Alarm method, system and device for server hardware abnormity

Abstract

The invention discloses a server hardware abnormity alarm method, system and device, and relates to the technical field of server hardware abnormity alarm, and the method comprises the steps: obtaining the characteristic parameters of an abnormal state mode, carrying out the risk grade division of a detected abnormal state according to an abnormity severity grading standard, and obtaining an abnormal state; a comprehensive anomaly scoring result is obtained through multi-dimensional feature weight calculation; triggering an alarm mechanism of a corresponding level according to a comprehensive anomaly score result, if an anomaly score exceeds an emergency threshold, immediately generating high-priority alarm information, and performing alarm information aggregation processing to obtain a complete hardware anomaly diagnosis report; an alarm information deduplication algorithm is adopted to carry out merging processing on repeated alarms of the same hardware component, and the stability and persistence characteristics of an abnormal state are judged through alarm frequency statistics and abnormal duration analysis in a time window.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of server hardware exception alarm, and in particular to a server hardware exception alarm method, system and device. BACKGROUND

[0002] Server hardware exception alarm is the core field of modern data center operation and management, directly related to system stability and business continuity, and its importance is self-evident. Hardware failure can cause service interruption, data loss and even economic loss, so real-time and accurate exception detection and alarm become the key to guarantee server operation. At present, most hardware monitoring solutions rely on periodic polling or static detection based on threshold, but these methods often lack dynamic adaptability and state consistency guarantee when facing complex and diverse hardware environments, making it difficult to deal with complex scenarios in multi-hardware concurrent monitoring. For example, when multiple hardware components change state at the same time, traditional methods may miss or misreport alarms due to delayed processing or data conflicts, affecting the accuracy of operation and maintenance decisions.

[0003] In server hardware exception detection, the core challenge is how to ensure accurate collection and consistent processing of each hardware component state in a complex environment of multi-hardware concurrent monitoring. Real-time collection of hardware state needs to face high-frequency changes in dynamic environment, and such dynamics often leads to inconsistency in data collection. For example, sudden changes in CPU and memory instantaneous load may conflict during collection, and some states may not be fully recorded, causing false positives or false negatives. This data inconsistency further exacerbates the complexity of exception judgment, as the system needs to ensure the integrity of each hardware state in concurrent operations, otherwise it may not be able to accurately distinguish between normal fluctuations and real exceptions due to partial data loss.

[0004] Therefore, how to ensure the integrity and consistency of hardware state collection in a dynamic environment of multi-hardware concurrent monitoring through effective mechanisms, while accurately distinguishing between normal fluctuations and abnormal states, has become a key problem for server hardware exception alarm systems. SUMMARY

[0005] The technical problem to be solved by the present application is to provide a server hardware exception alarm method, system and device to address the deficiencies of the background art.

[0006] The present application solves the above technical problems by adopting the following technical solutions: A server hardware exception alarm method, comprising: A state machine algorithm is used to establish a hardware component state transition model, historical data of CPU temperature, memory usage, and disk read / write speed are used to construct a normal operation state baseline for each hardware component, and a standard mode library of hardware component state changes is obtained by analyzing the state transition path. The system acquires real-time monitoring data streams from multiple hardware components. If concurrent state change events are detected, a timestamp synchronization mechanism is used to uniformly mark all hardware state data, and a time-synchronized set of hardware state snapshots is obtained through a data buffer temporary storage mechanism. The hardware state snapshot set is analyzed by time series analysis based on the sliding window algorithm. A continuous state change sequence is extracted by setting a fixed time window length. If the frequency of state change exceeds a preset threshold, it is determined that there are potential abnormal fluctuations in the time period. An anomaly detection algorithm is used to perform pattern matching analysis on the state change sequence. By calculating the similarity with normal fluctuation patterns in the standard pattern library, if the similarity is lower than a preset threshold, the state change sequence is determined to belong to an abnormal state pattern. The feature parameters of the abnormal state pattern are obtained, the risk level of the detected abnormal state is classified according to the severity of the abnormality, and the comprehensive abnormality score is obtained by multi-dimensional feature weight calculation. The alarm mechanism of the corresponding level is triggered based on the comprehensive anomaly score. If the anomaly score exceeds the emergency threshold, a high-priority alarm message is generated immediately. A complete hardware anomaly diagnosis report is obtained through alarm message aggregation and processing. An alarm information deduplication algorithm is used to merge duplicate alarms of the same hardware component. By analyzing the alarm frequency statistics and abnormal duration within a time window, the stability and persistence characteristics of the abnormal state are determined.

[0007] Preferably, the state machine algorithm is used to establish a hardware component state transition model. Based on historical data of CPU temperature, memory usage, and disk read / write speed, a baseline of normal operating state for each hardware component is constructed. A standard pattern library of hardware component state changes is obtained by analyzing state transition paths, including: Historical data on CPU temperature, memory usage, and disk read / write speed are acquired. Time-series data is extracted from a pre-defined data storage system, and outliers are removed using data cleaning techniques to obtain a standardized historical dataset. Based on the standardized historical dataset, the K-means clustering algorithm was used to perform cluster analysis on CPU temperature, memory usage and disk read / write speed to determine the baseline of normal operating status of each hardware component. Using a state machine algorithm, state transition sequences are extracted from the normal operating state baseline to generate a state transition model for hardware components, thus obtaining a set of state transition paths. For the set of state transition paths, a Markov chain model is used to analyze the transition probability of each path, determine the statistical law of state transition, and obtain the state transition probability matrix. If the transition probability of a certain path in the state transition probability matrix is ​​lower than a preset threshold, it is marked as an abnormal transition path and removed from the state transition path set to obtain the optimized state transition path set. Based on the optimized state transition path set, frequently occurring transition sequences are extracted, and a sequence mining algorithm is used to generate a standard pattern library of hardware component state changes, thus obtaining the final standard pattern set. Typical state transition patterns of each hardware component are extracted from the standard pattern set and stored in a preset pattern database to obtain a standard hardware state pattern library that can be used for real-time monitoring.

[0008] Preferably, in the process of acquiring real-time monitoring data streams from multiple hardware components, if concurrent state change events are detected, a timestamp synchronization mechanism is used to uniformly mark all hardware state data, and a time-synchronized hardware state snapshot set is obtained through a data buffer temporary storage mechanism, including: The system acquires real-time monitoring data streams from multiple hardware components, and uses streaming processing technology to segment and parse the data streams to obtain a sequence of segmented hardware status data. For the hardware state data sequence after fragmentation, if concurrent state change events are detected, a timestamp synchronization mechanism is used to add a unified timestamp to each hardware state data to obtain a time-aligned state data set. By using a data buffer temporary storage mechanism, the time-aligned state data set is stored in a preset buffer to obtain a time-synchronized hardware state snapshot set; The state features of each hardware component are extracted from the time-synchronized hardware state snapshot set, and the state features are dimensionality-reduced by the principal component analysis algorithm to obtain the dimensionality-reduced state feature vector. Based on the dimensionality-reduced state feature vector, a clustering analysis algorithm is used to group the states of the hardware components to obtain a set of state categories for each hardware component; Based on the set of state categories, a decision tree algorithm is used to classify the state change trends of hardware components and determine the state change patterns of each hardware component. If the state change pattern deviates from the preset normal mode threshold, the abnormal state is marked by the anomaly detection mechanism, and a set of hardware component identifiers of the abnormal state is obtained.

