Operating system fault detection method based on time sequence prediction and root cause analysis

Abstract

The invention relates to the technical field of operating system fault analysis, and provides an operating system fault detection method based on time sequence prediction and root cause analysis, which comprises the following steps: constructing a KPI tree based on system data and log data; traversing the KPI tree, executing the associated data acquisition command for each node, and updating an abnormal state identifier based on a real-time system performance index; in response to the abnormal state identifier, mapping the abnormal indexes in the KPI tree to a topological graph through a KPI-topological mapping dictionary, the topological graph representing an association relationship between physical components of the system; positioning an abnormal component in the topological graph based on mapping and outputting an abnormal dependency chain, using a BCC tool to hook a kernel function related to an abnormal index, collecting kernel call stack information, and performing root cause analysis based on the collected kernel call stack information; and a time sequence prediction model is used to predict system indexes, an early warning mechanism is triggered based on a prediction result, and the time sequence prediction model fuses dynamic characteristics based on a multi-scale recurrent neural network.

Description

Technical Field

[0001] This invention relates to the field of operating system fault analysis technology, and in particular to an operating system fault detection method based on timing prediction and root cause analysis. Background Technology

[0002] With the rapid development of information technology, the stability and reliability of the operating system, as the core infrastructure of a computer system, are of paramount importance. Existing operating system fault detection methods mainly adopt a flat system monitoring architecture, which independently collects various performance indicators such as CPU, memory, and disk I / O at the system level and makes anomaly judgments based on preset thresholds or simple statistical models. Meanwhile, some solutions introduce time series forecasting techniques to predict trends for single indicators, and fault location through log correlation analysis or call chain tracing.

[0003] However, the above-mentioned technical solutions have revealed the following problems in practical applications: First, traditional monitoring systems lack a hierarchical indicator correlation mechanism, and business-level KPIs are isolated from underlying system indicators. When business anomalies occur, it is difficult to quickly penetrate and locate specific physical components, resulting in low efficiency in fault delimitation. Second, existing root cause analysis methods mostly remain at the level of indicator correlation analysis or application-level call chain tracing, lacking the ability to deeply observe the execution state of operating system kernel functions. They cannot effectively capture faults caused by deep-seated reasons such as kernel-mode resource contention and driver anomalies, resulting in insufficient analysis depth. Third, existing time-series prediction models can use single-scale modeling, making it difficult to simultaneously capture the long-term trends and short-term fluctuation characteristics of system indicators. Moreover, prediction and detection are independent of each other, failing to form an effective linkage early warning mechanism. Finally, for the ecosystem of domestic operating systems (such as Kylin OS), existing tools have limited support in terms of compatibility and observability, making it difficult to meet the high requirements for fault detection accuracy and location accuracy in key industry applications. Summary of the Invention

[0004] To address the aforementioned shortcomings, the present invention aims to propose an operating system fault detection method based on time-series prediction and root cause analysis. This method achieves rapid anomaly delimitation through hierarchical KPI tree and system topology mapping, deep root cause analysis through kernel function hooking and call stack tracing based on BCC tools, and coordinated early warning of prediction and detection by integrating multi-scale time-series prediction models. This improves the accuracy of fault location, the depth of root cause analysis, and the timeliness of early warning.

[0005] To achieve this objective, the present invention adopts the following technical solution: The operating system fault detection method based on timing prediction and root cause analysis includes the following steps: S1: Collect system data and log data; S2: Construct a KPI tree based on the collected system data and log data. The KPI tree has the business layer as the root node and includes several levels. Each level includes several nodes, and each node is associated with data collection commands and abnormal status indicators. S3: Traverse the KPI tree, and for each node, execute the associated data acquisition command to obtain real-time system performance indicators, and update the abnormal status identifier based on the real-time system performance indicators; S4: In response to the detection of an abnormal state identifier in the KPI tree, the abnormal indicators in the KPI tree are mapped to a topology graph through a predefined KPI-topology mapping dictionary, wherein the topology graph represents the relationship between physical components of the system; S5: Based on the mapping in the topology graph, locate the abnormal components and output the abnormal dependency chain. Use the BCC tool to hook the kernel functions related to the abnormal indicators, collect kernel call stack information, and perform root cause analysis based on the collected kernel call stack information. S6: Use a time-series prediction model to predict system indicators. The time-series prediction model is based on a multi-scale recurrent neural network that fuses dynamic features. Based on the prediction results of the time-series prediction model, trigger an early warning mechanism.

