Enterprise operation data early warning method and system fusing index adjustment

Abstract

The application discloses a kind of enterprise operation data early warning method and system of fusion index adjustment, is specifically related to data early warning field, including by selecting enterprise operation data acquisition with local response capability edge computing node, in the non-high load cycle of enterprise operation, to each edge computing node injects preset input data sequence, edge computing node is guided to the minimum response path under operation, obtains the disturbance response output sequence of edge computing node, by time alignment with the reference output sequence that the edge computing node records in historical stable cycle to disturbance response output sequence, difference value is handled by sliding window and forms structure residual change track;The application is by dynamic spectrum offset analysis and multi-time scale monitoring, real-time identification of those not error but already failed node, discovers slow degradation mode, to solve the problem that existing early warning system cannot identify pseudo-normal node.

Description

Technical Field

[0001] This invention relates to the field of data early warning technology, and more specifically, to a method and system for early warning of enterprise operation data that integrates indicator adjustments. Background Technology

[0002] In the existing enterprise operation data monitoring system, node security faces a highly hidden problem that is generally overlooked by the technical system: some edge nodes experience a gradual degradation in hardware performance or logical path during non-high load operation, but because the output still falls within the system tolerance range, no abnormal alarms are triggered, and they are judged as normal. Existing technologies mostly rely on threshold monitoring and periodic callback mechanisms, which can only identify sudden or significant faults, and are completely ineffective against such pseudo-normal nodes whose outputs gradually deviate and have no sudden change signals.

[0003] More seriously, these nodes continuously transmit slightly biased indicators upstream, which then permeate the overall analysis results through the indicator fusion mechanism. This leads to a misled steady state in key models such as profit forecasting and strategy adjustment for enterprises. Ultimately, the existing node security system lacks a dynamic identification mechanism for slow degradation patterns and cannot detect these nodes that have failed without reporting errors, thus constituting a fatal structural risk to the current early warning system. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide an enterprise operation data early warning method and system that integrates indicator adjustments. Through dynamic spectrum offset analysis and multi-timescale monitoring, it identifies nodes that have failed without reporting errors in real time and discovers gradual degradation patterns, thereby solving the problem that existing early warning systems cannot identify pseudo-normal nodes.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for early warning of enterprise operational data that integrates indicator adjustments, comprising:

[0006] S1. By selecting edge computing nodes with local response capabilities in enterprise operation data collection, a preset input data sequence is injected into each edge computing node during the non-high load period of enterprise operation, guiding the edge computing node to run under the minimum response path, and obtaining the disturbance response output sequence of the edge computing node.

[0007] S2. By aligning the disturbance response output sequence with the baseline output sequence recorded by the edge computing node in the historical stable period, the difference between the two is processed by a sliding window to form the structural residual change trajectory.

[0008] S3. By performing a discrete Fourier transform on the structural residual change trajectory, the main peak frequency and energy centroid in the low-frequency range are extracted, and the frequency domain response feature set of the edge computing node is constructed.

[0009] S4. By calculating the Euclidean distance between the frequency domain response feature set and the preset historical frequency domain reference set of similar edge computing nodes, the spectral offset vector of the edge computing node is obtained.

[0010] S5. If the spectrum offset vector continuously exceeds the preset spectrum offset threshold across multiple time scales, the output index of the edge computing node is marked as abnormal; otherwise, the edge computing node is kept in normal state.

[0011] S6. By assigning dynamic weight attenuation values ​​to abnormal indicators based on their spectral offset amplitude and duration, and participating them in the fusion calculation of enterprise operation indicators, adjusted operation indicators are generated. If the operation indicator reaches the early warning trigger threshold, the corresponding indicator path is output as an early warning item; otherwise, the corresponding indicator path is kept in the subsequent normal calculation.

[0012] In a preferred embodiment, in S1, the input distribution characteristics of each edge computing node under low load are obtained by statistically analyzing the range of input index values ​​recorded by each edge computing node within a historical stable period. Then, based on these distribution characteristics, an input data sequence containing periodic slight disturbance components and amplitude-controlled random noise components is constructed.

[0013] The input data sequence is input to each edge computing node in a set order, and the edge computing node is controlled to call its local computing link only to perform the minimum response path operation driven by the input data sequence without responding to any external business requests, thus forming the continuous operation state of the edge computing node under light disturbance conditions.

[0014] By monitoring the output indicators generated by each edge computing node in real time for each item of the input data sequence under continuous operation, the initial data set of the disturbance response that constitutes the complete response process is collected.

[0015] The initial data set of the disturbance response is divided into segments according to a fixed period length. Then, each segment is subjected to period integrity detection and noise disturbance removal in sequence. Segments containing high-frequency jitter or abrupt changes are filtered out, and the complete disturbance response output sequence that meets the stability condition is output.

[0016] In a preferred embodiment, in S2, a set of output index corresponding data pairs with a complete time-series pairing relationship is obtained by matching the disturbance response output sequence with the benchmark output sequence recorded by the edge computing node in the historical stable period according to the time index.

