Business volume risk early warning method, device, equipment and medium

Abstract

The invention discloses a business volume risk early warning method and device, equipment and a medium. Comprising the following steps: acquiring a multi-dimensional business key index according to a historical business operation log in a first time interval, and establishing a time sequence database of the first time interval; training the business volume prediction model according to the time sequence database; at each prediction node in the second time interval, obtaining a business volume upper limit and a business volume lower limit which are respectively output by the business volume prediction model for each time point in the current prediction period; and according to the actual business volume, the business volume upper limit and the business volume lower limit of each time point in the current prediction period, respectively carrying out business volume risk detection on each time point, and when a business volume risk is detected at a target time point, triggering risk early warning for the target time point. By adopting the technical scheme, high-precision beforehand prediction analysis can be carried out on the future service volume, manual threshold setting is not needed, service fluctuation is automatically adapted, and invalid alarms are effectively reduced.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance monitoring technology, and in particular to a method, device, equipment and medium for early warning of business volume risks. Background Technology

[0002] As business architecture evolves towards distributed and microservice architectures, the complexity of inter-service call topologies continues to increase. To avoid service overload, slow response, or downtime, it is necessary to predict business volume risks in advance.

[0003] In existing technologies, business volume risk detection is generally based on fixed thresholds or statistical distributions. When the business volume exceeds the pre-set fixed threshold or the normal fluctuation range of the indicator, an alarm is triggered.

[0004] However, risk detection based on fixed thresholds relies on manual experience to set thresholds and lacks the ability to adapt to business fluctuations. It is prone to generating a large number of false alarms or missed alarms in cyclical fluctuation scenarios such as morning and evening peak hours and holidays. Alarms are only triggered when the anomaly reaches its peak, which is seriously delayed from the best intervention time. On the other hand, anomaly detection methods based on statistical distribution have low sensitivity to business cyclicality and long-term trend changes, lack the ability to predict future business volume trends, can only achieve real-time anomaly judgment, and do not support dynamic adjustments under special events such as holidays and promotional events. Summary of the Invention

[0005] This invention provides a method, apparatus, device, and medium for business volume risk early warning, which can perform high-precision advance prediction and analysis of future business volume, without the need for manual threshold setting, automatically adapt to business fluctuations, and effectively reduce invalid alarms.

[0006] According to one aspect of the present invention, a method for early warning of business volume risk is provided, comprising:

[0007] Based on the historical business operation logs within the first time interval, obtain multi-dimensional key business indicators and establish a time-series database for the first time interval;

[0008] Based on the time series database, the traffic volume prediction model is trained to obtain an updated traffic volume prediction model;

[0009] For each prediction node in the second time interval, the time characteristics of the prediction node are input into the traffic volume prediction model to obtain the upper limit and lower limit of traffic volume output by the traffic volume prediction model for each time point in the current prediction period.

[0010] Based on the actual business volume, upper limit of business volume, and lower limit of business volume at each time point within the current forecast period, business volume risk detection is performed at each time point, and when a business volume risk is detected at the target time point, a risk warning is triggered for the target time point.

[0011] According to another aspect of the present invention, a business volume risk early warning device is provided, comprising:

[0012] The time-series database establishment module is used to obtain multi-dimensional key business indicators based on historical business operation logs within the first time interval, and to establish a time-series database for the first time interval.

[0013] The business volume prediction model update module is used to train the business volume prediction model based on the time series database to obtain the updated business volume prediction model.

[0014] The traffic volume prediction module is used to input the time characteristics of the prediction node into the traffic volume prediction model for each prediction node in the second time interval, and obtain the upper limit and lower limit of traffic volume output by the traffic volume prediction model for each time point in the current prediction period.

[0015] The business volume risk warning module is used to detect business volume risks at each time point based on the actual business volume, upper limit of business volume, and lower limit of business volume at each time point within the current forecast period. When a business volume risk is detected at a target time point, a risk warning is triggered for that target time point.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] At least one processor; and

[0018] A memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the traffic risk warning method according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the traffic risk warning method according to any embodiment of the present invention.