[0006] Preferably, in step S2, constructing the KPI tree includes: Set the business layer as the root node of the KPI tree; Child nodes are added under the root node based on a predefined hierarchical order, which includes a business processing delay layer, a business application layer, a database layer, and a system layer. Each node is assigned a name, data acquisition command, threshold judgment function, and abnormal status identifier. The hierarchical structure of the KPI tree is constructed by associating child nodes with parent nodes.

[0007] Preferably, steps S4 and S5 include: The abnormal indicators in the KPI tree are mapped to the corresponding components of the topology graph using a predefined KPI-topology mapping dictionary; The topology diagram is constructed recursively with the business application layer as the root node, forming a hierarchical structure based on the relationships between the physical components of the system. The path prefix matching algorithm is used to calculate the lowest common ancestor of abnormal paths; Output the complete topological component anomaly dependency chain based on the nearest common ancestor.

[0008] Preferably, collecting kernel call stack information includes: The kernel functions related to the anomaly indicators are dynamically hooked using the kprobe probe; Probes are inserted at the entry and exit points of the hooked kernel function to record timestamps and calculate function call time. When a preset exception condition is met, a call stack acquisition mechanism is triggered to capture the address sequence of the kernel call stack. The address sequence is then symbolically parsed to generate a call stack ID. At the same time, the process ID, timestamp, and call stack context information are recorded. The collected event data is transmitted to user space through the event output mechanism. The user space program then aggregates and analyzes the multiple event call chains and outputs the complete kernel call stack.

[0009] Preferably, in step S6, predicting system indicators using a time-series prediction model includes: A dual-path feature extraction structure is constructed, which includes a first path for capturing short-term fluctuations of system indicators and a second path for capturing long-term evolution patterns of system indicators. The short-term fluctuation features extracted by the first path and the long-term evolution features extracted by the second path are adaptively fused to generate fused features; The prediction results of the system indicators are generated based on the fusion features.

[0010] Preferably, the time series prediction model includes: Feature enhancement is performed on the input system indicator time series data, including extracting time patterns through periodic encoding: ,in Indicates the current time step. Indicates the period length; The enhanced features are input into a bidirectional GRU network for temporal processing, through a reset gate. Filter historical information and update the gate By controlling the information fusion ratio, the final hidden state can be obtained. And through bidirectional fusion, the hidden state including forward and backward information is obtained. ; The GRU output is optimized by supplementing detailed information through residual connections: The final prediction result is obtained through post-processing smoothing. The post-processed smoothed prediction value satisfies the following relationship: ; Model training is performed using the Huber loss function, which satisfies the following relationship: ; in, and These represent the sine and cosine components of the periodic encoding, respectively. Indicates the current time step. Indicates the period length. This indicates a reset of the gate output. This represents the sigmoid activation function. and This represents the weight matrix of the reset gate. Represents the current feature vector. This indicates the hidden state of the previous time step. This indicates an update to the gate output. and This represents the weight matrix of the updated gate. This indicates element-wise multiplication. Indicates the candidate hidden state. and These represent the forward and backward hidden states, respectively. This represents vector concatenation. This indicates the output after residual connection; FC indicates a fully connected layer. This represents the last hidden state of the GRU. This represents the last feature of the input sequence. This represents the predicted value after post-processing smoothing. This represents the predicted value weight, and W represents the historical window size. Indicates historical CPU utilization. y represents the Huber loss value, and y represents the true value. Indicates the predicted value. This indicates the error threshold.

[0011] Preferably, step S6 includes post-processing optimization of the prediction results, including: The original forecast results are adjusted for volatility by dynamically scaling the forecast value based on the ratio of real-time volatility to historical benchmark volatility. Among them, the output weight is adaptively adjusted based on the system fluctuation state, the output weight is increased during the period of violent fluctuation, and the output weight is decreased during the period of stability; Peak detection and correction are performed on the prediction results; corrections are made when the predicted value exceeds a dynamic threshold. like Then the predicted value will be corrected to ; Establish a prediction feedback mechanism and output feedback information including volatility labels and peak labels. Volatility labels and peak labels are used to adjust the subsequent prediction weights and trigger health status assessment and early warning mechanisms. in, Indicates time Volatility adjustment factor at that point This represents the volatility of the current time window. Represents historical benchmark volatility. Indicates time step The original predicted value at that location, This represents the mean of historical data. The standard deviation of historical data is represented by the volatility label, the volatility level of the current time window is represented by the peak label, and the presence of abnormal peaks is indicated by the peak label.

