Intelligent operation and maintenance anomaly detection method, system and equipment

Abstract

The invention provides an intelligent operation and maintenance anomaly detection method, system and device, and belongs to the field of operation and maintenance monitoring, and the method comprises the steps: obtaining time sequence data of different first-level business indexes monitored by a business system, each first-level business index comprising a plurality of second-level business indexes; based on the data pattern classification result of each secondary business index, determining an anomaly detection model corresponding to each secondary business index according to a preset matching standard; inputting the time sequence data of each secondary business index into a corresponding anomaly detection model to obtain an anomaly detection result of each secondary business index; and analyzing the anomaly detection result of each secondary business index included in each primary business index by adopting a multi-dimensional attribution model to generate an anomaly detection result of each primary business index. According to the method provided by the invention, the abnormal condition of the monitoring index in the service system can be accurately identified, and the key reason causing the abnormal fluctuation can be quickly positioned.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance monitoring, specifically to an intelligent operation and maintenance anomaly detection method, an intelligent operation and maintenance anomaly detection system, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Traditional operations and maintenance monitoring primarily focuses on monitoring technical objects to determine their availability and the presence of potential risks. However, with the development and iteration of monitoring technologies, and the emergence of observable systems, a business-scenario-centric monitoring concept has emerged. This system incorporates business performance metrics, aiming to proactively identify business fluctuations and risks by monitoring both process and outcome indicators across the entire business process. A key challenge in this process is defining abnormal fluctuations in business monitoring metrics. Accurately identifying these fluctuations helps business personnel promptly detect problems and take appropriate measures, reducing or avoiding potential business risks and losses. This is crucial in today's highly competitive consumer finance market.

[0003] Existing technologies primarily rely on fixed thresholds, dynamic baselines, and statistical models to identify abnormal fluctuations in business monitoring indicators. These methods all suffer from limitations such as insufficient ability to identify historical trends and insufficient sensitivity in anomaly detection. Furthermore, these methods cannot perform anomaly analysis and problem localization on abnormal fluctuations in business operations and unusual situations of technical objects, resulting in the inability to quickly identify the key causes of abnormal fluctuations during alarm handling. Summary of the Invention

[0004] To address the technical problems of low recognition rate and poor accuracy in existing methods for detecting abnormal fluctuations in business monitoring indicators, this invention provides an intelligent operation and maintenance anomaly detection method. This method can not only accurately identify abnormal situations in monitoring indicators within the business system, but also quickly locate the key causes of abnormal fluctuations.

[0005] To achieve the above objectives, the first aspect of the present invention provides an intelligent operation and maintenance anomaly detection method, comprising the following steps: acquiring real-time monitoring data of a business system, wherein the real-time monitoring data includes time-series data of different types of primary business indicators, and each primary business indicator includes at least one secondary business indicator; analyzing the time-series data of each secondary business indicator based on data distribution characteristics to generate a data pattern classification result for each secondary business indicator; determining an anomaly detection model corresponding to each secondary business indicator according to a preset matching standard based on the data pattern classification result of each secondary business indicator, wherein the preset matching standard includes the construction method of the anomaly detection model corresponding to different data patterns; inputting the time-series data of each secondary business indicator into the corresponding anomaly detection model to obtain an anomaly detection result for each secondary business indicator; and generating an anomaly detection result for each primary business indicator based on the anomaly detection results of each secondary business indicator included in each primary business indicator.

[0006] In an exemplary embodiment of the present invention, the step of analyzing the time-series data of each secondary business indicator based on data distribution characteristics to generate a data pattern classification result for each secondary business indicator may include: analyzing the time-series data of each secondary business indicator based on global distribution characteristics to determine whether the data fluctuation of the secondary business indicator is regular; if the data fluctuation of the secondary business indicator is irregular, then the data pattern classification result of the secondary business indicator is determined to be irregular fluctuation type; if the data fluctuation of the secondary business indicator is regular, then analyzing the time-series data of the secondary business indicator based on stability distribution characteristics to determine whether the data fluctuation of the secondary business indicator is stable; if the data fluctuation of the secondary business indicator is stable, then the data pattern classification result of the secondary business indicator is determined to be stable type; if the data fluctuation of the secondary business indicator is regular, then the data pattern classification result of the secondary business indicator is determined to be stable type. If the data does not exhibit stationarity, the time-series data of the secondary business indicator is analyzed based on trend and periodic distribution characteristics to determine whether the data fluctuations of the secondary business indicator exhibit trend and periodicity. If the data fluctuations of the secondary business indicator do not exhibit stationarity, trend, or periodicity, the data pattern classification result of the secondary business indicator is determined to be pulse-type. If the data fluctuations of the secondary business indicator do not exhibit stationarity or trend, but exhibit periodicity, the data pattern classification result of the secondary business indicator is determined to be pure periodic. If the data fluctuations of the secondary business indicator do not exhibit stationarity, but exhibit periodicity and trend, the data pattern classification result of the secondary business indicator is determined to be trend-periodic. If the data fluctuations of the secondary business indicator do not exhibit stationarity or periodicity, but exhibit trend, the data pattern classification result of the secondary business indicator is determined to be trend-type.

[0007] In an exemplary embodiment of the present invention, the global distribution feature may include at least one of sample entropy and autocorrelation coefficient decay rate; the stability distribution feature may include standard deviation; the trend distribution feature may include standard deviation of second-order difference sequence; and the periodic distribution feature may include autocorrelation coefficient.

