance of the anomaly point, and is not shorter than one complete business cycle; the batch size is used for loading training samples in the feedback learning mechanism, the value is the maximum number of samples that can be trained in a single update cycle and is limited by the computing resources; the upper limit of learning rounds is used to terminate training, the value is the number of rounds when the performance indicators in the historical playback no longer improve plus a fixed margin; the learning rate step value is used for the amplitude of parameter increase and decrease, the determination method is the minimum effective increment that does not cause rule sorting shock and can continuously improve the accuracy on the validation set; the parameter upper and lower bounds are used to constrain the numerical range of the sensitivity parameters, the weight parameters and the forced order parameters, the values are in the closed interval from 0 to 1 and are fixed in offline verification; the passing standard of the consistency check rule is that there is no syntax error, no condition conflict, no action contradiction and complete and closed dependency relationship; the extraction condition of the new rule is that the item is dependent in the check rule set but does not exist in the sixth rule library, and its metadata is complete and in a usable state.

[0067] Step S7 includes obtaining initial data from the acquisition index sequence, structurally analyzing the data through the information processing link to obtain a structured index set; if the index in the structured index set deviates from the preset threshold, classifying the deviated index through an anomaly detection model to obtain a classified anomaly set; according to the classified anomaly set, using a causal reasoning model to perform correlation analysis on the abnormal index to determine a correlation path set; performing parallel verification on the correlation path set through the information processing link to obtain a verification path set; if the path in the verification path set is inconsistent with the integrated rule set, optimizing the rule set through a feedback adjustment mechanism to obtain an optimized rule set; according to the optimized rule set, extracting new index correlation from the acquisition index sequence to generate a complete processing chain; performing consistency checking on the complete processing chain through the information processing link to obtain a final processing chain.

[0068] After entering this step, initial data will be extracted from the acquisition index sequence according to a fixed sampling interval and a unified time range, and each record will be structurally analyzed in the information processing link to convert the original numerical value into a structured record containing index name, timestamp, numerical value, unit, sampling source and measurement accuracy, and finally aggregated to form a structured index set. The deviation of each index in the structured index set is calculated, and the deviation is the absolute difference between the current value and the preset threshold of the index. When the deviation is not less than the corresponding deviation threshold, the index is added to the to-be-judged set, and the anomaly detection model is called for classification. The anomaly detection model will calculate a determined feature set for each to-be-judged sample, including short-term fluctuation amplitude, short-term average change rate, mutation frequency, peak-valley interval, continuous abnormal duration and window variance, etc., and then output an explicit class label based on the fixed scoring boundary, forming a classified anomaly set. Subsequently, the causal reasoning model will be called based on the classified anomaly set to perform correlation analysis on the abnormal index, and during the analysis process, the time precedence relationship strength, change synchronization and conditional dependence of the abnormal index and the candidate correlation index are evaluated one by one on the fixed delay sequence, and the three metrics are weighted according to the determined weight to obtain the causal strength. The directed relationship with a causal strength not less than a causal threshold is included and constitutes a correlation path set. The correlation path set is verified in parallel in the information processing link, and parallel verification simultaneously checks the consistency of each path in multiple non-overlapping time windows, including whether the anomaly of the upstream index in the path occurs before the anomaly of the downstream index, whether the two anomalies repeatedly co-occur in the same window, and whether the path trigger corresponds to the recorded disposal result. Paths that meet the above verification standards are included in the verification path set.

[0069] The verification path set is then compared with the current integrated rule set, and when the trigger condition, execution logic or dependency sequence of the verification path is inconsistent with the integrated rule set, a feedback adjustment mechanism is started to optimize the rule set. The optimization actions include increasing or decreasing the priority weight of the relevant path according to the severity, tightening or relaxing the trigger condition threshold according to the accuracy, and merging logically equivalent repeated paths or splitting conflicting paths. After each round of adjustment, the trigger accuracy and conflict rate are reviewed in the verification window until the desired target is reached, and the optimized rule set is output. According to the optimized rule set, new index pairs related to new rules are retrieved in the collection index sequence, and the time sequence strength and co-occurrence frequency of these index pairs are calculated. The new index pairs that meet the inclusion criteria are merged with the existing paths to generate a complete processing chain that covers the detection, reasoning and disposal of the entire link. Finally, the consistency of the complete processing chain is checked in the information processing link, including path syntax integrity, trigger condition determinability, execution action compatibility and dependency relationship closure. After all the checks pass, the final processing chain is output for subsequent execution.