[0009] Preferably, the step of performing time-series analysis on the hardware state snapshot set according to the sliding window algorithm, extracting continuous state change sequences by setting a fixed time window length, and determining that potential abnormal fluctuations exist within the time period if the state change frequency exceeds a preset threshold, includes: The continuous state change sequence is extracted from the hardware state snapshot set by the sliding window algorithm. A fixed time window length is set to obtain the state change frequency within the time period. If the frequency of state changes exceeds a preset threshold, potential abnormal fluctuations are marked through an anomaly detection mechanism to obtain a set of abnormal time period identifiers; Based on the set of abnormal time period identifiers, a subset of state data for the corresponding time period is extracted from the set of hardware state snapshots using timestamp alignment technology. The set of hardware component categories in abnormal states is obtained by grouping the state data subset using the k-means clustering algorithm. Based on the set of hardware component categories, statistical analysis methods are used to calculate the state change amplitude of each hardware component to obtain the abnormal fluctuation feature vector. If the amplitude of the abnormal fluctuation feature vector exceeds the preset amplitude threshold, the abnormal mode of the hardware component is determined by the classifier, and an abnormal mode identifier set is obtained. Based on the set of abnormal pattern identifiers, detailed status records for relevant time periods are extracted from the set of hardware status snapshots to generate an abnormal status sequence dataset.

[0010] Preferably, the step of using an anomaly detection algorithm to perform pattern matching analysis on the state change sequence, calculating the similarity with normal fluctuation patterns in a standard pattern library, and determining that the state change sequence belongs to an abnormal state pattern if the similarity is lower than a preset threshold, includes: By using time series segmentation technology, state change sequences are extracted from a set of hardware state snapshots to obtain time series data; The time series data were analyzed using a pattern matching algorithm, and the similarity score was calculated by comparing it with normal fluctuation patterns in the standard pattern library. If the similarity score is lower than the preset threshold, the time series data is marked as an abnormal state pattern through the anomaly detection mechanism to obtain the anomaly pattern identifier; Based on the abnormal mode identifier, extract the corresponding time series data subset from the hardware state snapshot set to obtain the abnormal state data; By using fluctuation feature extraction technology, abnormal state data can be analyzed to obtain fluctuation feature vectors; The decision tree algorithm is used to classify the fluctuation feature vectors, determine the category to which the abnormal state pattern belongs, and obtain the abnormal pattern category; Based on the abnormal pattern category, relevant normal fluctuation patterns are extracted from the standard pattern library to generate a comparative analysis dataset of abnormal states.

[0011] Preferably, the step of acquiring feature parameters of abnormal state patterns, classifying the risk level of detected abnormal states according to an anomaly severity grading standard, and obtaining a comprehensive anomaly score result through multi-dimensional feature weight calculation includes: The state change sequence is obtained from the hardware state snapshot set, and the state change sequence is processed by time series segmentation technology to obtain time series data; By analyzing time series data using feature extraction techniques, key features are extracted to obtain state feature vectors. The K-nearest neighbor algorithm is used to analyze the state feature vector and calculate the similarity with the patterns in the preset normal pattern library to obtain the similarity score S, where S represents the degree of matching between the state feature vector and the normal pattern. If the similarity score S is lower than the preset threshold T, where T is a pre-established anomaly judgment standard, then the time series data is marked as an anomaly state, and an anomaly state identifier is obtained. Based on the abnormal state identifier, the corresponding data subset is extracted from the time series data to obtain the abnormal state data; The abnormal state data is processed by a weighted calculation method, and combined with a preset weight W, where W represents the contribution of different features to the severity of the abnormality, a comprehensive abnormality score R is calculated, where R represents the risk level of the abnormal state. Based on the comprehensive anomaly score R, the decision tree algorithm is used to classify the abnormal state data, determine the risk category to which the abnormal state belongs, and obtain the risk category identifier.

[0012] Preferably, the alarm mechanism triggering the corresponding level based on the comprehensive anomaly score result, if the anomaly score exceeds the emergency threshold, immediately generates high-priority alarm information, and obtains a complete hardware anomaly diagnostic report through alarm information aggregation processing, including: If the overall anomaly score exceeds the preset emergency threshold, a high-priority alarm signal is generated. The alarm signals are sorted using signal queue management technology to obtain a priority sorting signal sequence. Based on the priority order of the signal sequence, message distribution technology is used to transmit high-priority alarm signals to the target processing module, thereby obtaining the set of distributed alarm signals; The distributed alarm signal set is processed by information aggregation technology, and a subset of abnormal state data is generated by combining the preset feature weight calculation method. If the feature values ​​in the subset of abnormal state data exceed the preset abnormal range, the support vector machine algorithm is used to classify the subset of abnormal state data to obtain an abnormal category identifier. Based on the anomaly category identifier, extract the corresponding anomaly time window from the time series data to generate anomaly time series segments; By processing abnormal time series segments using time series analysis techniques and combining them with state feature vectors, a set of hardware anomaly diagnostic information is generated. A decision tree algorithm is used to assess the risk of hardware anomaly diagnostic information set, and the final risk level classification result is determined by combining the risk category identifier.

[0013] Preferably, the method of merging duplicate alarms from the same hardware component using an alarm information deduplication algorithm, and determining the stability and persistence characteristics of the abnormal state through alarm frequency statistics and abnormal duration analysis within a time window, includes: The duplicate alarms identified by hardware components are merged using an alarm information deduplication algorithm, and the alarm frequency is statistically analyzed using time window analysis technology to obtain alarm frequency statistics. Based on the alarm frequency statistics and combined with time series analysis techniques, the duration of the anomaly is calculated to obtain the anomaly duration data. If the abnormal duration data exceeds the preset threshold, the K-means clustering algorithm is used to classify the abnormal duration data to obtain the abnormal state classification result. The abnormal state classification results are weighted by a feature weight calculation method, and combined with time series segments to generate a set of stability feature values. Based on the set of stability eigenvalues, time series analysis techniques are used to extract abnormal time windows to obtain abnormal time series feature data; If the feature values ​​in the abnormal time series feature data exceed the preset abnormal range, the feature data are merged through information aggregation technology to obtain comprehensive abnormal state data. The decision tree algorithm is used to classify the risk level of the comprehensive data of abnormal states, and the final risk level result is determined by combining the set of stability feature values.

[0014] An alarm device for server hardware anomalies includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor as described in the claims, characterized in that the processor executes the computer program to implement the steps of an alarm method for server hardware anomalies.

[0015] A computer-readable storage system storing a computer program, wherein the steps of an alarm method for server hardware malfunction are implemented when the computer program is executed by a processor.