[0008] In an exemplary embodiment of the present invention, the step of determining the anomaly detection model corresponding to each secondary business indicator based on the data pattern classification result of each secondary business indicator according to a preset matching standard may include: if the data pattern classification result of the current secondary business indicator is irregular fluctuation type, then an anomaly detection model corresponding to the monitoring indicator is constructed using an LSTM model and a Transformer model; if the data pattern classification result of the current secondary business indicator is stationary type, then an anomaly detection model corresponding to the secondary business indicator is constructed using a dynamic analysis algorithm; if the data pattern classification result of the current secondary business indicator is impulsive type, then an anomaly detection model corresponding to the secondary business indicator is constructed using a dynamic analysis algorithm and a dynamic unsupervised model; if the data pattern classification result of the current secondary business indicator is purely periodic type, then an anomaly detection model corresponding to the secondary business indicator is constructed using a feature extraction algorithm and a dynamic analysis algorithm; if the data pattern classification result of the current secondary business indicator is trend periodic type, then an anomaly detection model corresponding to the secondary business indicator is constructed using a feature extraction algorithm and a dynamic unsupervised model; if the data pattern classification result of the current secondary business indicator is trend type, then an anomaly detection model corresponding to the secondary business indicator is constructed using a dynamic unsupervised model.

[0009] In an exemplary embodiment of the present invention, generating anomaly detection results for each primary business indicator based on the anomaly detection results of each secondary business indicator included in each primary business indicator may include: when multiple secondary business indicators of a primary business indicator have anomaly detection results, determining several related indicators of the primary business indicator based on the correlation between the secondary business indicators and technical indicators, wherein the related indicators include secondary business indicators and technical indicators; generating a multidimensional feature matrix of the primary business indicator based on the time-series data and anomaly detection results of each related indicator; and inputting the multidimensional feature matrix of the target analysis indicator into a multidimensional attribution model to obtain the anomaly detection results of the primary business indicator.

[0010] In an exemplary embodiment of the present invention, the step of inputting the multidimensional feature matrix of the primary business indicator into a multidimensional attribution model to obtain the anomaly detection result of the primary business indicator may include: inputting the multidimensional feature matrix into a dynamic adaptive model, calculating the correlation weights between various related indicators through an adaptive mechanism; generating an attention weight matrix based on the correlation weights between various related indicators; inputting the attention weight matrix into a neural network model to obtain the anomaly scores of the primary business indicator at different time points; and comparing the anomaly score of the primary business indicator at the current time point with a preset score threshold to obtain the anomaly detection result of the primary business indicator.

[0011] In an exemplary embodiment of the present invention, the detection method may further include: analyzing the anomaly detection results of the primary business indicators using an NLG model to generate business anomaly alarm information for the primary business indicators.

[0012] A second aspect of the present invention provides an intelligent operation and maintenance anomaly detection system, the detection system comprising: a data acquisition module for acquiring real-time monitoring data of a business system, the real-time monitoring data including time-series data of different types of primary business indicators, each primary business indicator including at least one secondary business indicator; a data classification module for analyzing the time-series data of each secondary business indicator based on data distribution characteristics, generating a data pattern classification result for each secondary business indicator; a model matching module for determining anomaly detection models corresponding to each secondary business indicator according to a preset matching standard based on the data pattern classification results of each secondary business indicator, the preset matching standard including anomaly detection model construction methods corresponding to different data patterns; a first anomaly detection module for inputting the time-series data of each secondary business indicator into the corresponding anomaly detection model to obtain anomaly detection results for each secondary business indicator; and a second anomaly detection module for generating anomaly detection results for each primary business indicator based on the anomaly detection results of each secondary business indicator included in each primary business indicator.

[0013] A third aspect of the present invention provides an electronic device comprising a processor and a memory, wherein the memory stores at least one computer program, the at least one computer program being loaded and executed by one or more of the processors to cause the processors to perform the intelligent operation and maintenance anomaly detection method as described above.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium storing at least one piece of program code, which is loaded and executed by a processor to enable a computer to perform the intelligent operation and maintenance anomaly detection method as described above.

[0015] The present invention has at least the following technical effects through the technical solution provided by the present invention: (1) Based on the characteristics of business monitoring indicators, this invention classifies data patterns by analyzing historical data of business monitoring indicators and establishes anomaly detection models under different data patterns. This not only realizes automatic anomaly identification of business monitoring indicators, but also improves the accuracy of identification. (2) This invention combines a multi-layered monitoring indicator system, integrates business monitoring indicators and technical monitoring indicators into a model, takes business indicators as the starting point, finds related technical monitoring indicators based on the call chain and vertical topology, and establishes a multi-dimensional attribution model. Through this multi-dimensional attribution model, it is possible to locate the technical object and possible cause of the current business fluctuation, thereby quickly recovering the current fault situation, reducing business losses, and achieving efficient recovery.

[0016] Other features and advantages of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 A flowchart of the intelligent operation and maintenance anomaly detection method provided in the embodiments of the present invention; Figure 2 This is a technical schematic diagram of the anomaly detection model corresponding to different data modes provided in the embodiments of the present invention; Figure 3 This is a schematic diagram of the intelligent operation and maintenance anomaly detection system provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0018] Explanation of reference numerals in the attached figures 101-Data acquisition module, 102-Data classification module, 103-Model matching module, 104-First anomaly detection module, 105-Second anomaly detection module, 201-Processor, 202-Memory. Detailed Implementation

[0019] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0021] In this invention, unless otherwise stated, directional terms such as "upper," "lower," "top," and "bottom" are generally used to describe the relative positional relationships of components in relation to the directions shown in the accompanying drawings or in relation to vertical, perpendicular, or gravitational directions. Terms such as "first" and "second" are used merely for ease of description and distinction and should not be construed as indicating or implying relative importance.