[0070] The sampling interval is determined by the real-time requirements of the business and the resource processing capacity, ensuring that redundant sampling is reduced without losing critical information; the timestamp accuracy of the structured record depends on the minimum sampling unit of the collection device, which is defined by the data source; the preset threshold is determined by the mean value of the historical running data in the stable state plus a safety margin, and the safety margin is set according to the index fluctuation characteristics; the deviation threshold is the minimum deviation value for triggering abnormal classification, and the determination method is to analyze the false positive rate and false negative rate curves on historical data and select the deviation value corresponding to the minimum weighted error point; the classification categories and decision boundaries of the anomaly detection model are obtained by training the annotated historical anomaly event set, including performance anomalies, resource anomalies and data collection anomalies; the precedence relationship strength threshold of the causal reasoning model is the minimum value that ensures the causal accuracy rate to be no less than a specified proportion in historical verification; the time window length of parallel verification is the time range covering a complete business fluctuation period; the inconsistency determination conditions of the integrated rule set include trigger condition logic mismatch, execution action conflict and dependency relationship difference; the optimization amplitude and step value of the feedback adjustment mechanism are determined by comparing the rule matching accuracy and resource consumption scores in offline verification; the passing standard of the consistency check is no syntax error, no logic conflict, no contradictory execution action and closed dependency path.

[0071] In the specific implementation process, the collection module interface is called to batch read the original index values at the set sampling interval and time range, the original values, timestamps, units, and source device information of each record are parsed into structured fields, and the structured index set is written. The deviation detection link calculates the absolute difference between the current value and the corresponding preset threshold value for each record, and compares it with the deviation threshold value. The records exceeding the threshold value are added to the to-be-processed set. In the classification stage, the abnormality detection model extracts the short-time fluctuation amplitude, short-time average change rate, mutation frequency, peak-valley interval, continuous abnormal duration, and window variance of each record, combines these values into a feature vector, inputs the feature vector into the model, and outputs a class label to form a classified abnormal set. In the cause-effect analysis stage, the time sequence relationship strength, change synchronization, and conditional dependency are calculated for each pair, and the cause-effect strength is weighted to generate a directed relationship set. In the parallel verification stage, each path is verified in multiple independent threads at the same time to verify the trigger order, co-occurrence frequency, and disposition record correspondence. The paths that meet the conditions are added to the verified path set. In the optimization stage, the feedback adjustment mechanism adjusts the priority weight, tightens or relaxes the trigger condition, and merges or splits the paths to correct the rules. After each adjustment, the accuracy and conflict rate are verified until the target is met. Finally, based on the optimized rule set, the new index correlation is extracted, merged with the existing path to form a complete processing chain, and the syntax, logic, execution action, and dependency relationship are checked in the consistency verification link. After passing all the checks, the final processing chain record is put into operation.

[0072] Model overall architecture: The abnormality detection model of the technical solution takes the multi-dimensional index sequence in the time series database as input, at least contains response time and resource occupation two kinds of indexes, and outputs the standardized deviation value set and the corresponding first abnormal index set. When any deviation value exceeds the preset threshold value, it enters the information processing link, and sequentially performs fluctuation feature extraction, smoothing processing and clustering analysis, finally generates an abnormal index set, and updates the monitoring rules in real time based on the set. Therefore, the model realizes the complete process from data sampling, abnormal scoring, threshold determination to abnormal identification and strategy updating.

[0073] Data acquisition and preprocessing: The terminal collects response time and resource occupation and other indicators according to the preset sampling interval, and writes them into the time series database to form a multi-dimensional index sequence. The current sequence data set is extracted within the observation window as the model input, and the sampling interval and window length are selected by analyzing the peak capture rate, short-time variance and missing rate of historical data and other indicators to ensure that the complete business cycle is covered and redundant or expired data is avoided. Missing points are interpolated according to the last valid value, so as to maintain the equidistant sequence input and ensure the accuracy of subsequent modeling and determination.

