A power application performance anomaly detection method and system for a domestic environment

Abstract

The application relates to a power application performance anomaly detection method and system facing a domestic environment, which comprises the following steps: S1: obtaining a domestication basic environment, power real-time data, application system performance indexes and business operation logs, and preprocessing to obtain a multi-dimensional time sequence data matrix; S2: based on the multi-dimensional time sequence data matrix, performing feature engineering and feature optimization to obtain an optimized feature matrix; S3: based on the optimized feature matrix, combining historical labeled abnormal samples, and constructing a multi-level AI anomaly detection model; S4: according to the multi-level AI anomaly detection model, according to the preprocessed real-time data, obtaining an abnormal detection result; S5: according to the abnormal detection result, obtaining an alarm strategy and a disposal whitelist, and converting the abnormal detection result into an operable alarm and disposal. The application effectively reduces operation and maintenance pressure and response risk, realizes intelligentization and fine management of the whole process from abnormal detection to alarm disposal.

Description

TECHNICAL FIELD

[0001] The application relates to the field of application anomaly detection, and in particular to a power application performance anomaly detection method and system for a domestic environment. BACKGROUND

[0002] In a domestic application environment, power services are sensitive to performance stability and require high-speed perception and timely disposal of faults. However, due to differences between the domestic software and hardware environment and foreign mainstream products in terms of ecological perfection, compatibility and performance optimization, performance bottlenecks, resource contention, system anomalies and service fluctuations are prone to occur. If accurate monitoring and real-time detection cannot be achieved, business interruption and core working condition anomalies are likely to occur, resulting in economic and safety risks. SUMMARY

[0003] To solve the above problems, the purpose of the application is to provide a power application performance anomaly detection method and system for a domestic environment, which effectively reduces the operation and maintenance pressure and response risk, and realizes intelligent and fine management of the whole process from anomaly detection to alarm disposal.

[0004] To achieve the above purpose, the application adopts the following technical solutions:

[0005] A power application performance anomaly detection method for a domestic environment, comprising the following steps:

[0006] S1: Obtain a domestic basic environment, power real-time data, application system performance indicators and business operation logs, and preprocess to obtain a multi-dimensional time series data matrix;

[0007] S2: Based on the multi-dimensional time series data matrix, perform feature engineering and feature optimization to obtain an optimized feature matrix;

[0008] S3: Based on the optimized feature matrix, combine the historically labeled abnormal samples to construct a multi-level AI anomaly detection model;

[0009] S4: According to the multi-level AI anomaly detection model, obtain an anomaly detection result according to the preprocessed real-time data;

[0010] S5: According to the anomaly detection result, obtain an alarm strategy and a disposal whitelist, and convert the anomaly detection result into an operable alarm and disposal.

[0011] Further, the domestic basic environment, power real-time data, application system performance indicators and business operation logs are obtained as follows:

[0012] In the context of domestically produced CPUs, obtain an inventory and boundary of the basic hardware and software environment, including host list, virtualization / container form, network topology, storage type, database and middleware version, message bus, and time-series storage / log platform;

[0013] Establish unified metadata and identification standards for all managed objects, verify the alignment accuracy with the time synchronization system, and clarify data classification, national cryptographic algorithm usage strategies, access control, and auditing traces. Adopt a unified telemetry semantics and tagging system compatible with OTLP, standardize field naming, units, and sampling windows, and establish a unified data dictionary and measurement unit standard. Define patterns and extract regular expression templates for log fields to form key fields and context association keys. All data entries are accompanied by timestamps and unified tags.

[0014] Further preprocessing is performed as follows:

[0015] Time governance is performed on cross-source data to ensure it can be used for sliding window analysis and cross-domain comparison, including: setting late arrival tolerance windows for each data stream and rearranging it by timestamp within the window; marking and downweighting data that arrives late; deduplicating based on primary key or sequence number; and resampling data of different frequencies to a uniform time granularity to generate aligned time grids.

[0016] Based on the data cleaning strategy, the robustness of downstream features and models is improved, including: short-term missing data is filled or interpolated according to business, and missing data exceeding the time limit is marked with a hole and the missing rate index is retained; impossible values ​​are removed based on physical boundaries and industry thresholds, and evidence is added to samples that are suspected of being abnormal but may contain fault signals to avoid accidentally deleting useful information; smoothing is applied to data with jitter index exceeding the threshold to reduce noise without losing abrupt change signals.

[0017] Align all data to a unified timeline and concatenate them column-wise according to object granularity to form a multidimensional time-series data matrix.

[0018] Furthermore, based on the multidimensional time-series data matrix, feature engineering and feature optimization are performed to obtain the optimized feature matrix, as follows:

[0019] Based on a multidimensional time series data matrix, we obtain basic statistical features, rate of change and mutation features, cross-domain correlation features, and topological and call chain features.

