Operation abnormal state maintenance system and method for Internet platform

Abstract

The invention discloses an abnormal operation state maintenance system and method for an internet platform. The system comprises a data acquisition module, an intelligent analysis module, a strategy generation module, an execution control module and a knowledge base module. The data acquisition module generates monitoring data stream signals in a unified format; the intelligent analysis module receives the monitoring data stream signal and generates an abnormal state judgment signal and a root cause positioning signal through multi-source data fusion analysis; the strategy generation module generates an operation instruction signal containing a disposal type and an execution parameter; the execution control module receives the operation instruction signal and generates an operation result feedback signal; and the knowledge base module continuously receives and stores associated data of the root cause positioning signal and the operation result feedback signal, and provides a historical case matching signal for the intelligent analysis engine module. According to the operation abnormal state maintenance system and method for the internet platform, the problem of alarm failure caused by high false report and missing report rate of abnormal detection can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet platform operation automation and intelligent exception handling, and in particular to an operation exception state maintenance system and method for an Internet platform. BACKGROUND

[0002] Current Internet platforms generally adopt micro-service architecture and cloud native deployment, and the service dependency relationship is complex and dynamic. Traditional monitoring systems rely on pre-set threshold rules to trigger alarms, which produces a large number of false positives and false negatives in scenarios such as business traffic fluctuations and infrastructure elasticity scaling. The operation personnel need to manually screen real faults from a large number of alarms, which is inefficient and easy to miss critical exceptions. The fault location link mainly relies on expert experience to view isolated monitoring data (such as index dashboards, log keywords, and call chain fragments), which is difficult to quickly determine the root cause service node in a distributed system, and the average repair time (MTTR) often exceeds several hours.

[0003] Existing automated handling solutions are mostly driven by simple rules (such as scaling instances when CPU exceeds threshold), lacking evaluation mechanisms for operation safety. Historical cases show that automatic restart of key nodes may cause upstream and downstream service avalanches without pre-judgment of service dependency impact. Although some individual research attempts to introduce machine learning to detect exceptions, most are single-dimensional analysis (only indicators or logs), and do not solve the problem of fragmented multi-source data. Knowledge base systems usually only store basic event records, lack of spatiotemporal correlation modeling of handling effects and root causes, and cannot effectively support decision optimization. SUMMARY

[0004] In view of the above shortcomings of the prior art, the present application aims to provide an operation exception state maintenance system and method for an Internet platform, which solves the problems of high false positive and false negative rates of exception detection leading to alarm failure, and delay in recovery due to reliance on manual experience for fault root cause localization. The present application uses a dynamic cleaning unit to purify index / log / link tracing data in real time, eliminating noise interference and converting it into dimensionless standard signals, solving the problem of misjudgment caused by data quality. The extensible probe interface is compatible with container orchestration layers, cloud service APIs, and other new data sources, ensuring full-stack monitoring coverage. Based on service dependency topology and graph attention networks, time series index slices, log semantic vectors, and link path encodings are cross-modally fused. The root cause probability distribution is calculated through an exception propagation deduction model, breaking through the limitations of traditional threshold rules and accurately locating the fault source node in the micro-service architecture.

[0005] The present application provides an operation exception state maintenance system for an Internet platform, comprising:

[0006] A data acquisition module, which acquires index data, log data, and link tracing data of platform operation in real time, and generates monitoring data stream signals in a unified format;

[0007] The intelligent analysis module receives the monitoring data stream signal, and generates an abnormal state judgment signal and a root cause positioning signal through multi-source data fusion analysis;

[0008] The policy generation module receives the abnormal state judgment signal and the root cause positioning signal, and generates an operation instruction signal containing a treatment type and an execution parameter in combination with a preset rule library;

[0009] The execution control module receives the operation instruction signal, drives the platform infrastructure to perform resource adjustment operation or service recovery operation, and generates an operation result feedback signal;

[0010] The knowledge base module continuously receives and stores the associated data of the root cause positioning signal and the operation result feedback signal, and provides a historical case matching signal to the intelligent analysis engine module.

