A task alarm handling method and system based on intelligent hierarchical classification

Abstract

This invention provides a task alarm processing method and system based on intelligent hierarchical classification, relating to the field of task scheduling alarm technology. The method includes: collecting execution behavior data of each task in a task scheduling system within multiple time windows and converting it into a state transition matrix through time-series encoding; identifying abnormal tasks and quantifying alarm intensity values ​​by analyzing non-stationary characteristics; constructing a heterogeneous graph of data flow and resource competition relationships among tasks, mapping abnormal tasks to corresponding nodes; generating context-aware vectors through multi-hop neighborhood aggregation, forming alarm clusters based on semantic distance, and determining core nodes; determining control instructions based on the alarm intensity of core nodes, performing conflict detection in conjunction with resource competition relationships, adjusting task execution timing, and predicting failure probabilities based on state transition paths to output risk types. This invention enables intelligent hierarchical classification and precise processing of alarms, improving the reliability and resource utilization efficiency of the task scheduling system.

Description

Technical Field

[0001] This invention relates to the field of task scheduling and alarm technology, and in particular to a task alarm processing method and system based on intelligent hierarchical classification. Background Technology

[0002] With the rapid development of cloud computing and big data technologies, task scheduling systems have become a core component of enterprise information infrastructure. In modern data centers, task scheduling systems need to manage and coordinate tens of thousands of interdependent tasks, involving multiple stages such as data acquisition, processing, analysis, and storage. The stable operation of the task scheduling system is directly related to the availability of business systems and the timeliness of data processing. However, due to the large number of tasks, complex dependencies, and intense resource competition, delays, failures, or anomalies frequently occur during task execution.

[0003] To ensure the stable operation of task scheduling systems, the industry commonly employs alarm monitoring mechanisms to detect and handle task anomalies. Traditional alarm handling methods are primarily based on threshold rules, triggering alarms when task execution time exceeds a preset threshold or when the task status is abnormal. Upon receiving an alarm, operations and maintenance personnel need to manually analyze task logs, investigate the cause of the anomaly, and take corresponding measures. As system scale increases, traditional methods are gradually becoming unable to meet the demands of modern task scheduling systems for intelligent operations and maintenance.

[0004] Existing alarm monitoring technologies still fail to effectively capture the temporal changes and non-stationary patterns of task execution behavior, resulting in insufficient ability to identify early abnormal signs. Alarms are often triggered only after a task has become severely abnormal or failed. Each abnormal task is analyzed and processed as an independent event, ignoring the complex dependencies and resource competition relationships between tasks. It is unable to identify related alarm clusters caused by the same root cause, making it difficult to quickly locate the core problem. Furthermore, there is a lack of comprehensive consideration of the task execution context and system resource status. When taking control measures, it is easy to cause new resource conflicts or break the dependency constraints between tasks. Moreover, there is a lack of real-time evaluation and risk prediction mechanisms for the effectiveness of handling measures, and it is impossible to adjust the handling strategy in a timely manner according to the dynamic changes in task execution, which reduces the success rate of anomaly handling and the overall stability of the system. Summary of the Invention

[0005] This invention provides a task alarm processing method and system based on intelligent hierarchical classification, which can at least solve some of the problems existing in the prior art.

[0006] A first aspect of this invention provides a task alarm processing method based on intelligent hierarchical classification, comprising:

[0007] The execution behavior data of each task in the task scheduling system within multiple time windows are collected and converted into a state transition matrix through time-series encoding. The non-stationarity characteristics in the state transition matrix are analyzed and abnormal tasks are identified. The behavior deviation index of the abnormal tasks is extracted and quantified to obtain the alarm intensity value.

[0008] Obtain the data flow relationship and resource competition relationship between tasks in the task scheduling system and construct a heterogeneous graph. Map abnormal tasks to the corresponding nodes in the heterogeneous graph to obtain the alarm node set.

[0009] Perform a multi-hop neighborhood aggregation operation on the heterogeneous graph to generate a context-aware vector representation. Calculate the semantic distance between the context-aware vectors of different alarm nodes in the alarm node set and classify alarm nodes with a distance less than a preset threshold into alarm clusters. Determine the alarm intensity value of each alarm node in the alarm cluster and determine the core node by combining it with the graph centrality index.

[0010] The corresponding control command is determined based on the alarm intensity value of the core node, and the currently available resources are queried. Conflict detection is performed in combination with the resource competition relationship. If the currently available resources are sufficient and there is no conflict, the execution sequence of tasks in the alarm cluster is adjusted based on the data flow relationship and the control command is executed. Execution process data is collected and the failure probability is predicted by combining the state transition path analysis. The task risk type is determined by combining the preset risk threshold and output.

[0011] In one alternative implementation,

[0012] The execution behavior data of each task in the task scheduling system within multiple time windows is collected and converted into a state transition matrix through time-series encoding. The non-stationarity characteristics in the state transition matrix are analyzed to identify abnormal tasks. Behavioral deviation indicators of the abnormal tasks are extracted and quantified to obtain alarm intensity values, including:

[0013] The execution behavior data of each task in the task scheduling system is collected within multiple time windows. The execution behavior data is segmented according to the length of the time window. The state sequence of the task within each time window is extracted. The transition relationship between adjacent states in the state sequence is encoded as matrix elements. Based on the matrix elements, the transition probability of different state transition paths is determined and a state transition matrix is ​​constructed.

[0014] The state transition matrix is ​​decomposed to extract the dominant feature vector and the similarity change rate of the dominant feature vector is calculated between consecutive time windows. The steady-state distribution of the state transition matrix is ​​calculated and the divergence of the steady-state distribution between different time windows is obtained. The divergence and the similarity change rate are fused to obtain a comprehensive non-stationary feature value. Tasks whose comprehensive non-stationary feature value exceeds a preset threshold are identified as abnormal tasks.

[0015] Extract the state sequence corresponding to the abnormal task and encode the state sequence to generate a behavior representation vector. Calculate the Euclidean distance between the behavior representation vector corresponding to the abnormal task and the preset standard behavior pattern. Use the minimum value of the Euclidean distance as a behavior deviation index and convert it into an initial intensity value through a preset mapping function. Obtain the data dependency relationship between different tasks in the task scheduling system and correct the initial intensity value according to the data dependency relationship to obtain the alarm intensity value.

[0016] In one alternative implementation,

[0017] Obtain the data flow and resource contention relationships among tasks in the task scheduling system and construct a heterogeneous graph. Map abnormal tasks to corresponding nodes in the heterogeneous graph to obtain the alarm node set, including:

[0018] Obtain the input data source and output data target of each task and determine the data flow relationship between each task. Record the data flow direction in the data flow relationship and determine the resource application record and resource occupation time period of each task in the task scheduling system. Detect the overlap between the resource occupation time periods of different tasks, identify tasks with resource competition relationship and record the competition resource type.

[0019] Initialize the heterogeneous graph, map tasks to nodes in the heterogeneous graph, map the data flow relationship to the edges connecting the corresponding nodes in the heterogeneous graph and label the data flow direction, map the resource competition relationship to the edges connecting the corresponding nodes in the heterogeneous graph and label the competition resource type, and construct the heterogeneous graph by repeating the mapping and connection, assign a node identifier to each node in the heterogeneous graph and establish a mapping relationship table;

[0020] The abnormal tasks are mapped to the heterogeneous graph. The node identifier corresponding to each abnormal task is obtained by querying the mapping relationship table. The node corresponding to the node identifier is marked as an alarm node, and all alarm nodes are combined to obtain an alarm node set.

[0021] In one alternative implementation,

[0022] Performing a multi-hop neighborhood aggregation operation on the heterogeneous graph to generate a context-aware vector representation, calculating the semantic distance between the context-aware vectors of different alarm nodes in the alarm node set, and classifying alarm nodes with a distance less than a preset threshold into alarm clusters includes:

[0023] Starting from the nodes in the heterogeneous graph, a multi-hop traversal is performed to identify heterogeneous path patterns. For each heterogeneous path pattern, path embedding encoding is performed to extract path-level semantic features. The distribution differences of neighboring nodes under different heterogeneous path patterns are compared to identify structural deviation features. The neighboring nodes of each node under different heterogeneous path patterns are obtained, and the node features corresponding to the neighboring nodes are coupled with the path-level semantic features and the structural deviation features to obtain a path-aware node representation. The path-aware node representation is hierarchically aggregated to obtain multi-scale neighborhood features. The multi-scale neighborhood features are fused with the node features of the current node and the alarm intensity value to generate a context-aware vector representation.

[0024] Extract the context-aware vector representation corresponding to each alarm node, calculate the topological centrality of each alarm node based on the heterogeneous graph, and perform weighted modulation on the context-aware vector representation corresponding to the alarm node according to the topological centrality to obtain a centrality-enhanced vector representation. Calculate the vector distance between different centrality-enhanced vector representations to obtain the initial semantic distance, analyze the distribution skewness and kurtosis of the initial semantic distance to obtain the semantic distance, identify alarm node pairs with a semantic distance less than a preset distance threshold and connect them to obtain an alarm similarity graph, perform connected component decomposition on the alarm similarity graph and divide the alarm nodes into alarm clusters by calculating the internal connection density.

[0025] In one alternative implementation,

[0026] Determine the alarm intensity value of each alarm node in the alarm cluster and, in conjunction with the graph centrality index, determine the core nodes, including:

[0027] Obtain the alarm intensity value corresponding to each alarm node, locate each alarm node in the heterogeneous graph, assign type weights to each edge in the heterogeneous graph based on the alarm intensity value and calculate the weighted degree centrality of each alarm node, calculate the edge type entropy by analyzing the weight distribution of different types of edges connected to the current alarm node, and determine the propagation mode mixing degree of the current alarm node based on the edge type entropy.

