Video live broadcast monitoring system based on data analysis

Abstract

The invention discloses a live video monitoring system based on data analysis, and relates to the technical field of live video monitoring, and the system comprises a flow monitoring module which obtains the flow data of a plurality of live data interfaces in real time, and carries out the preprocessing of the flow data; the feature extraction module is used for extracting time sequence features and spatial distribution features of the preprocessed flow data based on a TrafficFormer model to obtain platform load data; the information acquisition module is used for acquiring an interface log through a preset interface burying point and mining audience behavior data; and the report generation module is used for generating and storing a live broadcast analysis report by integrating the platform load data and the audience behavior data. According to the invention, multidimensional data analysis of live broadcast flow load and user behaviors is realized; by integrating platform load data and behavior data to generate an early warning report containing time-space association, the problems of difficulty in finding potential behavior patterns, low anomaly detection efficiency and insufficient decision basis in the prior art are effectively solved, and dynamic optimization scheduling of resources is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of video live monitoring technology, and particularly relates to a video live monitoring system based on data analysis. BACKGROUND

[0002] The current video monitoring system mainly collects video images by installing various cameras in the monitoring area, such as gun cameras, half-sphere cameras, ball cameras, etc., and transmits the video data to the central management end by using wired or wireless transmission network, sets video management servers, storage servers and display devices in the central management end for centralized management, stores the video signals by using hard disk video recorders or network video recorders and cloud storage, and integrates some systems with artificial intelligence technologies such as face recognition and behavior analysis to realize intelligent analysis, but there are still deficiencies in data analysis, and the overall application is limited by human reliability, display effect, analysis and management ability, environmental factors, network conditions and other factors.

[0003] However, the current common solutions have many shortcomings, including: the existing technology is difficult to discover potential behavior patterns, event trends and other rules from a large amount of video data; the abnormal detection efficiency is low: simply relying on manual or simple threshold judgment to detect abnormal situations is easy to miss some complex and not obvious abnormal behaviors; when facing security events or operation problems, managers are difficult to make scientific and accurate decisions without strong basis obtained through data analysis. SUMMARY

[0004] This section aims to summarize some aspects of the embodiments of the present application and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract and title of the specification to avoid obscuring the purpose of this section, abstract and title, and such simplifications or omissions cannot be used to limit the scope of the present application.

[0005] In view of the above problems of the prior art, the present application is proposed.

[0006] Therefore, the purpose of the present application is to provide a video live monitoring system based on data analysis, which is suitable for solving the problems that the existing technology is difficult to discover potential behavior patterns, event trends and other rules from a large amount of video data; the abnormal detection efficiency is low: simply relying on manual or simple threshold judgment to detect abnormal situations is easy to miss some complex and not obvious abnormal behaviors; when facing security events or operation problems, managers are difficult to make scientific and accurate decisions without strong basis obtained through data analysis.

[0007] To solve the above technical problems, the present application provides the following technical solutions: In a first aspect, embodiments of the present invention provide a video live streaming monitoring system based on data analysis, comprising: a traffic monitoring module for real-time acquisition of traffic data from multiple live streaming data interfaces and preprocessing the traffic data; a feature extraction module for extracting temporal and spatial distribution features of the preprocessed traffic data based on the TrafficFormer model to obtain platform load data; an information acquisition module for acquiring interface logs and mining audience behavior data through preset interface embedding points; and a report generation module for generating and storing a live streaming analysis report by integrating the platform load data and audience behavior data.

[0008] As a preferred embodiment of the video live streaming monitoring system based on data analysis described in this invention, the traffic data includes the size of the traffic data packet, basic information of the data port identifier, and transmission stability indicators; the traffic data is obtained through a real-time monitoring data interface; the platform load data includes traffic time-series characteristics, traffic spatial distribution characteristics, and comprehensive load indicators; the audience behavior data includes behavior pattern association rules, behavior support and confidence, and hierarchical behavior characteristics.