[0021] The technical solution of this invention obtains multi-dimensional key business indicators based on historical business operation logs within a first time interval and establishes a time-series database for the first time interval. Based on this database, a business volume prediction model is trained to obtain an updated model. At each prediction node within a second time interval, the time characteristics of the prediction node are input into the business volume prediction model. The upper and lower limits of the business volume output by the model for each time point within the current prediction period are obtained. Based on the actual business volume, upper and lower limits of the business volume at each time point within the current prediction period, business volume risk detection is performed at each time point. When a business volume risk is detected at a target time point, a risk warning is triggered for that target time point. This method enables intelligent prediction of future business volume without the need for manual threshold setting. It automatically adapts to business fluctuations, and the multi-factor-based business volume prediction effectively improves prediction accuracy. It supports business volume prediction in complex scenarios such as holidays and major promotions, effectively reducing invalid alarms. Furthermore, predicting the upper and lower limits of business volume in advance can identify potential business volume risks, breaking through the limitations of current post-event alarms.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a business volume risk early warning method provided in Embodiment 1 of the present invention;

[0025] Figure 2 This is a flowchart of another business volume risk warning method provided according to Embodiment 2 of the present invention;

[0026] Figure 3 This is a schematic diagram of a business volume risk early warning device provided according to Embodiment 3 of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the business volume risk warning method of this invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Example 1

[0031] Figure 1 This is a flowchart of a traffic volume risk early warning method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where a traffic volume prediction model trained based on historical data of a first time interval is used to detect traffic volume risks at each time point within a second time interval. This method can be executed by a traffic volume risk early warning device, which can be implemented in hardware and / or software and is generally configured in a computer or processor with data processing capabilities. Figure 1 As shown, the method includes:

[0032] S110. Based on the historical business operation logs within the first time interval, obtain multi-dimensional key business indicators and establish a time-series database for the first time interval.

[0033] Optionally, the first time interval can refer to the historical data collection period used to train the model. By collecting historical business operation logs in the first time interval, a business volume prediction model for predicting business volume in the second time interval can be trained. The length of the first time interval is the same as the length of the second time interval.

[0034] Optionally, multi-dimensional key business indicators may include multiple information such as minute-level timestamps from historical business operation logs, business identifiers, and business stages. Among them, the business identifier can be a business serial number, and the business stage can include the start of the business, the specific progress of the business execution, and the end of the task.

[0035] Optionally, a time-series database is used to store time-series data. The time-series database supports high-throughput minute-level metric writing, fast querying by time range, and historical data backtracking, adapting to the time correlation characteristics of business volume data.

[0036] Optionally, log collection tools can be used to extract historical business operation logs within the first time interval from the log center. In each historical business operation log, multiple information such as minute-level timestamps, business identifiers, and business stages can be extracted. The historical operation logs belonging to the same business can be aggregated according to the business identifier of each business. During the aggregation process, operations such as sorting and extracting key information can be performed on the historical logs belonging to the same business based on the business stage.

[0037] Optionally, multi-dimensional key business metrics may also include the number of transactions per minute, the success rate, and the average response time for transactions. These metrics can be used to validate the trained business volume prediction model.

[0038] This includes obtaining multi-dimensional key business indicators based on historical business operation logs within the first time interval, and establishing a time-series database for the first time interval, which may include:

[0039] Based on the historical business operation logs within the first time interval, extract the business identifier and minute-level timestamp of each historical business operation log;

[0040] Based on the business identifier of each historical business operation log, multiple historical business operation logs belonging to the same business are integrated to obtain the integrated business log;

[0041] Based on the minute-level timestamps of each business log, the business logs are stored in the time-series database in chronological order, and each business log is marked with a business type and a special date label.

[0042] Optionally, the business identifier can be a unique identifier used to distinguish different businesses. The business identifier can ensure that logs of the same business can be accurately integrated and avoid data confusion across businesses.

[0043] Optionally, based on the business identifier of each historical business operation log, the target historical business operation logs belonging to the same business can be identified, and the scattered logs of the same business and the same minute can be merged into a single minute-level business record, i.e., the integrated business log, by using a newline regular expression.

[0044] Optionally, business logs can be sorted according to their minute-level timestamps, and then stored in a time-series database in either the oldest to the newest or the newest to the oldest order.

[0045] Optionally, the business type tag can refer to the business category label of each business log, such as e-commerce transaction, user registration, message push, etc.

[0046] Optionally, special date tags can refer to markers added for special time points such as holidays, promotional days, and system upgrades. Special date tags can be used to describe the specific nature of special dates, such as Spring Festival, National Day, mid-year events, and system upgrade days.

[0047] Optionally, based on the minute-level timestamps of each business log, the natural day on which each business log occurred can be determined, and then a special date label for the business log can be determined based on the natural day and a predefined list of special dates.