[0011] In an embodiment of the present application, the data acquisition module comprises a dynamic cleaning unit, which performs real-time purification processing on original index data log data and link tracking data before generating the monitoring data stream signal. The purification processing comprises eliminating repeated acquisition points, compensating for field loss caused by transmission loss, filtering high-frequency noise interference, and simultaneously adopting a sliding time window mechanism to dynamically calculate the reference value of each data source, so as to convert heterogeneous data into dimensionless standard values. The dynamic cleaning unit autonomously adjusts the purification rules and standardization parameters according to data characteristics, so as to ensure that the monitoring data stream signal meets the input specification requirements of the intelligent analysis module.

[0012] In an embodiment of the present application, the data acquisition module is provided with an extensible probe interface to support on-demand mounting of a customized acquisition unit for a specific infrastructure. The customized acquisition unit captures container orchestration layer resource scheduling events, cloud service interface call states or database slow transaction records in real time, and the captured data is incorporated into the monitoring data stream signal after format conversion through the probe interface. The extensible probe interface has a built-in protocol adaptation layer to support the transmission of original data of open source monitoring protocols and private monitoring protocols.

[0013] In an embodiment of the present application, the intelligent analysis module constructs a service dependency relationship graph when performing multi-source data fusion analysis. The graph takes platform microservices as nodes and takes service inter-call links as edges. Each edge loads historical call success rate and delay statistical values. When the abnormal state judgment signal indicates that a node is abnormal, the adjacent nodes are traversed along the dependent edge to calculate the root cause probability distribution. The root cause positioning signal outputs the identification of the fault node with the highest probability and the abnormal propagation path topology thereof.

[0014] In an embodiment of the present application, the intelligent analysis module adopts a graph neural network model to process the monitoring data stream signal, the model input layer receives the vectorized index time slice log semantic vector and link path encoding hidden layer aggregates multi-hop neighbor node state through a graph attention mechanism, the output layer generates an abnormal confidence score and a root cause positioning signal, and an abnormal state judgment signal, and the model output score is dynamically generated according to the model output score.

[0015] In an embodiment of the present application, the intelligent analysis module is built-in with an adaptive threshold generation unit, the unit continuously learns the statistical distribution characteristics of the historical monitoring data stream signal in the normal state, dynamically calculates the abnormal judgment boundary value of each monitoring index based on the distribution characteristics, triggers the abnormal state judgment signal when the real-time data breaks through the boundary value, and the boundary value is automatically updated with the change of the platform running mode.

[0016] In an embodiment of the present application, the preset rule library of the strategy generation module contains a treatment strategy knowledge graph, the knowledge graph takes the root cause type as an entity node, associates a treatment operation entity and a constraint condition entity, receives the root cause positioning signal, starts graph traversal, matches an operation path that meets the current platform environment state, generates an operation instruction signal, and synchronously outputs a treatment strategy confidence and an alternative strategy set.

[0017] In an embodiment of the present application, the strategy generation module integrates a reinforcement learning decision engine, the engine takes the operation result feedback signal as a reward function input to continuously optimize the operation instruction generation strategy, executes a multi-armed bandit algorithm every time the operation instruction signal is generated to balance the historical optimal strategy and the new strategy exploration, and the decision engine dynamically adjusts the exploration coefficient according to the platform fault recovery rate.

[0018] In an embodiment of the present application, the execution control module contains a sandbox verification unit, receives the operation instruction signal, simulates the execution of the resource adjustment operation or the service recovery operation in the isolated environment, collects the resource change record and the service state change data generated by the simulation execution, and drives the actual platform infrastructure to execute when the simulation result meets the expectation, otherwise triggers the operation instruction rollback signal.