[0009] As a preferred embodiment of the video live streaming monitoring system based on data analysis described in this invention, the process of extracting the temporal and spatial distribution features of traffic data based on the TrafficFormer model to obtain platform load data includes the following steps: based on the preprocessed traffic data, the traffic temporal data is mapped into a low-dimensional vector through the embedding layer of the TrafficFormer model; location encoding is added; the data is processed through a multi-layer Transformer encoder, with each layer performing the following: calculating the query matrix, key matrix, and value matrix and calculating the attention output; and weighted summation of the features of each data interface according to their weights to generate platform load data.

[0010] As a preferred embodiment of the video live streaming monitoring system based on data analysis described in this invention, the location code is added by adding the low-dimensional vector to the location code element by element to obtain an input vector containing time sequence information.

[0011] As a preferred embodiment of the video live streaming monitoring system based on data analysis described in this invention, the method for obtaining interface logs through preset interface embedding points to mine audience behavior data includes the following steps: filtering interface logs based on business chain identifiers, retaining logs whose business chain identifiers are equal to the target identifier, and generating a target interface log set; using time windows... Units, by timestamp Target interface log collection Divided into hierarchical log collections ,satisfy:

[0012] In the formula, is an index of the hierarchical log set; is a time window size; is a timestamp of the target interface log.

[0013] As a preferred scheme of the video live monitoring system based on data analysis, the mining of the audience behavior data adopts an Apriori algorithm, comprising: calculating the support of behavior transactions in the hierarchical log; retaining frequent item sets with support greater than or equal to a minimum support; generating association rules for the frequent item sets and calculating the confidence; and retaining rules with confidence greater than or equal to a minimum confidence.

[0014] As a preferred scheme of the video live monitoring system based on data analysis, the generation of the live analysis report comprises: spatiotemporal correlation of the platform load data and the audience behavior data; generation of a warning report when any of the following conditions is detected: the platform load data exceeds a platform carrying capacity threshold; a high-risk behavior mode with support greater than a support threshold and confidence greater than a confidence threshold is found; and storage of the report in a distributed database and marking of a timestamp.

[0015] As a preferred scheme of the video live monitoring system based on data analysis, the platform carrying capacity threshold is calculated as follows:

[0016] In the formula, is a platform carrying capacity threshold; is a historical load mean value; is a standard deviation.

[0017] As a preferred scheme of the video live monitoring system based on data analysis, the time window is dynamically adjusted according to user interaction characteristics of platform business types.

[0018] As a preferred scheme of the video live monitoring system based on data analysis, the system further comprises a real-time response module, and the specific content is as follows: when the platform load data is greater than or equal to the platform carrying capacity threshold, it indicates that the current traffic load of the platform has reached an emergency state requiring immediate intervention, a warning report containing load abnormal information is automatically generated, and an abnormal timestamp and a high-load interface distribution are marked; when the platform load data is less than the platform carrying capacity threshold, it indicates that the platform load is within the range of regular monitoring, and no emergency expansion is triggered, and the load trend is continuously monitored; when a high-risk behavior mode is detected, an alarm is pushed to a management terminal in real time, and the alarm content includes specific rules of the high-risk behavior mode, an event window and an impact range of the behavior occurrence, and a suggested artificial verification direction.

[0019] The beneficial effects of the present application are: the present application classifies and screens the multi-interface traffic data through the flow monitoring module, combines the TrafficFormer model to deeply extract the traffic time sequence and spatial distribution characteristics, simultaneously uses the Apriori algorithm of the dynamic time window to mine the audience behavior association rules, realizes the multi-dimensional data analysis on the live traffic load and user behavior, generates the early warning report containing the space-time association by integrating the platform load data and behavior data, and dynamically calculates the threshold value based on the historical load mean and standard deviation to trigger the automatic expansion or alarm push, effectively solves the problems of difficult potential behavior pattern discovery, low abnormal detection efficiency and insufficient decision basis in the prior art, can accurately identify traffic anomalies and high-risk behavior patterns, provides scientific data support for managers, improves the stability and operation decision efficiency of the live platform, and realizes the dynamic optimization scheduling of resources. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor. Among them: Figure 1 The flowchart for the implementation of the present application in embodiment 1.