[0048] S120. Based on the time series database, train the business volume prediction model to obtain an updated business volume prediction model.

[0049] Optionally, the actual form of the business volume forecasting model can be an additive model. The business volume forecasting model can achieve accurate forecasting by separating the individual effects of trends, cycles, and holidays, which is significantly different from traditional fixed threshold or statistical distribution models.

[0050] The business volume forecasting model is an additive model, which includes a trend function, a periodic function, a holiday effect function, and a residual term.

[0051] Optionally, the business volume forecasting model can be expressed as: Where y(t) is the actual observed value at time t, which is the output of the traffic volume prediction model. Let be the trend function, s(t) be the periodic function, and h(t) be the holiday effect function. As the residual term, the business volume prediction model based on the additive model is more in line with the actual fluctuation pattern of business, and each factor can be analyzed separately, which facilitates model optimization.

[0052] Optionally, trend functions can be used to represent long-term non-periodic changes and can include logistic growth functions and linear trend functions. Logistic growth functions are suitable for businesses whose growth is approaching saturation, such as newly launched products, and can be represented as follows: Where C represents the maximum capacity at time point t, k represents the growth rate, and m represents the inflection point; the linear trend function is suitable for businesses with stable growth or decline in business volume, and can be expressed as... Where k represents the slope and m represents the intercept, the choice of trend function can be determined according to the actual business type. The logical growth function or linear trend function can be configured in the business volume model according to the actual business type predicted.

[0053] Optionally, periodic functions can be used to represent monthly, quarterly, or other periodic fluctuations. A periodic function can be expressed as follows: Where P represents the prediction period length in minutes. For example, if the prediction period is every 24 hours, then P is 1440; if the prediction period is every week, then P is 10080. N is the harmonic order, which can be selected from 1 to 10. The harmonic order is used to control the fitting precision. n b n The Fourier coefficients can be obtained by fitting historical data in a time series database. The periodic function can simultaneously model multiple periods such as daily, weekly, and monthly periods, and is suitable for analyzing peak business periods. For example, the superimposed fluctuations of the daily peak at 8:00 AM and the weekly peak on Monday can be accurately fitted by the periodic function.

[0054] Optionally, the holiday effect function can be used to describe the impact of special dates on business volume. The holiday effect function can be expressed as follows: Z(t) can be determined based on a predefined list of holidays. If time point t belongs to a holiday specified in the list, then Z(t) is 1; otherwise, Z(t) is 0. This is the intensity parameter for each holiday in the holiday list. The intensity parameter can be used to describe the extent to which holidays affect business volume. The intensity parameter for each holiday can be preset.

[0055] Optionally, the residual term can refer to random noise that the model did not capture, that is, the difference between the actual business volume and the model prediction.

[0056] Optionally, after generating the time series database, data preprocessing can be performed on each business log in the time series database. Specifically, this may include cleaning extreme values, filling in missing values, and normalizing the units. Then, the business volume prediction model can be fitted based on the preprocessed time series database.

[0057] The process of training a traffic volume prediction model based on the time-series database to obtain an updated traffic volume prediction model may include:

[0058] Based on the business type of each business log in the time series database, determine the target trend function; whereby the target trend function is either a logical growth function or a linear trend function.

[0059] Based on the business logs in the time series database and the target trend function, train the business volume prediction model to update the target trend function, periodic function and residual terms in the business volume prediction model;

[0060] Based on the list of special dates within the second time interval and the intensity parameters corresponding to each special date within the second time interval, the holiday effect function of the business volume prediction model within the second time interval is determined.

[0061] Optionally, the trend function type corresponding to each business type can be pre-matched, and then the target trend function can be determined according to the business log type in the current time series database.

[0062] Optionally, the target trend function can be determined by calculating the standard deviation of the growth rate of the daily average transaction volume in the time series database. Specifically, this includes: extracting the daily average transaction volume within the first time interval and generating a sequence of dates and daily average transaction volume; if the standard deviation of the growth rate of the sequence is <10%, it indicates that the business growth is stable, and a linear trend function is selected; if the growth rate of the sequence gradually decreases and the daily average transaction volume approaches the specified upper limit, it indicates that the business is approaching saturation, and a logical growth trend function is selected.