[0017] By performing difference calculation on each output index corresponding data pair in the output index corresponding data pair, a response offset value sequence covering the entire disturbance period is generated, and then the response offset value sequence is normalized.

[0018] By setting sliding window lengths with multiple nested scales, the normalized response offset value sequence is divided into multiple window segments in chronological order. In each window segment, a local change modeling operation based on the residual fitting curve is performed to extract the response offset slope parameter and fluctuation amplitude index within each window segment.

[0019] By concatenating the response offset slope parameter extracted from each window segment with the fluctuation amplitude index in a time series order, a complete structural residual change trajectory is formed. During the trajectory concatenation process, a weighted smoothing process based on the continuity of cross-window fitting is applied to output a continuous residual trend expression structure for subsequent frequency domain response feature extraction.

[0020] In a preferred embodiment, in S3, the amplitude and phase information of each frequency component are calculated by inputting the structural residual change trajectory into the discrete Fourier transform algorithm. Based on the amplitude and phase information of these frequency components, the distribution characteristics of the structural residual change trajectory in the frequency domain are extracted, and the frequency domain response map of the edge computing node is constructed.

[0021] Extract the frequency signal components in the low-frequency range from the frequency domain response spectrum, identify the main peak frequency in the frequency signal, and calculate the amplitude and phase information of the main peak frequency.

[0022] The energy value of each frequency component is obtained by calculating the square of the amplitude of the frequency signal components in the low frequency range, and the energy centroid position of the frequency signal is calculated based on these energy values. This centroid position is used as a key indicator of the frequency domain response of the edge computing node.

[0023] The main peak frequency and the energy centroid location are integrated to form a complete set of frequency domain response features for the edge computing node.

[0024] In a preferred embodiment, in S4, by obtaining the frequency domain response feature set of each edge computing node and the historical frequency domain reference set of the same type as the edge computing node, the frequency components of the two are matched one by one, and the frequency domain response data is standardized by weighted averaging based on the amplitude and phase information of each frequency component, thereby constructing a unified standardized frequency domain response dataset.

[0025] The standardized frequency domain response dataset and the historical frequency domain benchmark set are used to calculate the Euclidean distance band by band. Based on the calculation results, the spectral offset of each edge computing node relative to its benchmark node is obtained, thereby determining the degree of deviation of the edge computing node in the frequency domain.

[0026] Based on the spectral offset calculation results, a spectral offset vector is generated from the spectral offset of each edge computing node. This spectral offset vector is then used to quantitatively express the magnitude and trend of the edge computing node's change in the frequency domain, thus forming a frequency domain offset feature representation of the edge computing node.

[0027] The spectral offset vector is input into a preset spectral offset threshold determination algorithm. The algorithm compares whether the spectral offset of the edge computing node exceeds the preset threshold. If the offset exceeds the threshold, the edge computing node is identified as an abnormal node and its abnormal status is output. If the offset does not exceed the threshold, the edge computing node is kept in a normal state.

[0028] In a preferred embodiment, in S5, the spectral offset vector of each edge computing node is obtained, and the spectral offset vector is divided into multiple time windows. A spectral offset value sequence is generated based on the spectral offset value in each time window.

[0029] The spectral offset value sequence is compared with a preset spectral offset threshold. The deviation between the spectral offset and the preset threshold in each time window is calculated. Then, the spectral offset exceeding the limit in each time window is statistically analyzed, the spectral offset exceeding the limit detection result is output, and it is identified whether there is a trend of spectral offset continuously exceeding the threshold in multiple time scales.

[0030] By identifying whether there is a trend of continuously exceeding the preset spectrum offset threshold, the output index of the edge computing node with the offset exceeding the limit is marked as abnormal, and the abnormality level is determined according to the magnitude of the deviation value. Finally, the abnormality identifier and abnormality level of the edge computing node are output.

[0031] The output metrics of edge computing nodes whose spectral offset vectors do not exceed the preset threshold are maintained in a normal state, and the output metrics of these edge computing nodes continue to participate in the subsequent operation metric fusion calculation, ultimately outputting the fusion result in a normal state.

[0032] In a preferred embodiment, in S6, the dynamic weight decay factor of the edge computing node is calculated by obtaining the magnitude and duration of the spectral offset vector of each edge computing node.

[0033] The dynamic weight decay factor is weighted and fused with the operational indicators under normal conditions to generate the adjusted operational indicators, and the trend of their change in the overall operation of the enterprise is evaluated based on the adjusted operational indicators.

[0034] The adjusted operational indicators are compared with the preset warning trigger thresholds. If an operational indicator exceeds the warning trigger threshold, the operational indicator is marked as abnormal and the abnormal indicator is output as a warning item. Then, the effectiveness of the abnormal indicator is verified by comparing historical data, and the potential risk value of the warning item is further calculated.

[0035] If the adjusted operating metric does not exceed the warning trigger threshold, the operating metric will be maintained as normal, and the adjusted operating metric will continue to be used as input for subsequent calculations and decisions.