[0016] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects: This invention discloses a method, system, and apparatus for alarming server hardware anomalies. By constructing a baseline of normal operating conditions and a standard pattern library, combined with timestamp synchronization and a sliding window algorithm, it accurately captures hardware state snapshots and extracts temporal change sequences. Through anomaly detection algorithms and similarity matching with the standard pattern library, it identifies abnormal state patterns and calculates a comprehensive anomaly score based on multi-dimensional feature weights, triggering a tiered alarm mechanism. Simultaneously, it employs deduplication algorithms and frequency statistics to analyze the persistence of anomalies. This invention significantly improves the accuracy and real-time performance of hardware anomaly diagnosis through time synchronization, pattern matching, and risk grading, reducing false alarm rates and providing efficient monitoring and diagnostic support for the stable operation of complex hardware systems. Attached Figure Description

[0017] Figure 1 This is a flowchart of an alarm method for server hardware anomalies according to the present invention. Detailed Implementation

[0018] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, a specific alarm method for server hardware anomalies in this embodiment may include: S101. A state machine algorithm is used to establish a hardware component state transition model. Based on historical data of CPU temperature, memory usage, and disk read / write speed, a baseline of normal operating state for each hardware component is constructed. By analyzing the state transition path, a standard pattern library of hardware component state changes is obtained.

[0020] Historical data on CPU temperature, memory usage, and disk read / write speed are acquired. Time-series data is extracted from a pre-defined data storage system, and outliers are removed using data cleaning techniques to obtain a standardized historical dataset. Based on this standardized historical dataset, K-means clustering is used to cluster CPU temperature, memory usage, and disk read / write speed to determine the baseline of normal operating conditions for each hardware component. A state machine algorithm is then used to extract state transition sequences from the baseline, generating state transition models for the hardware components and resulting in a set of state transition paths. For this set, a Markov chain model is used to analyze the transition probabilities of each path, determining the statistical regularities of state transitions and obtaining a state transition probability matrix. If the transition probability of a path in the state transition probability matrix is ​​lower than a preset threshold, it is marked as an abnormal transition path and removed from the set, resulting in an optimized set of state transition paths. Based on this optimized set, frequently occurring transition sequences are extracted, and a sequence mining algorithm is used to generate a standard pattern library for hardware component state changes, resulting in a final standard pattern set. Typical state transition patterns for each hardware component are extracted from the standard pattern set and stored in a pre-defined pattern database, resulting in a standard hardware state pattern library for real-time monitoring.

[0021] In one possible implementation, historical data on CPU temperature, memory usage, and disk read / write speed needs to be extracted from a pre-defined data storage system such as the time-series database InfluxDB.

[0022] For example, data is collected from a server cluster every 5 seconds to obtain sequences of CPU temperatures ranging from 50°C to 80°C, memory usage from 20% to 90%, and disk read / write speeds from 10MB / s to 200MB / s. Data cleaning techniques, such as median absolute deviation, remove outliers, like discarding records with CPU temperatures above 95°C, ensuring data reliability. This step effectively reduces noise interference and improves the accuracy of subsequent analysis.

[0023] For example, K-means clustering can be used to analyze a standardized dataset, with K=3, dividing the data into three categories: low load, normal load, and high load. Assuming a server has a CPU temperature of 60°C, memory utilization of 40%, and disk read / write speed of 50MB / s, it would be classified as belonging to the normal load category. This baseline reflects the hardware's operating state under typical scenarios, providing a foundation for state machine modeling. The clustering results can visually display the hardware performance distribution, facilitating anomaly identification.

[0024] In one embodiment, the state machine algorithm extracts the state transition sequence from the baseline.

[0025] For example, the CPU temperature rises from 60°C (normal) to 85°C (high load), and then drops to 55°C (normal), forming a "normal-high load-normal" sequence. The state transition model generates a path set from this, recording the patterns of hardware state transitions. This helps predict hardware behavior and optimize resource scheduling.

[0026] Specifically, the Markov chain model analyzes the transition probabilities of the path set. Assume the transition probability for "normal-high load" is 0.7, for "high load-normal" it's 0.6, and for "normal-low load" it's only 0.05. If the threshold is set to 0.1, the latter is marked as an abnormal path and removed, optimizing the path set. This process can identify rare transitions, reduce false alarms, and improve monitoring efficiency.

[0027] Preferably, sequence mining algorithms such as Apriori extract frequent sequences from the optimized path set.

[0028] For example, the pattern "Normal-High Load-Normal" occurs 80% of the time and is included in the standard pattern library. This pattern library is stored in a database and includes typical patterns such as "Low Load-Normal-High Load," supporting real-time monitoring. The pattern library can be used to detect deviations; for example, if a sustained high CPU temperature is detected, an alarm will be triggered to ensure system stability.

[0029] Understandably, the standard pattern library is used for real-time monitoring.

[0030] For example, if a server exhibits a "high load-high load" pattern for three consecutive days, deviating from the standard pattern, it indicates a potential hardware failure. The technical advantage lies in quickly locating problems through pattern matching, reducing operational costs, and improving system reliability.

[0031] S102. Obtain real-time monitoring data streams of multiple hardware components. If concurrent state change events are detected, use a timestamp synchronization mechanism to uniformly mark all hardware state data and obtain a set of time-synchronized hardware state snapshots through a data buffer temporary storage mechanism.

[0032] Real-time monitoring data streams from multiple hardware components are acquired. Streaming technology is used to segment and parse the data streams, resulting in a segmented hardware status data sequence. For each segmented hardware status data sequence, if concurrent status change events are detected, a timestamp synchronization mechanism is used to add a unified timestamp to each hardware status data segment, resulting in a time-aligned status data set. A data buffer temporary storage mechanism is used to store the time-aligned status data set in a preset buffer, resulting in a time-synchronized hardware status snapshot set. Status features of each hardware component are extracted from the time-synchronized hardware status snapshot set, and principal component analysis (PCA) is used to reduce the dimensionality of these features, resulting in a dimensionality-reduced status feature vector. Based on the dimensionality-reduced status feature vector, a clustering analysis algorithm is used to group the states of the hardware components, resulting in a set of status categories for each hardware component. Based on the status category set, a decision tree algorithm is used to classify the status change trends of the hardware components and determine the status change patterns of each hardware component. If the status change pattern deviates from a preset normal mode threshold, an anomaly detection mechanism is used to mark the abnormal state, resulting in a set of hardware component identifiers for the abnormal state.

[0033] For example, when acquiring real-time monitoring data streams from multiple hardware components, streaming processing technology can be used to collect data such as CPU temperature, memory usage, and disk read / write speeds per second from a server cluster. Suppose a data center server generates a data stream per second containing data such as a CPU temperature of 65°C, memory usage of 45%, and disk read / write speed of 80MB / s. Streaming processing technology can use Apache Kafka as a message queue to segment the data stream into 10-second segments, generating a sequence of 120 records per segment. This segmentation facilitates subsequent processing of high-concurrency data and ensures the real-time performance of the data stream.

[0034] In one possible implementation, if concurrent state change events are detected, such as a sudden rise in CPU temperature to 85°C or a drop in memory usage to 30%, a unified time stamp can be added to each data point through a timestamp synchronization mechanism.

[0035] For example, at a certain time T1, CPU temperature, memory usage, and disk read / write speed are recorded as T1:2025-08-06 12:14:00, generating a time-aligned set of state data. This mechanism ensures that data from different hardware components are aligned on the timeline, facilitating the analysis of the correlation between state changes.