[0022] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integrated connection; they can refer to a direct connection or an indirect connection; they can refer to a wired connection or a wireless connection. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0023] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] like Figure 1 As shown in the figure, this embodiment of the invention provides an intelligent operation and maintenance anomaly detection method, which includes the following steps: Step S101: Obtain real-time monitoring data from the business system; Step S102: Analyze the time series data of each secondary business indicator based on the data distribution characteristics to generate data pattern classification results for each secondary business indicator; Step S103: Based on the data pattern classification results of each secondary business indicator, determine the anomaly detection model corresponding to each secondary business indicator according to the preset matching standard; Step S104: Input the time series data of each secondary business indicator into the corresponding anomaly detection model to obtain the anomaly detection result of each secondary business indicator; Step S105: Based on the anomaly detection results of each secondary business indicator contained in each primary business indicator, generate the anomaly detection result for each primary business indicator.

[0025] It should be noted that during the operation of the maintenance system, the business system continuously generates various types of structured and unstructured data, including log data, business behavior metrics, call chain metrics, latency rate, error rate, pass rate, conversion rate, and resource consumption (CPU, memory, disk I / O, etc.). These data sources cover various metrics from the underlying infrastructure to the upper-level business logic, forming a complete perspective on business observability. This data can be aggregated to the central data processing platform in real time or near real time through a data acquisition system. The data acquisition system can be a streaming acquisition channel built on middleware such as Kafka, Flume, or Logstash, or a batch acquisition module driven by scheduled tasks. Step S101 above mainly extracts real-time monitoring data of the business system from the batch data obtained by the data acquisition system.

[0026] Real-time monitoring data for business systems primarily refers to time-series data of different types of primary business metrics. Primary business metrics are those monitored based on business scenarios. Since each primary business metric can be broken down according to different business attribute dimensions, each primary business metric includes at least one secondary business metric. When abnormal fluctuations occur in the primary business metrics monitored by the business system, the secondary business metrics, which can be broken down by dimensions, can pinpoint the detailed directions of potential problems in business development. This allows for in-depth comparative analysis and exploration, ensuring that the anomaly detection model at the business layer can provide specific directions of anomalies.

[0027] The preset matching standard refers to the construction method of the business layer anomaly detection model corresponding to different data patterns. That is, each data pattern can be used to build a matching anomaly detection model. Anomaly detection models under different data patterns can be established based on this preset matching standard. Since existing technologies all use the same set of preset rules (such as fixed thresholds, fixed statistical models, etc.) to evaluate abnormal fluctuations in business layer monitoring indicators, while anomaly identification under these rules can detect some major anomalies, it may hide or ignore slow declines or sudden increases, leading to inaccurate alarm generation. Over time, this will mask effective alarms, resulting in alarm fatigue. To improve the accuracy of identifying abnormal fluctuations in business layer monitoring indicators, this application proposes to first classify the data patterns of business layer monitoring indicators, and then establish targeted anomaly detection models under different data patterns, enabling the model algorithm to automatically identify anomalies under the classification and recognition conditions.

[0028] Furthermore, in one possible implementation, in step S102, the process of analyzing the time-series data of each secondary business indicator based on data distribution characteristics and generating a data pattern classification result for each secondary business indicator may include, but is not limited to, the following sub-steps S1021 to S1029: Sub-step S1021: Analyze the time series data of each secondary business indicator based on the global distribution characteristics to determine whether the data fluctuation of the secondary business indicator has regularity. Sub-step S1022: If the data fluctuation of the secondary business indicator is irregular, then the data pattern classification result of the secondary business indicator is determined to be irregular fluctuation type. Sub-step S1023: If the data fluctuation of the secondary business indicator is regular, then the time series data of the secondary business indicator is analyzed based on the stability distribution characteristics to determine whether the data fluctuation of the secondary business indicator is stable. Sub-step S1024: If the data fluctuation of the secondary business indicator is stable, then the data pattern classification result of the secondary business indicator is determined to be stable. Sub-step S1025: If the data fluctuation of the secondary business indicator does not have stability, then the time series data of the secondary business indicator is analyzed based on the trend distribution characteristics and periodic distribution characteristics to determine whether the data fluctuation of the secondary business indicator has trend and periodicity. Sub-step S1026: If the data fluctuation of the secondary business indicator does not have stability, trend and periodicity, then the data pattern classification result of the secondary business indicator is determined to be pulse type. Sub-step S1027: If the data fluctuation of the secondary business indicator does not have stability and trend, but has periodicity, then the data pattern classification result of the secondary business indicator is determined to be pure periodic. Sub-step S1028: If the data fluctuation of the secondary business indicator does not have stability, but has periodicity and trend, then the data pattern classification result of the secondary business indicator is determined to be trend-periodic type. Sub-step S1029: If the data fluctuation of the secondary business indicator does not have stability and periodicity, but has a trend, then the data pattern classification result of the secondary business indicator is determined to be trend-type.