[0020] The basic statistical characteristics include the mean characteristic. ,variance With discreteness characteristics Specifically, for time series data X(t) within the time window W k Inside:

[0021] ;

[0022] ;

[0023] ;

[0024] wherein, is a preset constant; t is a time;

[0025] The change rate and mutation features include a first-order difference , a relative change rate and an exponential weighted moving average (EWMA):

[0026] ;

[0027] ;

[0028] ;

[0029] wherein, a is a smoothing parameter;

[0030] The cross-domain correlation features include a Pearson correlation coefficient , and mutual information MI(X, Y);

[0031] ;

[0032] ;

[0033] wherein, and are the mean values of X and Y in the time window, respectively; p(x, y) is a joint probability distribution, and p(x) and p(y) are marginal probability distributions;

[0034] The topology and calling chain features combine service topology and calling chain information to construct features M reflecting the system architecture, and calculate service node importance, calling path criticality, upstream and downstream propagation delay, and dependency health degree.

[0035] For the constructed features, L1 regularization is used to automatically perform feature screening and retain high-value features.

[0036] The selected high-value features are standardized, the processed features are organized into a standardized optimization feature matrix, the format of the matrix is a behavior time sample and column as a feature dimension, the matrix is accompanied by time stamp, object identifier and quality score meta information, and a feature dictionary is established to record the definition, calculation method and business meaning of each feature.

[0037] Further, the multi-level AI anomaly detection model is constructed to include a fast alarm layer, a robust decision layer and a root cause auxiliary layer; the fast alarm layer adopts a lightweight statistical and distance measurement method for analysis, and outputs an abnormal score and a preliminary screening label; the robust decision layer adopts a supervised learning model constructed based on historical labeled samples to process nonlinearity and interaction, and outputs a label with a confidence higher than a threshold; the root cause auxiliary layer combines system topology structure and call chain information to perform root cause analysis and propagation path tracking, and finally the three-layer model forms a final anomaly detection result through score fusion and rule constraint.

[0038] Further, the fast alarm layer adopts a lightweight statistical and distance measurement method for analysis, and outputs an abnormal score and a preliminary screening label, and the specific process is as follows:

[0039] According to the optimized feature matrix ft, a statistical deviation score SZ(t) and a distance measurement score SM(t) are calculated:

[0040] ;

[0041] ;

[0042] ;

[0043] Wherein, z j (t) is the robust Z-score value of the jth feature at time t; f t,j is the observation value of the jth feature at time t; med j is the historical median of the jth feature; MAD j is the median absolute deviation of the jth feature;

[0044] is a small constant to prevent division by zero; p is the total number of feature dimensions; μ is the historical mean vector of the feature; Σ is the covariance matrix of the feature;

[0045] S Z (t) and S M (t) are mapped to a consistent interval and weighted fused to obtain a comprehensive abnormal score S L1 (t) of the fast alarm layer:

[0046] ;

[0047] Wherein, , are weight coefficients, respectively;

[0048] A preliminary screening label and a confidence are generated by comparing a dynamic threshold τ

[0049] ;

[0050] ;

[0051] wherein med(S L1 ) is the historical median of the fast alarm layer anomaly score; MAD(S L1 ) is the median absolute deviation of the L1 layer anomaly score; k is the threshold adjustment coefficient; is the binary anomaly label of the fast alarm layer; is the indicator function; c L1 (t) is the anomaly confidence score IQR(S L1 ): the interquartile range of the L1 anomaly score; is the positive part function.

[0052] Further, the robust decision layer includes a cost-sensitive logistic regression module, a gradient boosting tree module, a focal loss module, and an integrated fusion module, specifically as follows:

[0053] The objective function of the cost-sensitive logistic regression module is:

[0054] ;

[0055] wherein β is the regression coefficient vector; is the class weight; is the log loss function; σ is the activation function; λ1 is the L1 regularization coefficient; λ2 is the L2 regularization coefficient; x i is the feature vector of the i-th sample; y i is the true label of the i-th sample; n is the number of samples;

[0056] Anomaly probability calculation:

[0057] ;

[0058] wherein x t represents the feature vector at time t;

[0059] Confidence evaluation:

[0060] ;

[0061] Label decision: wherein is the final decision label; is the probability decision threshold;

[0062] The gradient boosting tree module uses XGBoost, which calculates the first and second order gradients of the loss function L in each round of training. The first order gradient indicates the error direction, and the second order gradient provides curvature information:

[0063] ;

[0064] ;