[0036] In a preferred embodiment, an enterprise operation data early warning system for fusion indicator adjustment includes a response acquisition module, a residual generation module, a feature extraction module, a distance calculation module, an anomaly identification module, and a fusion adjustment module.

[0037] The response acquisition module selects edge computing nodes with local indicator processing and response generation capabilities from the enterprise operation data collection, injects a set of standardized perturbation input sequences into each edge computing node during the non-high load period of enterprise operation, guides the edge computing nodes to run under the minimum response path, and obtains the perturbation response output sequence of the edge computing nodes.

[0038] The residual generation module aligns the disturbance response output sequence with the baseline output sequence recorded by the edge computing node during the historical stable period in time, and processes the difference between the two through a sliding window to form the structural residual change trajectory.

[0039] The feature extraction module extracts the main peak frequency and energy centroid in the low-frequency range by performing a discrete Fourier transform on the structural residual change trajectory, and constructs a set of frequency domain response features for the edge computing node.

[0040] The distance calculation module obtains the spectral offset vector of the edge computing node by calculating the Euclidean distance between the set of frequency domain response features and the set of historical frequency domain benchmarks of similar edge computing nodes;

[0041] The anomaly detection module determines whether the spectral offset vector continuously exceeds the preset spectral offset threshold over multiple time scales. If the offset amplitude and offset persistence conditions are met, the edge computing node is identified as a slowly degrading node, and its corresponding output index is marked as an abnormal index. If not, the index status of the edge computing node is retained as the default normal label under the current version.

[0042] The fusion adjustment module assigns dynamic weight attenuation values ​​to abnormal indicators based on their spectral offset magnitude and duration, and participates in the fusion calculation of enterprise operation indicators to generate adjusted operation indicators. If the operation indicator reaches the early warning trigger threshold, the corresponding target indicator path is output as an early warning item; if it does not reach the threshold, the current indicator path is maintained in a normal state and continues to participate in subsequent fusion.

[0043] The technical effects and advantages of this invention are as follows:

[0044] 1. This solution identifies slowly degrading nodes that have not triggered traditional threshold alarms by dynamically monitoring the spectral shift of edge computing nodes during low load periods. By analyzing frequency domain characteristics and shift trends, it overcomes the limitation of traditional methods that only identify sudden failures, thereby identifying potential pseudo-normal nodes to ensure the accuracy of enterprise operation data.

[0045] 2. This solution dynamically detects and adjusts node performance changes by real-time monitoring of node spectral shift, combined with sliding window and multi-scale analysis, in order to identify node security risks and predict node failure risks, thereby optimizing the early warning mechanism for enterprise operational data.

[0046] 3. This solution quantifies the abnormal performance of each edge computing node by accurately analyzing the frequency domain response of the nodes, ensuring the accurate calculation of key operational indicators and avoiding errors introduced by pseudo-normal nodes.

[0047] 4. This solution detects persistent deviations exceeding the preset threshold across multiple time scales by comparing and analyzing the spectral offset vector with the preset threshold, thereby enabling a quantitative assessment of the persistence of abnormal events and providing a basis for risk assessment and intervention in enterprise operations.

[0048] 5. This solution incorporates a dynamic weight decay factor to perform fusion calculations on abnormal indicators, enabling the adjusted operational indicators to accurately reflect the company's operational status and helping the company effectively cope with complex operating environments and optimize resource allocation. Attached Figure Description

[0049] Figure 1 This is a flowchart of the method steps of the present invention.

[0050] Figure 2 This is a system module diagram of the present invention.

[0051] Figure 3 This is a flowchart of the node initialization and response generation process of the present invention.

[0052] Figure 4 This is a flowchart of the spectrum shift detection and early warning generation process of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Refer to the instruction manual appendix Figure 1-4 An embodiment of the present invention provides an enterprise operation data early warning method for adjusting integrated indicators, comprising:

[0055] S1. By selecting edge computing nodes with local response capabilities in enterprise operation data collection, a preset input data sequence is injected into each edge computing node during the non-high load period of enterprise operation to construct a light load disturbance scenario. The preset input data sequence includes periodic slight disturbances and amplitude-controlled random noise, guiding the edge computing nodes to run under the minimum response path and obtaining the disturbance response output sequence of the edge computing nodes.

[0056] S2. By aligning the disturbance response output sequence with the baseline output sequence recorded by the edge computing node in the historical stable period, the difference between the two is processed by a sliding window to form the structural residual change trajectory.

[0057] S3. By performing a discrete Fourier transform on the structural residual change trajectory, the main peak frequency and energy centroid in the low-frequency range are extracted, and the frequency domain response feature set of the edge computing node is constructed.

[0058] S4. By calculating the Euclidean distance between the frequency domain response feature set and the preset historical frequency domain reference set of similar edge computing nodes, the spectral offset vector of the edge computing node is obtained.

[0059] S5. If the spectrum offset vector continuously exceeds the preset spectrum offset threshold across multiple time scales, the output index of the edge computing node is marked as abnormal; otherwise, the edge computing node is kept in normal state.