[0028] The dominant propagation mechanism of the current alarm node is determined based on the propagation mode mixing degree. For alarm nodes whose dominant propagation mechanism is data flow, a flow imbalance factor is calculated based on the difference between the weights of the incoming and outgoing edges. For alarm nodes whose dominant propagation mechanism is resource competition, a competition fluctuation factor is calculated based on the variance of the competition edge weights. The flow imbalance factor or the competition fluctuation factor is used as the propagation path attenuation coefficient to correct the alarm intensity value of the current alarm node to obtain the path-corrected alarm intensity.

[0029] Based on the path-corrected alarm intensity and the weighted degree centrality, a comprehensive influence index is constructed. Principal component analysis is performed on the comprehensive influence index of all alarm nodes in the alarm cluster to extract the influence principal components. The load value of the comprehensive influence index of each alarm node on the influence principal components is calculated, and the alarm node with the largest load value is selected as the core node.

[0030] In one alternative implementation,

[0031] Based on the alarm intensity value of the core node, the corresponding control command is determined and the currently available resources are queried. Conflict detection is performed in conjunction with the resource contention relationship. If the currently available resources are sufficient and there is no conflict, the execution sequence of tasks in the alarm cluster is adjusted based on the data flow relationship, and the control command is executed, including:

[0032] The control command type is determined based on the alarm intensity value of the core node, and the currently available resources are queried. The control command type is then mapped to a predefined resource requirement template to obtain the direct resource requirement corresponding to the control command type.

[0033] Based on the resource competition relationship, extract the set of competing nodes that compete with the core node, and construct a resource competition propagation network based on the edges corresponding to the resource competition relationship in the heterogeneous graph. In the resource competition propagation network, simulate the resource occupation propagation process after the execution of the control command to obtain the resource occupation propagation path. Track the cascading diffusion effect of resource occupation along the resource occupation propagation path and identify indirect competing nodes. Calculate the derived resource demand corresponding to the indirect competing nodes. Combine the direct resource demand to determine the total resource demand. Based on the total resource demand and the current available resources, determine the resource sufficiency status and perform path bottleneck analysis on the resource occupation propagation path to identify resource blocking nodes. If there are resource blocking nodes, calculate the resource diversion capacity of the resource blocking nodes and determine the conflict status.

[0034] When the resource sufficiency status is sufficient and the conflict status is conflict-free, the downstream dependent nodes of the core node are identified based on the data flow relationship, the execution timing of the tasks corresponding to the downstream dependent nodes is adjusted based on the data flow relationship, and the control instructions are executed.

[0035] In one alternative implementation,

[0036] Collect execution process data and combine it with state transition path analysis to predict failure probability. Combine this with preset risk thresholds to determine the task risk type and output the following:

[0037] The task state sequence and state transition timestamps during the execution of control commands are collected as execution process data. The task state sequence is expanded in chronological order to obtain a state evolution sequence and state loop segments are identified. The number of loops and the duration of each state loop segment are counted and the state loop intensity is calculated. The path transition frequency is extracted from the historical transition path from the current state to the failure state in the state evolution sequence. The path failure probability of the task reaching the failure state along the historical transition path is calculated based on the path transition frequency and the state transition timestamp. The failure probability is obtained based on the path failure probability and the state loop intensity.

[0038] The state evolution sequence is divided into multiple state evolution subsequences by time window segmentation. The state transition density is obtained based on the number of state types and the number of state transitions in each state evolution subsequence. The time window in which the state transition density exceeds a preset density threshold is identified, and the state dispersion entropy is calculated based on the dispersion degree of the task state. The instability of task execution is quantified based on the state dispersion entropy to obtain the state instability coefficient. A comprehensive risk score is calculated by combining the failure probability and the state instability coefficient and compared with a preset risk threshold. The task risk type is determined based on the comparison result and output.

[0039] A second aspect of the present invention provides a task alarm processing system based on intelligent hierarchical classification, comprising:

[0040] The first unit is used to collect the execution behavior data of each task in the task scheduling system within multiple time windows and convert it into a state transition matrix through time-series encoding. It analyzes the non-stationarity characteristics in the state transition matrix and identifies abnormal tasks, extracts the behavior deviation index of the abnormal tasks and quantifies it to obtain the alarm intensity value.

[0041] The second unit is used to obtain the data flow relationship and resource competition relationship between tasks in the task scheduling system and to construct a heterogeneous graph. Abnormal tasks are mapped to the corresponding nodes in the heterogeneous graph to obtain the alarm node set.

[0042] The third unit is used to perform multi-hop neighborhood aggregation operation on the heterogeneous graph to generate context-aware vector representation, calculate the semantic distance between context-aware vectors of different alarm nodes in the alarm node set and classify alarm nodes with a distance less than a preset threshold into alarm clusters, determine the alarm intensity value of each alarm node in the alarm cluster and determine the core node in combination with the graph centrality index.

[0043] The fourth unit is used to determine the corresponding control command based on the alarm intensity value of the core node and query the currently available resources. It performs conflict detection in combination with the resource competition relationship. If the currently available resources are sufficient and there is no conflict, it adjusts the execution sequence of tasks in the alarm cluster based on the data flow relationship and executes the control command. It collects execution process data and analyzes and predicts the failure probability in combination with the state transition path. It judges the task risk type in combination with the preset risk threshold and outputs the result.

[0044] A third aspect of the present invention provides an electronic device, comprising:

[0045] A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0046] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0047] In this invention, execution behavior data of each task in a task scheduling system within multiple time windows are collected and converted into a state transition matrix through time-series encoding. The non-stationarity characteristics in the state transition matrix are analyzed to identify abnormal tasks. Behavioral deviation indicators of abnormal tasks are extracted and quantified to obtain alarm intensity values. This allows for accurate identification of abnormal states during task execution. Quantitative analysis enables precise measurement of alarm intensity, providing a reliable data foundation for subsequent intelligent hierarchical processing. This improves the accuracy of abnormal task identification and the scientific nature of alarm processing. Furthermore, by acquiring the data flow and resource competition relationships between tasks in the task scheduling system and constructing a heterogeneous graph, abnormal tasks are mapped to corresponding nodes in the heterogeneous graph to obtain an alarm node set. Multi-hop neighborhood aggregation is performed on the heterogeneous graph to generate context-aware vector representations. The semantic distance between the context-aware vectors of different alarm nodes in the alarm node set is calculated, and alarm nodes with a distance less than a preset threshold are identified. By dividing alarms into clusters, determining the alarm intensity of each alarm node within the cluster, and identifying core nodes using graph centrality metrics, the system comprehensively considers the relationships and impact ranges between tasks. This enables intelligent clustering of alarms and precise localization of core issues, avoiding alarm storms and redundant processing, and improving the efficiency and relevance of alarm handling. By determining corresponding control commands based on the alarm intensity of core nodes and querying currently available resources, conflict detection is performed based on resource contention relationships. The execution sequence of tasks within the alarm cluster is adjusted based on data flow relationships, and control commands are executed. Execution process data is collected, and failure probabilities are predicted using state transition path analysis. Based on preset risk thresholds, task risk types are determined and output. This enables closed-loop alarm processing and dynamic risk assessment. Resource coordination and timing optimization ensure the safe execution of control commands, effectively reducing system failure rates and maintenance costs, and improving the stability and reliability of the task scheduling system. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating the task alarm processing method based on intelligent hierarchical classification according to an embodiment of the present invention;

[0049] Figure 2 This is a flowchart illustrating the resource management and control instruction execution process of the intelligent hierarchical task alarm processing method according to an embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0052] Figure 1 This is a flowchart illustrating the intelligent hierarchical task alarm processing method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0053] The execution behavior data of each task in the task scheduling system within multiple time windows are collected and converted into a state transition matrix through time-series encoding. The non-stationarity characteristics in the state transition matrix are analyzed and abnormal tasks are identified. The behavior deviation index of the abnormal tasks is extracted and quantified to obtain the alarm intensity value.

[0054] Obtain the data flow relationship and resource competition relationship between tasks in the task scheduling system and construct a heterogeneous graph. Map abnormal tasks to the corresponding nodes in the heterogeneous graph to obtain the alarm node set.

[0055] Perform a multi-hop neighborhood aggregation operation on the heterogeneous graph to generate a context-aware vector representation. Calculate the semantic distance between the context-aware vectors of different alarm nodes in the alarm node set and classify alarm nodes with a distance less than a preset threshold into alarm clusters. Determine the alarm intensity value of each alarm node in the alarm cluster and determine the core node by combining it with the graph centrality index.

[0056] The corresponding control command is determined based on the alarm intensity value of the core node, and the currently available resources are queried. Conflict detection is performed in combination with the resource competition relationship. If the currently available resources are sufficient and there is no conflict, the execution sequence of tasks in the alarm cluster is adjusted based on the data flow relationship and the control command is executed. Execution process data is collected and the failure probability is predicted by combining the state transition path analysis. The task risk type is determined by combining the preset risk threshold and output.

[0057] In one alternative implementation,

[0058] The execution behavior data of each task in the task scheduling system within multiple time windows is collected and converted into a state transition matrix through time-series encoding. The non-stationarity characteristics in the state transition matrix are analyzed to identify abnormal tasks. Behavioral deviation indicators of the abnormal tasks are extracted and quantified to obtain alarm intensity values, including:

[0059] The execution behavior data of each task in the task scheduling system is collected within multiple time windows. The execution behavior data is segmented according to the length of the time window. The state sequence of the task within each time window is extracted. The transition relationship between adjacent states in the state sequence is encoded as matrix elements. Based on the matrix elements, the transition probability of different state transition paths is determined and a state transition matrix is ​​constructed.

[0060] The state transition matrix is ​​decomposed to extract the dominant feature vector and the similarity change rate of the dominant feature vector is calculated between consecutive time windows. The steady-state distribution of the state transition matrix is ​​calculated and the divergence of the steady-state distribution between different time windows is obtained. The divergence and the similarity change rate are fused to obtain a comprehensive non-stationary feature value. Tasks whose comprehensive non-stationary feature value exceeds a preset threshold are identified as abnormal tasks.