[0021] Figure 2 The flowchart for generating a live analysis report in embodiment 1.

[0022] Figure 3 The technical architecture flowchart of the present application in embodiment 1. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification.

[0024] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the connotation of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0025] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an independent or alternative embodiment that excludes other embodiments.

[0026] Embodiment 1 Referring to Figure 1 , Figure 2 and Figure 3 , a first embodiment of the present application provides a video live monitoring system based on data analysis, comprising the following steps: S1: traffic monitoring module: real-time acquisition of traffic data of multiple live data interfaces, and preprocessing of the traffic data.

[0027] Specifically, the traffic data includes the size of the traffic data packet, the data port identification basic information, and the transmission stability index.

[0028] Further, the traffic data is acquired through real-time monitoring of the data interface.

[0029] Further, the platform load data includes traffic time sequence characteristics, traffic spatial distribution characteristics, and comprehensive load indicators.

[0030] Further, the audience behavior data includes behavior pattern association rules, behavior support and confidence, and hierarchical behavior characteristics.

[0031] It should be noted that the preprocessing of the traffic data is traffic data classification and traffic data filtering.

[0032] Further, the traffic data classification includes the following steps: Based on the data port identification IDport, the traffic data packet is divided into the corresponding set. Assuming that there are n data ports, for any traffic data packet P, its data port identification is IDport, define Ci as the traffic data set corresponding to the i-th data port, i=1, 2, 3..., n, for any traffic data packet P, if its IDport=i, then P∈Cᵢ.

[0033] Further, the traffic data filtering includes the following steps: Assuming that the preset traffic filtering model is based on the traffic size threshold Tsize and the data transmission stability index S, such as packet loss rate, delay jitter, etc. For each traffic data packet in the classified traffic data set Ci, the size is sizej, the stability index is sj, and the filtering condition is: sizej>=Tsize and sj<=S. Only the traffic data packet that meets the two conditions will be retained to form a new data interface traffic data set , which is used to filter invalid traffic and ensure the effectiveness of subsequent analysis data.

[0034] ​​Exemplarily, in the e-commerce live broadcast, the system obtains traffic data of a payment interface (IDport=101) and a barrage interface (IDport=202) in real time, the traffic data packet of the payment interface is classified into the set because it involves fund transactions, the barrage traffic is classified into , then the system screens data packets with a size ≥ 1 MB and a packet loss rate ≤ 5% in the payment interface to form a set , and ensures the effectiveness of subsequent analysis data.

[0035] S2: Feature extraction module: extract the time sequence features and spatial distribution features of the traffic data based on the TrafficFormer model to obtain platform load data.

[0036] Preferably, the step of extracting the time sequence features and spatial distribution features of the traffic data based on the TrafficFormer model to obtain platform load data comprises the following steps: According to the preprocessed traffic data, the traffic time sequence data is mapped to a low-dimensional vector by the embedding layer of the TrafficFormer model.

[0037] Add position encoding , the calculation formula is as follows: ,

[0038] In the formula, , is the position encoding; is the time position, which identifies the time sequence of the traffic data; is the dimension index, which determines the dimension position of the position encoding in the vector; is the model dimension, which controls the periodic change frequency of the position encoding.

[0039] It should be noted that adding position encoding can capture the time sequence dependence of data traffic. Traffic data has a strict time sequence. Position encoding gives each time step a unique position feature through sine / cosine functions, enabling the TrafficFormer model to identify the periodicity and sudden changes of traffic. The Transformer model itself does not have time sequence modeling capability, and its self-attention mechanism can only capture the correlation between elements and cannot distinguish the sequence order (e.g., it cannot determine the order of “t1 traffic” and “t2 traffic”). Therefore, time sequence information must be explicitly introduced through position encoding.