[0060] S6. By assigning dynamic weight attenuation values ​​to abnormal indicators based on their spectral offset amplitude and duration, and participating them in the fusion calculation of enterprise operation indicators, adjusted operation indicators are generated. If the operation indicator reaches the early warning trigger threshold, the corresponding indicator path is output as an early warning item; otherwise, the corresponding indicator path is kept in the subsequent normal calculation.

[0061] In S1, by statistically analyzing the range of input index values ​​recorded by each edge computing node within a historical stable period, the input distribution characteristics of each edge computing node under low load are obtained. Then, based on these distribution characteristics, an input data sequence containing periodic slight disturbance components and amplitude-controlled random noise components is constructed to generate a controllable disturbance signal within the sensitive range of edge computing node load state changes.

[0062] The input data sequence is input to each edge computing node in a set order, and the edge computing node is controlled to call its local computing link only to perform the minimum response path operation driven by the input data sequence without responding to any external business requests, thus forming the continuous operation state of the edge computing node under light disturbance conditions.

[0063] By monitoring the output metrics generated by each edge computing node in real time for each item of the input data sequence under continuous operation, the initial set of disturbance response data constituting the complete response process is collected to present the real-time response behavior of edge computing nodes under low load conditions.

[0064] The initial data set of the disturbance response is divided into segments according to a fixed period length. Then, each segment is subjected to periodic integrity detection and noise disturbance removal. Segments containing high-frequency jitter or abrupt changes are filtered out, and the complete disturbance response output sequence that meets the stability condition is output as the input basis for the subsequent construction of the structural residual change trajectory.

[0065] In S2, by matching the disturbance response output sequence with the baseline output sequence recorded by the edge computing node in the historical stable period according to the time index, a set of output index corresponding data pairs with a complete time-series pairing relationship is obtained, which is used to construct a reference structure under a unified time axis.

[0066] By performing difference calculation on each output index corresponding data pair in the output index corresponding data pair, a response offset value sequence covering the entire disturbance cycle is generated. Then, the response offset value sequence is normalized to maintain the comparability of residuals between the edge computing node and other similar edge computing nodes.

[0067] By setting sliding window lengths with multiple nested scales, the normalized response offset value sequence is divided into multiple window segments in chronological order. In each window segment, a local change modeling operation based on the residual fitting curve is performed to extract the response offset slope parameter and fluctuation amplitude index within each window segment.

[0068] By concatenating the response offset slope parameter extracted from each window segment with the fluctuation amplitude index in a time series order, a complete structural residual change trajectory is formed. During the trajectory concatenation process, a weighted smoothing process based on the continuity of cross-window fitting is applied to output a continuous residual trend expression structure for subsequent frequency domain response feature extraction.

[0069] In S3, the amplitude and phase information of each frequency component are calculated by inputting the structural residual change trajectory into the discrete Fourier transform algorithm. Based on the amplitude and phase information of these frequency components, the distribution characteristics of the structural residual change trajectory in the frequency domain are extracted, and the frequency domain response map of the edge computing node is constructed.

[0070] The frequency signal components in the low-frequency range of the frequency domain response spectrum are extracted, the main peak frequency in the frequency signal is identified, and the amplitude and phase information of the main peak frequency are calculated, thereby characterizing the frequency response characteristics of the edge computing node under perturbation input conditions.

[0071] By calculating the square of the amplitude of the frequency signal components in the low-frequency range, the energy value of each frequency component is obtained, and the energy centroid position of the frequency signal is calculated based on these energy values. This centroid position is used as a key indicator of the frequency domain response of the edge computing node to evaluate the response sensitivity of the edge computing node to disturbance signals.

[0072] The main peak frequency and the energy centroid location are integrated to form a complete frequency domain response feature set for the edge computing node, and this frequency domain response feature set is used as the input data basis for subsequent spectrum offset analysis and abnormal node identification.

[0073] In S4, by obtaining the frequency domain response feature set of each edge computing node and the historical frequency domain benchmark set of the same type as the edge computing node, the frequency components of the two are matched one by one, and the frequency domain response data is standardized by weighted averaging based on the amplitude and phase information of each frequency component, thereby constructing a unified standardized frequency domain response dataset for comparative analysis of the frequency domain characteristics of different edge computing nodes.

[0074] The standardized frequency domain response dataset and the historical frequency domain benchmark set are used to calculate the Euclidean distance band by band. Based on the calculation results, the spectral offset of each edge computing node relative to its benchmark node is obtained, thereby determining the degree of deviation of the edge computing node in the frequency domain.

[0075] Based on the spectral offset calculation results, a spectral offset vector is generated from the spectral offset of each edge computing node. This spectral offset vector is then used to quantitatively express the magnitude and trend of the edge computing node's change in the frequency domain, thus forming a frequency domain offset feature representation of the edge computing node.