[0061] Extract the state sequence corresponding to the abnormal task and encode the state sequence to generate a behavior representation vector. Calculate the Euclidean distance between the behavior representation vector corresponding to the abnormal task and the preset standard behavior pattern. Use the minimum value of the Euclidean distance as a behavior deviation index and convert it into an initial intensity value through a preset mapping function. Obtain the data dependency relationship between different tasks in the task scheduling system and correct the initial intensity value according to the data dependency relationship to obtain the alarm intensity value.

[0062] In a task scheduling system, execution behavior data for each task is continuously collected across multiple time windows. This data includes the task's start time, execution duration, resource usage, and execution status. To analyze task behavior patterns, the execution behavior data needs to be segmented according to the length of the time window. The time window can be set according to actual needs, for example, it can be set to 1 hour, 6 hours, or 24 hours. For a data collection task A, its execution behavior data for one week can be segmented into 28 time window segments, each with a 6-hour time window.

[0063] For task execution behavior data within each time window, extract the task's state sequence. Task states can include "Waiting," "Running," "Paused," "Completed," and "Failed." For example, task A within a 6-hour time window might have a state sequence of ["Waiting," "Running," "Paused," "Running," "Completed"]. Encoding the transition relationships between adjacent states in the state sequence as matrix elements creates a state transition matrix. The rows and columns of the matrix represent different states, and the matrix elements represent the number of transitions from one state to another. For example, if the "Waiting" state is followed by the "Running" state 3 times in the state sequence, then the element value in the corresponding "Waiting" row and "Running" column of the matrix would be 3.

[0064] Based on the matrix elements, the transition probabilities of different state transition paths can be determined, and a state transition matrix can be constructed. The transition probability is calculated by dividing the number of state transitions by the total number of times that state occurs. For example, if the "waiting" state occurs a total of 5 times, and 3 of those times are followed by the "running" state, then the transition probability from "waiting" to "running" is 3 / 5 = 0.6. For task A, a 5×5 state transition matrix can be obtained, where the matrix elements represent the probability of the corresponding state transition.

[0065] Matrix decomposition is performed on the state transition matrix to extract the dominant eigenvectors. The dominant eigenvectors are the eigenvectors corresponding to the largest eigenvalue of the state transition matrix, representing the main pattern of state transitions. The rate of change of similarity between the dominant eigenvectors is calculated between consecutive time windows. Cosine similarity is used to measure the similarity between two eigenvectors, and the rate of change of similarity between adjacent time windows is calculated. For example, for two consecutive time windows of task A, if the cosine similarity of its dominant eigenvectors changes from 0.95 to 0.80, the rate of change of similarity is (0.95-0.80) / 0.95≈0.158.

[0066] Calculate the steady-state distribution of the state transition matrix. The steady-state distribution represents the probability distribution of each state during the long-term operation of the task. Obtain the divergence of the steady-state distribution between different time windows. The KL divergence can be used to calculate the degree of difference between two probability distributions. For example, the steady-state distribution divergence of task A between two adjacent time windows is 0.25.

[0067] By combining the aforementioned divergence and similarity change rates, a comprehensive non-stationary feature value is obtained. This value is then fused using a weighted average method. For example, if the weights are set to 0.6 and 0.4 respectively, the comprehensive non-stationary feature value is approximately 0.6 × 0.25 + 0.4 × 0.158 ≈ 0.213. Tasks with a comprehensive non-stationary feature value exceeding a preset threshold are identified as anomalous tasks. If the preset threshold is 0.2, then task A will be identified as an anomalous task.

[0068] For identified anomalous tasks, their corresponding state sequences are extracted and encoded to generate behavioral representation vectors. Encoding methods can employ techniques such as one-hot encoding or word embedding. The Euclidean distance between the behavioral representation vector of the anomalous task and a preset standard behavioral pattern is calculated. The standard behavioral pattern is derived from analyzing the behavioral patterns of historical normal tasks, consisting of multiple typical patterns. For example, the Euclidean distances between the behavioral representation vector of task A and the three standard patterns are 2.5, 1.8, and 3.2, respectively. The minimum Euclidean distance is used as the behavioral deviation index, i.e., 1.8.

[0069] The behavioral deviation index is converted into an initial intensity value through a preset mapping function. The mapping function can be a linear function or a non-linear function. For example, the mapping function can be set as f(x)=10 / (1+x), then the initial intensity value of task A is 10 / (1+1.8)≈3.57.

[0070] Obtain the data dependencies between different tasks in the task scheduling system. Data dependencies can be represented as a directed graph, where nodes represent tasks and edges represent dependencies. Adjust the initial intensity value based on the data dependencies to obtain the alarm intensity value. The adjustment method can consider the importance and impact of the tasks; for example, it can be adjusted based on the number of downstream dependent tasks. If task A has 5 downstream dependent tasks, the initial intensity value can be multiplied by an adjustment factor (1 + 5 × 0.1) = 1.5, resulting in an alarm intensity value of 3.57 × 1.5 ≈ 5.36.

[0071] Based on the calculated alarm intensity values, alarms can be categorized into different levels. For example, 0-3 can be set as low-level alarms, 3-6 as medium-level alarms, and 6-10 as high-level alarms. For task A, its alarm intensity value of 5.36 falls under the medium-level alarm category, which triggers the corresponding medium-level alarm handling process, including notifying relevant personnel and activating the preset recovery mechanism.

[0072] In this embodiment, by segmenting and analyzing task execution behavior on a time window scale and transforming the task state change process into a quantifiable state transition matrix, the sensitivity and stability of anomaly identification can be significantly enhanced. By extracting the dominant feature vector through matrix decomposition and combining it with the similarity change rate and steady-state distribution divergence of continuous time windows, a refined characterization of the non-stationarity of task behavior can be achieved. This allows for early detection of abnormal drifts in task behavior patterns over time, providing a stronger ability to perceive temporal anomalies compared to methods based on a single statistic. By generating behavioral representation vectors based on the encoding of abnormal task state sequences and measuring the degree of deviation by comparing them with standard behavioral patterns, the degree of behavioral anomaly can be further quantified after anomaly identification, making the alarm results more specific and interpretable.

[0073] In one alternative implementation,

[0074] Obtain the data flow and resource contention relationships among tasks in the task scheduling system and construct a heterogeneous graph. Map abnormal tasks to corresponding nodes in the heterogeneous graph to obtain the alarm node set, including:

[0075] Obtain the input data source and output data target of each task and determine the data flow relationship between each task. Record the data flow direction in the data flow relationship and determine the resource application record and resource occupation time period of each task in the task scheduling system. Detect the overlap between the resource occupation time periods of different tasks, identify tasks with resource competition relationship and record the competition resource type.

[0076] Initialize the heterogeneous graph, map tasks to nodes in the heterogeneous graph, map the data flow relationship to the edges connecting the corresponding nodes in the heterogeneous graph and label the data flow direction, map the resource competition relationship to the edges connecting the corresponding nodes in the heterogeneous graph and label the competition resource type, and construct the heterogeneous graph by repeating the mapping and connection, assign a node identifier to each node in the heterogeneous graph and establish a mapping relationship table;

[0077] The abnormal tasks are mapped to the heterogeneous graph. The node identifier corresponding to each abnormal task is obtained by querying the mapping relationship table. The node corresponding to the node identifier is marked as an alarm node, and all alarm nodes are combined to obtain an alarm node set.

[0078] Obtain the input data source and output data target for each task, and determine the data flow relationship between tasks. The input data source refers to the source of data required for task execution, which may be a database table, file, message queue, etc.; the output data target is the location where the processed data is stored. For example, for data acquisition task T1, the input data source might be external interface API1, and the output data target is the database table DB_TABLE1; while the input data source for data cleaning task T2 is DB_TABLE1, and the output data target is DB_TABLE2. By analyzing the task information, a data flow relationship can be determined between T1 and T2, that is, the output of T1 is the input of T2. This data flow relationship can be represented using directed edges, where the direction of the edge indicates the direction of data flow.

[0079] For each task in the task scheduling system, the corresponding resource request record and resource occupation time period are recorded. The resource request record includes information such as the resource type and quantity requested by the task; the resource occupation time period records the time when the task starts occupying and releases the resource. For example, task T3 occupies memory resource M1 from 9:00 to 10:00 every day, and task T4 occupies the same memory resource M1 from 9:30 to 10:30. Their resource occupation time periods overlap (9:30-10:00), so there is a resource competition relationship between T3 and T4. The type of resource being competed for is memory resource M1. The system detects the overlap of resource occupation time periods among all tasks, identifies task pairs with resource competition relationships, and records the type of resource they are competing for.

[0080] Construct and initialize a heterogeneous graph. A heterogeneous graph is a graph structure containing different types of nodes and edges; tasks are mapped to nodes in the heterogeneous graph. For each task in the data scheduling system, a corresponding node is created in the heterogeneous graph. For example, for tasks T1, T2, T3, T4, and T5, five nodes are created in the heterogeneous graph.

[0081] The aforementioned data flow relationships are mapped to edges connecting the corresponding nodes in the heterogeneous graph, and the data flow direction is labeled for each edge. For example, for the data flow relationship from T1 to T2, a directed edge is created in the heterogeneous graph from node T1 to node T2, and this edge is labeled to represent the "data flow" relationship. If there are multiple data flow types, data type information can be added to the edges, such as labeling them as "log data flow" or "user data flow".

[0082] Resource contention relationships are mapped to edges connecting corresponding nodes in a heterogeneous graph, and each edge is labeled with the type of resource being competed for. For the resource contention relationship between T3 and T4 in the previous example, an undirected edge connecting nodes T3 and T4 is created in the heterogeneous graph, and this edge is labeled as representing a "memory resource M1 contention" relationship. If two tasks are competing for multiple resources simultaneously, multiple edges can be created, each corresponding to a type of resource being competed for, or multiple resource types can be labeled on a single edge.

[0083] By repeating the aforementioned mapping and connection process, a complete heterogeneous graph is constructed. This graph contains all task nodes and edges representing data flow relationships and resource competition relationships between tasks. A unique node identifier is assigned to each node in the heterogeneous graph, and a mapping table between nodes and tasks is established. For example, task T1 can be assigned the node identifier "N001", task T2 can be assigned the node identifier "N002", and so on. The mapping table records the correspondence between task names and their corresponding node identifiers, in the form of "T1-N001, T2-N002, T3-N003, T4-N004, T5-N005".