[0040] Through a multi-layer Transformer encoder, each layer performs: Calculate the query matrix Key matrix and value matrix And calculate the attention output, the specific formula is as follows:

[0041] In the formula, For the first Transformer output characteristics of each data interface; This is a query matrix used to calculate the correlation between the current location and other locations; This is a key matrix used to identify key features and information about the data; It is a value matrix, containing the actual feature values ​​of the data; Let K be the dimension of the key matrix.

[0042] The platform load data is generated by weighted summation of the features of each data interface according to their respective weights. The calculation formula is as follows:

[0043] In the formula, This is platform load data; For the first The business importance weight of each data interface; The first output of Transformer Individual interface traffic characteristics; This represents the total number of data interfaces.

[0044] It should be noted that the platform load data integrates time-series characteristics (such as peak traffic time) and spatial distribution characteristics (such as the load ratio of each interface) through weighted summation, and combines business weights (such as the payment interface having a higher weight than the bullet screen interface), to achieve a more accurate load assessment than traditional single-dimensional monitoring (such as only looking at bandwidth usage).

[0045] For example, in a game live streaming scenario, the TrafficFormer model performs an embedding layer mapping on the preprocessed traffic data to generate a low-dimensional vector. It calculates the time sequence information through the position encoding formula, and then processes it through a 6-layer Transformer encoder to output the traffic characteristics of each interface. Finally, it combines the business importance weight (such as a weight of 0.8 for the core game interface) to generate platform load data and identify the abnormal situation of "excessive load on the real-time battle interface".

[0046] S3: Information Acquisition Module: Acquires interface logs and mines audience behavior data through preset interface tracking points.

[0047] Preferably, obtaining interface logs through the preset interface tracking points to mine audience behavior data includes the following steps: Based on business chain identifier Filtering interface logs, retaining service chain identifier = target identifier of logs, generating target interface log set .

[0048] In time window , according to timestamp Divide target interface log set into hierarchical log set , meet:

[0049] In the formula, Index of hierarchical log set Size of time window Timestamp of target interface log

[0050] Specifically, the mining of audience behavior data adopts Apriori algorithm, including: Calculate the support of behavior transactions in hierarchical logs , the specific formula is as follows:

[0051] In the formula, Support of behavior transactions , measure the universality of behavior patterns, used to filter frequent item sets; Behavior transaction, indicating the target behavior pattern that needs to calculate the support; The number of transactions containing in all transactions .

[0052] Retain frequent item sets with support greater than or equal to minimum support.

[0053] Generate association rules for frequent item sets , and calculate confidence, the specific formula is as follows:

[0054] In the formula, Confidence of association rules ; , Frequent item set, indicating the condition ( ) and result ( ) of behavior pattern; Support of transactions containing and ; Containing Support for transactions.

[0055] Rules with a confidence level greater than or equal to the minimum confidence level are retained to reflect the association patterns between audience behaviors.

[0056] It should be noted that the Apriori algorithm is a classic algorithm used to mine association rules in audience behavior data. Its core is to filter out frequent itemsets and strong association rules by calculating the support and confidence of behavioral transactions.

[0057] Furthermore, the time window The platform will be dynamically adjusted based on the user interaction characteristics of its various business types, as detailed below: For business types with high interaction frequency and drastic traffic fluctuations, a small time window is used to capture real-time behavioral changes.

[0058] For business types with low interaction frequency and strong content continuity, a large time window is used to aggregate long-cycle behavioral characteristics.

[0059] The dynamic adjustment rules are implemented through a preset business type-time window mapping table, which allows administrators to customize the configuration according to actual business scenarios.

[0060] For example, in educational live streaming, the system obtains user viewing logs through interface tracking, filters out logs related to "course explanation" based on business chain identifiers, divides the log set into hierarchical levels using a 30-minute time window, and uses the Apriori algorithm to mine behavioral patterns, discovering the association rule of "watching for 20 minutes → asking questions", with a support of 30% and a confidence of 80%, triggering optimization suggestions for course content.

[0061] S4: Report Generation Module: Generates and stores live streaming analysis reports by integrating platform load data and audience behavior data.

[0062] Preferably, the generation of the live broadcast analysis report includes: Platform load data Spatiotemporal correlation with audience behavior data.