[0074] Anomaly detection model construction: This model uses the Isolation Forest algorithm as the core detection method. Isolation Forest divides the sample by setting a random threshold in the randomly selected dimension, generating multiple split trees, and each tree terminates when the sample is isolated. The anomaly score is calculated by the average path length of the data in the forest. The shorter the path, the easier it is to be isolated, and the higher the degree of anomaly. The score is converted into a deviation value set by standardization, and compared with the preset threshold. If it exceeds the threshold, it enters the subsequent processing link. The key parameters of the model include the number of trees, the maximum split depth and the subsampling size, which are determined by the stability and computational overhead of historical data grid evaluation.

[0075] Feature extraction and smoothing processing: After determining that the deviation value exceeds the threshold, the system enters the information processing link to extract the fluctuation characteristics of the original sequence corresponding to the anomaly. In the sliding window, the short-term fluctuation amplitude, average change rate, peak-valley interval, continuous rising or falling time and short-term variance are calculated segment by segment to form the fluctuation feature set. Then, the moving average method is used to smooth the original sequence and feature sequence. The window length is an integer multiple of the sampling interval, and the step length is the sampling interval, to balance between capturing mutations and suppressing short-term noise, and obtain the smoothed sequence data.

[0076] Clustering analysis and anomaly determination: After smoothing, the K-means clustering algorithm is used to classify the data. The initial center is selected by the distance dispersion method, and the sample classification and center update are iteratively executed until the center displacement is below the convergence threshold or the maximum iteration number is reached. The final output cluster center and cluster division result, and the abnormal cluster is determined by multiple conditions: the deviation value of the cluster center is in the high interval, the cluster size is below the set upper limit, and the fluctuation characteristics show high amplitude or long-term anomaly. The cluster that meets the above conditions is marked as an abnormal cluster, and the corresponding index is added to the abnormal index set.

[0077] Monitoring rule update and closed loop: When the abnormal index set is generated, the system dynamically updates the monitoring rules in the time series database, including the new alarm threshold, the number of continuous triggers, the alarm suppression interval, and the observation window and sampling interval settings. Then in the subsequent verification link, if the deviation value falls below the threshold, the repair and verification process is written into the log, and the feedback learning link is entered to optimize the causal reasoning and rule library, realizing the closed loop evolution of detection, positioning, disposal and learning. In this way, the anomaly detection model not only serves as a trigger to enter the emergency mode, but also as a verifier for the subsequent repair effect, improving the stability and adaptability of the system in complex business scenarios.

[0078] The deviation value threshold in the present application is obtained by standardizing the anomaly score output by the isolation forest algorithm, and the specific value is based on the upper limit of the deviation value distribution of the historical normal operation interval, and a fixed safety margin is added. The reason for such setting is to ensure that the probability of normal data exceeding the limit is as low as possible, thereby reducing the false positive rate, while ensuring that the proportion of truly abnormal data exceeding the limit is high enough to improve the detection rate. The threshold directly serves as the trigger condition for entering the subsequent information processing link, and is an important parameter for ensuring the sensitivity and stability of anomaly identification.

[0079] The causal correlation strength threshold is used to determine whether there is a significant causal dependence relationship between two indexes, and the value is the high quantile of the causal strength distribution of the historical normal operation interval, with a safety margin. Through such setting, accidental or false correlation index pairs can be effectively filtered out, and only the indexes with stable causal relationship are retained for further analysis, thereby ensuring the accuracy of root cause positioning and the reliability of subsequent reasoning results.

[0080] The variance threshold is introduced as a judgment condition when grouping abnormal indexes, and the value is the high quantile of the historical normal grouping variance distribution, with a safety margin. The reason for designing this threshold is to distinguish between normal random fluctuations and truly abnormal significant fluctuations. When the intra-group variance exceeds the threshold, further fluctuation frequency calculation is triggered to ensure that misjudgment does not occur due to slight fluctuations, while ensuring that abnormal fluctuations are captured in time.

[0081] The variance contribution rate threshold is used as a criterion for determining the number of principal components selected in the principal component analysis (PCA) link. The specific value range is usually 80% to 99%, and the value is determined by testing the clustering stability and intra-class compactness under different contribution rates on historical data, and selecting the proportion when both indicators reach the optimal balance. The reason for such setting is to significantly reduce the dimension and computational complexity, while ensuring that the remaining principal components cover most of the feature information, without losing key abnormal information, thereby maintaining stability and accuracy in anomaly detection and rule retrieval.