[0063] Optionally, a training dataset can be generated based on a time-series database and input into the business volume prediction model to be optimized. The model optimizes the parameters through maximum likelihood estimation: specifically, updating the parameters k and m in the trend function parameters, and the Fourier coefficient a in the periodic function parameters. n b n And harmonic order, and residual term.

[0064] Optionally, the list of special dates within the second time interval can be marked with holidays and promotional dates that belong to the second time interval.

[0065] S130. For each prediction node in the second time interval, input the time characteristics of the prediction node into the business volume prediction model to obtain the upper limit and lower limit of business volume output by the business volume prediction model for each time point in the current prediction period.

[0066] Optionally, the second time interval can refer to the target period for which business volume risk warnings need to be issued. Within the second time interval, prediction results need to be generated at a fixed frequency to achieve continuous monitoring.

[0067] Optionally, the prediction node can refer to the time point within the second time interval when the prediction calculation is started. The start time of each prediction cycle can be used as the prediction node of that prediction cycle. For example, every 24 hours can be set as a prediction cycle, and the first time point of each prediction cycle can be used as the prediction node of that prediction cycle. Each prediction node triggers the calculation of the upper and lower limits of the business volume at each time point in the current prediction cycle once, ensuring that the prediction results are dynamically updated with business fluctuations. This satisfies the time requirement for early intervention by operations and maintenance, and avoids the decrease in accuracy caused by long-term prediction.

[0068] Optionally, the upper and lower limits of business volume are the maximum and minimum values ​​of business volume that may occur at each time point obtained through the business volume prediction model. The upper and lower limits of business volume can be determined based on the pre-set confidence interval and the process value of the business volume prediction model.

[0069] Optionally, the time feature may include a minute-level timestamp of the prediction node. If the date of the prediction node is a pre-specified special date, the time feature may also include a special date identifier.

[0070] Optionally, at each prediction node in the second time interval, the time characteristics of that node can be input into the trained business volume prediction model. The business volume prediction model can output the upper limit and lower limit of business volume at each minute-level time point within the current prediction period based on the confidence interval algorithm. For example, the prediction result can be: the upper limit of business volume at 10:10 is 12,000 transactions / minute and the lower limit of business volume is 8,000 transactions / minute. This is only an example.

[0071] Specifically, for each prediction node within the second time interval, the temporal characteristics of the prediction node are input into the traffic volume prediction model to obtain the upper and lower limits of traffic volume output by the traffic volume prediction model for each time point within the current prediction period. This may include:

[0072] For each prediction node within the second time interval, the node time and special date label of the prediction node are input into the traffic volume prediction model, so that the traffic volume prediction model can output the upper limit and lower limit of traffic volume at each time point in the current prediction period according to the preset confidence interval.

[0073] Optionally, special date tags can be used to query whether the current forecast period contains special dates. For example, if there are no holidays in the period, the tag will be "no special dates". If there are holidays in the period, the special date tag will describe the nature of the holidays, such as the Spring Festival holiday.

[0074] Optionally, the confidence interval is the range of confidence values ​​predicted by the model, which can be preset, for example, the confidence interval can be set to 95%.

[0075] Optionally, the business volume forecasting model can output the median value that satisfies a normal distribution at each time point based on the trend function, periodic function, holiday effect function, and residual term. Then, based on the confidence interval and the median value, the upper limit and lower limit of business volume at each time point can be obtained.

[0076] S140. Based on the actual business volume, upper limit of business volume, and lower limit of business volume at each time point within the current forecast period, conduct business volume risk detection for each time point, and trigger a risk warning for the target time point when a business volume risk is detected.

[0077] Optionally, the risk warning is a tiered alarm mechanism, which can determine the corresponding notification method based on the actual business volume and risk type, and issue alarms according to the corresponding notification method.

[0078] Optionally, based on the upper and lower limits of the business volume output by the model, the business volume risk range at each time point within the current forecast period can be determined, and the actual business volume at each time point can be collected in real time. If the actual business volume at the target time point falls within the business volume risk range, it is determined that there is a business volume risk at the target time point, and the corresponding warning form is determined and triggered based on the value of the actual business volume.