[0084] When an abnormal task is detected, it is mapped to a heterogeneous graph. Assume that tasks T2 and T4 are identified as abnormal tasks using the aforementioned anomaly detection method. By querying the mapping table, the node identifier corresponding to each abnormal task can be obtained. For abnormal tasks T2 and T4, the corresponding node identifiers are "N002" and "N004" respectively. The nodes corresponding to these node identifiers are marked as alarm nodes, and all alarm nodes are combined to obtain the alarm node set {N002, N004}.

[0085] In this embodiment, by simultaneously acquiring the data flow relationship and resource usage of tasks, and detecting the resource competition relationship between tasks in the time dimension, the originally scattered task interaction relationship can be transformed into structured and computable association information. This can significantly improve the ability to identify potential conflicts, dependency bottlenecks, and abnormal propagation paths between tasks. By uniformly mapping the data flow relationship and resource competition relationship to the heterogeneous graph, the multi-type association between tasks can be uniformly expressed, which can more comprehensively reflect the operation structure of the task scheduling system and improve the completeness and precision of the association analysis. By mapping the detected abnormal tasks to alarm nodes in the heterogeneous graph, single-point anomalies can be converted into structured alarms, supporting the identification of the impact range and potential diffusion path of anomalies from the perspective of system topology. This significantly enhances the correlation and globality of the anomaly identification results, enabling more efficient location of the problem source and early prevention of risk spread.

[0086] In one alternative implementation,

[0087] Performing a multi-hop neighborhood aggregation operation on the heterogeneous graph to generate a context-aware vector representation, calculating the semantic distance between the context-aware vectors of different alarm nodes in the alarm node set, and classifying alarm nodes with a distance less than a preset threshold into alarm clusters includes:

[0088] Starting from the nodes in the heterogeneous graph, a multi-hop traversal is performed to identify heterogeneous path patterns. For each heterogeneous path pattern, path embedding encoding is performed to extract path-level semantic features. The distribution differences of neighboring nodes under different heterogeneous path patterns are compared to identify structural deviation features. The neighboring nodes of each node under different heterogeneous path patterns are obtained, and the node features corresponding to the neighboring nodes are coupled with the path-level semantic features and the structural deviation features to obtain a path-aware node representation. The path-aware node representation is hierarchically aggregated to obtain multi-scale neighborhood features. The multi-scale neighborhood features are fused with the node features of the current node and the alarm intensity value to generate a context-aware vector representation.

[0089] Extract the context-aware vector representation corresponding to each alarm node, calculate the topological centrality of each alarm node based on the heterogeneous graph, and perform weighted modulation on the context-aware vector representation corresponding to the alarm node according to the topological centrality to obtain a centrality-enhanced vector representation. Calculate the vector distance between different centrality-enhanced vector representations to obtain the initial semantic distance, analyze the distribution skewness and kurtosis of the initial semantic distance to obtain the semantic distance, identify alarm node pairs with a semantic distance less than a preset distance threshold and connect them to obtain an alarm similarity graph, perform connected component decomposition on the alarm similarity graph and divide the alarm nodes into alarm clusters by calculating the internal connection density.

[0090] After the heterogeneous graph is constructed, a multi-hop traversal is performed starting from the nodes in the graph to identify heterogeneous path patterns. Multi-hop traversal refers to the process of starting from a single node and continuously visiting multiple nodes along the edges of the graph. Since heterogeneous graphs contain different types of edges—data flow relationship edges and resource contention relationship edges—different heterogeneous path patterns can be formed during the traversal. For example, for node N002, corresponding to task T2, possible heterogeneous path patterns include "data flow-data flow," which is a path traversing two data flow relationship edges, and "data flow-resource contention," which is a path traversing one data flow relationship edge and one resource contention relationship edge, etc. In practical implementation, the maximum number of hops for traversal is limited, such as to 3 hops, to control computational complexity.

[0091] For each identified heterogeneous path pattern, path embedding encoding is performed to extract path-level semantic features. Path embedding encoding is the process of mapping a path into a low-dimensional vector representation. This function is implemented using a path encoder, which receives the edge type sequence on the path as input and outputs a fixed-dimensional vector. For example, for the path pattern "data flow - resource competition", a 128-dimensional vector representation can be obtained. Path-level semantic features contain path type and structural information, and can capture the semantic differences between different types of paths.

[0092] By comparing the distribution differences of neighboring nodes under different heterogeneous path patterns, structural deviation characteristics are identified. A neighboring node is a set of nodes reachable through a specific path. For the same starting node, different path patterns may lead to different distributions of neighboring nodes. Structural deviation characteristics are identified by calculating the overlap and distribution differences of neighboring node sets under different path patterns. For example, task T2's reachable node set via the "data flow" path is {N005}, while the reachable node set via the "resource contention" path is {N003}. These are completely different, indicating that the interaction pattern of task T2 differs significantly under different relationships.

[0093] For each node, its neighboring nodes under different heterogeneous path patterns are obtained. The node features corresponding to these neighboring nodes are then coupled with path-level semantic features and structural deviation features to obtain a path-aware node representation. Node features can include information such as task type, execution frequency, and average execution time. The coupling process can be achieved through feature concatenation and nonlinear transformation. For example, for node N002, its neighboring node features, path-level semantic features, and structural deviation features under the "data flow" path can be combined to obtain a 256-dimensional path-aware representation vector.

[0094] Multi-scale neighborhood features are obtained by hierarchically aggregating the path-aware node representations. Hierarchical aggregation refers to the process of aggregating neighborhood information within different hop count ranges in a hierarchical manner. An attention aggregation mechanism can be designed to assign different weights to neighborhood nodes at different distances. For example, for node N002, the path-aware representations of 1-hop, 2-hop, and 3-hop neighborhoods can be aggregated separately to obtain neighborhood features at three scales. The final multi-scale neighborhood features are then obtained by weighted averaging.

[0095] Multi-scale neighborhood features are fused with the current node's node features and alarm intensity values ​​to generate a context-aware vector representation. The fusion process can employ non-linear transformations, such as multilayer perceptrons or gating units. For example, for alarm node N002, whose alarm intensity value is 5.36, this value is fused with node features and multi-scale neighborhood features to generate a 384-dimensional context-aware vector representation. This context-aware vector representation comprehensively considers the node's own attributes, structural environment, and alarm information, fully reflecting the node's characteristics within the alarm context.

[0096] The context-aware vector representation corresponding to each alarm node is extracted, and the topological centrality of each alarm node is calculated based on the heterogeneous graph. Topological centrality is an indicator that measures the importance of a node in the graph, and can be obtained by calculating the degree centrality, proximity centrality, or betweenness centrality of a node. For example, the degree centrality of node N002 is 3, indicating that this node is directly connected to 3 other nodes; while the degree centrality of node N004 is 2, indicating that it is directly connected to 2 nodes.

[0097] The context-aware vector representation corresponding to the alarm node is weighted and modulated based on topological centrality to obtain a centrality-enhanced vector representation. Weighted modulation refers to the process of scaling or transforming the vector according to the node's centrality value. The higher the centrality of the node, the greater the weight of its vector representation in subsequent processing. For example, the sigmoid function can be used to map the centrality to the interval [0.5, 1] ​​as a modulation factor. For node N002, if its modulation factor is 0.85, then the centrality-enhanced vector representation is its context-aware vector multiplied by 0.85.

[0098] The initial semantic distance is obtained by calculating the vector distance between the centrality-enhanced vector representations. Vector distance can be calculated using metrics such as Euclidean distance or cosine distance. For example, calculating the cosine distance between the centrality-enhanced vectors of alarm nodes N002 and N004 yields an initial semantic distance of 0.32.

[0099] The semantic distance is obtained by analyzing the skewness and kurtosis of the initial semantic distance distribution. Skewness and kurtosis reflect the morphological characteristics of the distance distribution, and the initial semantic distance can be adjusted based on these characteristics to better reflect the similarity between nodes. For example, if the initial semantic distance distribution exhibits a right-skewed characteristic, a logarithmic transformation can be applied to the distance values ​​to make the distribution more balanced. For example, the initial semantic distance of 0.32 between N002 and N004 might be adjusted to 0.28.

[0100] The system identifies pairs of alarm nodes whose semantic distance is less than a preset threshold and connects them to form an alarm similarity graph. The preset threshold can be set according to actual needs, such as 0.3. If the semantic distance between two alarm nodes is less than 0.3, they are considered similar, and an edge connecting these two nodes is created in the alarm similarity graph. For example, the semantic distance between N002 and N004 is 0.28, which is less than the threshold of 0.3, therefore an edge connecting N002 and N004 is created in the alarm similarity graph.

[0101] Connected component decomposition (CBD) is performed on the alarm similarity graph, and alarm nodes are divided into alarm clusters by calculating the internal connectivity density. A connected component is an interconnected subgraph within the graph. CBD can initially divide alarm nodes into multiple disjoint subsets. Internal connectivity density is the ratio of the actual number of edges in a subgraph to the maximum possible number of edges, and can be used to assess the compactness of the subgraph. For example, if a connected component contains alarm nodes {N002, N004, N007} with an internal connectivity density of 0.67, it indicates strong similarity between the nodes, and they can be grouped into the same alarm cluster.