[0012] Preferably, a feature engineering process is included before step S6, the feature engineering process including: Constructing a multi-dimensional feature system: Extracting periodic features of time series through periodic encoding, calculating statistical features using a sliding window, selecting lag features, and identifying fluctuation patterns by combining difference operations; The volatility coefficient is constructed based on statistics within a predefined time window; The output weights of the prediction model are adaptively adjusted based on the volatility coefficient, with the output weights being increased during periods of severe volatility and decreased during periods of stability.

[0013] Preferably, the triggering of the early warning mechanism includes: The ability to detect abnormal spikes is enhanced by using a spike-sensing branch, and abnormal spikes are identified based on statistics within a predefined time window. A composite loss function is used for model training, which includes basic prediction accuracy loss and volatility matching loss. A health assessment score is constructed based on prediction bias rate and volatility stability; By setting multiple warning thresholds and combining predicted values, confidence intervals, and health assessment scores, dynamic warning triggering can be achieved.

[0014] One of the above technical solutions has the following advantages or beneficial effects: This invention collects system and log data to construct a KPI tree with the business layer as the root node, incorporating business performance and lower-level resource indicators into a unified hierarchical framework, thereby opening up a vertical analysis channel from business to resources. Then, by traversing the KPI tree to perform data collection and update anomaly status markers, anomalies can propagate downwards along the tree structure, enabling drill-down localization of business anomalies at the system resource level. When an anomaly marker is detected, a predefined KPI-topology mapping dictionary is used to map the anomaly indicator to the physical component topology, transforming abstract performance anomalies into concrete hardware relationships, achieving precise delimitation from the logical layer to the physical layer. By using the BCC tool to hook kernel functions related to the anomaly indicator and collect call stack information, the observation depth is extended from user space to kernel space, forming a three-in-one root cause analysis capability covering user space monitoring, resource analysis, and kernel tracing. Finally, a time-series prediction model based on multi-scale recurrent neural networks fusing dynamic features is used to predict system indicators, and the prediction results are linked with a real-time detection mechanism to trigger proactive warnings, shifting the system from passive response to proactive defense. In summary, this invention, through hierarchical modeling, deep hooking, and predictive detection fusion, can significantly improve the accuracy of fault location, the penetration of root cause analysis, and the foresight of operation and maintenance response. It is particularly suitable for end-to-end tracking and intelligent operation and maintenance scenarios of complex faults in domestic environments such as the Kylin operating system. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0016] Figure 1 This is a flowchart of the operating system fault detection method based on timing prediction and root cause analysis provided in the embodiments of the present invention; Figure 2 This is a flowchart of the training process of the KylinPulse prediction model provided in an embodiment of the present invention; Figure 3 This is a flowchart of kernel call stack acquisition based on BCC tools provided in an embodiment of the present invention; Figure 4 This is a root cause analysis framework diagram based on the KPI-topology-Trace call stack provided in the embodiments of the present invention. Detailed Implementation

[0017] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0018] In this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0019] Operating system fault detection methods based on timing prediction and root cause analysis, such as Figure 1-4 As shown, a preferred embodiment of the present invention includes the following steps: S1: Collect system data and log data; It should be noted that system data refers to various quantitative performance indicators generated by the operating system during operation, including but not limited to CPU utilization, memory usage, disk I / O rate, network throughput, process context switch count, and system call frequency. This data is obtained through counters exposed by the system kernel, the Performance Monitoring Unit (PMU), or virtual file system interfaces such as / proc and / sys. It can be actively retrieved by collection tools (such as Telegraf) at fixed time intervals (e.g., every 10 seconds) and converted into structured time-series data. In this step, system data serves as the quantitative basis for fault detection, providing measurable performance baseline data for each node in the KPI tree. Log data refers to text records generated by the operating system kernel, system services, and applications during operation, including system logs (such as syslog), kernel logs (such as dmesg), application logs, error logs, and security audit logs. These logs are stored through the file system or output in real time via network sockets, and are monitored, parsed, and structured in real time by log collection tools (such as Logstash). In this step, log data and system data complement each other. The former provides qualitative event context, while the latter provides quantitative performance metrics. Together, they construct a complete system observability dataset, laying the data foundation for subsequent multi-level root cause analysis and avoiding the information loss problem caused by isolated data sources in traditional monitoring.