[0065] wherein f k is the kth tree; T k is the number of leaf nodes of the kth tree; w j,k is the weight of the jth leaf of the kth tree; γ is the leaf node number penalty coefficient; λ is the leaf weight L2 regularization coefficient; is the overall loss of the model; is the model prediction label of the i th sample; K is the number of decision trees;

[0066] and based on the gradient information, a new decision tree is constructed, the prediction value of each leaf node is determined by gradient information optimization, the gradient sum of the samples falling into the leaf is considered to prevent the leaf weight from being too large in the final prediction, and the prediction values of all trees are weighted and summed and then converted into probability through Sigmoid;

[0067] The focus loss module automatically transfers the training focus from simple samples to difficult samples by introducing a dynamic modulation factor in the loss function, and when a certain class of samples has been correctly classified by the model with high confidence, the loss contribution automatically decreases; while for low confidence and easily confused samples, the loss weight remains or is emphasized, so that the model obtains stronger discriminant ability in the boundary area;

[0068] The integrated fusion module performs multi-strategy fusion on the probability scores and confidence degrees of the above base learners, adopts two-layer Stacking: the first layer is the parallel output probability of multiple models, and the second layer meta-learner learns the optimal weight based on the validation set or performs linear combination in the logit space; the unified score after fusion is converted into the final label through adaptive threshold optimization and rule constraint, ensuring that high confidence abnormal judgment is output under the premise of controllable risk.

[0069] Further, the root cause auxiliary layer, in combination with the system topology structure and the call chain information, performs root cause analysis and propagation path tracking, specifically as follows: graph topology modeling uses a graph convolution network to encode the topology structure and call chain relationship of the system into graph features, identifies abnormal propagation paths and impact ranges through information propagation between nodes, sequence time series modeling uses a convolutional neural network to capture long-term dependencies and context patterns in time series, and calculates reconstruction error through a sequence autoencoder as an anomaly indicator; path contribution analysis is also implemented, the propagation intensity of the anomaly score on the call chain path is calculated to identify the most likely abnormal source and propagation path, and finally the root cause node ranking, abnormal propagation link, time series anomaly segment and structured explanation information are output.

[0070] Further, according to the abnormality detection result, an alarm strategy and a disposal whitelist are acquired, and the abnormality detection result is converted into an operable alarm and disposal, specifically as follows: the abnormality score, confidence, root cause direction and influence range output by the multi-level AI abnormality detection model are mapped into an executable alarm and disposal: first, hierarchical and routing are performed according to the alarm strategy library, and then automatic security operations are matched according to the disposal whitelist, and the application range, precondition and risk level are checked, low-risk actions are directly executed, medium and high-risk actions trigger approval and rollback protection; the whole process is recorded and effect acceptance is performed, if convergence is not reached, upgrade or alternative script is used, and false positives / disposal effectiveness is fed back to the upstream to continuously optimize the strategy threshold and model calibration.

[0071] A power application performance abnormality detection system for a domestic environment includes a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, it specifically executes the steps of a power application performance abnormality detection method for a domestic environment.

[0072] The present application has the following advantages:

[0073] 1. The present application is oriented towards a domestic complex environment, and comprehensively integrates multi-source data such as basic hardware and software, application performance, real-time business and operation logs, etc. Through unified data collection and multi-dimensional time series analysis, it provides rich context information and data basis for abnormality detection, effectively improving the adaptability and perception granularity of specific fault modes in the domestic environment;

[0074] 2. The present application can deeply mine the non-linear correlation between multi-source features, realize high-sensitivity identification and low-false alarm rate determination of various complex abnormalities, and can solve practical problems such as data imbalance and scene variability, ensuring the generalization ability and robustness in large-scale power systems;

[0075] 3. The present application efficiently converts abnormality detection results into hierarchical alarms and automated, auditable response actions, significantly improving the practicality of alarms and the efficiency of closed-loop disposal, effectively reducing the operation and maintenance pressure and response risk, and realizing intelligent and fine-grained management of the whole process from abnormality detection to alarm disposal. BRIEF DESCRIPTION OF DRAWINGS

[0076] Figure 1 The present application is a method flowchart. DETAILED DESCRIPTION

[0077] The present application will be further described in detail below in combination with the drawings and specific embodiments:

[0078] Reference Figure 1 In this embodiment, a power application performance abnormality detection method for a domestic environment is provided, including the following steps:

[0079] S1: Obtain the localization basic environment, real-time power data, application system performance indicators, and business operation logs, and preprocess to obtain a multi-dimensional time series data matrix;

[0080] S2: Based on the multi-dimensional time series data matrix, perform feature engineering and feature optimization to obtain an optimized feature matrix;

[0081] S3: Based on the optimized feature matrix, combine the historically labeled abnormal samples to construct a multi-level AI anomaly detection model;

[0082] S4: According to the multi-level AI anomaly detection model, according to the preprocessed real-time data, obtain the anomaly detection result;

[0083] S5: According to the anomaly detection result, obtain the alarm strategy and disposal whitelist, and convert the anomaly detection result into operable alarm and disposal.