[0036] For example, time-aligned state data sets can be stored in a Redis buffer using a data buffer stencil mechanism, generating a time-synchronized hardware state snapshot set. Suppose a snapshot set contains hardware state records for each second over 10 minutes, storing approximately 600 data entries. This stencil method supports fast access and is suitable for real-time monitoring scenarios.

[0037] In one possible implementation, state features are extracted from a snapshot set, such as the average CPU temperature of 75°C, memory usage fluctuations of 20%-80%, and peak disk read / write speeds of 150MB / s. Principal component analysis (PCA) algorithms can reduce these high-dimensional features to 2D state feature vectors, retaining 90% of the information. This dimensionality reduction simplifies data complexity and facilitates subsequent analysis.

[0038] For example, based on the dimensionality-reduced state feature vectors, the DBSCAN clustering algorithm is used to classify hardware states into three categories: normal, high load, and low load. Suppose a server's feature vector represents a CPU temperature of 70°C and memory usage of 50%, it is classified as normal. This grouping intuitively reflects the hardware's operating status and facilitates the identification of anomalies.

[0039] In one possible implementation, the decision tree algorithm can analyze state change trends based on a set of state categories.

[0040] For example, if the CPU temperature rises from 70°C to 90°C and then drops to 60°C, the decision tree classifies it as a "normal-high load-normal" pattern. If this pattern deviates from a preset threshold, such as continuous high load for more than 5 minutes, the anomaly detection mechanism marks the server as abnormal and generates an anomaly identifier set containing the server ID. This classification and detection method supports rapid location of problematic hardware.

[0041] Understandably, each step of the above method is closely linked, forming a complete process from data acquisition to anomaly labeling. Data sharding and time synchronization ensure data consistency, dimensionality reduction and clustering improve analytical efficiency, and decision trees and anomaly detection accurately pinpoint problems. This multi-layered analysis effectively improves system stability and reduces operational complexity in data center monitoring.

[0042] S103. Perform time-series analysis on the hardware state snapshot set according to the sliding window algorithm. Extract continuous state change sequences by setting a fixed time window length. If the state change frequency exceeds a preset threshold, it is determined that there are potential abnormal fluctuations within the time period.

[0043] A sliding window algorithm is used to extract continuous state change sequences from a hardware state snapshot set. A fixed time window length is set to obtain the state change frequency within a time period. If the state change frequency exceeds a preset threshold, a potential abnormal fluctuation is marked using an anomaly detection mechanism, resulting in an abnormal time period identifier set. Based on the abnormal time period identifier set, a timestamp alignment technique is used to extract a subset of state data corresponding to the time period from the hardware state snapshot set. The k-means clustering algorithm is used to group the state data subsets, obtaining a set of hardware component categories with abnormal states. Based on the hardware component category set, statistical analysis methods are used to calculate the state change amplitude of each hardware component, obtaining an abnormal fluctuation feature vector. If the amplitude of the abnormal fluctuation feature vector exceeds a preset amplitude threshold, a classifier is used to determine the abnormal pattern of the hardware component, obtaining an abnormal pattern identifier set. Based on the abnormal pattern identifier set, detailed state records for the relevant time periods are extracted from the hardware state snapshot set to generate an abnormal state sequence dataset.

[0044] For example, the sliding window algorithm, applied to hardware state snapshot sets, can extract continuous state change sequences by setting a fixed time window. Assuming a time window length of 30 seconds, the system collects server CPU utilization, memory usage, and network bandwidth data every second. The sliding window slides in 10-second increments to analyze the frequency of state changes within 30 seconds.

[0045] In one embodiment, within a certain time window, CPU utilization was recorded to increase from 50% to 80%, memory usage to decrease from 40% to 20%, and network bandwidth to increase from 100MB / s to 200MB / s, with a frequency of 3 times per 30 seconds. If the preset threshold is 2 times per 30 seconds, the window is marked as a potential abnormal fluctuation, and an abnormal time period identifier set is generated, recording the time period from 12:14:00 to 12:14:30 on August 6, 2025.

[0046] Understandably, timestamp alignment techniques are used to extract subsets of state data from a set of hardware state snapshots that fall outside the normal time period.

[0047] For example, based on the aforementioned abnormal time period identifier, the system extracts 30 records from the Redis buffer between 12:14:00 and 12:14:30 on August 6, 2025, including CPU utilization, memory usage, and network bandwidth, forming a subset of status data. Timestamp alignment ensures that all data points correspond precisely on the timeline, facilitating subsequent analysis.

[0048] Specifically, the k-means clustering algorithm groups a subset of state data to identify the set of hardware component categories in abnormal states. Assuming the subset contains 30 records and the k value is set to 3, the clustering result will divide the data into three categories: high load, normal, and low load.

[0049] For example, records with 80% CPU utilization, 20% memory usage, and 200MB / s network bandwidth are categorized as high-load records, generating a set of categories containing high-load server IDs.

[0050] For example, statistical analysis methods calculate the magnitude of state changes for each hardware component, generating an abnormal fluctuation feature vector. For high-load servers, analyzing changes in CPU utilization (30%), memory usage (20%), and network bandwidth (100MB / s) over 30 seconds generates feature vectors. Assuming preset threshold values ​​of 20% for CPU, 15% for memory, and 80MB / s for network bandwidth, if this vector exceeds these thresholds, it indicates significant abnormal fluctuations.

[0051] In one embodiment, the classifier identifies abnormal patterns and generates an abnormal pattern identifier set. Based on feature vectors, the random forest classifier analyzes state change trends; for example, a CPU utilization rate rising from 50% to 80% and then falling to 60% is identified as a "normal-high load-normal" pattern. If this pattern occurs three times consecutively, it is marked as an abnormal pattern, and an abnormal pattern identifier set containing server IDs is generated.

[0052] Understandably, detailed status records for time periods related to abnormal patterns are extracted from the hardware status snapshot set to form an abnormal status sequence dataset.

[0053] For example, in response to the above-mentioned anomaly pattern, the system extracts 60 records from 12:14:00 to 12:15:00 on August 6, 2025, containing detailed status information for CPU, memory, and network, forming a dataset. This dataset supports in-depth analysis of the causes of the anomalies, improving the efficiency of the monitoring system.

[0054] In one embodiment, the extended scheme can incorporate historical data to analyze the recurrence of abnormal patterns.

[0055] For example, if a server exhibits five similar abnormal patterns within the past 24 hours, the system can prioritize marking that server as high-risk and optimize resource allocation. This multi-layered analysis ensures the completeness of the process from data extraction to anomaly identification, enhancing the accuracy and reliability of data center monitoring.

[0056] S104. An anomaly detection algorithm is used to perform pattern matching analysis on the state change sequence. By calculating the similarity with the normal fluctuation patterns in the standard pattern library, if the similarity is lower than the preset threshold, the state change sequence is determined to belong to an abnormal state pattern.