[0020] S2: Construct a KPI tree based on the collected system data and log data. The KPI tree has the business layer as the root node and includes several levels. Each level includes several nodes, and each node is associated with data collection commands and abnormal status indicators. It's important to note that a KPI tree is a hierarchical model for organizing key performance indicators. Its data structure is tree-like, including a root node, parent nodes, child nodes, and leaf nodes. Each node represents a measurable performance or business indicator. In this step, the KPI tree serves as a hierarchical analysis framework for fault detection. Its tree structure establishes a top-down decomposition relationship between high-level business indicators (such as business processing latency) and low-level system resource indicators (such as CPU utilization). The business layer refers to the root node level of the KPI tree, representing top-level indicators directly related to business service quality, such as transaction processing latency, request response time, and business throughput. These indicators directly reflect the service quality perceived by users. In this step, the business layer, as the root node, establishes the starting point for analysis, enabling fault detection to begin with business impact and ensuring that root cause localization ultimately serves business recovery. Data acquisition commands refer to executable instructions or API calls bound to KPI tree nodes, used to obtain the specific values ​​of the corresponding indicators for that node in real time. Used to collect CPU utilization, or "ss -s" to collect network connection count. In this step, the data collection command is used as a node attribute and is invoked during traversal execution to automate the acquisition of metric data. Anomaly status identifiers refer to boolean or enumerated state variables (such as is_anomaly:true / false) maintained internally by the node, used to record whether the most recently collected metric for that node exceeds a preset threshold. In this step, the anomaly status identifier serves as a carrier for anomaly propagation; the parent node can quickly determine the anomaly propagation path based on the child node identifier, achieving top-down anomaly drill-down.

[0021] Understandably, traditional monitoring systems treat each indicator independently. When business latency increases, operations and maintenance personnel need to manually investigate multiple levels, including network, database, and system resources, which is inefficient and relies heavily on experience. This invention uses a tree structure to hierarchically model indicators, directly linking the root node of the business layer to child nodes such as the application layer, database layer, and system layer. Each node is bound to specific collection commands and threshold judgment logic, thus pre-defining the dependencies between indicators structurally. Specifically, when a business layer node detects an abnormal latency, it can automatically trigger a traversal and collection of its child nodes. The abnormal state propagates from top to bottom along the tree structure, quickly locating specific resource indicators (such as a sudden increase in disk I / O latency). This avoids the tedious process of manual cross-system comparison in traditional solutions, significantly improving the efficiency and accuracy of anomaly identification and enabling automatic correlation analysis between business impact and resource consumption.

[0022] S3: Traverse the KPI tree, and for each node, execute the associated data acquisition command to obtain real-time system performance indicators, and update the abnormal status identifier based on the real-time system performance indicators; It should be noted that traversal refers to the process of visiting all nodes in the KPI tree in a specific order. Step S3 is implemented using the Depth-First Search (DFS) algorithm, starting from the root node, visiting the current node first, and then recursively visiting each of its child nodes until all leaf nodes have been visited. Traversal serves as the execution mechanism for anomaly detection, ensuring that the metrics of each node are periodically collected and evaluated. Real-time system performance metrics refer to the quantified values ​​obtained at the current moment by executing the data acquisition commands bound to the node during the traversal process, such as the current CPU utilization rate of 78.5%, memory usage of 16GB, and average disk I / O latency of 23ms. Real-time system performance metrics serve as input for anomaly judgment, reflecting the actual operating status of the system at the sampling time. The threshold judgment function refers to the predefined judgment logic in the node, which can be a lambda function or a user-defined function. It receives real-time metric values ​​as input and returns a boolean value indicating whether an anomaly exists (e.g., lambda x: x>80 means that the metric is judged as an anomaly when it exceeds 80). The threshold judgment function serves as the decision basis for anomaly state updates, realizing the automated judgment of metric anomalies. Anomaly status update refers to the process of modifying the value of the `is_anomaly` field maintained internally by the node based on the output of the threshold judgment function. If the indicator exceeds the threshold, it is set to `True`; otherwise, it is set to `False`. As an anomaly information persistence mechanism, status status update enables parent nodes to quickly identify anomaly propagation paths based on child node identifiers, supporting top-down anomaly drill-down analysis.