[0076] The spectrum offset vector is input into a preset spectrum offset threshold determination algorithm. The algorithm compares whether the spectrum offset of the edge computing node exceeds the preset threshold. If the offset exceeds the threshold, the edge computing node is identified as an abnormal node and its abnormal state is output. If the offset does not exceed the threshold, the edge computing node is kept in a normal state and its spectrum offset vector is used as the input for subsequent spectrum analysis and node behavior prediction.

[0077] It should be noted that in the formula structure involved in this scheme, dimensionless terms can be used as proportional or structural adjustment factors. When combined with quantities with units, they only play a role in numerical scaling and do not introduce new physical dimensions. Therefore, they will not change or confuse the overall unit system. This combination of "dimensionless terms and terms with units" can be understood as a composite structural expression commonly used in mathematical physics modeling. It conforms to the principle of dimensional consistency and has a clear physical interpretation basis.

[0078] Secondly, in the formula structure of this scheme, if multiple variables with different physical units are involved, including but not limited to time, mass or energy variables, their joint appearance is to express the collaborative modeling relationship of multiple physical mechanisms. Each variable can form a unified structure through function mapping, ratio combination or normalization adjustment, with clear units and clear meaning. The overall expression conforms to the principle of dimensional consistency and the conventional formula of engineering modeling.

[0079] In this solution, constants, weights, adjustment factors, threshold parameters, proportional coefficients, etc., are all adjustable control parameters for different application environments. Their values ​​depend on the target equipment configuration, data input characteristics, and performance optimization goals. During the implementation phase, they are set to converge within a reasonable range through model verification, performance constraints, or engineering calibration. Although these parameters do not have a unique preset value, they have clear adjustment logic and calculation paths. They belong to the deterministic setting process in engineering implementation. The purpose of this setting is to ensure that the solution is both universally adaptable and reproducible and operable, without affecting its technical clarity and feasibility.

[0080] definition The amplitude after standardization. The standardized phase:

[0081]

[0082] If ||D (i) If ||2>T, then it is identified as an abnormal node.

[0083] in The amplitude of the kth frequency component is given by the i-th edge computing node. μ represents the phase of the k-th frequency component, which originates from the i-th edge computing node. k σ is the mean of the k-th frequency component; k The standard deviation of the k-th frequency component; This is the standardized amplitude; The phase after standardization; D represents the spectral offset of the k-th frequency component in the j-th time window. (i) Let D be the spectral offset vector of the i-th edge computing node. (i) Represents the offset of all frequency components; T is the spectral offset threshold, which is used to determine whether a node is abnormal; ||D (i) ||2 is the Euclidean norm of the spectral offset vector, ||D (i) ||2 represents the magnitude of the overall spectral shift;

[0084] By quantifying the offset and trend of node frequency components, standardizing the amplitude and phase of each frequency component, calculating the spectral offset and generating a spectral offset vector, quantifying the magnitude of the spectral offset by calculating the Euclidean distance, and determining whether a node is abnormal by setting a threshold T, anomaly detection is performed on edge computing nodes. This ensures accurate measurement of the node's frequency domain response and eliminates unnecessary biases through standardization, thus providing data support for subsequent node behavior analysis.

[0085] In S5, the spectral offset vector of each edge computing node is obtained and divided into multiple time windows. A spectral offset value sequence is generated based on the spectral offset value in each time window. The spectral offset value sequence is then directly used as input for subsequent spectral offset detection and anomaly analysis.

[0086] The spectral offset value sequence is compared with a preset spectral offset threshold. The deviation between the spectral offset and the preset threshold in each time window is calculated. Then, the spectral offset exceeding the limit in each time window is statistically analyzed, the spectral offset exceeding the limit detection result is output, and it is identified whether there is a trend of spectral offset continuously exceeding the threshold in multiple time scales.

[0087] By identifying whether there is a trend of continuously exceeding the preset spectrum offset threshold, the output index of the edge computing node with the offset exceeding the limit is marked as abnormal, and the abnormality level is determined according to the magnitude of the deviation value. Finally, the abnormality identifier and abnormality level of the edge computing node are output.

[0088] The output metrics of edge computing nodes whose spectral offset vectors do not exceed the preset threshold are maintained in a normal state, and the output metrics of these edge computing nodes continue to participate in the subsequent operation metric fusion calculation, ultimately outputting the fusion result in a normal state.

[0089] definition For the spectral offset value sequence:

[0090]

[0091] Normal marking (i) =0

[0092] in is the spectral offset value of the k-th frequency component within the j-th time window, and the spectral offset value comes from the i-th edge computing node; K is the total number of frequency components; T is the spectral offset threshold, which is used to determine whether the spectral offset exceeds the normal range. This represents the deviation value of the k-th frequency component within the j-th time window, i.e., the degree of deviation from the threshold. Let be the weighted total deviation value for the j-th time window, representing the combined deviation of all frequency components within that time window; The weighting coefficient for the k-th frequency component is dynamically adjusted to account for its influence in the overall calculation; f trend (ΔD) is the multi-scale out-of-limit trend detection function, f trend (ΔD) is used to assess the persistent overshoot trend of spectral shift within multiple time windows; N w N represents the number of time windows. w This represents the granularity of the spectral offset value sequence for each edge computing node; β is the anomaly detection threshold. If the trend value exceeds this threshold, it is marked as an anomaly.