[0082] Cluster-related thresholds: In the K-means clustering process, the convergence threshold, the upper limit of cluster size, and the setting of the abnormal cluster determination threshold are involved. The convergence threshold takes the minimum center point displacement when the category assignment is stable in the historical clustering process, which is used to determine whether the iteration is finished; the upper limit of cluster size is the total number of samples multiplied by a set proportion, which prevents small clusters from being incorrectly identified as valid patterns; the abnormal cluster determination threshold requires the cluster center deviation value to be in the high interval and the cluster size to be lower than the upper limit. Such design ensures that the clustering results can both find small-scale abnormal patterns and avoid unlimited splitting or overfitting, thereby balancing the abnormal detection rate and clustering stability.

[0083] Sliding window and step threshold: The sliding window length and step are key parameters used in feature extraction, smoothing processing, and trend calculation. The window length is set to cover at least one complete business cycle and be an integer multiple of the sampling interval to ensure that the integrity of business fluctuations can be captured and short-term noise interference can be suppressed. The step is fixed at the sampling interval to ensure that no sample points are missed. The reason for such setting is to achieve the optimal trade-off between capturing abnormal mutations and maintaining the stability of time series, ensuring the stability and real-time performance of the calculation results.

[0084] Resource allocation and performance-related thresholds: When dynamically adjusting resource allocation such as database connection pool, the invention sets multiple performance-related thresholds, including connection pool deviation threshold, resource occupation peak threshold, and connection acquisition timeout and average delay limit threshold. Among them, the deviation threshold is determined by the upper limit of the center point distance distribution in the historical stable period plus a safety margin; the resource occupation peak threshold is determined by the upper limit of the peak value distribution in the historical stable period plus a safety margin; the connection acquisition timeout and average delay threshold are set through stress testing and historical peak data performance. The reason for such setting is to ensure service response under high load while avoiding resource starvation or resource storm, ensuring the continuity and stability of the system under dynamic load.

[0085] Abnormal detection and feedback learning threshold: In the abnormal detection and feedback learning process, the invention involves abnormal determination threshold, abnormal proportion threshold, backtracking range, learning rate step value, and weight upper and lower limits. The abnormal determination threshold is used for single-point anomaly recognition, taking the upper limit of the historical normal interval fluctuation plus a safety margin; the abnormal proportion threshold is used to trigger attribution analysis, taking the high quantile point of the historical stable period abnormal proportion distribution plus a safety margin; the backtracking range takes the longest observation period that leads to abnormality, which is not shorter than a complete business cycle; the learning rate step value selects the smallest effective increment that can improve accuracy; the weight upper and lower limits are limited between 0 and 1 to avoid parameter overflow. The reason for such design is to balance the detection sensitivity and stability, and prevent excessive updating in the feedback learning process to prevent model oscillation, thereby ensuring the effectiveness of model optimization.

[0086] Rule matching related threshold: In the rule retrieval and execution phase, the present application introduces a rule correlation strength threshold and an abnormal rollback rate threshold. The value of the rule correlation strength threshold is the weighted result of the rule and node feature similarity and historical effectiveness, and needs to be higher than the upper limit of the historical normal interval distribution plus a safety margin, to ensure that the rules entering the execution link are guaranteed in similarity and reliability. The value of the abnormal rollback rate threshold is the high quantile point of the rollback proportion in the historical execution plus a safety margin, which is used to identify and reduce the weight of high-risk rules. The reason for such setting is to ensure that the rules entering the execution have a high historical success rate, and to reduce the risk of failure or repeated repair in emergency handling.