[0057] Time series data is obtained by extracting state change sequences from a hardware state snapshot set using time series segmentation technology. A pattern matching algorithm is then used to analyze the time series data, calculating similarity scores with normal fluctuation patterns in a standard pattern library. If the similarity score is below a preset threshold, the time series data is marked as an abnormal state pattern using an anomaly detection mechanism, resulting in an anomaly pattern identifier. Based on the anomaly pattern identifier, a corresponding subset of time series data is extracted from the hardware state snapshot set to obtain the abnormal state data. Fluctuation feature extraction technology is then used to analyze the abnormal state data, obtaining fluctuation feature vectors. A decision tree algorithm is used to classify the fluctuation feature vectors, determining the category to which the abnormal state pattern belongs, thus obtaining the abnormal pattern category. Based on the abnormal pattern category, associated normal fluctuation patterns are extracted from the standard pattern library to generate a comparative analysis dataset of abnormal states.

[0058] For example, time series segmentation techniques can be used to extract sequences of state changes from a collection of hardware state snapshots. Suppose a server collects CPU utilization, memory usage, and disk I / O data once per second, forming time series data.

[0059] Specifically, the system sets the time window to 60 seconds and performs sliding segmentation in 15-second increments to generate multiple time series segments. Each segment contains 60 records, covering changes in CPU utilization from 40% to 70%, fluctuations in memory usage from 30% to 50%, and changes in disk I / O from 50MB / s to 150MB / s. The segmented time series data provides a continuous view of state changes for subsequent analysis.

[0060] In one possible implementation, the pattern matching algorithm calculates a similarity score for the time series data by comparing it with normal fluctuation patterns in a standard pattern library.

[0061] For example, the standard pattern library includes a normal pattern where "CPU usage is stable at 50% ± 10%". The system uses the cosine similarity method to compare the segmented time series with the standard pattern. If the CPU usage of a 60-second segment fluctuates between 40% and 70%, and the memory usage fluctuates between 30% and 50%, and the similarity score is 0.6, which is lower than the preset threshold of 0.8, then the segment is marked as an abnormal state pattern.

[0062] For example, the anomaly detection mechanism generates anomaly pattern identifiers based on similarity scores. For the aforementioned segment, the system marks the time period as 2025-08-06 12:15:00 to 12:16:00, generates anomaly pattern identifiers, and records the server ID and timestamp. This identifier method facilitates rapid location of abnormal time periods, improving the efficiency of subsequent data extraction.

[0063] Specifically, extract the time-series data subset corresponding to the abnormal mode identifier from the hardware state snapshot set.

[0064] For example, the system retrieves 60 records from the Redis cache between 12:15:00 and 12:16:00 on August 6, 2025, forming a subset of data containing CPU usage, memory usage, and disk I / O. Timestamp alignment ensures accurate correspondence of data points, facilitating subsequent feature extraction.

[0065] In one possible implementation, a fluctuation feature extraction technique analyzes a subset of data to generate a fluctuation feature vector.

[0066] For example, for the aforementioned subset, the system calculates a 30% change in CPU utilization, a 20% change in memory usage, and a 100MB / s change in disk I / O within 60 seconds, forming a feature vector. This vector quantifies the degree of abnormal fluctuations, providing a basis for classification.

[0067] For example, decision tree algorithms classify fluctuating feature vectors to determine the category of abnormal state patterns. Assuming the feature vectors are input into a decision tree, the system categorizes abnormal patterns into three types: high load, intermittent fluctuations, and low load. The aforementioned feature vector, due to significant fluctuations in CPU and disk I / O, is classified into the high load category, generating a set of categories containing server IDs.

[0068] Specifically, based on the abnormal pattern category, the system extracts relevant normal fluctuation patterns from the standard pattern library and generates a comparative analysis dataset.

[0069] For example, the normal mode corresponding to high load is "CPU stable at 50%±5%". The system extracts abnormal data from 12:15:00 to 12:16:00 on August 6, 2025, and compares it with the normal mode to form a dataset containing both abnormal and normal states. This dataset supports in-depth analysis of the causes of anomalies.

[0070] In one possible implementation, the extended scheme incorporates historical data analysis to detect recurring anomaly patterns.

[0071] For example, if a server exhibits four high-load patterns in the past 24 hours, the system marks it as high-risk and prioritizes the allocation of monitoring resources to it. This multi-layered analysis enhances the accuracy and reliability of data center monitoring.

[0072] S105. Obtain the feature parameters of the abnormal state pattern, classify the risk level of the detected abnormal state according to the severity grading standard, and obtain the comprehensive abnormal score result by multi-dimensional feature weight calculation.

[0073] State change sequences are obtained from a hardware state snapshot set. Time series segmentation techniques are used to process these sequences, resulting in time series data. Feature extraction techniques are employed to analyze the time series data, extracting key features to obtain state feature vectors. The K-nearest neighbor algorithm is used to analyze these feature vectors and calculate their similarity with patterns in a pre-defined normal pattern library, yielding a similarity score S, where S represents the degree of matching between the state feature vector and the normal pattern. If the similarity score S is lower than a pre-defined threshold T, where T is a pre-established anomaly judgment standard, the time series data is marked as an anomalous state, resulting in an anomalous state identifier. Based on the anomalous state identifier, corresponding data subsets are extracted from the time series data to obtain anomalous state data. A weighted calculation method is used to process the anomalous state data, incorporating pre-defined weights W, where W represents the contribution of different features to the severity of the anomaly, to calculate a comprehensive anomaly score R, where R represents the risk level of the anomalous state. Based on the comprehensive anomaly score R, a decision tree algorithm is used to classify the anomalous state data, determining the risk category to which the anomalous state belongs, and obtaining a risk category identifier.

[0074] Specifically, time series segmentation is a key step in obtaining the state change sequence from the hardware state snapshot set.

[0075] For example, the server collects network interface card (NIC) traffic, CPU temperature, and memory usage every minute, creating a set of state snapshots. The system sets a time window of 120 seconds, sliding the data in 30-second increments to generate a sequence segment containing 120 records. Each segment records changes in NIC traffic from 100MB / s to 200MB / s, CPU temperature from 50°C to 70°C, and memory usage from 20% to 40%. This segmentation method transforms continuous snapshots into time-series data, making it easier to capture trends in state changes.

[0076] In one possible implementation, feature extraction techniques analyze time series data to generate state feature vectors.

[0077] Specifically, the system extracts feature vectors from a 120-second segment, showing changes in network interface traffic of 100 MB / s, CPU temperature of 20°C, and memory usage of 20%. These vectors quantify the characteristics of state fluctuations, providing a basis for subsequent analysis.

[0078] It should be noted that feature extraction focuses on the range and frequency of changes in key indicators to ensure that the vectors reflect the dynamic behavior of the system. The K-nearest neighbor algorithm is used to analyze the state feature vectors and compare them with patterns in the normal pattern library.

[0079] For example, the normal pattern library contains the pattern "network card traffic is stable at 150MB / s ± 20MB / s". The system calculates the cosine similarity between the feature vector and the normal pattern to obtain a similarity score S.

[0080] For example, if the S value of a certain segment is 0.65, which is lower than the preset threshold T=0.85, it is marked as an abnormal state, an abnormal state identifier is generated, and the time period from 12:20:00 to 12:22:00 on August 6, 2025, and the server ID are recorded. This identifier facilitates quick anomaly location. Based on the abnormal state identifier, the system retrieves 120 records corresponding to the time period from the Redis cache, forming an abnormal state data subset.