[0029] In other words, we first conduct a comprehensive analysis of the time series data of the secondary business indicators based on the global distribution characteristics to determine whether the data fluctuations are regular. For data that is obviously irregular, there is no need to calculate the three local distribution characteristics such as stability, trend line, and periodicity. We can directly determine that the data pattern of the secondary business indicator belongs to the irregular fluctuation type (C6). For data with regular fluctuations, we then analyze the specific composition of the pattern based on the local distribution characteristics. If the time-series data of a secondary business indicator exhibits stability, then there is no need to consider trends, periodicity, or other characteristics; the data pattern of the secondary business indicator can be directly determined to be stable (C1). If the time-series data of a secondary business indicator does not exhibit stability, trends, or periodicity, then the data pattern of the secondary business indicator is determined to be impulsive (C2). If the time-series data of a secondary business indicator does not exhibit stability or trends, but does exhibit periodicity, then the data pattern of the secondary business indicator is determined to be purely periodic (C3). If the time-series data of a secondary business indicator does not exhibit stability, but does exhibit periodicity and trends, then the data pattern of the secondary business indicator is determined to be trend-periodic (C4). If the time-series data of a secondary business indicator does not exhibit stability or periodicity, but does exhibit trends, then the data pattern of the secondary business indicator is determined to be trend-based (C5).

[0030] Furthermore, it should be noted that data preprocessing is required before classifying the time series data for each secondary business indicator. For example, data cleaning can be performed in the preprocessing module, including basic quality assurance operations such as removing duplicate records, imputing null values, and replacing illegal values. Next, time alignment is performed on the time series data to unify the time granularity (e.g., 1 minute, 5 minutes, 1 hour, etc.), and missing time points are filled using methods such as linear interpolation and Lagrange interpolation. Normalization is performed on each indicator (e.g., Min-Max standardization, Z-Score standardization) to improve model convergence speed and training performance. At the same time, for data containing outliers, robust statistical analysis methods (e.g., median shift, local outlier factors, etc.) in the preprocessing process are used to achieve preliminary detection and removal of outliers. Finally, the preprocessed data is encoded into a unified format dataset and stored in a cache or feature warehouse for subsequent data pattern classification of the preprocessed time series data.

[0031] Furthermore, in one possible implementation, the global distribution characteristics include at least one of sample entropy and autocorrelation coefficient decay rate. These global distribution characteristics can be compared with corresponding thresholds, and the regularity of the data fluctuations can be determined based on the comparison results. Sample entropy is used to measure the complexity and unpredictability of a time series. If the sample entropy of the time series data is greater than a preset sample entropy threshold, the sequence arrangement of the data can be considered random and irregular; conversely, if the sample entropy of the time series data is less than the preset sample entropy threshold, the sequence arrangement of the data can be considered regular. Similarly, the autocorrelation coefficient decay rate is used to measure the regularity of a time series. For regular sequences, their autocorrelation structure will exhibit a certain pattern (such as periodic decay); for irregular sequences, their autocorrelation coefficient will rapidly decay to zero. Therefore, if the autocorrelation coefficient decay rate of the time series data is less than a preset decay rate, the sequence arrangement of the data is considered to lack long-term regularity; conversely, if the autocorrelation coefficient decay rate of the time series data is greater than the preset decay rate, the sequence arrangement of the data is considered to have long-term regularity.

[0032] The stability distribution characteristic mainly refers to the standard deviation of time series data. The stability of data fluctuations can be determined by whether the standard deviation of time series data is lower than a preset threshold. If the standard deviation of a certain secondary business indicator's time series data is lower than a preset first standard deviation threshold, then the data fluctuations of that secondary business indicator are considered stable. Conversely, if the standard deviation of a certain secondary business indicator's time series data is higher than the preset first standard deviation threshold, then the data fluctuations of that secondary business indicator are considered unstable.

[0033] Trend distribution characteristics mainly refer to the standard deviation of the second-order difference sequence of time series data. Whether the data fluctuations exhibit a trend can be determined by whether the standard deviation of the second-order difference sequence is less than a preset threshold. If the standard deviation of the second-order difference sequence of a certain secondary business indicator is lower than the preset second standard deviation threshold, then the data fluctuations of that secondary business indicator are considered to have a trend. Conversely, if the standard deviation of the second-order difference sequence of a certain secondary business indicator is higher than the preset second standard deviation threshold, then the data fluctuations of that secondary business indicator are considered not to have a trend.

[0034] The periodic distribution characteristic mainly refers to the autocorrelation coefficient, which can be used to determine whether the data fluctuations are periodic based on whether the autocorrelation coefficient exceeds a preset threshold. If the autocorrelation coefficient of a certain secondary business indicator is lower than the preset threshold, then the data fluctuations of that secondary business indicator are considered periodic; conversely, if the autocorrelation coefficient of a certain secondary business indicator is higher than the preset threshold, then the data fluctuations of that secondary business indicator are considered non-periodic.