[0087] Although embodiments of the present application have been shown and described, it is to be understood that various modifications, substitutions, replacements and changes can be made to these embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for handling interaction events for emergency mode switching in a smart terminal, characterized in that, The method comprises the following steps: Step S1, by adopting a time series database to store a multi-dimensional index sequence, obtaining a current index sequence according to a preset sampling interval, and calculating a deviation value through an anomaly detection model to obtain a first anomaly index set; Step S2, if the deviation value in the first anomaly index set exceeds a preset threshold, extracting a historical index sequence from the time series database, analyzing the correlation between multiple indexes through a causal reasoning model to determine a second anomaly root path, and traversing the causal chain between indexes through the causal reasoning model to obtain a root node; Step S3, according to the second anomaly root path, querying an associated repair rule from a preset knowledge graph, and processing the root node attribute through a rule matching engine to obtain a third repair instruction sequence; Step S4, executing the third repair instruction sequence through a resource allocation module, processing the database root by dynamically adjusting the size of the connection pool, obtaining an adjusted index sequence, and recalculating the deviation value through the anomaly detection model to obtain a fourth verification index set; Step S5, if the deviation value in the fourth verification index set is lower than the preset threshold, storing the repair process data through a log recording module, updating the multi-dimensional index sequence from the time series database, and obtaining a fifth optimized model version by optimizing the parameters of the causal reasoning model through a feedback learning mechanism, and determining the parameter increment by batch training the historical root path through the information processing link of the feedback learning mechanism; Step S6, according to the fifth optimized model version, expanding a new repair rule from the preset knowledge graph, and obtaining a sixth rule library update by processing the expanded rule through the rule matching engine, and obtaining an integrated rule set by compatibility judgment of the new rule and the existing path through the information processing link of the rule matching engine; Step S7, processing the subsequent collected index sequence by using the integrated rule set, and obtaining a seventh anomaly processing chain by jointly calculating the deviation value and the root path through the anomaly detection model and the causal reasoning model.

2. The method according to claim 1, wherein, The step S1 comprises: Collecting response time indexes and resource occupation indexes, storing them in a time series database, and generating a multi-dimensional index sequence; Obtaining an index sequence of a preset sampling interval from the time series database to generate a current sequence data set; Analyzing the current sequence data set by using an isolation forest algorithm, calculating the sequence deviation value, and obtaining a deviation value set; If the deviation value exceeds the preset threshold, extracting the sequence fluctuation characteristics through the information processing link to generate a fluctuation feature set; According to the fluctuation feature set, smoothing the sequence by using the moving average method to generate a smoothed sequence data; Classifying the smoothed sequence data by using the K-means clustering algorithm to obtain an anomaly index set; For the anomaly index set, real-time update the monitoring rules of the time series database to generate an updated monitoring strategy.

3. The method of claim 1, wherein the method further comprises: The step S2 comprises: Obtaining the historical index sequence corresponding to the first anomaly index from the time series database, analyzing the dependency between sequences by using a causal reasoning model to obtain a causal correlation matrix; If the correlation strength of an index pair in the causal correlation matrix exceeds a preset threshold, extracting the time sequence characteristics of the index pair through the information processing link to obtain a feature vector set; Performing dimensionality reduction processing on the feature vector set by using a principal component analysis algorithm to generate a feature data set; According to the feature data set, the K-means clustering algorithm is used to group the indexes to obtain an abnormal index grouping set; If the variance of the indexes in the abnormal index grouping set exceeds a preset threshold, the fluctuation frequency of the indexes in the group is calculated through the information processing link to obtain a fluctuation frequency set; According to the fluctuation frequency set, the corresponding historical index sequence is extracted from the time series database, and the dynamic change trend of the sequence is calculated by using the sliding window method to obtain a trend data set; The weight parameters of the causal reasoning model are updated through the trend data set to generate an updated root node set.

4. The method of claim 1, wherein the method further comprises: The step S3 comprises: The associated node set is obtained from the second abnormal root source path, the time sequence characteristics of the nodes are extracted through the information processing link to obtain a feature vector set; The feature vector set is processed by dimension reduction through the principal component analysis algorithm to generate a feature data set; Through the feature data set, the rule matching engine queries the repair rules in the preset knowledge graph to obtain a matching rule set; If the correlation strength of a rule in the matching rule set exceeds a preset threshold, the node attribute mapping of the rule is calculated through the information processing link to determine a repair instruction sequence; According to the repair instruction sequence, the time sequence execution trend of the instruction is analyzed by using the sliding window method to obtain a dynamic trend data set; The weight parameters of the rule matching engine are updated through the dynamic trend data set to generate an optimized instruction priority set; According to the optimized instruction priority set, the final repair instruction sequence is extracted from the preset knowledge graph to determine the execution order.