[0084] In this embodiment, the localization basic environment, real-time power data, application system performance indicators, and business operation logs are obtained as follows:

[0085] In the environment of domestic operating systems such as UOS and Kirin OS and domestic CPUs such as Feiteng, Kunpeng, and Longxin, the inventory and boundaries of the basic software and hardware environment are obtained, including host list, virtualization / container form, network topology, storage type, database and middleware version, message bus, time sequence storage / log platform;

[0086] A unified metadata and identification specification is established for all managed objects, and the alignment accuracy with the time synchronization system is verified to ensure that subsequent time series data can be aligned on a millisecond time axis. Synchronize the data classification, national encryption algorithm usage strategy (transmission SM2 / SM4, storage encryption), access control (RBAC / ABAC), and audit trail to provide a compliance framework for data collection and preprocessing;

[0087] Around the four main lines of “electricity physical quantity-IT performance-business log-context metadata”, the indicator caliber and collection frequency are clearly defined:

[0088] Real-time power data (physical quantity): voltage, current, active / reactive power, power factor, frequency, power quality events (voltage sag, waveform distortion, harmonic content), etc., with a sampling frequency set according to device capability and business demand (e.g. 1s–5s).

[0089] Application system performance indicators (IT indicators): CPU usage (overall and core level), load, context switching; memory occupancy, cache, memory pressure; disk I / O (IOPS, throughput, latency, queue depth); network throughput, retransmission rate, packet loss rate, average RTT; application interface RT (P50 / P95 / P99), QPS, error rate, connection pool / thread pool level, GC pause.

[0090] Business operation logs (behavior data): error logs, transaction records, user operation traces, status codes and exception stacks, order / work order / transaction flow, etc., requiring structured or semi-structured field extraction capabilities.

[0091] Environment and change context: release and rollback, configuration changes, maintenance plans, holiday / shift markers, geographic / room labels, service topology relationships and dependency mappings, used to explain indicator fluctuations and build causal clues.

[0092] To ensure the fusion and traceability of heterogeneous data, a compatible OTLP telemetry semantic and label system is adopted, field naming, units and sampling windows are standardized, and a unified data dictionary and measurement unit specification is established: voltage in V, current in A, power in kW / kVar, frequency in Hz, CPU in percent, response time in ms, throughput in MB / s or Gbps, IOPS / latency / queue depth remain fixed caliber; For log fields, define patterns and extract regular templates to form key fields (such as level, code, module, msg, stack, userid, bizid) and context association keys (such as trac_id, requestid), all data entries are attached with timestamp and unified labels, ensuring the association with topology, instance, region, version, and working condition.

[0093] In this embodiment, preprocessing is performed as follows:

[0094] Time management is performed on cross-source data to ensure that it can be used for sliding window analysis and cross-domain comparison, including: setting a late arrival tolerance window for each data stream, rearranging by timestamp within the window; marking and down-weighting data that arrives late; de-duplication based on primary key (timestamp + label hash) or sequence number to reduce statistical bias; resample data of different frequencies to a unified time granularity (e.g. 1s or 5s) to generate aligned time bins;

[0095] Based on data cleaning strategies, the robustness of downstream features and models is improved, including: short-term missing data is filled or interpolated according to business (such as linear / forward filling); missing data that exceeds the time limit is marked with holes and the missing rate is retained; impossible values ​​are removed based on physical boundaries and industry thresholds (such as CPU > 100%, frequency deviation > 2%); evidence is added to samples that are suspected of being abnormal but may contain fault signals to avoid accidentally deleting useful information; smoothing (such as median filtering, sliding window removal) is applied to data with jitter indicators exceeding the threshold to reduce noise without losing abrupt changes.

[0096] Align all data to a unified timeline and concatenate them in columnar fashion according to object granularity (such as service / instance / interface or substation / feeder) to form a multidimensional time series data matrix.

[0097] In this embodiment, feature engineering and feature optimization are performed based on a multi-dimensional time-series data matrix to obtain an optimized feature matrix, as detailed below:

[0098] Based on a multidimensional time series data matrix, we obtain basic statistical features, rate of change and mutation features, cross-domain correlation features, and topological and call chain features.

[0099] The basic statistical characteristics include the mean characteristic. ,variance With discreteness characteristics Specifically, for time series data X(t) within the time window W k Inside:

[0100] ;

[0101] ;

[0102] ;

[0103] in, t is a preset constant; t is time.