[0102] In this embodiment, by performing multi-hop traversal and identifying heterogeneous path patterns in the heterogeneous graph, the complex multi-type relationships between tasks can be extended from a local perspective to a path-level perspective. This enables the capture of deep interaction structures across resources, data flows, and multi-layer dependency chains, significantly improving the ability to perceive potential structural patterns and abnormal associated paths. By embedding and encoding heterogeneous paths and extracting path-level semantic features, and coupling them with neighborhood structure bias, node representations can reflect the structural semantic features of the task's context, making the expression of alarm nodes more comprehensive and discriminative. Through hierarchical aggregation to generate multi-scale neighborhood features, these features can be applied to different... By integrating contextual information within the receptive field, the context-aware vector can simultaneously reflect local behavioral features and global structural features, thereby improving the precision of semantic association analysis between abnormal tasks. By combining topological centrality to weight and modulate the context vector, the influence of important nodes in similarity calculation is made more consistent with the real system structure, effectively avoiding the similarity bias problem caused by differences in node status in traditional methods. Based on the centrality-enhanced vector representation, semantic distance calculation and distribution skewness and kurtosis analysis are performed, which can identify alarm node pairs with similar semantics and reduce the interference of noise and local anomalies on the overall clustering results.

[0103] In one alternative implementation,

[0104] Determine the alarm intensity value of each alarm node in the alarm cluster and, in conjunction with the graph centrality index, determine the core nodes, including:

[0105] Obtain the alarm intensity value corresponding to each alarm node, locate each alarm node in the heterogeneous graph, assign type weights to each edge in the heterogeneous graph based on the alarm intensity value and calculate the weighted degree centrality of each alarm node, calculate the edge type entropy by analyzing the weight distribution of different types of edges connected to the current alarm node, and determine the propagation mode mixing degree of the current alarm node based on the edge type entropy.

[0106] The dominant propagation mechanism of the current alarm node is determined based on the propagation mode mixing degree. For alarm nodes whose dominant propagation mechanism is data flow, a flow imbalance factor is calculated based on the difference between the weights of the incoming and outgoing edges. For alarm nodes whose dominant propagation mechanism is resource competition, a competition fluctuation factor is calculated based on the variance of the competition edge weights. The flow imbalance factor or the competition fluctuation factor is used as the propagation path attenuation coefficient to correct the alarm intensity value of the current alarm node to obtain the path-corrected alarm intensity.

[0107] Based on the path-corrected alarm intensity and the weighted degree centrality, a comprehensive influence index is constructed. Principal component analysis is performed on the comprehensive influence index of all alarm nodes in the alarm cluster to extract the influence principal components. The load value of the comprehensive influence index of each alarm node on the influence principal components is calculated, and the alarm node with the largest load value is selected as the core node.

[0108] Obtain the alarm intensity value corresponding to each alarm node. For example, alarm node N002 has an alarm intensity value of 5.6, indicating a moderate anomaly; alarm node N004 has an alarm intensity value of 8.2, indicating a relatively serious anomaly; and alarm node N007 has an alarm intensity value of 3.8, indicating a minor anomaly. Alarm intensity values ​​are typically calculated based on indicators such as resource utilization deviation, response time extension rate, or error rate increase.

[0109] After locating each alarm node in the heterogeneous graph, a type weight needs to be assigned to each edge in the graph based on the alarm intensity value. The edge type weight refers to assigning a corresponding importance weight to edges of different types, such as data flow edges or resource contention edges. The weighting method can consider both the edge type and the alarm intensity values ​​of the associated nodes. For data flow edges, the alarm intensity value of the source node can be used as the weight factor; for resource contention edges, the average of the alarm intensity values ​​of the two endpoints can be used as the weight factor. For example, the weight of a data flow edge from N002 to N005 can be set to 5.6; while the weight of a resource contention edge connecting N002 and N004 can be set to 6.9.

[0110] Calculating the weighted degree centrality of each alarm node is a key metric for evaluating its importance in a graph. Weighted degree centrality is the sum of the weights of all edges connected to a node. For node N002, assuming its connected edges are a data flow edge to N005 with a weight of 5.6, a resource contention edge with N004 with a weight of 6.9, and a resource contention edge with N003 with a weight of 4.2, then its weighted degree centrality is 16.7. A higher weighted degree centrality value indicates a greater influence of the node in the heterogeneous graph.

[0111] By analyzing the weight distribution of different types of edges connected to the current alarm node, edge type entropy can be calculated, thereby determining the propagation mode mixing degree of the current alarm node. Edge type entropy reflects the uncertainty of the edge type distribution connected to the node. It involves statistically analyzing the weight proportion of each type of edge connected to the node and then calculating the information entropy of that weight proportion. For example, for node N004, assuming its data flow edge weight proportion is 0.3 and its resource contention edge weight proportion is 0.7, the corresponding edge type entropy can be calculated as 0.611. Propagation mode mixing degree is a value normalized based on edge type entropy, representing the degree to which a node simultaneously participates in multiple propagation modes. A higher edge type entropy indicates a higher propagation mode mixing degree for the node.

[0112] The dominant propagation mechanism of the current alarm node is determined based on the degree of mixing of propagation modes. A threshold, such as 0.5, can be set. When the degree of mixing is below this threshold, the node is considered to have a clear dominant propagation mechanism. The propagation mechanism corresponding to the edge type with the highest weight is determined as the dominant propagation mechanism by comparing the total weight of each type of edge connected to the node. For example, the total weight of the data flow edge connected to node N002 is 5.6, and the total weight of the resource contention edge is 11.1, so its dominant propagation mechanism is resource contention; while the total weight of the data flow edge connected to node N007 is 9.3, and the total weight of the resource contention edge is 2.8, so its dominant propagation mechanism is data flow.

[0113] For alarm nodes where the dominant propagation mechanism is data flow, a flow imbalance factor is calculated based on the difference between the weights of incoming and outgoing edges. An incoming edge is an edge pointing to the node, and an outgoing edge is an edge pointing out of the node. The flow imbalance factor measures the degree of imbalance between data inflow and outflow. It is calculated by dividing the difference between the sum of the weights of incoming and outgoing edges by the absolute value of their sum. For example, if node N007 has a total weight of 4.5 for incoming edges and a total weight of 4.8 for outgoing edges, its flow imbalance factor is 0.033, indicating a basic balance between inflow and outflow. If the weights of incoming edges are much greater than those of outgoing edges, the factor value is close to 1, indicating that the node is primarily a data aggregation point. If the weights of outgoing edges are much greater than those of incoming edges, the factor value is close to -1, indicating that the node is primarily a data source point.

[0114] For alarm nodes whose dominant propagation mechanism is resource competition, a competition volatility factor is calculated based on the variance of the competition edge weights. The competition volatility factor reflects the degree of weight dispersion in the resource competition relationships in which the node participates, and is calculated by dividing the standard deviation of the competition edge weights by the mean. For example, if node N002 has resource competition edge weights of 6.9 and 4.2, a mean of 5.55, and a standard deviation of 1.35, then its competition volatility factor is 0.243. A larger competition volatility factor indicates a more unbalanced resource competition relationship in which the node participates, and that some competition relationships may dominate.

[0115] The path imbalance factor or competition volatility factor is used as the propagation path attenuation coefficient to correct the alarm intensity of the current alarm node, resulting in a path-corrected alarm intensity. The correction method involves multiplying the original alarm intensity by the function value of the propagation path attenuation coefficient. The attenuation coefficient can be designed as a function proportional to the imbalance factor or volatility factor. For example, for node N002 with a volatility factor of 0.243, the attenuation coefficient might be 1.122, corresponding to a corrected alarm intensity of 6.28, which is the original intensity of 5.6 multiplied by 1.122.

[0116] A comprehensive influence index is constructed based on path correction alarm strength and weighted degree centrality. The comprehensive influence index is a multi-dimensional vector containing multiple influence features of a node. The construction method combines path correction alarm strength, weighted degree centrality, and other possible influence features to form a vector. For example, for node N002, its path correction alarm strength is 6.28 and its weighted degree centrality is 16.7, which can be combined to form an influence vector [6.28, 16.7]. The comprehensive influence index comprehensively reflects the importance and influence range of a node in a heterogeneous graph.

[0117] Principal component analysis (PCA) is performed on the comprehensive influence index of all alarm nodes within an alarm cluster to extract the principal components of influence. PCA is a dimensionality reduction technique that can extract the main sources of variation in data. Through PCA, the principal components that best explain data variation can be extracted from the multidimensional comprehensive influence index. For example, for an alarm cluster containing nodes N002, N004, and N007, PCA might reveal that the first principal component explains 75% of the data variation, and the second principal component explains 20%.

[0118] Calculate the loading value of the comprehensive influence index of each alarm node on the principal components of influence, and select the alarm node with the largest loading value as the core node. The loading value reflects the degree of correlation between the original variables and the principal components. The solution method is to project the comprehensive influence index of the node onto the principal components. For example, the loading value of node N002 on the first principal component is 0.85, the loading value of node N004 is 0.92, and the loading value of node N007 is 0.64. Since node N004 has the largest loading value, it is selected as the core node of this alarm cluster. The core node represents the most typical characteristics of the alarm cluster, usually the node with the widest impact or the highest alarm intensity, and should be treated first.

[0119] In this embodiment, by associating alarm intensity with heterogeneous graph structure and assigning weights to different types of edges using alarm intensity, the importance assessment of nodes can be improved from traditional undifferentiated structural analysis to weighted structural analysis based on semantic differences and alarm saliency. This more accurately reflects the actual impact range of alarms in the system. By determining the mixing degree of propagation modes based on edge type entropy, the dominant path of alarms in different propagation mechanisms can be automatically identified, avoiding misjudgments caused by traditional methods that rely solely on a single relationship. This improves the accuracy of propagation mechanism identification. Flow imbalance factors and competition fluctuation factors are introduced into the dominant propagation mechanisms and used as path attenuation coefficients to correct alarm intensity, enabling alarm intensity to reflect the true diffusion capability of task nodes in the structural propagation link. This significantly improves the reliability of alarm intensity in propagation risk assessment. By extracting influence principal components through principal component analysis, the multi-dimensional alarm influence characteristics can be compressed into key influencing factors, improving the stability and interpretability of the ranking of alarm node influence.

[0120] In one alternative implementation,

[0121] Based on the alarm intensity value of the core node, the corresponding control command is determined and the currently available resources are queried. Conflict detection is performed in conjunction with the resource contention relationship. If the currently available resources are sufficient and there is no conflict, the execution sequence of tasks in the alarm cluster is adjusted based on the data flow relationship, and the control command is executed, including:

[0122] The control command type is determined based on the alarm intensity value of the core node, and the currently available resources are queried. The control command type is then mapped to a predefined resource requirement template to obtain the direct resource requirement corresponding to the control command type.