[0079] The technical solution of this invention obtains multi-dimensional key business indicators based on historical business operation logs within a first time interval and establishes a time-series database for the first time interval. Based on this database, a business volume prediction model is trained to obtain an updated model. At each prediction node within a second time interval, the time characteristics of the prediction node are input into the business volume prediction model. The upper and lower limits of the business volume output by the model for each time point within the current prediction period are obtained. Based on the actual business volume, upper and lower limits of the business volume at each time point within the current prediction period, business volume risk detection is performed at each time point. When a business volume risk is detected at a target time point, a risk warning is triggered for that target time point. This method enables intelligent prediction of future business volume without the need for manual threshold setting. It automatically adapts to business fluctuations, and the multi-factor-based business volume prediction effectively improves prediction accuracy. It supports business volume prediction in complex scenarios such as holidays and major promotions, effectively reducing invalid alarms. Furthermore, predicting the upper and lower limits of business volume in advance can identify potential business volume risks, breaking through the limitations of current post-event alarms.

[0080] Example 2

[0081] Figure 2This is a flowchart of a traffic volume risk warning method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment specifically illustrates the traffic volume risk warning method. Figure 2 As shown, the method includes:

[0082] S210. Based on the historical business operation logs within the first time interval, extract the business identifier and minute-level timestamp of each historical business operation log.

[0083] S220. Based on the business identifier of each historical business operation log, integrate multiple historical business operation logs belonging to the same business to obtain the integrated business log.

[0084] S230. Based on the minute-level timestamps of each business log, store each business log in the time-series database in chronological order, and mark each business log with its business type and special date label.

[0085] S240. Determine the target trend function based on the business type of each business log in the time series database.

[0086] The target trend function is either a logistic growth function or a linear trend function.

[0087] S250. Based on the business logs in the time series database and the target trend function, train the business volume prediction model to update the target trend function, periodic function and residual term in the business volume prediction model.

[0088] Specifically, based on the business logs in the time-series database and the target trend function, a business volume prediction model is trained to update the target trend function, periodic function, and residual terms in the business volume prediction model. This may include:

[0089] When the target trend function is a logistic growth function, the business volume per minute in the first time interval is counted according to the time series database, and the maximum capacity of each time point in a single time interval is determined based on the business volume per minute in the first time interval.

[0090] Configure the initial business volume prediction model based on the maximum capacity and cycle length of each time point within a single time interval, as well as the holiday effect function within the first time interval.

[0091] Based on the business logs in the time series database, the initial business volume prediction model is fitted to update the target trend function, periodic function, and residual term in the business volume prediction model.

[0092] S260. Based on the list of special dates in the second time interval and the intensity parameters corresponding to each special date in the second time interval, determine the holiday effect function of the business volume forecasting model in the second time interval.

[0093] S270. For each prediction node in the second time interval, input the node time and special date label of the prediction node into the business volume prediction model so that the business volume prediction model can output the upper limit and lower limit of business volume at each time point in the current prediction period according to the preset confidence interval.

[0094] S280. Based on the actual business volume, upper limit of business volume, and lower limit of business volume at each time point within the current forecast period, conduct business volume risk detection for each time point, and trigger a risk warning for the target time point when a business volume risk is detected.

[0095] Specifically, based on the actual business volume, upper limit, and lower limit of business volume at each time point within the current forecast period, business volume risk detection is performed at each time point. When a business volume risk is detected at a target time point, a risk warning is triggered for that target time point, which may include:

[0096] Based on the upper limit of business volume at the target time point, determine the risky business volume, and based on the risky business volume and the lower limit of business volume, determine the business volume risk range at the target time point.

[0097] When the actual traffic volume at the target time point is detected to fall within the traffic volume risk range, it is determined that there is traffic volume risk at the target time point, and one of the following actions is taken:

[0098] If the actual business volume at the target time point exceeds the business volume limit, a Level 1 warning will be triggered for the target time point.

[0099] If the actual business volume at the target time point is less than the lower limit of the business volume, a level 2 warning will be triggered for the target time point.

[0100] If the actual business volume at the target time point is between the risky business volume and the upper limit of the business volume, a level three warning will be triggered for the target time point.

[0101] Optionally, the risky business volume can refer to the threshold value that triggers the warning. The result of multiplying the upper limit of business volume by 0.9 can be used as the risky business volume, thereby setting a warning buffer. When the actual business volume is close to the upper limit but has not exceeded it, the operation and maintenance personnel will be reminded in advance to avoid missed reports due to sudden growth.

[0102] Optionally, if the actual business volume at the target time point is less than the lower limit of the business volume at the target time point or greater than the risky business volume at the target time point, then it is determined that the actual business volume at the target time point belongs to the business volume risk range.