[0035] Furthermore, in one possible implementation, such as Figure 2As shown, in step S103, the process of determining the anomaly detection model corresponding to each secondary business indicator based on the data pattern classification results of each secondary business indicator and according to the preset matching criteria may include, but is not limited to, the following sub-steps S1031 to S1036: Sub-step S1031: If the data pattern classification result of the current secondary business indicator is irregular fluctuation type, then the LSTM model (Long Short-Term Memory Network) and Transformer model are used to construct the anomaly detection model corresponding to the monitoring indicator. Sub-step S1032: If the data pattern classification result of the current secondary business indicator is stationary, then the dynamic analysis algorithm is used to construct the anomaly detection model corresponding to the secondary business indicator. Sub-step S1033: If the data pattern classification result of the current secondary business indicator is pulse type, then the dynamic analysis algorithm and dynamic unsupervised model are used to construct the anomaly detection model corresponding to the secondary business indicator. Sub-step S1034: If the data pattern classification result of the current secondary business indicator is pure periodic, then the feature extraction algorithm and dynamic analysis algorithm are used to construct the anomaly detection model corresponding to the secondary business indicator. Sub-step S1035: If the data pattern classification result of the current secondary business indicator is trend-periodic, then the feature extraction algorithm and dynamic unsupervised model are used to construct the anomaly detection model corresponding to the secondary business indicator. Sub-step S1036: If the data pattern classification result of the current secondary business indicator is trend-type, then a dynamic unsupervised model is used to construct the anomaly detection model corresponding to the secondary business indicator.

[0036] It should be noted that dynamic analysis algorithms mainly refer to data analysis using a mean ± N standard deviation model. This method is suitable for indicators that approximate a normal distribution, and its anomaly detection condition is |X μ|>Nσ, where X is the current value, μ and σ are the mean and standard deviation within the historical sliding window, respectively, and N is adjusted according to the fluctuation characteristics of the indicator and the business tolerance.

[0037] Feature extraction algorithms mainly refer to the comprehensive application of methods such as autocorrelation analysis, Fourier transform frequency domain features, sliding window trend fitting, and local variance analysis to concatenate multi-dimensional time series features into high-order feature vectors to enhance the model's expressive power.

[0038] Dynamic unsupervised models mainly refer to the collaborative identification of multiple machine learning algorithms. For example, IsolationForest constructs a random binary tree to divide the sample space and takes advantage of the characteristic that abnormal samples are separated in shallow paths. It uses the inverse function of the average path length as the anomaly score, which can efficiently identify isolated points without labels and is suitable for the initial screening of small and medium-sized indicators. At the same time, the DBSCAN clustering algorithm is used to detect sudden and persistent anomalies. By clustering the historical data of each day, it analyzes the distribution changes of the main clusters and identifies new clusters that deviate significantly from the historical pattern on the current day, thereby determining whether there is persistent abnormal behavior. The whole system forms a multi-granularity and multi-level anomaly detection mechanism.

[0039] Furthermore, in the feedback optimization module, after each alarm is generated, the system records the results of manual analysis, i.e., whether the alarm is deemed valid. This feedback serves as weakly supervised signals, participating in subsequent incremental learning and dynamic calibration of the model. For example, for models with high false alarm rates, the system updates its discrimination boundary or adjusts the threshold using feedback samples. It also acquires historical data on recent model errors and manually labeled data in real time, training dynamic supervised models, such as logistic regression classification models, and weights the predicted results with the results of each sub-model in the anomaly detection module to achieve dynamic feedback optimization.

[0040] For secondary business indicators that lack regular fluctuation patterns and make it difficult to determine their pattern type, such as business pass rate and transaction volume, LSTM (Long Short-Term Memory Network) and Transformer can be used as the main prediction model.

[0041] Furthermore, in one possible implementation, in step S105, when multiple secondary business indicators under a primary business indicator show abnormalities, these abnormal secondary business indicators can be comprehensively analyzed to determine whether the primary business indicator to which they belong is also abnormal. For example, the impact of these abnormal secondary business indicators on the primary business indicator can be analyzed. If it is found that most of the abnormal secondary business indicators (i.e., the number of abnormal secondary business indicators is less than a preset value) have a small impact on the primary business indicator, then the anomaly detection result of the primary business indicator can be judged to be normal. Conversely, if it is found that most of the abnormal secondary business indicators (i.e., the number of abnormal secondary business indicators is more than a preset value) have a large impact on the primary business indicator, then the anomaly detection result of the primary business indicator can be judged to be abnormal.

[0042] Of course, the present invention is not limited to this. A multidimensional attribution model can also be used to comprehensively analyze all secondary business indicators under a primary business indicator, as well as related technical indicators, to determine whether the anomaly detection result of the primary business indicator is abnormal. Specifically, in another possible implementation, the process of generating the anomaly detection result for each primary business indicator based on the anomaly detection results of each secondary business indicator included in each primary business indicator may include, but is not limited to, the following sub-steps S1051 to S1053: Sub-step S1051: When multiple secondary business indicators of a primary business indicator have abnormal detection results, based on the correlation between the secondary business indicators and technical indicators, determine several related indicators of the primary business indicator, including secondary business indicators and technical indicators. Sub-step S1052: Based on the time-series data and anomaly detection results of each related indicator, generate a multi-dimensional feature matrix of the primary business indicators; Sub-step S1053: Input the multidimensional feature matrix of the target analysis indicator into the multidimensional attribution model to obtain the anomaly detection results of the first-level business indicator.

[0043] In other words, starting with primary business metrics, anomaly detection results are found for the associated technical metrics based on the call chain and vertical topology. These results are then combined with secondary business metrics and their anomaly detection results to form a multi-dimensional feature matrix. Horizontally, each row of this matrix represents the time-series data of a secondary metric and whether the latest predicted point by the anomaly detection model is an anomaly. Vertically, each column represents the data sorted according to the call chain order at each time point. That is, X∈R n×(m+1) , where n is the number of associated metrics in the call chain, m is the time-series feature dimension of each associated metric, and the last column of X represents whether the latest point of each associated metric predicted by the anomaly detection model is abnormal.