[0019] The present application also provides a running abnormal state maintenance method for an Internet platform, comprising:

[0020] S1: real-time collection of index data, log data and link tracking data of platform running, generation of monitoring data stream signal in unified format;

[0021] S2: receiving the monitoring data stream signal, generating an abnormal state judgment signal and a root cause positioning signal through multi-source data fusion analysis;

[0022] S3: receiving the abnormal state judgment signal and the root cause positioning signal, generating an operation instruction signal containing a treatment type and an execution parameter in combination with a preset rule library;

[0023] S4: receiving operation instruction signals, driving platform infrastructure to perform resource adjustment operations or service recovery operations, and generating operation result feedback signals;

[0024] S5: continuously receiving and storing the association data of the root cause positioning signals and the operation result feedback signals, and providing historical case matching signals to the intelligent analysis engine module.

[0025] The application provides an operation abnormal state maintenance system and method for an Internet platform, which purifies index / log / link tracking data in real time through a dynamic cleaning unit, eliminates noise interference and converts it into dimensionless standard signals, solves the misjudgment problem caused by data quality. The extensible probe interface is compatible with container orchestration layer, cloud service API and other new data sources, ensuring full-stack monitoring coverage. Based on service dependency topology and graph attention network, time series index slices, log semantic vectors and link path encodings are cross-modally fused. The root cause probability distribution is calculated through an abnormal propagation deduction model, breaking through the limitations of traditional threshold rules and accurately locating the fault source node in the microservice architecture. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0027] Figure 1 It is a system architecture diagram of an operation abnormal state maintenance system for an Internet platform.

[0028] Figure 2 It is a schematic diagram showing the working process of an operation abnormal state maintenance system for an Internet platform.

[0029] Figure 3 It is a method flowchart of an operation abnormal state maintenance method for an Internet platform. DETAILED DESCRIPTION

[0030] The embodiments of the application will be described below through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the application from the content disclosed in the specification. The application can also be implemented or applied by different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0031] It is to be understood that the figures provided in the following embodiments are only schematic and show only those components that are relative to the application, other components being omitted for the sake of clarity. Hence, the figures are not intended to limit the application to a specific embodiment, but are merely to illustrate one of various aspects of it.

[0032] In the following description, numerous specific details are discussed in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to one of ordinary skill in the art that the embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and devices are not described in detail in order to avoid obscuring the embodiments of the present application.

[0033] Referring to Figures 1-3 , a system and method for maintaining abnormal state of operation of an Internet platform are shown. The system includes a data acquisition module, an intelligent analysis module, a strategy generation module, an execution control module, and a knowledge base module. The data acquisition module acquires index data, log data, and link tracking data of the platform in real time, and generates monitoring data stream signals in a unified format. The intelligent analysis module receives the monitoring data stream signals, and generates abnormal state judgment signals and root cause positioning signals through multi-source data fusion analysis. The strategy generation module receives the abnormal state judgment signals and the root cause positioning signals, and generates operation instruction signals containing disposal types and execution parameters in combination with a preset rule base. The execution control module receives the operation instruction signals, drives the platform infrastructure to perform resource adjustment operations or service recovery operations, and generates operation result feedback signals. The knowledge base module continuously receives and stores associated data of the root cause positioning signals and the operation result feedback signals, and provides historical case matching signals to the intelligent analysis engine module.