[0023] Understandably, traditional monitoring solutions allow for independent configuration of monitoring rules for each metric, lacking hierarchical linkage. When business anomalies occur, operations personnel must manually query multiple independent monitoring systems, which is time-consuming and prone to missing critical information. This invention employs the Depth-First Search (DFS) algorithm to automatically traverse the KPI tree. Starting from the business root node, it sequentially triggers data collection commands at each level, sending real-time metrics to a threshold function for evaluation and immediately updating the node's anomaly status flag. Specifically, when the business latency root node detects an anomaly, all its child nodes (such as database query time, disk I / O latency, etc.) are immediately triggered for collection. The anomaly status is marked level by level along the tree structure from top to bottom, forming a clear anomaly propagation path. This automated traversal mechanism avoids the delay of manual layer-by-layer investigation, enabling anomalies to be located to specific resource metrics within seconds, realizing a shift from passive response to proactive detection and significantly shortening fault delimitation time.

[0024] S4: In response to the detection of an abnormal state identifier in the KPI tree, the abnormal indicators in the KPI tree are mapped to a topology graph through a predefined KPI-topology mapping dictionary, wherein the topology graph represents the relationship between physical components of the system; It should be noted that "response" refers to a conditional triggering mechanism that automatically activates the execution flow of this step if and only if the is_anomaly flag of any node is found to be True during the KPI tree traversal. This triggering mechanism ensures that topology mapping is initiated only when an anomaly occurs, avoiding unnecessary computation and resource waste. The KPI-topology mapping dictionary refers to a static configuration structure, which can be a hash table or a set of key-value pairs. The key is the metric name in the KPI tree (e.g., "disk I / O latency"), and the value is the corresponding physical component identifier in the topology graph (e.g., "sda disk of storage node A"). This dictionary serves as a bridge between logical metrics and physical components, realizing the mapping from abstract performance anomalies to specific hardware entities. The topology graph refers to a graph structure describing the connection relationships between physical components of the system, composed of nodes and edges. Nodes represent physical entities such as servers, network devices, and disk arrays, while edges represent network connections, data dependencies, or physical dependencies between components. The topology graph serves as a spatial reference model for anomaly localization, examining KPI anomalies from a physical deployment perspective and supporting subsequent spatialized root cause tracing. The relationships between physical components refer to the actual deployment topology between components, such as a web server connected to a storage array via Fibre Channel, or an application server and a database server communicating via a switch. In this step, these relationships define the propagation path and scope of anomalies, enabling cascading failures across components to be fully traced.

[0025] Understandably, the core purpose of this step is to convert logical layer anomalies detected in the KPI tree into physical layer location information. Traditional monitoring tools can only provide flat metric alerts. After receiving an alert such as "high disk I / O latency," operations personnel still need to manually query the CMDB or topology diagram to confirm the server and associated application to which the disk belongs, a cumbersome and error-prone process. Through a predefined KPI-topology mapping dictionary, after an anomaly is marked in the KPI tree, the corresponding physical component is automatically queried immediately, and the anomaly information is injected into the topology diagram, achieving automatic association between logical anomalies and physical entities. When the "database layer slow query count" node in the KPI tree is marked as an anomaly, the mapping dictionary automatically points it to the "MySQL process of database server B" topology node, switching anomaly analysis from the logical metric space to the physical deployment space. This provides a spatial coordinate system for subsequent root cause tracing based on topology relationships, solving the pain point of the disconnect between logical monitoring and physical topology in traditional solutions, and significantly improving the intuitiveness and efficiency of anomaly location.