[0104] The rate of change and mutation characteristics include first-order differences. Relative rate of change Exponentially Weighted Moving Average (EWMA):

[0105] ;

[0106] ;

[0107] ;

[0108] Where α is the smoothing parameter;

[0109] Cross-domain correlation features include a Pearson correlation coefficient , mutual information MI(X, Y);

[0110] ;

[0111] ;

[0112] wherein, and are the mean values of X and Y within the time window respectively; p(x, y) is a joint probability distribution, and p(x) and p(y) are marginal probability distributions;

[0113] Topology and call chain features combine service topology and call chain information to construct features M reflecting system architecture, and calculate service node importance, call path criticality, upstream and downstream propagation delay, and dependency health degree.

[0114] For the constructed features, L1 regularization (LASSO) is used to automatically perform feature screening and retain high-value features.

[0115] The selected high-value features are standardized, and the processed features are organized into a standardized optimization feature matrix in the format of behavior time samples and columns as feature dimensions, with timestamp, object identifier and quality score meta information, and a feature dictionary is established to record the definition, calculation method and business meaning of each feature.

[0116] In the embodiment, the multi-level AI anomaly detection model includes a fast alarm layer, a robust decision layer and a root cause auxiliary layer; the fast alarm layer uses lightweight statistical and distance measurement methods for analysis, and outputs an anomaly score and a preliminary screening label; the robust decision layer uses a supervised learning model constructed based on historical labeled samples to process nonlinearity and interaction, and outputs a label with a confidence higher than a threshold; the root cause auxiliary layer combines system topology structure and call chain information to perform root cause analysis and propagation path tracking, and finally the three-layer model forms the final anomaly detection result through score fusion and rule constraint;

[0117] Preferably, linear weighted fusion is used for score fusion:

[0118] ;

[0119] Adaptive weight learning:

[0120] ;

[0121] Confidence weighted fusion:

[0122] ;

[0123] And through the Logit space fusion, get the final probability:

[0124] ;

[0125] ;

[0126] ;.

[0127] In this embodiment, the rapid alarm layer adopts lightweight statistical and distance measurement method analysis, outputs abnormal score and preliminary screening label, as follows:

[0128] According to the optimized feature matrix ft, calculate the statistical deviation score SZ(t) and distance measurement score SM(t):

[0129] ;

[0130] ;

[0131] ;

[0132] Wherein, z j (t) is the robust Z-score value of the jth feature at time t; f t,j is the observation value of the jth feature at time t; med j is the historical median of the jth feature; MAD j is the median absolute deviation of the jth feature;

[0133] is a small constant to prevent division by zero; p is the total number of feature dimensions; μ is the historical mean vector of the feature; Σ is the covariance matrix of the feature;

[0134] Map S Z (t), S M (t) to a consistent interval and weighted fusion to get the comprehensive abnormal score S L1 (t) of the rapid alarm layer:

[0135] ;

[0136] Among them, , are weight coefficients;

[0137] The preliminary screening label and confidence are generated by comparing the dynamic threshold τ

[0138] ;

[0139] ;

[0140] where med(S L1 ) is the historical median of the fast alarm layer anomaly score; MAD(S L1 ) is the median absolute deviation of the L1 layer anomaly score; k is the threshold adjustment coefficient; is the binary anomaly label of the fast alarm layer; is the indicator function; c L1 (t) is the anomaly confidence score IQR(S L1 ): the interquartile range of the L1 anomaly score; is the positive part function.

[0141] In this embodiment, the robust decision layer includes a cost-sensitive logistic regression module, a gradient boosting tree module, a focal loss module, and an integrated fusion module, as follows:

[0142] The objective function of the cost-sensitive logistic regression module is:

[0143] ;

[0144] where β is the regression coefficient vector (including the intercept term); is the class weight; is the log loss function; σ is the activation function; λ1 is the L1 regularization coefficient (feature selection); λ2 is the L2 regularization coefficient (anti-overfitting); x i is the feature vector of the i-th sample; y i is the true label of the i-th sample; n is the number of samples;

[0145] Anomaly probability calculation:

[0146] ;

[0147] where x t represents the feature vector at time t;

[0148] Confidence evaluation (based on probability distance):

[0149] ;

[0150] Label determination: ;

[0151] The gradient boosting tree module uses XGBoost, which calculates the first and second order gradients of the loss function L in each round of training. The first order gradient indicates the error direction, and the second order gradient provides curvature information:

[0152] ;

[0153] ;

[0154] where f k is the kth tree; T k is the number of leaf nodes of the kth tree; w j,k is the weight of the jth leaf of the kth tree; γ is the leaf node number penalty coefficient; λ is the leaf weight L2 regularization coefficient; is the overall loss of the model; is the model prediction label of the i th sample; K is the number of decision trees;

[0155] and based on the gradient information, a new decision tree is constructed, the prediction value of each leaf node is determined by gradient information optimization, the gradient sum of the samples falling into the leaf is considered to prevent the leaf weight from being too large, and finally the prediction value is optimized. The prediction values of all trees are weighted and summed and then converted into probabilities through Sigmoid;

[0156] The focus loss module automatically transfers the training focus from simple samples to difficult samples by introducing a dynamic modulation factor in the loss function. When certain samples have been correctly classified by the model with high confidence, their loss contribution automatically decreases. For low-confidence and easily confused samples, the loss weight remains or is emphasized, allowing the model to gain stronger discrimination ability in the boundary region.