[0034] As Figure 1As shown, the core system of the patent consists of five modules in a signal processing closed loop. The data acquisition module, as the input end of the system, captures three types of core data in real time from the platform infrastructure layer and the application layer: indicator data including CPU usage, memory occupancy, network throughput, and other performance metrics; log data covering text records of system logs, application logs, and audit logs; and link tracking data involving the call path and latency information of distributed requests between microservices. The module has a built-in data format conversion engine that converts heterogeneous data sources into a unified timestamp sequence of monitoring data stream signals. The signal structure includes three mandatory fields: data category label, collection time window, and standardized numerical matrix. The intelligent analysis module receives this signal and starts multi-source fusion analysis. First, it periodically slices the indicator data, encodes the semantic vectors of the log data, and constructs a service call graph for the link data. Then, through cross-modal correlation algorithms, it detects service state deviations. When the deviation in any dimension exceeds the dynamic threshold, it generates an abnormal state judgment signal, which carries the abnormal service identifier, abnormal type classification, and confidence score. At the same time, based on the graph propagation model, it locates the root cause node and generates a root cause positioning signal containing the root cause service coordinates, fault propagation path topology, and impact range assessment. The strategy generation module synchronously receives the above two signals and calls the matching of the pre-set rule library's treatment strategy knowledge graph. The knowledge graph takes the root cause type as the main entity node and connects the treatment operation entities and environmental constraint entities through three types of relationship edges: "triggerable," "avoidable," and "once effective." The matching process prioritizes filtering operation paths with confidence scores above the pre-set lower limit and generates operation instruction signals containing operation type codes (such as instance restart, traffic switching, configuration rollback), execution parameter sets (such as restart timeout length, switching traffic proportion), and alternative solution lists. The execution control module analyzes the operation instruction signal and drives the platform infrastructure to perform specific operations: resource adjustment operations include cloud host scaling, load balancing weight adjustment, and database connection pool reset; service recovery operations involve process restart, service hot deployment, and fault node isolation. After execution, it generates operation result feedback signals in real time, including execution status code (success / failure / partial success), resource change record, and service recovery indicators. The knowledge base module continuously receives and stores the associated data packets of root cause positioning signals and operation result feedback signals and establishes a causal chain of "fault root cause - treatment operation - recovery effect" through event timeline alignment technology. When the intelligent analysis module starts a new detection cycle, the knowledge base pushes historical case matching signals to it, which contain the treatment scheme feature vector of similar fault patterns, environmental state matching degree, and historical recovery efficiency indicators, providing decision-making prior knowledge for the analysis process.The signal transmission between each module follows strict timing logic: the data acquisition module pushes the monitoring data stream signal at a frequency of seconds; the intelligent analysis module completes analysis and output within 200 milliseconds after receiving the signal; the strategy generation module decision-making period is not more than 100 milliseconds; the execution control module operation feedback delay control is within 1 second; and the knowledge base module realizes quasi-real-time signal correlation storage and matching push.

[0035] Further, the dynamic cleaning unit integrated in the data acquisition module implements a four-stage purification pipeline. The first stage is redundancy elimination: repeated collection points are identified through a Bloom filter, time window overlap detection algorithm is used for index data, similar hash value comparison is implemented for log data, and link data is de-duplicated based on a global tracking ID. The second stage is data repair: field loss caused by transmission packet loss is compensated by real-time interpolation based on a historical data distribution model, numerical fields are predicted by a sliding window linear regression, and text fields are filled by a context semantic model. The third stage is noise filtering: an adaptive filter is designed for high-frequency interference signals, Fourier transform is used to separate service characteristic frequency bands, and non-characteristic frequency band fluctuations are dynamically suppressed; semantic entropy evaluation is used for log noise, and meaningless log entries with entropy values below a threshold are filtered. The fourth stage is normalization processing: a dynamic reference frame is constructed, moving average and standard deviation of each data source are calculated with a 5-minute sliding window, and original values are converted into offset values with standard deviation as the unit; when dimensionless fusion is performed on multi-source data, 0.4 weight is assigned to index data, 0.3 weight to log data, and 0.3 weight to link data, forming a unified dimension value in the interval [0, 1]. The dynamic cleaning unit has a rule self-optimization capability: by monitoring the misjudgment rate of the purified data in the intelligent analysis module, the de-duplication detection sensitivity (adjustable from 0.1 to 0.9), the interpolation model selection (linear / multinomial / neural network), the filter cutoff frequency (±15% floating range), and the normalization weight coefficient (±0.05 adjustment step) are automatically adjusted. This mechanism ensures that the monitoring data stream signal meets three core specifications: timing alignment error is not more than 50 milliseconds, field completeness rate is ≥99.9%, and signal noise ratio is higher than 20dB.