[0103] Optionally, if the actual business volume exceeds the business volume limit, a Level 1 warning will be triggered. Level 1 warnings are high-risk warnings, and the warning methods corresponding to Level 1 warnings are pop-up windows and SMS notifications. A response time limit can also be set at the same time. For example, a response time limit of 10 minutes can be set to avoid situations where the business volume far exceeds expectations and may lead to system overload.

[0104] Optionally, if the actual business volume at the target time point is less than the lower limit of business volume, a level 2 warning will be triggered. The level 2 warning is a warning for low-end situations, and the warning method corresponding to the level 2 warning is an abnormal degradation check, thereby avoiding business interruption or service downgrade.

[0105] Optionally, if the actual business volume at the target time point is between the risky business volume and the business volume limit, a Level 3 warning will be triggered. The Level 3 warning is a transitional warning, and the warning method corresponding to the Level 3 warning is email notification. A response time limit can also be set. The response time limit of the Level 3 warning can be higher than that of the Level 1 warning. For example, the response time limit of the Level 3 warning can be set to 30 minutes, so as to provide an early warning when the business volume is close to the limit.

[0106] The technical solution of this invention obtains multi-dimensional key business indicators based on historical business operation logs within a first time interval and establishes a time-series database for the first time interval. Based on this database, a business volume prediction model is trained to obtain an updated model. At each prediction node within a second time interval, the time characteristics of the prediction node are input into the business volume prediction model. The upper and lower limits of the business volume output by the model for each time point within the current prediction period are obtained. Based on the actual business volume, upper and lower limits of the business volume at each time point within the current prediction period, business volume risk detection is performed at each time point. When a business volume risk is detected at a target time point, a risk warning is triggered for that target time point. This method enables intelligent prediction of future business volume without the need for manual threshold setting. It automatically adapts to business fluctuations, and the multi-factor-based business volume prediction effectively improves prediction accuracy. It supports business volume prediction in complex scenarios such as holidays and major promotions, effectively reducing invalid alarms. Furthermore, predicting the upper and lower limits of business volume in advance can identify potential business volume risks, breaking through the limitations of current post-event alarms.

[0107] Example 3

[0108] Figure 3 This is a schematic diagram of a business volume risk early warning device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a time series database establishment module 310, a traffic volume prediction model update module 320, a traffic volume prediction module 330, and a traffic volume risk warning module 340.

[0109] The time-series database establishment module 310 is used to obtain multi-dimensional key business indicators based on historical business operation logs within the first time interval, and to establish a time-series database for the first time interval.

[0110] The business volume prediction model update module 320 is used to train the business volume prediction model based on the time series database to obtain the updated business volume prediction model.

[0111] The traffic volume prediction module 330 is used to input the time characteristics of the prediction node into the traffic volume prediction model for each prediction node in the second time interval, and obtain the upper limit and lower limit of traffic volume output by the traffic volume prediction model for each time point in the current prediction period.

[0112] The business volume risk warning module 340 is used to detect business volume risks at each time point based on the actual business volume, upper limit of business volume, and lower limit of business volume at each time point within the current forecast period, and to trigger a risk warning for the target time point when a business volume risk is detected.

[0113] The technical solution of this invention obtains multi-dimensional key business indicators based on historical business operation logs within a first time interval and establishes a time-series database for the first time interval. Based on this database, a business volume prediction model is trained to obtain an updated model. At each prediction node within a second time interval, the time characteristics of the prediction node are input into the business volume prediction model. The upper and lower limits of the business volume output by the model for each time point within the current prediction period are obtained. Based on the actual business volume, upper and lower limits of the business volume at each time point within the current prediction period, business volume risk detection is performed at each time point. When a business volume risk is detected at a target time point, a risk warning is triggered for that target time point. This method enables intelligent prediction of future business volume without the need for manual threshold setting. It automatically adapts to business fluctuations, and the multi-factor-based business volume prediction effectively improves prediction accuracy. It supports business volume prediction in complex scenarios such as holidays and major promotions, effectively reducing invalid alarms. Furthermore, predicting the upper and lower limits of business volume in advance can identify potential business volume risks, breaking through the limitations of current post-event alarms.

[0114] Based on the above embodiments, the time-series database establishment module 310 can be specifically used for:

[0115] Based on the historical business operation logs within the first time interval, extract the business identifier and minute-level timestamp of each historical business operation log;

[0116] Based on the business identifier of each historical business operation log, multiple historical business operation logs belonging to the same business are integrated to obtain the integrated business log;

[0117] Based on the minute-level timestamps of each business log, the business logs are stored in the time-series database in chronological order, and each business log is marked with a business type and a special date label.