[0157] The integrated fusion module performs multi-strategy fusion on the probability scores and confidence of each base learner, using a two-layer Stacking: the first layer is the parallel output probability of multiple models, and the second layer meta-learner learns the optimal weight based on the validation set or performs linear combination in the logit space. The unified score after fusion is converted into the final label through adaptive threshold optimization (which can face F1, AUC or cost minimization target) and necessary rule constraints (such as business hard threshold and time sequence consistency), ensuring high confidence of abnormal judgment under the premise of controllable risk.

[0158] In the present embodiment, the root cause auxiliary layer, in combination with the system topology structure and call chain information, performs root cause analysis and propagation path tracking, as follows: graph topology modeling uses a graph convolution network to encode the topology structure and call chain relationship of the system into graph features, identifies abnormal propagation paths and impact ranges through information propagation between nodes, sequence time sequence modeling uses a convolutional neural network to capture long-term dependencies and context patterns in time series, and calculates reconstruction error through a sequence autoencoder as an anomaly indicator; path contribution analysis is also implemented, which identifies the most likely abnormal source and propagation path by calculating the propagation intensity of the anomaly score on the call chain path, and finally outputs root cause node ranking, abnormal propagation link, time series anomaly segment, and structured explanation information.

[0159] In this embodiment, according to the abnormality detection result, the alarm strategy and the handling whitelist are acquired, and the abnormality detection result is converted into an operable alarm and handling, specifically as follows: the abnormality score, confidence, root cause pointing and impact range output by the multi-level AI abnormality detection model are mapped into an executable alarm and handling: first, hierarchical and routing are performed according to the alarm strategy library (combining threshold value, business impact, topology key degree and time consistency to dynamically determine P0-P3 levels, and application of suppression, deduplication and topology aggregation to avoid alarm storm), and then according to the handling whitelist, the automatic security operation (such as flow limiting, switching, restarting, fallback) is matched, the application range, precondition and risk level are checked, the low-risk action is directly executed, and the medium and high-risk actions trigger approval and rollback protection; the whole process is recorded and the effect is accepted (index regression, score back-off, business recovery), if the convergence is not reached, the backup script is upgraded or used, and the false alarm / handling effect is fed back to the upstream to continuously optimize the strategy threshold and model calibration.

[0160] A power application performance abnormality detection system for a domestic environment includes a processor, a memory, and a computer program stored on the memory, and when the processor executes the computer program, the steps of the power application performance abnormality detection method for the domestic environment are specifically executed.

[0161] Those skilled in the art will appreciate that embodiments of the application can be provided as methods, systems, or computer program products. Accordingly, the application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage media, etc.) having computer usable program code embodied in the medium.

[0162] The present application is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 An apparatus for performing the functions specified in one or more flows and / or blocks in the flowcharts and / or block diagrams. Figure 1 An apparatus for performing the functions specified in one or more flows and / or blocks in the flowcharts and / or block diagrams.

[0163] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 one or more flow or blocks and / or blocks Figure 1 one or more flow or blocks and / or blocks

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 one or more flow or blocks and / or blocks Figure 1 one or more flow or blocks and / or blocks

[0165] The above description is only preferred embodiments of the present application, not intended to limit other forms of the present application. Any person skilled in the art can make modifications or changes to the above-mentioned disclosed technical contents as equivalent embodiments. However, any simple modification, equivalent change and modification of the above embodiments without departing from the technical solution of the present application, according to the technical essence of the present application, still belongs to the protection scope of the technical solution of the present application.