[0063] An alert report will be generated when any of the following conditions are detected: Platform load data Exceeding the platform's carrying capacity threshold; High-risk behavioral patterns were identified with both support and confidence levels exceeding the support threshold.

[0064] Store the report in a distributed database and add a timestamp.

[0065] Specifically, the platform's load-bearing capacity threshold is calculated as follows:

[0066] In the formula, is a platform carrying capacity threshold value; is a historical load average; is a standard deviation.

[0067] Further, the system further comprises a real-time response module, and specific contents are as follows: When the platform load data is greater than or equal to the platform carrying capacity threshold value, it indicates that the current traffic load of the platform has reached an emergency state that needs immediate intervention, a pre-warning report containing load abnormal information is automatically generated, and an abnormal timestamp and a high load interface distribution are marked.

[0068] When the platform load data is less than the platform carrying capacity threshold value, it indicates that the platform load is in a regular monitoring range, and there is no need to trigger emergency expansion, and the load trend is continuously monitored.

[0069] When a high-risk behavior mode is detected, an alarm is pushed to a management terminal in real time, the alarm content includes specific rules of the high-risk behavior mode, an event window in which the behavior occurs, an influence range and a suggested manual verification direction, an operation and maintenance personnel verifies whether sensitive information or technical faults exist in the live content according to the alarm information; the interface interaction logic is adjusted, and if a user complaint trend is involved, a customer service priority response mechanism is triggered.

[0070] For example, in a promotion activity, the system integrates the load data (more than 120% of the threshold value) of the payment interface and the user behavior data (high-risk rule “not paying after adding to cart”) to generate a time-space correlation pre-warning report, which indicates that the payment interface load peak and the user adding-to-cart behavior occur in the same time window (19:00-19:10), and it is suggested to immediately expand the payment service and optimize the payment page interaction logic.

[0071] In summary, the present application classifies, screens and pre-processes the multi-interface traffic data through the traffic monitoring module, deeply extracts the traffic time sequence and spatial distribution features in combination with the TrafficFormer model, simultaneously mines the audience behavior association rules by using the Apriori algorithm of the dynamic time window, and realizes the multi-dimensional data analysis of the live traffic load and user behavior; the pre-warning report containing the time-space correlation is generated by integrating the platform load data and the behavior data, and the threshold value is dynamically calculated based on the historical load average and the standard deviation to trigger automatic expansion or alarm pushing, which effectively solves the problems of difficult potential behavior mode discovery, low abnormality detection efficiency and insufficient decision basis in the prior art, can accurately identify traffic abnormalities and high-risk behavior modes, provides scientific data support for managers, improves the stability and operation decision efficiency of the live platform, and realizes dynamic optimization and scheduling of resources.

[0072] Embodiment 2, which is an embodiment of the present application, differs from the previous embodiment in that: If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0073] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered a list of executable instructions for implementing logic functions, and can be specifically embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions, or in conjunction with these instructions. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport programs for use by an instruction execution system, apparatus, or device, or in conjunction with these instructions.

[0074] More specific examples (non-exhaustive list) of the computer-readable medium include the following: an electrical connection having one or more wires (electrical devices), a portable computer diskette (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CD ROM). In addition, the computer readable medium can even be paper or other suitable medium on which the program can be printed, because the program can be obtained electronically, for example, by optical scanning of the paper or other medium, followed by editing, interpreting, or otherwise processing, if necessary, in other suitable ways to obtain the electronic program, and then storing it in the computer memory.

[0075] It should be understood that portions of the present application can be implemented in hardware, software, firmware, or combinations thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, implementation can be with any or a combination of the following technologies, which are all well known in the art: a discrete logic circuit having logic gates for implementing logic functions upon an application of data signals, an application specific integrated circuit having appropriate combinational logic gates, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0076] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A video live streaming monitoring system based on data analysis, characterized in that: include: Traffic monitoring module: acquires traffic data from multiple live streaming data interfaces in real time and preprocesses the traffic data; Feature extraction module: Based on the TrafficFormer model, extract the temporal and spatial distribution features of the preprocessed traffic data to obtain platform load data; Information acquisition module: Acquires interface logs and mines audience behavior data through preset interface tracking points; Report generation module: Generates and stores live streaming analysis reports by integrating the platform load data and audience behavior data.