[0123] Based on the resource competition relationship, extract the set of competing nodes that compete with the core node, and construct a resource competition propagation network based on the edges corresponding to the resource competition relationship in the heterogeneous graph. In the resource competition propagation network, simulate the resource occupation propagation process after the execution of the control command to obtain the resource occupation propagation path. Track the cascading diffusion effect of resource occupation along the resource occupation propagation path and identify indirect competing nodes. Calculate the derived resource demand corresponding to the indirect competing nodes. Combine the direct resource demand to determine the total resource demand. Based on the total resource demand and the current available resources, determine the resource sufficiency status and perform path bottleneck analysis on the resource occupation propagation path to identify resource blocking nodes. If there are resource blocking nodes, calculate the resource diversion capacity of the resource blocking nodes and determine the conflict status.

[0124] When the resource sufficiency status is sufficient and the conflict status is conflict-free, the downstream dependent nodes of the core node are identified based on the data flow relationship, the execution timing of the tasks corresponding to the downstream dependent nodes is adjusted based on the data flow relationship, and the control instructions are executed.

[0125] The control command type is determined based on the alarm intensity value of the core node, and the currently available resources are queried. The alarm intensity value is obtained based on the previous example, which then determines the type of control command to be executed. For example, for core node N004, its alarm intensity value is 8.2, indicating a relatively serious anomaly, which may require executing resource expansion control commands; while for core node N002, with an alarm intensity of 5.6, task rescheduling control commands are suitable. Control command types typically include resource expansion, task rescheduling, task priority adjustment, and task splitting. Currently available resources are obtained by querying the resource management system, including available computing resources, storage resources, and network bandwidth. For example, currently available computing resources include a 32-core processor, 500GB of available storage space, and 200Mbps of available network bandwidth.

[0126] Control command types are mapped to predefined resource requirement templates to obtain the direct resource requirements corresponding to each control command type. The resource requirement templates are predefined standard resource configurations required for various control commands. For example, a resource expansion control command might require 8 core processors, 100GB of storage, and 50Mbps network bandwidth; a task rescheduling control command might require 4 core processors, 50GB of storage, and 20Mbps network bandwidth. For instance, the direct resource requirements for a resource expansion control command on core node N004 are 8 core processors, 100GB of storage, and 50Mbps network bandwidth.

[0127] Based on resource competition relationships, a set of competing nodes that compete with the core node is extracted, and a resource competition propagation network is constructed based on the edges corresponding to these resource competition relationships in the heterogeneous graph. A competing node is a node that shares or competes with the core node for the same resource. For example, core node N004 competes with nodes N002, N006, and N009, forming a set of competing nodes. The resource competition propagation network is a subgraph with competition relationships as edges, reflecting the propagation path of resource competition. In the resource competition propagation network, nodes represent tasks, edges represent resource competition relationships, and the weights of the edges reflect the intensity of competition.

[0128] In a resource contention propagation network, the resource occupancy propagation process after executing control instructions is simulated to obtain the resource occupancy propagation path. The resource occupancy propagation process refers to the impact of a node occupies resources on the resource availability of other nodes. The simulation method can employ a resource propagation model, considering the liquidity and sharing characteristics of resources. For example, if core node N004 executes a resource expansion instruction and occupies 8 core processors, it may cause some processor resources originally allocated to node N006 to be reallocated, thus affecting the resource availability of N006. Through simulation, the resource occupancy propagation path from N004 to N006 can be obtained.

[0129] The cascading diffusion effect of resource usage is traced along the propagation path, and indirect competing nodes are identified. The cascading diffusion effect refers to the propagation of resource usage changes through the network, affecting other nodes connected to directly competing nodes. Indirectly competing nodes are those that do not directly compete for resources with the core node but are indirectly affected by changes in the core node's resource usage. For example, although node N008 does not directly compete for resources with core node N004, it is identified as an indirectly competing node because it competes with N006, which in turn directly competes with N004.

[0130] Calculate the derived resource requirements corresponding to the indirectly competing nodes, and combine this with the direct resource requirements to determine the total resource requirements. Derived resource requirements refer to the additional resource requirements caused by resource reallocation. The calculation method can consider the resource propagation attenuation coefficient, that is, the degree of attenuation of resource requirements during propagation. For example, if the resource propagation attenuation coefficient is 0.6, then the resource requirement propagated from N004 to N006 is 0.6 times the direct resource requirement, i.e., 4.8 core processor capacity; when further propagated to N008, it attenuates to 0.36 times the direct resource requirement, i.e., 2.88 core processor capacity. The total resource requirement is the sum of the direct resource requirement and all derived resource requirements. For the above example, the total processor resource requirement is 8 + 4.8 + 2.88 = 15.68 core processor capacity.

[0131] The resource sufficiency status is determined based on the total resource demand and the currently available resources. Path bottleneck analysis is then performed on the resource occupancy propagation path to identify resource-blocking nodes. Resource sufficiency status indicates whether the system has sufficient resources to meet the total demand. The determination method compares the total resource demand with the currently available resources; if the total resource demand is less than the currently available resources, the status is sufficient; otherwise, it is insufficient. Path bottleneck analysis identifies nodes in the resource propagation path that may cause resource blockage. Resource-blocking nodes are nodes that cannot execute tasks normally due to insufficient resources, potentially causing delays or failures in tasks on the dependency chain. The identification method compares the node's current resource occupancy rate with a threshold; if the occupancy rate exceeds the threshold, such as 90%, the node is marked as a resource-blocking node. In the aforementioned example, if node N006's processor resource occupancy rate is 95%, exceeding the 90% threshold, then N006 is identified as a resource-blocking node.

[0132] If a resource-blocking node exists, its resource allocation capability is calculated, and a conflict state is determined. Resource allocation capability refers to a node's ability to release or reallocate resources, which can be assessed by analyzing the node's resource resilience and schedulability. For example, the resource allocation capability of node N006 can be calculated based on factors such as its task priority and resource usage patterns. Assume N006's resource allocation capability score is 0.3, indicating a low allocation capability. The determination of a conflict state is based on whether the resource allocation capability of the resource-blocking node exceeds a preset threshold, such as 0.5. If the allocation capability is below the threshold, the conflict state is determined to be conflicted; otherwise, it is considered conflict-free. In the aforementioned example, since N006's resource allocation capability is 0.3, which is below the threshold of 0.5, it is determined to be in a conflict state.

[0133] When resource sufficiency is sufficient and conflict is non-conflictual, downstream dependent nodes of the core node are identified based on data flow relationships. Downstream dependent nodes are task nodes that rely on the output data of the core node. For example, the downstream dependent nodes of core node N004 include N005, N011, and N013. The purpose of identifying these nodes is to ensure that, after executing control instructions, the execution plans of dependent nodes can be appropriately adjusted to maintain the smooth operation of the entire task flow.

[0134] Based on data flow relationships, the execution timing of tasks corresponding to downstream dependent nodes is adjusted, and control instructions are executed. Execution timing adjustment refers to adjusting the start time or execution order of tasks on dependent nodes according to changes in the task status of the core node. Adjustment methods can consider task priority, deadlines, and resource requirements. For example, if executing a resource expansion instruction on core node N004 is expected to shorten its execution time by 30%, the execution times of downstream nodes N005, N011, and N013 can be advanced accordingly, or their execution order can be adjusted to optimize the overall task flow execution efficiency.

[0135] In this embodiment, by combining the alarm intensity of the core node with the control command type and obtaining the direct resource demand based on a predefined resource demand template, the control decision-making process can be transformed from experience-based judgment to precise matching based on quantitative indicators. This significantly improves the adaptability between control commands and resource supply, avoiding insufficient or excessive resource allocation. By introducing resource competition relationships to construct a resource competition propagation network and simulating the resource occupation propagation path after the execution of control commands, the cascading diffusion effect of resources in the competition path can be predicted in advance, achieving a full-link, global assessment of resource demand and significantly improving the predictability of resource consumption risks. By comprehensively determining the total resource demand by combining direct and indirect demands and comparing it with the currently available resources, resource sufficiency can be accurately judged, avoiding misjudgments caused by static thresholds or experience-based judgments. Bottleneck analysis is performed on the resource occupation propagation path and resource blocking nodes are identified, enabling the system to locate potential blocking points in advance before executing control commands, improving the initiative of resource scheduling.

[0136] Figure 2 This is a flowchart illustrating the resource management and control instruction execution process of the intelligent hierarchical task alarm processing method according to an embodiment of the present invention.

[0137] In one alternative implementation,

[0138] Collect execution process data and combine it with state transition path analysis to predict failure probability. Combine this with preset risk thresholds to determine the task risk type and output the following:

[0139] The task state sequence and state transition timestamps during the execution of control commands are collected as execution process data. The task state sequence is expanded in chronological order to obtain a state evolution sequence and state loop segments are identified. The number of loops and the duration of each state loop segment are counted and the state loop intensity is calculated. The path transition frequency is extracted from the historical transition path from the current state to the failure state in the state evolution sequence. The path failure probability of the task reaching the failure state along the historical transition path is calculated based on the path transition frequency and the state transition timestamp. The failure probability is obtained based on the path failure probability and the state loop intensity.

[0140] The state evolution sequence is divided into multiple state evolution subsequences by time window segmentation. The state transition density is obtained based on the number of state types and the number of state transitions in each state evolution subsequence. The time window in which the state transition density exceeds a preset density threshold is identified, and the state dispersion entropy is calculated based on the dispersion degree of the task state. The instability of task execution is quantified based on the state dispersion entropy to obtain the state instability coefficient. A comprehensive risk score is calculated by combining the failure probability and the state instability coefficient and compared with a preset risk threshold. The task risk type is determined based on the comparison result and output.