[0026] S5: Based on the mapping in the topology graph, locate the abnormal components and output the abnormal dependency chain. Use the BCC tool to hook the kernel functions related to the abnormal indicators, collect kernel call stack information, and perform root cause analysis based on the collected kernel call stack information. It's important to note that an anomaly dependency chain refers to the sequence of nodes tracing upstream along the edges of the topology graph from the anomaly component back to the root cause component. This chain reflects the propagation path of the anomaly between physical components. As a spatial path guide for root cause analysis, the dependency chain helps operations personnel understand the transmission process of anomaly impacts. BCC tools refer to... This is a dynamic tracing toolset based on eBPF (Extended Berkeley Package Filter) technology, providing Python / Lua bindings. It can safely inject probes into kernel functions without modifying the kernel source code or restarting the system. In this step, the BCC tool serves as the carrier for kernel-mode observation, achieving deep penetration from user-mode monitoring to kernel-mode execution. Kernel function hooking refers to inserting eBPF programs at the entry or exit point of the target kernel function through the kprobe (kernel dynamic probe) mechanism to intercept function calls and capture context information. In this step, the hooking operation targets kernel functions directly related to the anomaly indicators (such as disk I / O latency corresponding to the submit_bio function of block_device), ensuring that only kernel behaviors related to the current anomaly are collected. Kernel call stack information refers to the kernel function call sequence, including the complete path from the system call entry point to the current function execution, represented in the form of function address or symbol name. Call stack information serves as direct evidence for root cause analysis, revealing the precise execution path of kernel resource contention. Root cause analysis refers to the reasoning process that integrates topological dependency chains and kernel call stacks to identify the ultimate technical cause (such as driver defects, lock contention, configuration errors, etc.) leading to business anomalies. As the final output of fault diagnosis, root cause analysis provides precise guidance for remedial actions.

[0027] It is understandable that, such as Figure 3As shown, step S5 aims to overcome the limitations of traditional monitoring, which stops at the user space, and extend the observation depth to the kernel execution layer, forming a complete chain of evidence. Traditional APM tools can only trace application-layer call chains and are powerless against faults caused by deep-seated problems such as kernel-mode resource contention, driver exceptions, and file system locks, often resulting in root cause localization remaining superficial. This step, after locating the abnormal physical component through topology mapping, immediately starts the BCC tool to dynamically hook the associated kernel functions. When the abnormal indicators are triggered again, the eBPF probe automatically captures the complete kernel call stack of the current process. Specifically, if the topology map identifies an anomaly in "Storage Node A", the BCC tool hooks the submit_bio function in the block layer. When I / O latency exceeds the limit, it captures the call stack, which may reveal kernel-mode issues such as lock waits in the ext4 file system or congestion in the SCSI drive queue. This three-stage analysis of "user-mode monitoring → physical component location → kernel forensics" penetrates the observation depth from the application layer to the kernel function level, making root cause analysis no longer dependent on guesswork, but based on precise evidence of kernel execution trajectory. This fundamentally solves the technical bottleneck of insufficient analysis depth and inability to locate kernel problems in traditional solutions.

[0028] S6: Use a time-series prediction model to predict system indicators. The time-series prediction model is based on a multi-scale recurrent neural network that fuses dynamic features. Based on the prediction results of the time-series prediction model, trigger an early warning mechanism.

[0029] It should be noted that the time-series prediction model refers to a deep learning model that numerically predicts the future trends of system performance indicators. This invention adopts a recurrent neural network architecture based on gated recurrent units (GRUs). As the core driver of the early warning mechanism, the time-series prediction model achieves pre-fault perception by mining historical data patterns. A multi-scale recurrent neural network refers to a neural network structure containing processing paths at different time granularities, including short-term paths (e.g., 5-minute intervals, 10 time steps) and long-term paths (e.g., 60-minute intervals, 12 time steps). The multi-scale structure enables the model to simultaneously capture the instantaneous fluctuations and long-term evolution patterns of system load, solving the problem of insufficient recognition capability of single-scale models for different frequency patterns. Dynamic features refer to feature representations that adaptively adjust with the system's operating state, including volatility calculated based on sliding windows and peak identifiers calculated based on statistics. Dynamic features enable the model to adjust its prediction strategy according to the current system state (e.g., periods of severe fluctuation or stable periods), enhancing its adaptability to sudden anomalies. The early warning mechanism refers to a decision-making system that automatically assesses the system's health status based on the prediction results and issues graded alarms, which may include threshold judgment, confidence interval assessment, and health scoring. As the execution end of the prediction results, the early warning mechanism transforms numerical predictions into actionable operation and maintenance actions, realizing a paradigm shift from passive response to proactive defense.