[0036] Specifically, the extensible probe interface of the data collection module adopts a microkernel plugin architecture. The interface core layer implements a protocol-independent data receiving framework, supporting the mounting of three types of collection plugins through hot deployment: infrastructure collection plugins interface with container orchestration layer APIs, capturing Kubernetes Pod scheduling events, Docker container resource quota changes, and ServiceEndpoint state transitions in real time; cloud service collection plugins adapt to mainstream cloud platform interfaces, monitoring Alibaba Cloud ECS instance state changes, AWS Lambda function cold start events, and Azure Blob storage access delay surges; database collection plugins embed MySQL slow query log parsing engines, Redis memory fragmentation rate monitors, and MongoDB shard balancing event capturers. Plugins interact with the interface through a two-level adapter: the protocol adaptation layer converts raw data into an intermediate representation, such as converting Kubernetes Watch events into JSONSchema standardized event streams and encapsulating cloud service API responses into Protobuf format messages; the data model layer maps fields according to target signal specifications, such as mapping "execution time" "scan row number" "lock waiting time" in database slow query transactions to sub-field matrices in monitoring data stream signals. The probe interface provides four-dimensional expansion capabilities: the protocol dimension supports the addition of gRPC / WebSocket / MQTT transmission protocol plugins; the data source dimension allows access to new types of data such as message queue accumulation monitoring and CDN edge node delay; the function dimension can extend data pre-aggregation modules (such as minute-level P99 delay statistics); and the security dimension integrates two-way certificate authentication and data encryption channels. When mounting customized collection units, the interface automatically performs three-stage compatibility detection: verifying whether the data collection frequency exceeds the total bus bandwidth limit, checking whether the field naming conforms to the snake naming specification, and evaluating whether the data magnitude triggers adaptive sampling rate adjustment; after all verifications are passed, the new data stream will be integrated into the main monitoring channel.

[0037] In an embodiment of the present application, the intelligent analysis module adopts dynamic topology modeling technology when constructing the service dependency graph. The graph takes the microservice instances recorded in the platform registry center as the node basis, establishes a directed edge relationship through real-time analysis of the call direction and frequency in the link tracking data, and marks the average value of the call success rate and the P99 delay value within the last 10 minutes for each edge. The node attribute layer loads three types of real-time state: the CPU memory disk three-dimensional resource water level mapped by the index data, the error rate and timeout alarm count extracted from the log data, and the inbound and outbound request throughput statistically calculated from the link data. When the abnormal state determination signal indicates that a node is abnormal, the root cause inference algorithm based on graph traversal is started: first, the abnormal node is taken as the starting point to traverse the dependency tree in reverse, and all upstream services that may affect the node are marked as the candidate root cause set; then, the abnormal propagation intensity is calculated along the call path in the forward direction, and the propagation intensity is determined by the weighted product of the edge call success rate and the node resource saturation degree; finally, the root cause probability distribution is generated by comprehensively considering the reverse path depth and the forward propagation intensity, and the nodes with a probability of more than 60% are output as the core content of the root cause positioning signal. The root cause positioning signal also contains the vectorized description of the abnormal propagation path topology, which encodes the service nodes as graph coordinates, converts the call edges into weighted connection lines, and forms a topology snapshot that can be quantitatively analyzed. To cope with the dynamic scaling of service instances, the dependency graph performs incremental updates every 15 seconds: new instances are automatically mounted to the service nodes they belong to, destroyed instances trigger associated edge weight redistribution, and service version changes trigger node attribute template switching. This mechanism ensures that the root cause can still be accurately located in an elastic scaling environment, and the average time consumption of the positioning process is controlled within 80 milliseconds.