[0141] The task state sequence and state transition timestamps during the execution of control commands are collected as execution process data. The task state sequence records the various states a task experiences during execution, such as waiting, running, blocked, paused, resumed, completed, or failed. The state transition timestamp records the precise time point when a task transitions from one state to another. For example, for the control command handling alarm node N004, its execution process task state sequence may include: waiting for resource allocation, resource allocation in progress, running, paused, resumed, running again, resource release, and completed.

[0142] The task state sequence is expanded chronologically to obtain a state evolution sequence, and state cycle segments are identified. The state evolution sequence is a record of the entire process of state transitions ordered by time. A state cycle segment refers to a recurring subsequence of states within the state evolution sequence, such as a state cycle of running-paused-resumption-running. Identification methods can employ the sliding window technique, comparing state sequences within different time windows to identify recurring state patterns. In the aforementioned example, running-paused-resumption-running can be identified as a state cycle segment.

[0143] The loop count and duration of each state cycle segment are recorded, and the state cycle strength is calculated. The loop count refers to the number of times a state cycle segment repeats throughout the entire state evolution sequence. The cycle duration refers to the time taken for each cycle segment from start to finish. The state cycle strength is an indicator of the impact of state cycles on task execution, and can be calculated by multiplying the loop count and cycle duration by the total execution time. For example, if the run-pause-resume-run cycle segment appears 3 times, with an average duration of 4 minutes each time, and the total task execution time is 30 minutes, then the cycle strength of this cycle segment is 0.4.

[0144] The path transition frequency is extracted from the historical transition paths from the current state to the failure state in the state evolution sequence. A historical transition path refers to the path that transitions from a specific state to the failure state in past execution records. The path transition frequency refers to the frequency with which a specific transition path occurs. For example, analysis of historical data reveals that the frequency of a direct transition from a blocked state to a failure state is 0.25, and the frequency of a transition from a paused state to a failure state is 0.1.

[0145] The path failure probability of a task reaching a failure state along historical transition paths is calculated based on path transition frequency and state transition timestamps. The path failure probability considers transition frequency and time factors, reflecting the likelihood of a task transitioning from its current state to a failure state. The calculation method combines a function of path transition frequency and a time factor, which can be the state duration or transition frequency calculated based on state transition timestamps. For example, if a task has been in a blocked state for 5 minutes, and based on historical data, the probability of a blocked state transitioning to failure after more than 5 minutes is 0.35, then the current path failure probability might be 0.35.

[0146] The failure probability is calculated based on the path failure probability and the state loop strength. The failure probability is an assessment of the likelihood of task failure after comprehensively considering both factors. It is calculated as a weighted sum of the path failure probability and the state loop strength, with the weights determined based on historical data analysis. For example, if the path failure probability is 0.35 and the state loop strength is 0.4, with weights of 0.7 and 0.3 respectively, the failure probability is 0.35*0.7 + 0.4*0.3 = 0.365. A higher failure probability indicates a greater likelihood of task failure during execution, requiring a higher level of monitoring and intervention.

[0147] The state evolution sequence is divided into multiple state evolution sub-sequences by time window segmentation. Time window segmentation divides the entire execution process into several sub-sequences based on time or event characteristics, facilitating local analysis of task state change characteristics. Segmentation methods can be fixed time windows, such as one window every 5 minutes, or dynamic windows, such as adaptively adjusting the window size according to the state transition frequency. For example, the aforementioned task execution process can be divided into 3 windows.

[0148] The state transition density is calculated by combining the number of state types and the number of state transitions in each state evolution subsequence. The number of state types refers to the number of different states that appear within the window. The number of state transitions refers to the number of times a state changes within the window. State transition density is an indicator of the frequency of state changes within a window, calculated by dividing the number of state transitions by the window duration. For example, in the second window, if there are three states—paused, resumed, and running—with two state transitions and a window duration of 5 minutes, the state transition density is 0.4 times per minute. A higher state transition density indicates more unstable task execution and potentially higher risks.

[0149] The system identifies time windows where the density of state transitions exceeds a preset density threshold and calculates the state dispersion entropy based on the dispersion of task states. The preset density threshold is a reference value set based on system operating experience, such as 0.3 times per minute. State dispersion reflects the uniformity of state distribution within the window and can be calculated by the distribution of the number of times each state occurs. State dispersion entropy is an indicator of the degree of dispersion in state distribution; a higher entropy value indicates a more uniform state distribution, while a lower entropy value indicates that some states dominate. For example, if the paused state occurs once, the resumed state occurs once, and the running state occurs three times within the second window, the state distribution is relatively concentrated, and the state dispersion entropy is low, with a calculated value of 0.68.

[0150] The state instability coefficient is obtained by quantifying the instability of task execution based on state dispersion entropy. The state instability coefficient is an indicator that comprehensively evaluates the degree of instability in task execution, and can be calculated as a function of state dispersion entropy and state transition density. For example, if the state dispersion entropy is 0.68 and the state transition density is 0.4, the state instability coefficient can be calculated as 0.544. A higher state instability coefficient indicates a more unstable task execution process, requiring closer monitoring and intervention.

[0151] A comprehensive risk score is calculated by combining the failure probability and the state instability coefficient, and then compared with a preset risk threshold. Based on the comparison result, the task risk type is determined and output. The comprehensive risk score is a combined consideration of the failure probability and the state instability coefficient, and can be calculated using a weighted average. For example, if the failure probability is 0.365 and the state instability coefficient is 0.544, with weights of 0.6 and 0.4 respectively, the comprehensive risk score is 0.365*0.6 + 0.544*0.4 = 0.4366. Multiple preset risk thresholds can be set, such as a low-risk threshold of 0.3, a medium-risk threshold of 0.5, and a high-risk threshold of 0.7. By comparing the comprehensive risk score with each threshold level, the task risk type can be determined. In the example above, the comprehensive risk score of 0.4366 falls between the low-risk and medium-risk thresholds, and can be classified as a low-to-medium risk type. The risk type output includes the risk level and recommended measures; for example, for low-to-medium risk, increasing monitoring frequency and preparing backup resources might be recommended.

[0152] In this embodiment, by collecting the task state sequence and state transition timestamps in real time during the execution of control instructions and expanding them into a state evolution sequence, the real-time perception capability of execution anomalies can be significantly enhanced. By identifying state loop segments and calculating loop intensity, the repeated lingering or stagnation of the task in certain states can be captured. Compared with the method based on simple timeout rules, it can more accurately reflect hidden anomaly patterns such as potential deadlock and resource waiting. By using the transfer frequency and timestamp information of historical transfer paths to calculate the path failure probability, the failure risk assessment is transformed from being based on single-node states to probabilistic inference based on path structure, which significantly improves the ability to predict failure trends. By segmenting the state evolution sequence into time windows and calculating the state transition density, local fluctuations and high-frequency state jumps in the execution stage can be captured, and potential execution chaos areas can be identified. The state instability coefficient is calculated based on the state dispersion entropy, which can quantify the degree of uncertainty in the task execution process, thereby more comprehensively characterizing the task risk features.

[0153] A second aspect of the present invention provides a task alarm processing system based on intelligent hierarchical classification, comprising:

[0154] The first unit is used to collect the execution behavior data of each task in the task scheduling system within multiple time windows and convert it into a state transition matrix through time-series encoding. It analyzes the non-stationarity characteristics in the state transition matrix and identifies abnormal tasks, extracts the behavior deviation index of the abnormal tasks and quantifies it to obtain the alarm intensity value.

[0155] The second unit is used to obtain the data flow relationship and resource competition relationship between tasks in the task scheduling system and to construct a heterogeneous graph. Abnormal tasks are mapped to the corresponding nodes in the heterogeneous graph to obtain the alarm node set.

[0156] The third unit is used to perform multi-hop neighborhood aggregation operation on the heterogeneous graph to generate context-aware vector representation, calculate the semantic distance between context-aware vectors of different alarm nodes in the alarm node set and classify alarm nodes with a distance less than a preset threshold into alarm clusters, determine the alarm intensity value of each alarm node in the alarm cluster and determine the core node in combination with the graph centrality index.

[0157] The fourth unit is used to determine the corresponding control command based on the alarm intensity value of the core node and query the currently available resources. It performs conflict detection in combination with the resource competition relationship. If the currently available resources are sufficient and there is no conflict, it adjusts the execution sequence of tasks in the alarm cluster based on the data flow relationship and executes the control command. It collects execution process data and analyzes and predicts the failure probability in combination with the state transition path. It judges the task risk type in combination with the preset risk threshold and outputs the result.

[0158] A third aspect of the present invention provides an electronic device, comprising:

[0159] A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0160] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0161] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0162] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A task alarm processing method based on intelligent hierarchical classification, characterized in that, include: The execution behavior data of each task in the task scheduling system within multiple time windows are collected and converted into a state transition matrix through time-series encoding. The non-stationarity characteristics in the state transition matrix are analyzed and abnormal tasks are identified. The behavior deviation index of the abnormal tasks is extracted and quantified to obtain the alarm intensity value. Obtain the data flow relationship and resource competition relationship between tasks in the task scheduling system and construct a heterogeneous graph. Map abnormal tasks to the corresponding nodes in the heterogeneous graph to obtain the alarm node set. Perform a multi-hop neighborhood aggregation operation on the heterogeneous graph to generate a context-aware vector representation. Calculate the semantic distance between the context-aware vectors of different alarm nodes in the alarm node set and classify alarm nodes with a distance less than a preset threshold into alarm clusters. Determine the alarm intensity value of each alarm node in the alarm cluster and determine the core node by combining it with the graph centrality index. The corresponding control command is determined based on the alarm intensity value of the core node, and the currently available resources are queried. Conflict detection is performed in combination with the resource competition relationship. If the currently available resources are sufficient and there is no conflict, the execution sequence of tasks in the alarm cluster is adjusted based on the data flow relationship and the control command is executed. Execution process data is collected and the failure probability is predicted by combining the state transition path analysis. The task risk type is determined by combining the preset risk threshold and output. Determine the alarm intensity value of each alarm node in the alarm cluster and, in conjunction with the graph centrality index, determine the core nodes, including: Obtain the alarm intensity value corresponding to each alarm node, locate each alarm node in the heterogeneous graph, assign type weights to each edge in the heterogeneous graph based on the alarm intensity value, calculate the weighted degree centrality of each alarm node, calculate the edge type entropy by analyzing the weight distribution of different types of edges connected to the current alarm node, and determine the propagation mode mixing degree of the current alarm node based on the edge type entropy. The dominant propagation mechanism of the current alarm node is determined based on the propagation mode mixing degree. For alarm nodes whose dominant propagation mechanism is data flow, a flow imbalance factor is calculated based on the difference between the weights of the incoming and outgoing edges. For alarm nodes whose dominant propagation mechanism is resource competition, a competition fluctuation factor is calculated based on the variance of the competition edge weights. The flow imbalance factor or the competition fluctuation factor is used as the propagation path attenuation coefficient to correct the alarm intensity value of the current alarm node to obtain the path-corrected alarm intensity. Based on the path-corrected alarm intensity and the weighted degree centrality, a comprehensive influence index is constructed. Principal component analysis is performed on the comprehensive influence index of all alarm nodes in the alarm cluster to extract the influence principal components. The load value of the comprehensive influence index of each alarm node on the influence principal components is calculated, and the alarm node with the largest load value is selected as the core node.