2. The video live streaming monitoring system based on data analysis as described in claim 1, characterized in that: The traffic data includes the size of the traffic data packets, basic information about the data port identifier, and transmission stability indicators. The traffic data is obtained through a real-time monitoring data interface; The platform load data includes traffic time-series characteristics, traffic spatial distribution characteristics, and comprehensive load indicators; The audience behavior data includes behavior pattern association rules, behavior support and confidence, and hierarchical behavior features.

3. The video live streaming monitoring system based on data analysis as described in claim 2, characterized in that: The steps involved in extracting the temporal and spatial distribution features of traffic data based on the TrafficFormer model to obtain platform load data are as follows: Based on the preprocessed traffic data, the traffic time series data is mapped into a low-dimensional vector through the embedding layer of the TrafficFormer model; Add location encoding; Processed through a multi-layer Transformer encoder, each layer performs the following: Calculate the query matrix, key matrix, and value matrix, and then calculate the attention output. The platform load data is generated by weighting and summing the features of each data interface according to their respective weights.

4. The video live streaming monitoring system based on data analysis as described in claim 3, characterized in that: The position code is added as follows: the low-dimensional vector is added to the position code element by element to obtain an input vector containing timing information.

5. The video live streaming monitoring system based on data analysis as described in claim 4, characterized in that: To obtain interface logs through the preset interface tracking points and mine audience behavior data, the following steps are included: Filter interface logs based on business chain identifiers, retain logs whose business chain identifiers are equal to the target identifier, and generate a target interface log set. With time window Units, by timestamp Target interface log collection Divided into hierarchical log collections ,satisfy: In the formula, An index for a hierarchical log collection; The size of the time window; The timestamp for the target interface log.

6. The video live streaming monitoring system based on data analysis as described in claim 5, characterized in that: The audience behavior data mining employs the Apriori algorithm, including: Calculate the support for behavioral transactions in the hierarchical log; Retain frequent itemsets with support greater than or equal to the minimum support; Generate association rules for frequent itemsets and calculate their confidence scores; Rules with a confidence level greater than or equal to the minimum confidence level are retained.

7. The video live streaming monitoring system based on data analysis as described in claim 6, characterized in that: The generated live stream analysis report includes: Spatiotemporal correlation between platform load data and audience behavior data; An alert report is generated when any of the following conditions are detected: The platform load data exceeds the platform's capacity threshold; High-risk behavioral patterns were identified with both support and confidence levels exceeding the support threshold. Store the report in a distributed database and add a timestamp.

8. The video live streaming monitoring system based on data analysis as described in claim 7, characterized in that: The platform's load-bearing capacity threshold is calculated as follows: In the formula, This represents the platform's carrying capacity threshold. This represents the historical average load. The standard deviation is denoted as .

9. The video live streaming monitoring system based on data analysis as described in claim 7, characterized in that: The time window is dynamically adjusted based on the user interaction characteristics of the platform's business type.

10. The video live streaming monitoring system based on data analysis as described in claim 7, characterized in that: The system also includes a real-time response module, the details of which are as follows: When the platform load data is greater than or equal to the platform carrying capacity threshold, it indicates that the current traffic load of the platform has reached an emergency state that requires immediate intervention. An early warning report containing abnormal load information will be automatically generated, and the abnormal timestamp and distribution of high-load interfaces will be marked. When the platform load data is less than the platform capacity threshold, it means that the platform load is within the normal monitoring range, there is no need to trigger emergency expansion, and the load trend should be continuously monitored. When a high-risk behavior pattern is detected, an alarm is pushed to the management terminal in real time. The alarm content includes the specific rules of the high-risk behavior pattern, the event window in which the behavior occurred and the scope of its impact, as well as suggested directions for manual verification.

Images