[0044] Furthermore, it should be noted that technical indicators mainly refer to metrics monitored based on systems, components, and basic resources (such as parameters related to the operational status of application modules supporting a specific business scenario, parameters indicating the status of components that services depend on, and parameters indicating the usage of infrastructure resources). Anomaly detection results for technical indicators can be obtained using methods similar to those for secondary business indicators, or other identification models can be employed.

[0045] The core advantage of the aforementioned multidimensional attribution model lies in its ability to model dependencies between arbitrary positions through an adaptive mechanism, overcoming the limitations of traditional sequence structures. The model employs positional encoding vectors to enhance temporal awareness and uses a multi-head attention mechanism with layered stacking to weight and aggregate features from different time periods, thereby improving its ability to identify sudden, coupled, and multidimensional interactive anomalies. The model ultimately outputs anomaly scores for primary business indicators at each time point. Subsequent analysis of these anomaly scores at the latest time point can be performed by setting thresholds or confidence intervals, thus achieving anomaly identification.

[0046] Furthermore, in one possible implementation, in sub-step S1053, the process of inputting the multidimensional feature matrix of the primary business indicators into the multidimensional attribution model to obtain the anomaly detection results of the primary business indicators may include, but is not limited to, the following sub-steps S10531 to S10534: Sub-step S10531: Input the multidimensional feature matrix into the dynamic adaptive model, and calculate the correlation weights between various related indicators through the adaptive mechanism. Sub-step S10532: Generate an attention weight matrix based on the correlation weights between various related indicators; Sub-step S10533: Input the attention weight matrix into the neural network model to obtain the abnormal scores of the primary business indicators at different time points; Sub-step S10534 compares the abnormal scores of the primary business indicators at the current time point with the preset scoring threshold to obtain the abnormal detection results of the primary business indicators.

[0047] For example, after inputting the multidimensional feature matrix of primary business indicators into the multidimensional attribution model, the specific data processing flow is as follows: (1) First, through adaptive transformation, features of different dimensions are mapped to the same vector space to eliminate the difference in dimensions and enhance the stability of the model. ,in W 1 is the model parameter matrix. It is the transformed feature matrix; (2) Dynamic analysis features are extracted through Fast Fourier Transform, i.e. ; (3) Then, through an adaptive mechanism, the adaptive fusion of multi-dimensional features is achieved, that is... Among them, W a W b and W c It is the model parameter matrix; (4) Finally, the fused features are mapped to anomaly scores through a feedforward network for final determination, i.e. ,in, W 2 andW 3 is the weight matrix, d1 and d2 are bias terms, ELU is the exponential linear unit activation function, and Y is the output vector, representing the anomaly score at each time point.

[0048] Furthermore, in one possible implementation, the detection method may further include step S106, using an NLG model (Natural Language Generation Model) to analyze the anomaly detection results of the primary business indicators and generate business anomaly alarm information for the primary business indicators. For example, the NLG model can provide human-readable text explanations of the background, causes, and deviations of the primary business indicators, such as "The current coupon distribution approval rate has suddenly dropped by 35%, which is lower than three standard deviations below the average of the past 30 days, possibly caused by system lag." These results are pushed to the operation and maintenance platform in the form of images and text, supporting multiple methods such as email alerts and automatic generation of work orders to ensure that information reaches operation and maintenance personnel in a timely manner.

[0049] Overall, the intelligent operation and maintenance anomaly detection method provided in this invention has achieved several key innovations in the field of business anomaly detection: First, it combines dynamic analysis methods, dynamic models, and deep learning to construct a multi-layered fusion anomaly identification mechanism; second, it introduces indicator pattern recognition capabilities, matching different modeling methods according to the data characteristics of business indicators to improve identification accuracy and generalization ability; third, it achieves a more business-interpretable and practically applicable alarm system through the interactive fusion of expert experience and model output; fourth, it implements a continuous feedback optimization and online update mechanism for the model, significantly improving the system's adaptability to new businesses, new indicators, and new scenarios; and fifth, it integrates the memory mechanism of LSTM and the global modeling capability of Transformer at the model construction level to fully explore the long-term dependencies and multi-dimensional interaction relationships in time series data.

[0050] In real-world testing scenarios, the aforementioned anomaly detection method has been deployed and tested in multiple financial settings. It has significantly improved the accuracy of anomaly identification, significantly reduced the false alarm rate, and significantly enhanced the comprehensive identification capability for both abrupt and gradual anomaly indicators. In actual business operations, this anomaly detection method has successfully captured several business risk events caused by approval delays, system lag, and interface bottlenecks, significantly advancing the effective warning time and greatly reducing business losses and customer complaint risks. This solution represents a shift from monitoring technical availability to monitoring business performance capabilities, fully embodying the business-centric evolution of operational observability, and possesses broad application prospects and significant value for technology promotion.

[0051] Furthermore, it should be noted that the implementation environment of this embodiment includes at least one terminal and one server, and the intelligent operation and maintenance anomaly detection method in the above embodiments is executed on the terminal or the server respectively. The terminal and the server can establish a communication connection to achieve interactive information transmission.

[0052] The terminal can be any electronic product that can interact with the user through one or more methods such as keyboard, touchpad, touch screen, voice interaction, etc., such as PC (Personal Computer), PPC (Pocket Personal Computer), tablet computer, etc.