5. The method of claim 1, wherein the method further comprises: The step S4 comprises: The third repair instruction sequence is loaded through the resource allocation module, and the database connection pool size is optimized by using the dynamic adjustment strategy to generate an adjusted index sequence; The time sequence characteristics are extracted from the adjusted index sequence, and the characteristics are grouped by using the K-means clustering algorithm to obtain a feature grouping set; If the center point of a group in the feature grouping set deviates from the preset threshold, the abnormality degree of the center point deviating from the preset threshold group is calculated through the information processing link to generate an abnormality degree data set; According to the abnormality degree data set, the support vector machine algorithm is applied to classify the abnormal groups to obtain a classified abnormal set; Through the classified abnormal set, the resource occupation state is analyzed by using the real-time monitoring mechanism to generate a resource occupation trend data set; If the peak value in the resource occupation trend data set exceeds a preset threshold, the allocation parameters of the database connection pool are adjusted through the information processing link to generate an optimized parameter set; The configuration of the resource allocation module is updated according to the optimized parameter set to determine the stable state.

6. The method of claim 1, wherein the method further comprises: The step S5 comprises: If the deviation value in the fourth verification index set is lower than a preset threshold, the repair process data is stored through the log recording module to generate a repair data set; The time sequence characteristics are extracted from the repair data set, and the characteristics are processed by dimension reduction through the principal component analysis algorithm to obtain a reduced dimension feature set; According to the reduced dimension feature set, the multi-dimensional index sequence is obtained from the time series database to generate a multi-dimensional index data set; If the abnormal value in the multi-dimensional index data set exceeds a preset threshold, the abnormal value is attributed through the information processing link to determine an abnormal reason set; The feedback learning mechanism is used for batch training on the abnormal reason set, parameters of the causal reasoning model are optimized, and a fifth optimized model version is obtained. The fifth optimized model version is used for prediction analysis on the multi-dimensional index data set, and a prediction trend set is generated. According to the prediction trend set, the resource allocation parameters are adjusted through the information processing link, and an optimized parameter set is determined.

7. The method of claim 1, wherein the method further comprises: The step S6 comprises: An extension rule set is obtained from a preset knowledge graph, the extension rule set is structured and parsed by the information processing link, and a parsed rule set is obtained; If the rule entries in the parsed rule set conflict with the existing path, the conflict entries are prioritized by a rule matching engine, and a sorted rule set is generated; According to the sorted rule set, an associated index sequence is extracted from a time series database, and the index sequence is processed by a principal component analysis algorithm, and a reduced dimension index set is obtained; If the abnormal values in the reduced dimension index set exceed a preset threshold, the abnormal values are attributed by the information processing link, and an abnormal rule set is determined.

8. The method of claim 7, wherein the method further comprises: The step S6 further comprises: According to the abnormal rule set, the sixth rule base is parameter-optimized by the feedback learning mechanism, and an optimized rule set is obtained; The integrated rule set is updated by the optimized rule set, the updated rule set is consistency-verified by the information processing link, and a verified rule set is obtained; According to the verified rule set, new rule entries are extracted from the knowledge graph, and a final version of the sixth rule base is generated.

9. The method of claim 1, wherein the method further comprises: The step S7 comprises: Initial data is obtained from the collected index sequence, the data is structured and parsed by the information processing link, and a structured index set is obtained; If the indexes in the structured index set deviate from the preset threshold, the deviating indexes are classified by an anomaly detection model, and a classified anomaly set is obtained; According to the classified anomaly set, the abnormal indexes are associated by a causal reasoning model, and an associated path set is determined; The associated path set is verified in parallel by the information processing link, and a verified path set is obtained; If the paths in the verified path set are inconsistent with the integrated rule set, the rule set is optimized by a feedback adjustment mechanism, and an optimized rule set is obtained.

10. The method of claim 9, wherein the method further comprises: The step S7 further comprises: According to the optimized rule set, new index associations are extracted from the collected index sequence, and a complete processing chain is generated; The complete processing chain is consistency-verified by the information processing link, and a final processing chain is obtained.

Images