[0093] Anomaly indicator (i) This represents the abnormal state of the i-th edge computing node, where i = 1 indicates an abnormal state and i = 0 indicates a normal state; L (i) Let L be the anomaly level of the i-th edge computing node. (i) Used to reflect the total degree of deviation of the node's offset; The weighting coefficients for the j-th time window are... This indicates the importance of the time window in trend judgment; α is the minimum cumulative deviation value for exceeding the limit. If this deviation value is exceeded multiple times, it indicates a persistent abnormal trend; normal indication. (i) This represents the normal state of the i-th edge computing node;

[0094] The stability of each edge computing node is evaluated through sequence analysis and anomaly trend detection of spectral offset values. This is achieved by calculating the spectral offset within each time window, performing weighted calculations to generate a total spectral offset deviation value, and then applying a trend detection function f. trend (ΔD) identifies whether there are abnormal changes exceeding the threshold. Finally, it determines whether a node is abnormal by using an anomaly identifier and calculates the anomaly level by combining its deviation value. This ensures that abnormal behavior of the detected node is detected at multiple time scales and provides a basis for node security assessment.

[0095] In S6, by obtaining the magnitude and duration of the spectral offset vector of each edge computing node, the dynamic weight decay factor of the edge computing node is calculated. The decay factor characterizes the degree of abnormality of the node and its impact on the overall operation indicators, and is used as an adjustment factor for subsequent indicator calculations.

[0096] The dynamic weight decay factor is weighted and fused with the operational indicators under normal conditions to generate the adjusted operational indicators, and the trend of their change in the overall operation of the enterprise is evaluated based on the adjusted operational indicators.

[0097] The adjusted operational indicators are compared with the preset warning trigger thresholds. If an operational indicator exceeds the warning trigger threshold, the operational indicator is marked as abnormal and the abnormal indicator is output as a warning item. Then, the effectiveness of the abnormal indicator is verified by comparing historical data, and the potential risk value of the warning item is further calculated.

[0098] If the adjusted operating metric does not exceed the warning trigger threshold, the operating metric will be maintained as normal, and the adjusted operating metric will continue to be used as input for subsequent calculations and decisions.

[0099] An enterprise operation data early warning system that integrates indicator adjustments includes a response acquisition module, a residual generation module, a feature extraction module, a distance calculation module, an anomaly identification module, and an integrated adjustment module;

[0100] The response acquisition module selects edge computing nodes with local indicator processing and response generation capabilities from the enterprise operation data collection, injects a set of standardized perturbation input sequences into each edge computing node during the non-high load period of enterprise operation, guides the edge computing nodes to run under the minimum response path, and obtains the perturbation response output sequence of the edge computing nodes.

[0101] The residual generation module aligns the disturbance response output sequence with the baseline output sequence recorded by the edge computing node during the historical stable period in time, and processes the difference between the two through a sliding window to form the structural residual change trajectory.

[0102] The feature extraction module extracts the main peak frequency and energy centroid in the low-frequency range by performing a discrete Fourier transform on the structural residual change trajectory, and constructs a set of frequency domain response features for the edge computing node.

[0103] The distance calculation module obtains the spectral offset vector of the edge computing node by calculating the Euclidean distance between the set of frequency domain response features and the set of historical frequency domain benchmarks of similar edge computing nodes;

[0104] The anomaly detection module determines whether the spectral offset vector continuously exceeds the preset spectral offset threshold over multiple time scales. If the offset amplitude and offset persistence conditions are met, the edge computing node is identified as a slowly degrading node, and its corresponding output index is marked as an abnormal index. If not, the index status of the edge computing node is retained as the default normal label under the current version.

[0105] The fusion adjustment module assigns dynamic weight attenuation values ​​to abnormal indicators based on their spectral offset magnitude and duration, and participates in the fusion calculation of enterprise operation indicators to generate adjusted operation indicators. If the operation indicator reaches the early warning trigger threshold, the corresponding target indicator path is output as an early warning item; if it does not reach the threshold, the current indicator path is maintained in a normal state and continues to participate in subsequent fusion.

[0106] In its implementation, this solution injects subtle perturbation signals into edge computing nodes to obtain response data under low load conditions, providing a foundation for subsequent detection. The perturbation response of the edge computing nodes is then compared with historical data to form residual change trajectories, revealing performance differences between the nodes. Fourier transform is then used to extract key features of the node's frequency domain response, laying the groundwork for spectral offset detection. Next, the frequency domain response features are standardized, and the spectral offset is calculated to quantify changes in the edge computing nodes. Multi-scale analysis is used to detect spectral offset exceeding limits, marking abnormal nodes and calculating the anomaly level. The abnormal indicators are then incorporated into dynamic weighted attenuation values ​​for operational indicator fusion, outputting warnings or maintaining normal operation to ensure system stability. This approach, through frequency domain analysis, sliding window methods, and multi-scale over-limit trend detection, fundamentally improves the ability to identify complex abnormal behaviors. Especially when facing node security issues, it effectively prevents potential threats to enterprise operations from seemingly normal but actually slowly degrading nodes, improving the accuracy of data warnings and ensuring that enterprises can adjust strategies and take countermeasures in a timely manner when dealing with changing operating environments.