[0053] A server can be a single server, a server cluster consisting of multiple servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0054] like Figure 3 As shown, this embodiment of the invention also provides an intelligent operation and maintenance anomaly detection system, which includes a data acquisition module 101, a data classification module 102, a model matching module 103, a first anomaly detection module 104, and a second anomaly detection module 105.

[0055] The data acquisition module 101 is used to acquire real-time monitoring data of the business system. The real-time monitoring data includes time-series data of different types of primary business indicators, and each primary business indicator includes at least one secondary business indicator.

[0056] The data classification module 102 is used to analyze the time series data of each secondary business indicator based on the data distribution characteristics and generate data pattern classification results for each secondary business indicator.

[0057] The model matching module 103 is used to determine the anomaly detection model corresponding to each secondary business indicator based on the data pattern classification results of each secondary business indicator and according to the preset matching standard. The preset matching standard includes the construction method of the anomaly detection model corresponding to different data patterns.

[0058] The first anomaly detection module 104 is used to input the time series data of each secondary business indicator into the corresponding anomaly detection model to obtain the anomaly detection result of each secondary business indicator.

[0059] The second anomaly detection module 105 is used to generate anomaly detection results for each primary business indicator based on the anomaly detection results of each secondary business indicator contained in each primary business indicator.

[0060] It should be noted that the intelligent operation and maintenance anomaly detection system described above is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the equipment can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the intelligent operation and maintenance anomaly detection system and the intelligent operation and maintenance anomaly detection method provided in the above embodiments belong to the same concept. For details of their specific implementation, please refer to the embodiments of the intelligent operation and maintenance anomaly detection method, which will not be repeated here.

[0061] like Figure 4 As shown, this embodiment of the invention also provides an electronic device, which includes a processor 201 and a memory 202. The memory stores at least one computer program, which is loaded and executed by one or more processors to enable the processors to implement the intelligent operation and maintenance anomaly detection method in the above embodiment.

[0062] Of course, the electronic device may also have wired or wireless network interfaces, keyboards, and input / output interfaces for input and output. The electronic device may also include other components for implementing the various functions of the device, which will not be elaborated here.

[0063] This invention also provides a computer-readable storage medium storing at least one piece of program code, which is loaded and executed by a processor to enable a computer to implement the intelligent operation and maintenance anomaly detection method described in the above embodiments.

[0064] Optionally, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk, or an optical disc data storage device, etc. Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a microcontroller, chip, or processor to execute all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc.

[0065] In summary, this invention enables more accurate anomaly detection and alarm discovery for business monitoring metrics. It goes beyond simply focusing on primary metrics of business performance; it supports drill-down analysis based on the dimensions of business metrics, effectively identifying and locating abnormal fluctuations in the business. To a certain extent, this invention breaks away from the current monitoring landscape, which primarily focuses on technical monitoring and non-model-based conventional rule monitoring. It achieves dynamic, real-time identification based on historical trends and expert experience, proactively detecting abnormal business fluctuations and anticipating market changes for business development, thereby improving implementation effectiveness and reducing costs. Based on the company's current implementation, the results after two months of operation are as follows: over 97.8% of the metrics covered by the model outperformed previous manual rules, with a recall rate exceeding 90%, a precision rate exceeding 88%, and an alarm reduction rate of over 75% for the metrics covered by the model.

[0066] Furthermore, the technical effect achieved by this invention is that it can combine business monitoring and technical monitoring, and perform multi-dimensional modeling and correlation analysis through modeling to find the underlying causes of business fluctuations, so as to ensure rapid location and recovery.

[0067] The preferred embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the specific details of the above embodiments. Within the scope of the technical concept of the present invention, various simple modifications can be made to the technical solution of the present invention, and these simple modifications all fall within the protection scope of the present invention.

[0068] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present invention will not describe the various possible combinations separately.

[0069] Furthermore, various different embodiments of the present invention can be combined in any way, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed by the present invention.

Claims

1. A method for intelligent operation and maintenance anomaly detection, characterized in that, The detection method includes: Acquire real-time monitoring data of the business system. The real-time monitoring data includes time-series data of different types of primary business indicators, and each primary business indicator includes at least one secondary business indicator. Based on the data distribution characteristics, the time series data of each secondary business indicator is analyzed to generate data pattern classification results for each secondary business indicator. Based on the data pattern classification results of each secondary business indicator, the anomaly detection model corresponding to each secondary business indicator is determined according to the preset matching standard, which includes the construction method of the anomaly detection model corresponding to different data patterns. The time-series data of each secondary business indicator is input into the corresponding anomaly detection model to obtain the anomaly detection results for each secondary business indicator. Based on the anomaly detection results of each secondary business indicator included in each primary business indicator, anomaly detection results for each primary business indicator are generated.