[0081] For example, the subset contains data on network interface card traffic, CPU temperature, and memory usage, with timestamp alignment ensuring data accuracy.

[0082] It should be noted that the subset retains complete state information, supporting further in-depth analysis. Abnormal state data is processed using a weighted calculation method, combined with a preset weight W.

[0083] For example, network card traffic weight is 0.5, CPU temperature is 0.3, and memory usage is 0.2, reflecting the impact of each characteristic on the severity of the anomaly. The system calculates a comprehensive anomaly score R.

[0084] For example, an R value of 0.75 for a subset indicates a higher risk.

[0085] It should be noted that the weighting is based on historical data analysis to ensure that the scores reflect actual risks. A decision tree algorithm is used to classify abnormal data, and the risk category is determined based on the score R.

[0086] For example, an R value higher than 0.7 is classified as a high-risk category, generating a risk category identifier that includes the server ID.

[0087] In one possible implementation, the system combines historical data to analyze the repetitiveness of high-risk patterns.

[0088] For example, if a server experiences three high-risk anomalies within 24 hours, monitoring resources will be allocated preferentially. This classification method supports rapid response to potential faults.

[0089] In one possible implementation, the extended scheme analyzes trends in abnormal state data.

[0090] For example, the system compares the deviations between abnormal subsets and normal patterns, generates trend reports, and identifies sudden increases in network interface card (NIC) traffic as the primary cause of anomalies. This analysis supports operations and maintenance personnel in optimizing resource allocation.

[0091] S106. Trigger the corresponding alarm mechanism based on the comprehensive anomaly score. If the anomaly score exceeds the emergency threshold, generate high-priority alarm information immediately and obtain a complete hardware anomaly diagnosis report through alarm information aggregation processing.

[0092] If the overall anomaly score exceeds a preset emergency threshold, a high-priority alarm signal is generated. This alarm signal is then sorted using signal queue management technology to obtain a priority-ranked signal sequence. Based on this sequence, message distribution technology is used to transmit the high-priority alarm signal to the target processing module, resulting in a distributed alarm signal set. Information aggregation technology is used to process this set of distributed alarm signals, and a subset of abnormal state data is generated using a preset feature weight calculation method. If the feature values ​​in this subset exceed a preset anomaly range, a support vector machine algorithm is used to classify the subset, resulting in an anomaly category identifier. Based on the anomaly category identifier, the corresponding anomaly time window is extracted from the time series data, generating an anomaly time series segment. Time series analysis technology is used to process this segment, and combined with state feature vectors, a hardware anomaly diagnostic information set is generated. A decision tree algorithm is used to assess the risk of this hardware anomaly diagnostic information set, and combined with the risk category identifier, the final risk level classification is determined.

[0093] For example, in server monitoring scenarios, a comprehensive anomaly score reflects the degree of anomaly in system operation. Suppose a server's score reaches 0.9, exceeding the preset emergency threshold of 0.85, the system generates a high-priority alarm signal. The signal includes the server ID, a timestamp (2025-08-06 14:30:00), and the anomaly type, such as a surge in network interface card traffic. Signal queue management technology sorts the alarm signals, generating a sequence based on priority and timestamp.

[0094] For example, high-priority signals take precedence over low-priority signals, and signals within the same priority level are arranged in ascending order of timestamps to ensure that emergency signals are processed first.

[0095] Specifically, message distribution technology transmits high-priority alarm signals to the target processing module. Assuming the module includes a log analysis module and an operation and maintenance notification module, the system distributes signals to both modules via a message queue, forming a set of distributed alarm signals. This set records the signal distribution time and the target module ID for easy tracking of processing status. Information aggregation technology processes this set, combining feature weights to calculate a subset of abnormal state data.

[0096] For example, with network card traffic weight of 0.6, CPU temperature weight of 0.3, and memory usage weight of 0.1, the system extracts data from the signal showing a sudden increase in traffic from 150MB / s to 300MB / s and a rise in CPU temperature from 55°C to 75°C within 120 seconds, and generates a subset.

[0097] In one embodiment, a support vector machine algorithm classifies a subset. Subset feature values, such as a sudden increase in traffic of 150 MB / s exceeding a preset range of 100 MB / s, are classified as "severely abnormal" by the system, generating an anomaly category identifier. Based on this identifier, the system extracts an abnormal time window from the time-series data, such as from 14:30:00 to 14:32:00 on August 6, 2025, generating an abnormal time-series segment containing 120 records. The segment records trends in traffic, temperature, and other parameters.

[0098] For example, time series analysis techniques process data segments and combine them with state feature vectors, such as a traffic change frequency of 2 MB / s and a temperature change rate of 0.2°C / s, to generate a set of hardware anomaly diagnostic information. This set describes the cause of the anomaly, such as "network card overload causing a traffic surge." A decision tree algorithm evaluates this set and, combined with risk category identifiers, classifies the risk as high-risk.

[0099] For example, if the flow rate is continuously overloaded and the temperature is abnormal, the system will determine it to be at the "immediate intervention required" level.

[0100] Understandably, the above process, through layered processing, forms a complete monitoring chain from signal generation to risk classification. Each step is closely linked, optimizing weights and thresholds based on historical data to ensure accurate alarms. Signal queuing and distribution technology ensures rapid response to emergency signals, while classification and analysis technology provides detailed diagnostic data, supporting maintenance personnel in timely intervention of potential faults.

[0101] S107. Use an alarm information deduplication algorithm to merge duplicate alarms of the same hardware component. By analyzing the alarm frequency statistics and abnormal duration within the time window, determine the stability and persistence characteristics of the abnormal state.

[0102] Duplicate alarms identified by hardware components are merged using an alarm information deduplication algorithm. Alarm frequency is then statistically analyzed using time window analysis. Based on this statistical result, the duration of anomalies is calculated using time series analysis. If the duration exceeds a preset threshold, K-means clustering is used to classify the duration, resulting in anomaly classification. The classification results are then weighted using feature weighting and combined with time series segments to generate a set of stability feature values. Based on this set, time series analysis is used to extract anomaly time windows, yielding anomalous time series feature data. If the feature values ​​in this time series data exceed a preset range, the feature data is merged using information aggregation to obtain comprehensive anomalous status data. Finally, a decision tree algorithm is used to classify the comprehensive anomalous status data by risk level, and the final risk level is determined by combining this with the stability feature value set.

[0103] In one possible implementation, the alarm information deduplication algorithm merges duplicate alarms by identifying them using hardware components.

[0104] For example, in a server monitoring scenario, if a network interface card (NIC) triggers multiple alarms within a short period due to abnormal traffic, the system uses a deduplication algorithm to identify duplicate NIC IDs, merges them into a single alarm record, and retains the first alarm time and the highest priority information. Deduplication is based on the hardware ID and alarm type, generating a simplified alarm record after merging. For instance, alarms with NIC ID NC001 are merged into one record with a timestamp of 2025-08-06 15:00:00 and an anomaly type of "traffic surge."