[0107] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for early warning of enterprise operational data that integrates indicator adjustments, characterized in that, include: S1. By selecting edge computing nodes with local response capabilities in enterprise operation data collection, a preset input data sequence is injected into each edge computing node during the non-high load period of enterprise operation, guiding the edge computing node to run under the minimum response path, and obtaining the disturbance response output sequence of the edge computing node. S2. By aligning the disturbance response output sequence with the baseline output sequence recorded by the edge computing node in the historical stable period, the difference between the two is processed by a sliding window to form the structural residual change trajectory. S3. By performing a discrete Fourier transform on the structural residual change trajectory, the main peak frequency and energy centroid in the low-frequency range are extracted, and the frequency domain response feature set of the edge computing node is constructed. S4. By calculating the Euclidean distance between the frequency domain response feature set and the preset historical frequency domain reference set of similar edge computing nodes, the spectral offset vector of the edge computing node is obtained. S5. If the spectrum offset vector continuously exceeds the preset spectrum offset threshold across multiple time scales, the output index of the edge computing node is marked as abnormal. Otherwise, maintain the edge computing node in its normal state; S6. By assigning dynamic weight attenuation values ​​to abnormal indicators according to their spectral offset amplitude and duration, the abnormal indicators are included in the integrated calculation of enterprise operation indicators to generate adjusted operation indicators. If the operation indicator reaches the early warning trigger threshold, the corresponding indicator path is output as an early warning item; otherwise, the corresponding indicator path is kept to participate in subsequent normal calculations. In S1, by statistically analyzing the range of input index values ​​recorded by each edge computing node within a historical stable period, the input distribution characteristics of each edge computing node under low load are obtained. Then, based on these distribution characteristics, an input data sequence containing periodic slight disturbance components and amplitude-controlled random noise components is constructed. The input data sequence is input to each edge computing node in a set order, and the edge computing node is controlled to call its local computing link only to perform the minimum response path operation driven by the input data sequence without responding to any external business requests, thus forming the continuous operation state of the edge computing node under light disturbance conditions. By monitoring the output indicators generated by each edge computing node in real time for each item of the input data sequence under continuous operation, the initial data set of the disturbance response that constitutes the complete response process is collected. The initial data set of the disturbance response is divided into segments according to a fixed period length. Then, each segment is subjected to period integrity detection and noise disturbance removal in sequence. Segments containing high-frequency jitter or abrupt changes are removed, and the complete disturbance response output sequence that meets the stability condition is output. In S2, by matching the disturbance response output sequence with the baseline output sequence recorded by the edge computing node in the historical stable period according to the time index, a set of output index corresponding data pairs with a complete time-series pairing relationship is obtained. By performing difference calculation on each output index corresponding data pair in the output index corresponding data pair, a response offset value sequence covering the entire disturbance period is generated, and then the response offset value sequence is normalized. By setting sliding window lengths with multiple nested scales, the normalized response offset value sequence is divided into multiple window segments in chronological order. In each window segment, a local change modeling operation based on the residual fitting curve is performed to extract the response offset slope parameter and fluctuation amplitude index within each window segment. By concatenating the response offset slope parameter extracted from each window segment with the fluctuation amplitude index in a time series order, a complete structural residual change trajectory is formed. During the trajectory concatenation process, a weighted smoothing process based on the continuity of cross-window fitting is applied to output a continuous residual trend expression structure for subsequent frequency domain response feature extraction.

2. The enterprise operation data early warning method for integrating indicator adjustments according to claim 1, characterized in that: In S3, the amplitude and phase information of each frequency component are calculated by inputting the structural residual change trajectory into the discrete Fourier transform algorithm. Based on the amplitude and phase information of these frequency components, the distribution characteristics of the structural residual change trajectory in the frequency domain are extracted, and the frequency domain response map of the edge computing node is constructed. Extract the frequency signal components in the low-frequency range from the frequency domain response spectrum, identify the main peak frequency in the frequency signal, and calculate the amplitude and phase information of the main peak frequency. The energy value of each frequency component is obtained by calculating the square of the amplitude of the frequency signal components in the low frequency range, and the energy centroid position of the frequency signal is calculated based on these energy values. This centroid position is used as a key indicator of the frequency domain response of the edge computing node. By integrating the main peak frequency with the energy centroid location, a complete set of frequency domain response characteristics for this edge computing node is formed.