[0118] Based on the above embodiments, the business volume prediction model is an additive model, which includes a trend function, a periodic function, a holiday effect function, and a residual term.

[0119] Based on the above embodiments, the traffic volume prediction model update module 320 may include:

[0120] The trend function selection unit is used to determine the target trend function based on the business type of each business log in the time series database; wherein the target trend function is either a logical growth function or a linear trend function.

[0121] The function update unit is used to train the business volume prediction model based on the business logs in the time series database and the target trend function, so as to update the target trend function, periodic function and residual term in the business volume prediction model.

[0122] The holiday effect function acquisition unit is used to determine the holiday effect function of the business volume prediction model in the second time interval based on the list of special dates in the second time interval and the intensity parameters corresponding to each special date in the second time interval.

[0123] Based on the above embodiments, the function update unit can be specifically used for:

[0124] When the target trend function is a logistic growth function, the business volume per minute in the first time interval is counted according to the time series database, and the maximum capacity of each time point in a single time interval is determined based on the business volume per minute in the first time interval.

[0125] Configure the initial business volume prediction model based on the maximum capacity and cycle length of each time point within a single time interval, as well as the holiday effect function within the first time interval.

[0126] Based on the business logs in the time series database, the initial business volume prediction model is fitted to update the target trend function, periodic function, and residual term in the business volume prediction model.

[0127] Based on the above embodiments, the traffic prediction module 330 can be specifically used for:

[0128] For each prediction node within the second time interval, the node time and special date label of the prediction node are input into the traffic volume prediction model, so that the traffic volume prediction model can output the upper limit and lower limit of traffic volume at each time point in the current prediction period according to the preset confidence interval.

[0129] Based on the above embodiments, the business volume risk warning module 340 can be specifically used for:

[0130] Based on the upper limit of business volume at the target time point, determine the risky business volume, and based on the risky business volume and the lower limit of business volume, determine the business volume risk range at the target time point.

[0131] When the actual traffic volume at the target time point is detected to fall within the traffic volume risk range, it is determined that there is traffic volume risk at the target time point, and one of the following actions is taken:

[0132] If the actual business volume at the target time point exceeds the business volume limit, a Level 1 warning will be triggered for the target time point.

[0133] If the actual business volume at the target time point is less than the lower limit of the business volume, a level 2 warning will be triggered for the target time point.

[0134] If the actual business volume at the target time point is between the risky business volume and the upper limit of the business volume, a level three warning will be triggered for the target time point.

[0135] The traffic risk warning device provided in this embodiment of the invention can execute the traffic risk warning method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0136] Example 4

[0137] Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0138] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0139] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0140] Processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the traffic risk warning method described in the embodiments of the present invention. That is:

[0141] Based on the historical business operation logs within the first time interval, obtain multi-dimensional key business indicators and establish a time-series database for the first time interval;

[0142] Based on the time series database, the traffic volume prediction model is trained to obtain an updated traffic volume prediction model;

[0143] For each prediction node in the second time interval, the time characteristics of the prediction node are input into the traffic volume prediction model to obtain the upper limit and lower limit of traffic volume output by the traffic volume prediction model for each time point in the current prediction period.

[0144] Based on the actual business volume, upper limit of business volume, and lower limit of business volume at each time point within the current forecast period, business volume risk detection is performed at each time point, and when a business volume risk is detected at the target time point, a risk warning is triggered for the target time point.

[0145] In some embodiments, the traffic risk warning method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the traffic risk warning method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the traffic risk warning method by any other suitable means (e.g., by means of firmware).

[0146] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0147] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0148] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0149] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0150] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0151] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0152] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0153] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A traffic risk early warning method, characterized in that, The method comprises the following steps: According to the historical business operation log in the first time interval, obtain multi-dimensional business key indicators, and establish a time series database of the first time interval; According to the time series database, train the business volume prediction model to obtain an updated business volume prediction model; In each prediction node in the second time interval, input the time characteristics of the prediction node into the business volume prediction model to obtain the upper limit and lower limit of the business volume output by the business volume prediction model for each time point in the current prediction period; According to the actual business volume, the upper limit and the lower limit of the business volume of each time point in the current prediction period, respectively detect the business volume risk of each time point, and when the target time point is detected to have a business volume risk, trigger the risk warning for the target time point.