2. The intelligent operation and maintenance anomaly detection method according to claim 1, characterized in that, The analysis of time-series data for each secondary business indicator based on data distribution characteristics generates data pattern classification results for each secondary business indicator, including: Based on the global distribution characteristics, the time series data of each secondary business indicator are analyzed to determine whether the data fluctuations of the secondary business indicator are regular. If the data fluctuation of the secondary business indicator is irregular, then the data pattern classification result of the secondary business indicator is determined to be irregular fluctuation type; If the data fluctuation of the secondary business indicator is regular, then the time series data of the secondary business indicator is analyzed based on the stability distribution characteristics to determine whether the data fluctuation of the secondary business indicator is stable. If the data fluctuation of the secondary business indicator is stable, then the data pattern classification result of the secondary business indicator is determined to be stable. If the data fluctuation of the secondary business indicator is not stable, then the time series data of the secondary business indicator is analyzed based on the trend distribution characteristics and periodic distribution characteristics to determine whether the data fluctuation of the secondary business indicator has a trend and periodicity. If the data fluctuation of the secondary business indicator does not exhibit stability, trend, or periodicity, then the data pattern classification result of the secondary business indicator is determined to be pulse-type. If the data fluctuation of the secondary business indicator does not have stability and trend, but has periodicity, then the data pattern classification result of the secondary business indicator is determined to be pure periodic. If the data fluctuation of the secondary business indicator is not stable, but has periodicity and trend, then the data pattern classification result of the secondary business indicator is determined to be trend-periodic type. If the data fluctuation of the secondary business indicator does not have stability and periodicity, but has a trend, then the data pattern classification result of the secondary business indicator is determined to be trend-type.

3. The intelligent operation and maintenance anomaly detection method according to claim 2, characterized in that, The global distribution feature includes at least one of the sample entropy and the autocorrelation coefficient decay rate; The stability distribution characteristics include: standard deviation; The trend distribution characteristics include: the standard deviation of the second-order difference sequence; The periodic distribution characteristics include: autocorrelation coefficient.

4. The intelligent operation and maintenance anomaly detection method according to claim 2, characterized in that, The data pattern classification results based on each secondary business indicator, and the anomaly detection model corresponding to each secondary business indicator determined according to a preset matching standard, include: If the data pattern classification result of the current secondary business indicator is irregular fluctuation type, then the LSTM model and Transformer model are used to construct the anomaly detection model corresponding to the monitoring indicator. If the data pattern classification result of the current secondary business indicator is stationary, then a dynamic analysis algorithm is used to construct the anomaly detection model corresponding to the secondary business indicator. If the data pattern classification result of the current secondary business indicator is pulse type, then the anomaly detection model corresponding to the secondary business indicator is constructed by using dynamic analysis algorithm and dynamic unsupervised model; If the data pattern classification result of the current secondary business indicator is pure periodic, then the anomaly detection model corresponding to the secondary business indicator is constructed by using feature extraction algorithm and dynamic analysis algorithm; If the data pattern classification result of the current secondary business indicator is trend-periodic, then the anomaly detection model corresponding to the secondary business indicator is constructed using feature extraction algorithm and dynamic unsupervised model; If the current secondary business indicator's data pattern classification result is trend-based, then a dynamic unsupervised model is used to construct the anomaly detection model corresponding to that secondary business indicator.

5. The intelligent operation and maintenance anomaly detection method according to claim 1, characterized in that, The generation of anomaly detection results for each primary business indicator, based on the anomaly detection results of each secondary business indicator contained within each primary business indicator, includes: When multiple secondary business indicators show abnormality in the detection results of a primary business indicator, several related indicators are determined based on the correlation between the secondary business indicators and technical indicators. These related indicators include secondary business indicators and technical indicators. Based on the time-series data and anomaly detection results of each related indicator, a multi-dimensional feature matrix of primary business indicators is generated. By inputting the multidimensional feature matrix of the target analysis indicators into the multidimensional attribution model, anomaly detection results of the primary business indicators are obtained.

6. The intelligent operation and maintenance anomaly detection method according to claim 5, characterized in that, The step of inputting the multidimensional feature matrix of the primary business indicators into the multidimensional attribution model to obtain the anomaly detection results of the primary business indicators includes: The multidimensional feature matrix is ​​input into the dynamic adaptive model, and the correlation weights between various related indicators are calculated through the adaptive mechanism. An attention weight matrix is ​​generated based on the correlation weights among various related indicators. The attention weight matrix is ​​input into the neural network model to obtain the abnormal scores of the primary business indicators at different time points. The abnormal scores of the primary business indicators at the current time point are compared with the preset scoring thresholds to obtain the abnormal detection results of the primary business indicators.

7. The intelligent operation and maintenance anomaly detection method according to claim 6, characterized in that, The detection method further includes: The NLG model is used to analyze the anomaly detection results of the primary business indicators and generate business anomaly alarm information for the primary business indicators.

8. An intelligent operation and maintenance anomaly detection system, characterized in that, The detection system includes: The data acquisition module is used to acquire real-time monitoring data of the business system. The real-time monitoring data includes time-series data of different types of primary business indicators, and each primary business indicator includes at least one secondary business indicator. The data classification module is used to analyze the time series data of each secondary business indicator based on the data distribution characteristics and generate data pattern classification results for each secondary business indicator. The model matching module is used to determine the anomaly detection model corresponding to each secondary business indicator based on the data pattern classification results of each secondary business indicator and according to the preset matching criteria. The preset matching criteria include the construction method of the anomaly detection model corresponding to different data patterns. The first anomaly detection module is used to input the time series data of each secondary business indicator into the corresponding anomaly detection model to obtain the anomaly detection result of each secondary business indicator. The second anomaly detection module is used to generate anomaly detection results for each primary business indicator based on the anomaly detection results of each secondary business indicator contained in each primary business indicator.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory, wherein the memory stores at least one computer program, which is loaded and executed by one or more of the processors to enable the processors to perform the intelligent operation and maintenance anomaly detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one piece of program code, which is loaded and executed by a processor to cause the computer to perform the intelligent operation and maintenance anomaly detection method according to any one of claims 1 to 7.

Images