Claims

1. A power application performance anomaly detection method for a domestic environment, characterized by, The method comprises the following steps: S1: Obtain the localization basic environment, real-time power data, application system performance indicators and business operation logs, and preprocess to obtain a multi-dimensional time series data matrix; S2: Based on the multi-dimensional time series data matrix, perform feature engineering and feature optimization to obtain an optimized feature matrix; S3: Based on the optimized feature matrix, combine the historically labeled abnormal samples to construct a multi-level AI abnormality detection model; S4: According to the multi-level AI abnormality detection model, obtain an abnormality detection result according to the preprocessed real-time data; S5: According to the abnormality detection result, obtain an alarm strategy and a disposal whitelist, and convert the abnormality detection result into an operable alarm and disposal; The multi-level AI abnormality detection model comprises a fast alarm layer, a robust judgment layer and a root cause auxiliary layer; the fast alarm layer uses a lightweight statistical and distance measurement method for analysis, and outputs an abnormality score and a preliminary screening label; the robust judgment layer uses a supervised learning model constructed based on historical labeled samples to process nonlinearity and interaction, and outputs a label with a confidence higher than a threshold; the root cause auxiliary layer combines system topology structure and call chain information to perform root cause analysis and propagation path tracking, and finally the three-layer model forms a final abnormality detection result through score fusion and rule constraint; The fast alarm layer uses a lightweight statistical and distance measurement method for analysis, and outputs an abnormality score and a preliminary screening label, specifically as follows: According to the optimized feature matrix ft, calculate the statistical deviation score SZ(t) and the distance measurement score SM(t): ； ； ； where z j (t) is the robust Z-score value of the jth feature at time t; f t,j is the observed value of the jth feature at time t; med j is the historical median of the jth feature; MAD j is the median absolute deviation of the jth feature; a small constant to prevent division by zero; p is the total number of feature dimensions; μ is the historical mean vector of the feature; and Σ is the covariance matrix of the feature. S Z (t), S M (t) are mapped to a consistent interval and fused with weights to get the integrated anomaly score of the fast alert layer S L1 (t): ； wherein , are weight coefficients, respectively. Compare the dynamic threshold τ to generate a preliminary screening label and a confidence: ； ； wherein med(S L1 ) is the historical median of the fast alarm layer anomaly score; MAD(S L1 ) is the median absolute deviation of the L1 layer anomaly score; k is a threshold adjustment coefficient; is the binary anomaly label of the fast alarm layer; is an indicator function; c L1 (t) is the anomaly confidence score; IQR(S L1 ) is the interquartile range of the L1 anomaly score; is a positive part function.

2. The method for detecting performance anomaly of power application facing domestic environment according to claim 1, characterized in that, The localization basic environment, real-time power data, application system performance indicators and business operation logs are obtained as follows: In the environment of a domestic CPU, the basic hardware and software environment is checked and the boundaries are obtained, including a host list, virtualization / container form, network topology, storage type, database and middleware version, message bus, time sequence storage / log platform; Unified metadata and identification specifications are established for all objects under management, and the alignment accuracy with the time synchronization system is verified, and the data classification, national encryption algorithm usage strategy, access control and audit trace are synchronized; unified OTLP compatible telemetry semantics and label system are used, field naming, units and sampling window are standardized, and a unified data dictionary and measurement unit specification are established; the log field is defined and regular template is extracted to form a key field and context association key, and all data entries are attached with timestamp and unified label. 3.The method of claim 2, wherein, The preprocessing is specifically as follows: Time management is performed on cross-source data to ensure that it can be used for sliding window analysis and cross-domain comparison, including: setting a late arrival tolerance window for each data stream, rearranging according to timestamp within the window; marking and de-weighting data that arrives beyond the time; de-duplicating based on primary key or serial number; resampling data of different frequencies to a unified time granularity to generate an aligned time grid; Based on the data cleaning strategy, the robustness of downstream features and models is improved, including: short-time missing data is filled or interpolated according to business, and the missing rate index is generated for long-time missing data; impossible values are removed according to physical boundaries and industry thresholds, and evidence labels are added to samples suspected to be abnormal but may contain fault signals to avoid deleting useful information; for data with jitter indicators exceeding the threshold, smoothing is applied without losing mutation signals. Align all data to a unified time axis, and perform columnar splicing by object granularity to form a multi-dimensional time series data matrix.

4. The method for power application performance anomaly detection for domestic environment according to claim 1, characterized in that, Based on the multi-dimensional time series data matrix, feature engineering and feature optimization are performed to obtain an optimized feature matrix, specifically as follows: Based on the multi-dimensional time series data matrix, basic statistical features, change rate and mutation features, cross-domain correlation features, and topology and call chain features are obtained. The base statistical features include mean features , variance , and dispersion features , in particular, for time series data X(t) within a time window W k : ； ； ； wherein, is a preset constant; t is the time; The rate of change and mutation features include a first difference , a relative rate of change , and an exponentially weighted moving average (EWMA): ； ； ； Wherein, α is a smoothing parameter. Cross-domain associated features include a Pearson correlation coefficient , a mutual information MI(X, Y); ； ； where, and are the mean of X and Y within the time window, respectively; p(x, y) is the joint probability distribution, p(x) and p(y) are the marginal probability distributions; The topology and call chain features, combined with service topology and call chain information, construct features M reflecting the system architecture to calculate service node importance, call path criticality, upstream and downstream propagation delay, and dependency health degree. For the constructed features, L1 regularization is used to automatically select features and retain high-value features. The selected high-value features are standardized, and the processed features are organized into a standardized optimized feature matrix in the format of behavior time samples and columns as feature dimensions, with timestamp, object identifier and quality score meta information, and a feature dictionary is established to record the definition, calculation method and business meaning of each feature.