[0038] As Figure 2As shown, the graph neural network model adopted by the intelligent analysis module is a three-layer attention network architecture. The input layer receives the pre-processed heterogeneous data vectors: the index time series slice is converted into a 300-dimensional time series feature vector, the log text is generated by the BERT model to generate a 768-dimensional semantic embedding vector, and the link tracking path is encoded into a combination of one-hot vector and graph adjacency matrix. The data fusion stage adopts cross-modal alignment technology to project the three types of vectors within the same time window into a shared feature space, and calculates the correlation weights between indicators, logs and links through cross-attention mechanism. The hidden layer deploys a graph attention network, and the initial feature vector of each service node is composed of the weighted sum of its own cross-modal features and directly connected neighbor node features, and the weight calculation introduces abnormal propagation prior knowledge: edges with call success rate below 95% are assigned a 0.6 decay factor, and nodes with resource saturation exceeding 80% are assigned a 0.8 attention coefficient. After two layers of graph convolution iteration, the node features aggregate three-hop neighbor state information. The output layer includes a double-task branch: the anomaly detection branch outputs the anomaly confidence score of each node through the fully connected layer, and the nodes with scores exceeding the dynamic threshold trigger the abnormal state judgment signal; the root cause positioning branch calculates the node-level abnormal influence factor, and generates the root cause weight ranking combined with the topological position centrality. The model training adopts a semi-supervised mechanism: normal state samples are automatically labeled based on historical data, abnormal samples are generated by injecting fault exercises, and the loss function is designed as the harmonic mean of detection accuracy and positioning accuracy. The model online update follows the gradual principle: incremental training of the previous 24 hours data every morning, and 10% of the historical base model parameters are reserved during full training every week to prevent catastrophic forgetting.

[0039] Further, the adaptive threshold generation unit of the intelligent analysis module implements four-stage dynamic regulation. The first stage is baseline modeling: the monitoring data stream signals are stored in a 7-day cycle, the independent patterns of weekdays and weekends are extracted, and a 24-hour baseline curve is established for each monitoring index. The baseline curve generation uses a robust regression algorithm to eliminate the influence of outliers and fit the expected value interval of each hour. The second stage is fluctuation learning: the deviation of the actual value of the index from the baseline curve is calculated in real time, and the root mean square error and kurtosis coefficient of the deviation are calculated in the time window sliding process. When a change in business activity pattern is detected, the fluctuation range is automatically expanded. The third stage is threshold calculation: according to the index type, the difference strategy is selected, the standard deviation multiple method is used for CPU type index, and the baseline value ± 3 times the rolling standard deviation is taken as the boundary; the percentile method is used for error rate type index, and the P99 value in history is taken as the upper limit; the asymmetric control is implemented for throughput type index, the lower limit is set to 50% of the baseline value, and the upper limit is set to 200% of the baseline value. The fourth stage is real-time adjustment: when a new version of the platform is released or the traffic surges by more than 30%, an emergency learning mode is started to compress the modeling period to 1 hour, and service SLA constraints are introduced to ensure that threshold adjustment does not violate the 99.9% availability commitment. After the threshold out-of-range event is triggered, the unit automatically performs root cause correlation analysis: if three or more indexes of the same service are out of range at the same time, the confidence of the abnormal state judgment signal is increased to 90%; if a single index is temporarily out of range and quickly recovers, a low-confidence observation signal is generated. All threshold parameters are stored in the knowledge base module every hour, supporting three-dimensional retrieval of historical threshold evolution trajectory by service name, index type, and time range.

[0040] As shown in Figure 3 , it is a method for maintaining abnormal state of operation of an Internet platform. S1: real-time acquisition of index data, log data and link tracking data of platform operation, generation of monitoring data stream signals in unified format; S2: receiving the monitoring data stream signals, generating abnormal state judgment signals and root cause positioning signals through multi-source data fusion analysis; S3: receiving the abnormal state judgment signals and the root cause positioning signals, generating operation instruction signals containing handling types and execution parameters in combination with a pre-set rule base; S4: receiving the operation instruction signals, driving platform infrastructure to perform resource adjustment operation or service recovery operation, generating operation result feedback signals; S5: continuously receiving and storing the associated data of the root cause positioning signals and the operation result feedback signals, providing historical case matching signals to the intelligent analysis engine module.