2. The method according to claim 1, characterized in that, The execution behavior data of each task in the task scheduling system within multiple time windows is collected and converted into a state transition matrix through time-series encoding. The non-stationarity characteristics in the state transition matrix are analyzed to identify abnormal tasks. Behavioral deviation indicators of the abnormal tasks are extracted and quantified to obtain alarm intensity values, including: The execution behavior data of each task in the task scheduling system is collected within multiple time windows. The execution behavior data is segmented according to the length of the time window. The state sequence of the task within each time window is extracted. The transition relationship between adjacent states in the state sequence is encoded as matrix elements. Based on the matrix elements, the transition probability of different state transition paths is determined and a state transition matrix is ​​constructed. The state transition matrix is ​​decomposed to extract the dominant feature vector and the similarity change rate of the dominant feature vector is calculated between consecutive time windows. The steady-state distribution of the state transition matrix is ​​calculated and the divergence of the steady-state distribution between different time windows is obtained. The divergence and the similarity change rate are fused to obtain a comprehensive non-stationary feature value. Tasks whose comprehensive non-stationary feature value exceeds a preset threshold are identified as abnormal tasks. Extract the state sequence corresponding to the abnormal task and encode the state sequence to generate a behavior representation vector. Calculate the Euclidean distance between the behavior representation vector corresponding to the abnormal task and the preset standard behavior pattern. Use the minimum value of the Euclidean distance as a behavior deviation index and convert it into an initial intensity value through a preset mapping function. Obtain the data dependency relationship between different tasks in the task scheduling system and correct the initial intensity value according to the data dependency relationship to obtain the alarm intensity value.

3. The method according to claim 1, characterized in that, Obtain the data flow and resource contention relationships among tasks in the task scheduling system and construct a heterogeneous graph. Map abnormal tasks to corresponding nodes in the heterogeneous graph to obtain the alarm node set, including: The system obtains the input data source and output data target of each task and determines the data flow relationship between each task. It records the data flow direction in the data flow relationship and determines the resource application record and resource occupation time period of each task in the task scheduling system. It detects the overlap between the resource occupation time periods of different tasks, identifies tasks with resource competition relationship, and records the competition resource type. Initialize the heterogeneous graph, map tasks to nodes in the heterogeneous graph, map the data flow relationship to the edges connecting the corresponding nodes in the heterogeneous graph and label the data flow direction, map the resource competition relationship to the edges connecting the corresponding nodes in the heterogeneous graph and label the competition resource type, and construct the heterogeneous graph by repeating the mapping and connection, assign a node identifier to each node in the heterogeneous graph and establish a mapping relationship table; The abnormal tasks are mapped to the heterogeneous graph. The node identifier corresponding to each abnormal task is obtained by querying the mapping relationship table. The node corresponding to the node identifier is marked as an alarm node, and all alarm nodes are combined to obtain an alarm node set.

4. The method according to claim 1, characterized in that, Performing a multi-hop neighborhood aggregation operation on the heterogeneous graph to generate a context-aware vector representation, calculating the semantic distance between the context-aware vectors of different alarm nodes in the alarm node set, and classifying alarm nodes with a distance less than a preset threshold into alarm clusters includes: Starting from the nodes in the heterogeneous graph, a multi-hop traversal is performed to identify heterogeneous path patterns. For each heterogeneous path pattern, path embedding encoding is performed to extract path-level semantic features. The distribution differences of neighboring nodes under different heterogeneous path patterns are compared to identify structural deviation features. The neighboring nodes of each node under different heterogeneous path patterns are obtained, and the node features corresponding to the neighboring nodes are coupled with the path-level semantic features and the structural deviation features to obtain a path-aware node representation. The path-aware node representation is hierarchically aggregated to obtain multi-scale neighborhood features. The multi-scale neighborhood features are fused with the node features of the current node and the alarm intensity value to generate a context-aware vector representation. Extract the context-aware vector representation corresponding to each alarm node, calculate the topological centrality of each alarm node based on the heterogeneous graph, and perform weighted modulation on the context-aware vector representation corresponding to the alarm node according to the topological centrality to obtain a centrality-enhanced vector representation. Calculate the vector distance between different centrality-enhanced vector representations to obtain the initial semantic distance, analyze the distribution skewness and kurtosis of the initial semantic distance to obtain the semantic distance, identify alarm node pairs with a semantic distance less than a preset distance threshold and connect them to obtain an alarm similarity graph, perform connected component decomposition on the alarm similarity graph and divide the alarm nodes into alarm clusters by calculating the internal connection density.

5. The method according to claim 1, characterized in that, Based on the alarm intensity value of the core node, the corresponding control command is determined and the currently available resources are queried. Conflict detection is performed in conjunction with the resource contention relationship. If the currently available resources are sufficient and there is no conflict, the execution sequence of tasks in the alarm cluster is adjusted based on the data flow relationship, and the control command is executed, including: The control command type is determined based on the alarm intensity value of the core node, and the currently available resources are queried. The control command type is then mapped to a predefined resource requirement template to obtain the direct resource requirement corresponding to the control command type. Based on the resource competition relationship, extract the set of competing nodes that compete with the core node, and construct a resource competition propagation network based on the edges corresponding to the resource competition relationship in the heterogeneous graph. In the resource competition propagation network, simulate the resource occupation propagation process after the execution of the control command to obtain the resource occupation propagation path. Track the cascading diffusion effect of resource occupation along the resource occupation propagation path and identify indirect competing nodes. Calculate the derived resource demand corresponding to the indirect competing nodes. Combine the direct resource demand to determine the total resource demand. Based on the total resource demand and the current available resources, determine the resource sufficiency status and perform path bottleneck analysis on the resource occupation propagation path to identify resource blocking nodes. If there are resource blocking nodes, calculate the resource diversion capacity of the resource blocking nodes and determine the conflict status. When the resource sufficiency status is sufficient and the conflict status is conflict-free, the downstream dependent nodes of the core node are identified based on the data flow relationship, the execution timing of the tasks corresponding to the downstream dependent nodes is adjusted based on the data flow relationship, and the control instructions are executed.

6. The method according to claim 1, characterized in that, Collect execution process data and combine it with state transition path analysis to predict failure probability. Combine this with preset risk thresholds to determine the task risk type and output the following: The task state sequence and state transition timestamps during the execution of control commands are collected as execution process data. The task state sequence is expanded in chronological order to obtain a state evolution sequence and state loop segments are identified. The number of loops and the duration of each state loop segment are counted and the state loop intensity is calculated. The path transition frequency is extracted from the historical transition path from the current state to the failure state in the state evolution sequence. The path failure probability of the task reaching the failure state along the historical transition path is calculated based on the path transition frequency and the state transition timestamp. The failure probability is obtained based on the path failure probability and the state loop intensity. The state evolution sequence is divided into multiple state evolution subsequences by time window segmentation. The state transition density is obtained based on the number of state types and the number of state transitions in each state evolution subsequence. The time window in which the state transition density exceeds a preset density threshold is identified, and the state dispersion entropy is calculated based on the dispersion degree of the task state. The instability of task execution is quantified based on the state dispersion entropy to obtain the state instability coefficient. A comprehensive risk score is calculated by combining the failure probability and the state instability coefficient and compared with a preset risk threshold. The task risk type is determined based on the comparison result and output.

7. A task alarm processing system based on intelligent hierarchical classification, used to implement the method of any one of claims 1-6, characterized in that, include: The first unit is used to collect the execution behavior data of each task in the task scheduling system within multiple time windows and convert it into a state transition matrix through time-series encoding. It analyzes the non-stationarity characteristics in the state transition matrix and identifies abnormal tasks, extracts the behavior deviation index of the abnormal tasks and quantifies it to obtain the alarm intensity value. The second unit is used to obtain the data flow relationship and resource competition relationship between tasks in the task scheduling system and to construct a heterogeneous graph. Abnormal tasks are mapped to the corresponding nodes in the heterogeneous graph to obtain the alarm node set. The third unit is used to perform multi-hop neighborhood aggregation operation on the heterogeneous graph to generate context-aware vector representation, calculate the semantic distance between context-aware vectors of different alarm nodes in the alarm node set and classify alarm nodes with a distance less than a preset threshold into alarm clusters, determine the alarm intensity value of each alarm node in the alarm cluster and determine the core node in combination with the graph centrality index. The fourth unit is used to determine the corresponding control command based on the alarm intensity value of the core node and query the currently available resources. It performs conflict detection in combination with the resource competition relationship. If the currently available resources are sufficient and there is no conflict, it adjusts the execution sequence of tasks in the alarm cluster based on the data flow relationship and executes the control command. It collects execution process data and analyzes and predicts the failure probability in combination with the state transition path. It judges the task risk type in combination with the preset risk threshold and outputs the result.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images