[0105] For example, time window analysis technology can be used to count alarm frequency. A 5-minute time window is set, and the number of alarms triggered by a server within that window is counted. Suppose network card NC001 triggers 3 traffic anomaly alarms within 5 minutes, the frequency count is 0.6 alarms per minute. By analyzing the frequency, the system can determine the density of anomalies, facilitating subsequent processing.

[0106] Specifically, time series analysis technology calculates the duration of the anomaly. Based on the aforementioned frequency statistics, the system extracts time series data and analyzes the traffic anomaly from 15:00:00 on August 6, 2025 to 15:05:00, obtaining an anomaly duration of 300 seconds. If the preset threshold is 240 seconds, the system determines that the anomaly exceeds the limit and requires further classification.

[0107] In one possible implementation, the K-means clustering algorithm classifies the data based on the duration of anomalies. Assuming multiple devices in a server cluster malfunction for durations of 300 seconds, 180 seconds, and 400 seconds, the algorithm categorizes the data into two types: short-term anomalies and persistent anomalies. The 300-second anomaly of network card NC001 is classified as a persistent anomaly, and a classification label is generated.

[0108] For example, the feature weight calculation method weights the classification results. Setting an anomaly traffic weight of 0.7 and a duration weight of 0.3, the system calculates the stability feature value of network interface card NC001. Combining this with time series segments, such as a sudden increase in traffic from 200MB / s to 350MB / s, a set of stability feature values ​​is generated, including traffic change and duration characteristics.

[0109] Specifically, time series analysis technology extracts abnormal time windows. Based on the aforementioned data, the system identifies the period from 15:00:00 to 15:05:00 on August 6, 2025, as the abnormal window and generates characteristic data, such as a traffic change trend of 3MB / s per second. If the characteristic value exceeds the preset range of 100MB / s, further processing is triggered.

[0110] In one possible implementation, information aggregation technology merges comprehensive data on abnormal states. The system integrates features such as traffic and duration to generate comprehensive data, such as "Network interface card NC001 experienced a traffic surge lasting 300 seconds." The data records the complete context of the anomaly for easy subsequent analysis.

[0111] For example, decision tree algorithms classify comprehensive data into risk levels. Based on a set of stability feature values, the algorithm assesses traffic surges and their duration, and combines rules such as "a duration exceeding 240 seconds and a traffic increase exceeding 100MB / s is considered high risk," classifying network interface card NC001 as high-risk. The final risk level result guides maintenance personnel to prioritize handling and reduce the impact of the fault.

[0112] Based on the embodiments of the present invention described above, and through the above description, those skilled in the art can make various changes and modifications without departing from the technical concept of the present invention. The technical scope of the present invention is not limited to the contents of the specification, but must be determined according to the scope of the claims.

Claims

1. A method for alarming server hardware anomalies, characterized in that, include: A state machine algorithm is used to establish a state transition model for hardware components. Based on historical data of CPU temperature, memory usage, and disk read / write speed, a baseline of normal operating state for each hardware component is constructed. By analyzing the state transition path, a standard pattern library of hardware component state changes is obtained. The system acquires real-time monitoring data streams from multiple hardware components. If concurrent state change events are detected, a timestamp synchronization mechanism is used to uniformly mark all hardware state data, and a time-synchronized set of hardware state snapshots is obtained through a data buffer temporary storage mechanism. The hardware state snapshot set is analyzed by time series analysis based on the sliding window algorithm. A continuous state change sequence is extracted by setting a fixed time window length. If the frequency of state change exceeds a preset threshold, it is determined that there are potential abnormal fluctuations in the time period. An anomaly detection algorithm is used to perform pattern matching analysis on the state change sequence. By calculating the similarity with normal fluctuation patterns in the standard pattern library, if the similarity is lower than a preset threshold, the state change sequence is determined to belong to an abnormal state pattern. The feature parameters of the abnormal state pattern are obtained, the risk level of the detected abnormal state is classified according to the severity of the abnormality, and the comprehensive abnormality score is obtained by multi-dimensional feature weight calculation. The alarm mechanism of the corresponding level is triggered based on the comprehensive anomaly score. If the anomaly score exceeds the emergency threshold, a high-priority alarm message is generated immediately. A complete hardware anomaly diagnosis report is obtained through alarm message aggregation and processing. An alarm information deduplication algorithm is used to merge duplicate alarms of the same hardware component. By analyzing the alarm frequency statistics and abnormal duration within a time window, the stability and persistence characteristics of the abnormal state are determined.

2. The alarm method for server hardware anomalies according to claim 1, characterized in that, The process employs a state machine algorithm to establish a hardware component state transition model. Based on historical data of CPU temperature, memory usage, and disk read / write speed, a baseline of normal operating states for each hardware component is constructed. By analyzing state transition paths, a standard pattern library of hardware component state changes is obtained, including: Historical data on CPU temperature, memory usage, and disk read / write speed are obtained. Time-series data is extracted from a pre-defined data storage system, and outliers are removed using data cleaning techniques to obtain a standardized historical dataset. Based on the standardized historical dataset, the K-means clustering algorithm was used to perform cluster analysis on CPU temperature, memory usage and disk read / write speed to determine the baseline of normal operating status of each hardware component. Using a state machine algorithm, state transition sequences are extracted from the normal operating state baseline to generate a state transition model for hardware components, thus obtaining a set of state transition paths. For the set of state transition paths, a Markov chain model is used to analyze the transition probability of each path, determine the statistical law of state transition, and obtain the state transition probability matrix. If the transition probability of a certain path in the state transition probability matrix is ​​lower than a preset threshold, it is marked as an abnormal transition path and removed from the state transition path set to obtain the optimized state transition path set. Based on the optimized state transition path set, frequently occurring transition sequences are extracted, and a sequence mining algorithm is used to generate a standard pattern library of hardware component state changes, thus obtaining the final standard pattern set. Typical state transition patterns of each hardware component are extracted from the standard pattern set and stored in a preset pattern database to obtain a standard hardware state pattern library that can be used for real-time monitoring.

3. The alarm method for server hardware anomalies according to claim 1, characterized in that, The process involves acquiring real-time monitoring data streams from multiple hardware components. If concurrent state change events are detected, a timestamp synchronization mechanism is used to uniformly mark all hardware state data. A time-synchronized set of hardware state snapshots is obtained through a data buffer temporary storage mechanism, including: The system acquires real-time monitoring data streams from multiple hardware components, and uses streaming processing technology to segment and parse the data streams to obtain a sequence of segmented hardware status data. For the hardware state data sequence after fragmentation, if concurrent state change events are detected, a timestamp synchronization mechanism is used to add a unified timestamp to each hardware state data to obtain a time-aligned state data set. By using a data buffer temporary storage mechanism, the time-aligned state data set is stored in a preset buffer to obtain a time-synchronized hardware state snapshot set; The state features of each hardware component are extracted from the time-synchronized hardware state snapshot set, and the state features are dimensionality-reduced by the principal component analysis algorithm to obtain the dimensionality-reduced state feature vector. Based on the dimensionality-reduced state feature vector, a clustering analysis algorithm is used to group the states of the hardware components to obtain a set of state categories for each hardware component; Based on the set of state categories, a decision tree algorithm is used to classify the state change trends of hardware components and determine the state change patterns of each hardware component. If the state change pattern deviates from the preset normal mode threshold, the abnormal state is marked by the anomaly detection mechanism, and a set of hardware component identifiers of the abnormal state is obtained.