[0041] Further, the treatment strategy knowledge graph of the strategy generation module is constructed using an attribute graph model. The graph ontology defines three types of core entities: the root cause entity contains the microservice name, the fault code, the influence level attribute, the treatment operation entity records the operation script path, the execution time, the risk level, and the environment constraint entity describes the platform version, the resource pool size, the network topology and other conditions. The relationship between entities is designed as a multi-layer structure: the root cause and the operation establish three types of relationships, i.e., “triggerable”, “inhibitable trigger” and “conditional trigger”, the relationship attribute marks the success rate of treatment and the latest effective timestamp; the operation and the constraint establish relationships such as “dependent resource”, “conflicting configuration” and “version limit”, and the relationship attribute stores the Boolean expression of the constraint condition. The graph traversal algorithm uses a bidirectional reasoning mechanism: the positive direction locates the signal from the root cause, extracts the fault code and service coordinates, and retrieves all “triggerable” operations and their associated constraints; the reverse direction matches the constraint conditions from the current platform environment state, and filters the operation paths that do not meet the execution conditions. The matching process introduces a confidence score comprehensive evaluation: the basic confidence score is determined by the historical success rate of the operation, the environment matching degree is calculated by the proportion of constraint conditions that are met, and the time decay factor is linearly decreased based on the latest effective time, and the three are weighted to obtain the final confidence score ranking. When generating the operation instruction signal, the main instruction selects the operation with a comprehensive confidence score greater than 75%, and the alternative solution list retains the top three options in descending order of confidence score. When a new type of root cause is detected, a similarity extension retrieval is started: the vector distance between the unmatched root cause and the existing root cause in the graph is calculated, and if the distance is less than 0.3, the treatment scheme of the similar root cause is recommended and the analogy reasoning identifier is marked. The knowledge graph evolves automatically every week: the associated pairs of new root cause positioning and operation feedback are extracted from the knowledge base module, and after manual review, the entities are combined, the relationships are added or the relationship attributes are updated, and when there is a conflict between entities, the latest timestamp is given priority.

[0042] The abnormal state maintenance system and method for the Internet platform provided by the application can solve the problems of high false alarm and missed alarm rates of abnormal detection, and delay of fault root cause positioning caused by dependence on artificial experience.

[0043] Therefore, the abnormal state maintenance system and method for the Internet platform provided by the application can solve the problems of high false alarm and missed alarm rates of abnormal detection, and delay of fault root cause positioning caused by dependence on artificial experience.

[0044] The above embodiments are only illustrative of the principles of the present application and its efficacy, and are not intended to limit the present application. Any modification or change made by any person skilled in the art without departing from the spirit and scope of the present application shall be covered by the claims of the present application.

Claims

1. A system for maintaining abnormal operation status of an Internet platform, characterized in that: include: A data acquisition module, which collects platform operation indicator data, log data, and link tracking data in real time and generates monitoring data stream signals in a unified format; An intelligent analysis module receives the monitoring data stream signal and generates an abnormal state determination signal and a root cause location signal through multi-source data fusion analysis; A strategy generation module receives the abnormal state determination signal and the root cause location signal, and generates an operation instruction signal including a disposal type and execution parameters in combination with a preset rule base; an execution control module, wherein the execution control module receives the operation instruction signal, drives the platform infrastructure to perform a resource adjustment operation or a service recovery operation, and generates an operation result feedback signal; A knowledge base module continuously receives and stores correlation data between the root cause location signal and the operation result feedback signal, and provides a historical case matching signal to the intelligent analysis engine module.

2. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: The data acquisition module includes a dynamic cleaning unit. This unit performs real-time purification processing on the original indicator data, log data and link tracking data before generating the monitoring data stream signal. The purification processing includes eliminating duplicate collection points, compensating for field defects caused by transmission loss, filtering high-frequency noise interference, and using a sliding time window mechanism to dynamically calculate the benchmark reference value of each data source, converting heterogeneous data into dimensionless standard values. The dynamic cleaning unit autonomously adjusts the purification rules and standardization parameters based on data characteristics to ensure that the monitoring data stream signal meets the input specification requirements of the intelligent analysis module.

3. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: The data acquisition module is equipped with an extensible probe interface that supports on-demand mounting of customized acquisition units for specific infrastructure. The customized acquisition unit captures container orchestration layer resource scheduling events, cloud service interface call status, or database slow transaction records in real time. The captured data is converted into the probe interface format and incorporated into the monitoring data stream signal. The extensible probe interface has a built-in protocol adaptation layer that is compatible with the original data transparent transmission of open source monitoring protocols and private monitoring protocols.

4. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: When the intelligent analysis module performs multi-source data fusion analysis, it constructs a service dependency graph. The graph uses platform microservices as nodes and service call links as edges. Each edge is loaded with historical call success rate and delay statistics. When the abnormal state judgment signal indicates that a node is abnormal, it traverses the adjacent nodes along the dependency edge to calculate the root cause probability distribution, the root cause location signal output probability, the fault node identifier with the highest fault propagation path topology.

5. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: The intelligent analysis module uses a graph neural network model to process monitoring data stream signals. The input layer of the model receives vectorized indicator time-series slice log semantic vectors and link path encoding. The hidden layer aggregates multi-hop neighbor node states through a graph attention mechanism. The output layer generates anomaly confidence scores and root cause node weights. The abnormal state judgment signal and root cause location signal are dynamically generated based on the model output score.

6. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: The intelligent analysis module has a built-in adaptive threshold generation unit. This unit continuously learns the statistical distribution characteristics of historical monitoring data stream signals under normal conditions and dynamically calculates the abnormal judgment boundary values ​​of each monitoring indicator based on the distribution characteristics. When the real-time data exceeds the boundary value, the abnormal state judgment signal is triggered and the boundary value is automatically updated as the platform operation mode changes.

7. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: The preset rule base of the strategy generation module includes a disposal strategy knowledge graph. The knowledge graph uses the root cause type as the entity node to associate the disposal operation entity with the constraint condition entity. After receiving the root cause positioning signal, it starts the graph traversal to match the operation path that meets the current platform environment status and generates an operation instruction signal, and simultaneously outputs the disposal strategy confidence and the alternative strategy set.

8. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: The strategy generation module integrates a reinforcement learning decision engine. The engine uses the operation result feedback signal as the reward function input to continuously optimize the operation instruction generation strategy. Each time an operation instruction signal is generated, the multi-arm bandit algorithm is executed to balance the historical optimal strategy and the new strategy exploration decision engine to dynamically adjust the exploration coefficient according to the platform failure recovery rate.

9. The abnormal operation state maintenance system for an Internet platform according to claim 1, characterized in that: The execution control module includes a sandbox verification unit that receives an operation instruction signal and simulates the execution of resource adjustment operations or service recovery operations in an isolated environment to collect resource change records and service status change data generated by the simulation execution. When the simulation results meet expectations, the actual platform infrastructure is driven to execute; otherwise, the operation instruction rollback signal is triggered.

10. A method for maintaining abnormal operation status of an Internet platform according to any one of claims 1 to 9, characterized in that: include: S1: Collects platform operation indicator data, log data, and link tracking data in real time, and generates monitoring data stream signals in a unified format; S2: Receive the monitoring data stream signal, and generate an abnormal state determination signal and a root cause location signal through multi-source data fusion analysis; S3: receiving the abnormal state determination signal and the root cause location signal, and generating an operation instruction signal including a treatment type and execution parameters in combination with a preset rule base; S4: receiving the operation instruction signal, driving the platform infrastructure to perform a resource adjustment operation or a service recovery operation, and generating an operation result feedback signal; S5: Continuously receive and store the correlation data of the root cause location signal and the operation result feedback signal, and provide a historical case matching signal to the intelligent analysis engine module.

Images