5. The method for power application performance anomaly detection for domestic environment according to claim 1, wherein, The robust decision layer includes a cost-sensitive logistic regression module, a gradient boosting tree module, a focal loss module, and an integrated fusion module, specifically as follows: The objective function of the cost-sensitive logistic regression module is: ； where β is a regression coefficient vector; is a category weight; is a log loss function; σ is an activation function; λ1 is an L1 regularization coefficient; λ2 is an L2 regularization coefficient; x i is a feature vector of the i-th sample; y i is a true label of the i-th sample; n is a number of samples; Abnormal probability Calculation: ； where x t represents the feature vector at time t; Confidence Evaluation: ； Tag decision: wherein is the final decision tag; is the probability decision threshold; The gradient boosting tree module uses XGBoost to calculate the first and second order gradients of the loss function L in each round of training, and the first order gradient indicates the error direction and the second order gradient provides curvature information: ; ； where f k is the kth tree; T k is the number of leaf nodes of the kth tree; w j,k is the weight of the jth leaf of the kth tree; γ is the leaf node number penalty coefficient; λ is the leaf weight L2 regularization coefficient; is the overall loss of the model; is the model predicted label of the ith sample; K is the number of decision trees; And based on the gradient information, a new decision tree is constructed, and the prediction value of each leaf node is determined by gradient information optimization, considering the gradient sum of the samples falling into the leaf to prevent the leaf weight from being too large in the final prediction; the prediction values of all trees are weighted and summed, and then converted to probability through Sigmoid; The focal loss module introduces a dynamic modulation factor into the loss function to shift the training focus from simple samples to difficult samples, and when a certain class of samples is correctly classified with high confidence by the model, the loss contribution automatically decreases; for low confidence and easily confused samples, the loss weight remains or is emphasized, so that the model has stronger discriminant ability in the boundary area; The integrated fusion module performs multi-strategy fusion on the probability scores and confidence of each base learner, using a two-layer Stacking: the first layer outputs probabilities in parallel, and the second layer meta-learner learns the optimal weight based on the validation set or performs linear combination in the logit space; the unified score after fusion is converted to the final label through adaptive threshold optimization and rule constraint, ensuring that high confidence abnormality is output under the premise of controllable risk.

6. The method for detecting performance anomaly of power application facing domestic environment according to claim 5, characterized in that, The root cause auxiliary layer, in combination with system topology and call chain information, performs root cause analysis and propagation path tracking, specifically as follows: graph topology modeling uses a graph convolution network to encode the topology structure and call chain relationship of the system as graph features, and through information propagation between nodes, identifies abnormal propagation paths and impact ranges; sequence time series modeling uses a convolutional neural network to capture long-term dependencies and context patterns in time series, and calculates reconstruction error through a sequence autoencoder as an anomaly indicator; path contribution analysis is also implemented, which identifies the most likely abnormal source and propagation path by calculating the propagation intensity of the anomaly score on the call chain path, and finally outputs root cause node ranking, abnormal propagation links, time series anomaly segments, and structured explanation information.

7. The method of claim 1, wherein the method is a method of detecting abnormal performance of power application in a domestic environment. According to the abnormal detection result, an alarm strategy and a disposal whitelist are obtained, and the abnormal detection result is converted into an operable alarm and disposal, specifically as follows: the abnormal score, confidence, root cause direction, and impact range output by the multi-level AI abnormal detection model are mapped into executable alarms and disposals: first, hierarchical and routing are performed according to the alarm strategy library, and then automatic security operations are matched according to the disposal whitelist, and the application scope, preconditions, and risk levels are checked, low-risk actions are executed directly, and medium and high-risk actions trigger approval and rollback protection; full-process records are executed and effect acceptance is performed, if convergence is not reached, upgrade or alternative script is used, and false positives / disposal effectiveness are fed back to the upstream to continuously optimize the strategy threshold and model calibration.

8. A power application performance anomaly detection system for a domestic environment, characterized by, The computer program product comprises a processor, a memory, and a computer program stored on the memory, and when the processor executes the computer program, the steps of the power application performance anomaly detection method for the domestic environment as claimed in any one of claims 1-7 are specifically executed.

Images