4. The alarm method for server hardware anomalies according to claim 1, characterized in that, The step involves performing time-series analysis on the hardware state snapshot set using a sliding window algorithm. By setting a fixed time window length, continuous state change sequences are extracted. If the frequency of state changes exceeds a preset threshold, potential abnormal fluctuations are identified within that time period, including: The continuous state change sequence is extracted from the hardware state snapshot set by the sliding window algorithm. A fixed time window length is set to obtain the state change frequency within the time period. If the frequency of state changes exceeds a preset threshold, potential abnormal fluctuations are marked through an anomaly detection mechanism to obtain a set of abnormal time period identifiers; Based on the set of abnormal time period identifiers, a subset of state data for the corresponding time period is extracted from the set of hardware state snapshots using timestamp alignment technology. The set of hardware component categories in abnormal states is obtained by grouping the state data subset using the k-means clustering algorithm. Based on the set of hardware component categories, statistical analysis methods are used to calculate the state change amplitude of each hardware component to obtain the abnormal fluctuation feature vector. If the amplitude of the abnormal fluctuation feature vector exceeds the preset amplitude threshold, the abnormal mode of the hardware component is determined by the classifier, and an abnormal mode identifier set is obtained. Based on the set of abnormal pattern identifiers, detailed status records for relevant time periods are extracted from the set of hardware status snapshots to generate an abnormal status sequence dataset.

5. The alarm method for server hardware anomalies according to claim 1, characterized in that, The anomaly detection algorithm is used to perform pattern matching analysis on the state change sequence. Similarity is calculated between the sequence and normal fluctuation patterns in a standard pattern library. If the similarity is below a preset threshold, the state change sequence is determined to belong to an abnormal state pattern, including: By using time series segmentation technology, state change sequences are extracted from a set of hardware state snapshots to obtain time series data; The time series data were analyzed using a pattern matching algorithm, and the similarity score was calculated by comparing it with normal fluctuation patterns in the standard pattern library. If the similarity score is lower than the preset threshold, the time series data is marked as an abnormal state pattern through the anomaly detection mechanism to obtain the anomaly pattern identifier; Based on the abnormal mode identifier, extract the corresponding time series data subset from the hardware state snapshot set to obtain the abnormal state data; By using fluctuation feature extraction technology, abnormal state data can be analyzed to obtain fluctuation feature vectors; The decision tree algorithm is used to classify the fluctuation feature vectors, determine the category to which the abnormal state pattern belongs, and obtain the abnormal pattern category; Based on the abnormal pattern category, relevant normal fluctuation patterns are extracted from the standard pattern library to generate a comparative analysis dataset of abnormal states.

6. The alarm method for server hardware anomalies according to claim 1, characterized in that, The process involves acquiring feature parameters of abnormal state patterns, classifying the detected abnormal states into risk levels based on anomaly severity grading standards, and calculating a comprehensive anomaly score through multi-dimensional feature weights, including: The state change sequence is obtained from the hardware state snapshot set, and the state change sequence is processed by time series segmentation technology to obtain time series data; By analyzing time series data using feature extraction techniques, key features are extracted to obtain state feature vectors. The K-nearest neighbor algorithm is used to analyze the state feature vector and calculate the similarity with the patterns in the preset normal pattern library to obtain the similarity score S, where S represents the degree of matching between the state feature vector and the normal pattern. If the similarity score S is lower than the preset threshold T, where T is a pre-established anomaly judgment standard, then the time series data is marked as an anomaly state, and an anomaly state identifier is obtained. Based on the abnormal state identifier, the corresponding data subset is extracted from the time series data to obtain the abnormal state data; The abnormal state data is processed by a weighted calculation method, and combined with a preset weight W, where W represents the contribution of different features to the severity of the abnormality, a comprehensive abnormality score R is calculated, where R represents the risk level of the abnormal state. Based on the comprehensive anomaly score R, the decision tree algorithm is used to classify the abnormal state data, determine the risk category to which the abnormal state belongs, and obtain the risk category identifier.

7. The alarm method for server hardware anomalies according to claim 1, characterized in that, The alarm mechanism triggers the corresponding level based on the comprehensive anomaly score. If the anomaly score exceeds the emergency threshold, a high-priority alarm is immediately generated. A complete hardware anomaly diagnostic report is obtained through alarm information aggregation and processing, including: If the overall anomaly score exceeds the preset emergency threshold, a high-priority alarm signal is generated. The alarm signals are sorted using signal queue management technology to obtain a priority sorting signal sequence. Based on the priority order of the signal sequence, message distribution technology is used to transmit high-priority alarm signals to the target processing module, thereby obtaining the set of distributed alarm signals; The distributed alarm signal set is processed by information aggregation technology, and a subset of abnormal state data is generated by combining the preset feature weight calculation method. If the feature values ​​in the subset of abnormal state data exceed the preset abnormal range, the support vector machine algorithm is used to classify the subset of abnormal state data to obtain an abnormal category identifier. Based on the anomaly category identifier, extract the corresponding anomaly time window from the time series data to generate anomaly time series segments; By processing abnormal time series segments using time series analysis techniques and combining them with state feature vectors, a set of hardware anomaly diagnostic information is generated. A decision tree algorithm is used to assess the risk of hardware anomaly diagnostic information set, and the final risk level classification result is determined by combining the risk category identifier.

8. The alarm method for server hardware anomalies according to claim 1, characterized in that, The method employs an alarm information deduplication algorithm to merge duplicate alarms from the same hardware component. By analyzing alarm frequency statistics and abnormal duration within a time window, the stability and persistence characteristics of the abnormal state are determined, including: The duplicate alarms identified by hardware components are merged using an alarm information deduplication algorithm, and the alarm frequency is statistically analyzed using time window analysis technology to obtain alarm frequency statistics. Based on the alarm frequency statistics and combined with time series analysis techniques, the duration of the anomaly is calculated to obtain the anomaly duration data. If the abnormal duration data exceeds the preset threshold, the K-means clustering algorithm is used to classify the abnormal duration data to obtain the abnormal state classification result. The abnormal state classification results are weighted by a feature weight calculation method, and combined with time series segments to generate a set of stability feature values. Based on the set of stability eigenvalues, time series analysis techniques are used to extract abnormal time windows to obtain abnormal time series feature data; If the feature values ​​in the abnormal time series feature data exceed the preset abnormal range, the feature data are merged through information aggregation technology to obtain comprehensive abnormal state data. The decision tree algorithm is used to classify the risk level of the comprehensive data of abnormal states, and the final risk level result is determined by combining the set of stability feature values.

9. An alarm device for server hardware anomalies, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor as described in the claims, characterized in that, When the processor executes the computer program, it implements the steps of the alarm method for server hardware anomalies as described in any one of claims 1 to 8.

10. A computer-readable storage system storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the alarm method for server hardware anomalies as described in any one of claims 1 to 8.

Images