2. The method of claim 1, wherein, According to the historical business operation log in the first time interval, obtain multi-dimensional business key indicators, and establish a time series database of the first time interval, comprising: According to the historical business operation log in the first time interval, extract the business identifier and the minute-level timestamp of each historical business operation log; According to the business identifier of each historical business operation log, integrate multiple historical business operation logs belonging to the same business to obtain integrated business logs; According to the minute-level timestamp of each business log, store each business log in time sequence in the time series database, and mark the business type and special date label of each business log.

3. The method of claim 1, wherein, The business volume prediction model is an additive model, including a trend function, a periodic function, a holiday effect function and a residual term.

4. The method of claim 3, wherein, According to the time series database, train the business volume prediction model to obtain an updated business volume prediction model, comprising: According to the business type of each business log in the time series database, determine a target trend function; wherein the target trend function is a logistic growth function or a linear trend function; According to each business log in the time series database and the target trend function, train the business volume prediction model to update the target trend function, the periodic function and the residual term in the business volume prediction model; According to the special date list in the second time interval and the intensity parameters corresponding to each special date in the second time interval, determine the holiday effect function of the business volume prediction model in the second time interval.

5. The method of claim 4, wherein, According to each business log in the time series database and the target trend function, train the business volume prediction model to update the target trend function, the periodic function and the residual term in the business volume prediction model, comprising: When the target trend function is a logistic growth function, according to the time series database, statistics the business volume of each minute in the first time interval, and according to the business volume of each minute in the first time interval, determine the maximum capacity of each time point in a single time interval; According to the maximum capacity of each time point in a single time interval, the periodic length and the holiday effect function in the first time interval, configure an initial business volume prediction model; According to each business log of the time series database, fit the initial business volume prediction model to update the target trend function, the periodic function and the residual term in the business volume prediction model.

6. The method of claim 1, wherein, At each prediction node in the second time interval, input the time feature of the prediction node into the traffic volume prediction model, obtain the upper limit and the lower limit of the traffic volume respectively output by the traffic volume prediction model for each time point in the current prediction period, including: At each prediction node in the second time interval, input the node time and the special date label of the prediction node into the traffic volume prediction model, so that the traffic volume prediction model respectively outputs the upper limit and the lower limit of the traffic volume for each time point in the current prediction period according to the preset confidence interval.

7. The method of claim 1, wherein, According to the actual traffic volume, the upper limit and the lower limit of the traffic volume of each time point in the current prediction period, respectively detect the traffic volume risk of each time point, and when it is detected that the target time point has traffic volume risk, trigger the risk warning for the target time point, including: According to the upper limit of the traffic volume of the target time point, determine the risk traffic volume, and according to the risk traffic volume and the lower limit of the traffic volume, determine the traffic volume risk interval of the target time point; When it is detected that the actual traffic volume of the target time point belongs to the traffic volume risk interval, it is determined that the target time point has traffic volume risk, and any one of the following is executed: If the actual traffic volume of the target time point is greater than the upper limit of the traffic volume, trigger the first-level warning for the target time point; If the actual traffic volume of the target time point is less than the lower limit of the traffic volume, trigger the second-level warning for the target time point; If the actual traffic volume of the target time point is between the risk traffic volume and the upper limit of the traffic volume, trigger the third-level warning for the target time point.

8. A traffic risk early warning device, characterized by, Including: The time series database establishing module is configured to obtain multi-dimensional business key indicators according to historical business operation logs in the first time interval, and establish a time series database of the first time interval; The traffic volume prediction model updating module is configured to train the traffic volume prediction model according to the time series database to obtain an updated traffic volume prediction model; The traffic volume prediction module is configured to, at each prediction node in the second time interval, input the time feature of the prediction node into the traffic volume prediction model, and obtain the upper limit and the lower limit of the traffic volume respectively output by the traffic volume prediction model for each time point in the current prediction period; The traffic volume risk warning module is configured to, according to the actual traffic volume, the upper limit and the lower limit of the traffic volume of each time point in the current prediction period, respectively detect the traffic volume risk of each time point, and when it is detected that the target time point has traffic volume risk, trigger the risk warning for the target time point.

9. An electronic device, comprising: The electronic device includes: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the traffic volume risk warning method of any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing the processor to execute when the traffic volume risk warning method of any one of claims 1-7 is implemented.

Images