3. The enterprise operation data early warning method for adjusting integrated indicators according to claim 2, characterized in that: In S4, by obtaining the frequency domain response feature set of each edge computing node and the historical frequency domain benchmark set of the same type as the edge computing node, the frequency components of the two are matched one by one, and the frequency domain response data is standardized by weighted averaging based on the amplitude and phase information of each frequency component, thereby constructing a unified standardized frequency domain response dataset. The standardized frequency domain response dataset and the historical frequency domain benchmark set are used to calculate the Euclidean distance band by band. Based on the calculation results, the spectral offset of each edge computing node relative to its benchmark node is obtained, thereby determining the degree of deviation of the edge computing node in the frequency domain. Based on the spectral offset calculation results, a spectral offset vector is generated from the spectral offset of each edge computing node. This spectral offset vector is then used to quantitatively express the magnitude and trend of the edge computing node's change in the frequency domain, thus forming a frequency domain offset feature representation of the edge computing node. The spectrum offset vector is input into the preset spectrum offset threshold determination algorithm. The algorithm compares whether the spectrum offset of the edge computing node exceeds the preset threshold. If the offset exceeds the threshold, the edge computing node is identified as an abnormal node and its abnormal status is output. If the threshold is not exceeded, the edge computing node will remain in a normal state.

4. The enterprise operation data early warning method for adjusting integrated indicators according to claim 3, characterized in that: In S5, the spectral offset vector of each edge computing node is obtained and divided into multiple time windows. A sequence of spectral offset values ​​is generated based on the spectral offset values ​​in each time window. The spectral offset value sequence is compared with a preset spectral offset threshold. The deviation between the spectral offset and the preset threshold in each time window is calculated. Then, the spectral offset exceeding the limit in each time window is statistically analyzed, the spectral offset exceeding the limit detection result is output, and it is identified whether there is a trend of spectral offset continuously exceeding the threshold in multiple time scales. By identifying whether there is a trend of continuously exceeding the preset spectrum offset threshold, the output index of the edge computing node with the offset exceeding the limit is marked as abnormal, and the abnormality level is determined according to the magnitude of the deviation value. Finally, the abnormality identifier and abnormality level of the edge computing node are output. The output metrics of edge computing nodes whose spectral offset vectors do not exceed the preset threshold are maintained in a normal state, and the output metrics of these edge computing nodes continue to participate in the subsequent operation metric fusion calculation, ultimately outputting the fusion result in a normal state.

5. The enterprise operation data early warning method for adjusting integrated indicators according to claim 4, characterized in that: In S6, the dynamic weight decay factor of each edge computing node is calculated by obtaining the magnitude and duration of the spectral offset vector of each edge computing node. The dynamic weight decay factor is weighted and fused with the operational indicators under normal conditions to generate the adjusted operational indicators, and the trend of their change in the overall operation of the enterprise is evaluated based on the adjusted operational indicators. The adjusted operational indicators are compared with the preset warning trigger thresholds. If an operational indicator exceeds the warning trigger threshold, the operational indicator is marked as abnormal and the abnormal indicator is output as a warning item. Then, the effectiveness of the abnormal indicator is verified by comparing historical data, and the potential risk value of the warning item is further calculated. If the adjusted operating metric does not exceed the warning trigger threshold, the operating metric will be maintained as normal, and the adjusted operating metric will continue to be used as input for subsequent calculations and decisions.

6. A system for early warning of enterprise operational data with integrated indicator adjustments, used to implement the method for early warning of enterprise operational data with integrated indicator adjustments as described in claim 1, characterized in that, It includes a response acquisition module, a residual generation module, a feature extraction module, a distance calculation module, an anomaly detection module, and a fusion adjustment module; The response acquisition module selects edge computing nodes with local indicator processing and response generation capabilities from the enterprise operation data collection, injects a set of standardized perturbation input sequences into each edge computing node during the non-high load period of enterprise operation, guides the edge computing nodes to run under the minimum response path, and obtains the perturbation response output sequence of the edge computing nodes. The residual generation module aligns the disturbance response output sequence with the baseline output sequence recorded by the edge computing node during the historical stable period in time, and processes the difference between the two through a sliding window to form the structural residual change trajectory. The feature extraction module extracts the main peak frequency and energy centroid in the low-frequency range by performing a discrete Fourier transform on the structural residual change trajectory, and constructs a set of frequency domain response features for the edge computing node. The distance calculation module obtains the spectral offset vector of the edge computing node by calculating the Euclidean distance between the set of frequency domain response features and the set of historical frequency domain benchmarks of similar edge computing nodes; The anomaly detection module determines whether the spectral offset vector continuously exceeds the preset spectral offset threshold over multiple time scales. If the offset amplitude and offset persistence conditions are met, the edge computing node is identified as a slowly degrading node, and its corresponding output index is marked as an abnormal index. If not, the index status of the edge computing node is retained as the default normal label under the current version. The fusion adjustment module assigns dynamic weight attenuation values ​​to abnormal indicators based on their spectral offset magnitude and duration, and incorporates them into the fusion calculation of enterprise operation indicators to generate adjusted operation indicators. If the operation indicator reaches the early warning trigger threshold, the corresponding target indicator path is output as an early warning item. If the target is not met, the current indicator path will be maintained and the system will continue to participate in subsequent integrations under normal conditions.

Images