[0030] Understandably, traditional time-series forecasting models (such as ARIMA and single LSTM) only output future values, and the prediction results are independent of the real-time detection system, failing to create a synergistic effect, leading to delayed warnings or high false alarm rates. A multi-scale GRU model is used to synchronously predict system indicators. When the model predicts that CPU utilization will exceed a threshold at a future time, an early warning mechanism is immediately triggered, and simultaneously, the KPI tree is linked to pre-mark the expected abnormal states of relevant nodes. Specifically, the time-series forecasting model can be the KylinPulse model, such as... Figure 2 As shown, the KylinPulse model captures instantaneous load jumps in its short-term path and mines cyclical patterns in its long-term path. The dual-path features are fused through an attention mechanism to output a predicted value. This predicted value corroborates the anomaly markers detected in real time. If both point to the same component, the reliability of the warning is significantly improved, enabling the system to issue warnings minutes before a real fault occurs, giving maintenance personnel time to respond. At the same time, the adaptive adjustment of dynamic features reduces the false alarm rate during stable periods, solving the shortcomings of poor timeliness and insufficient accuracy in traditional solutions.

[0031] Preferably, in step S2, constructing the KPI tree includes: Set the business layer as the root node of the KPI tree; Child nodes are added under the root node based on a predefined hierarchical order, which includes a business processing delay layer, a business application layer, a database layer, and a system layer. Each node is assigned a name, data acquisition command, threshold judgment function, and abnormal status identifier. The hierarchical structure of the KPI tree is constructed by associating child nodes with parent nodes.

[0032] It's important to clarify that the business processing latency layer refers to the technical indicator level in the KPI tree that directly reflects the end-to-end business service quality. This includes quantifiable metrics that measure business performance, such as average transaction response time, API call latency, and user request processing time. This layer's nodes can collect data through instrumentation probes or APM tools. Its role is to transform user-perceived service quality into monitorable technical parameters, serving as the starting point for anomaly propagation throughout the KPI tree. The business application layer refers to the software runtime environment layer that carries business logic. This includes middleware-level metrics such as JVM heap memory usage, application thread pool queue length, and HTTP connection count. This layer's nodes obtain data through JMX, application-exposed Metrics interfaces, or bytecode injection techniques. Its role is to connect business performance with underlying resource consumption and identify performance issues caused by the application's own logic or configuration. The database layer refers to the performance indicator level of data persistence services, including the number of slow SQL queries, database connection pool usage, and InnoDB buffer pool hit rate. This layer's nodes collect data through database management commands or performance views. Its role is to locate business latency caused by data access bottlenecks. The system layer refers to the operating system kernel and hardware resource metrics layer, including CPU utilization, memory usage, disk I / O latency, network throughput, etc. Nodes at this layer are obtained through the / proc file system or system calls, and their function is to reveal underlying hardware resource contention or abnormal kernel behavior. Threshold judgment functions are executable logic units embedded in each node. They can be implemented as lambda expressions that receive metric values ​​and return boolean values, or as independent functions. For example, `lambda x: x>80` means that an abnormal state update is triggered when the metric value exceeds 80. Their function is to transform continuous performance metrics into discrete state identifiers, providing a decision-making basis for anomaly propagation. Child node-to-parent node relationships refer to tree-like hierarchical relationships established through memory pointer references, foreign key ID records, or nested data structures. For example, a parent node's `children` list stores references to child node objects, or a child node maintains a `parent_id` field pointing to its parent node. Their function is to construct a top-down anomaly propagation path, enabling the parent node to quickly aggregate the state of its child nodes.

[0033] Understandably, traditional monitoring systems lack unified indicator organization standards, with indicators managed in a decentralized manner at each level, making it difficult to establish the correlation between business and resources during fault diagnosis. This invention mandates that the business layer be the root node, and that the system be built hierarchically in a predefined order: business processing delay layer → business application layer → database layer → system layer. This hierarchical order simulates the processing chain of real business requests, ensuring that the anomaly propagation path is consistent with the technical service stack. Specifically, the business processing delay layer, as the root node, directly reflects the user experience. When it is abnormal, the system automatically drills down to its child node, the business application layer (e.g., JVM memory). If the application layer is not abnormal, the propagation continues to the database layer (e.g., slow queries), and finally reaches the system layer (e.g., disk I / O). Each node is uniquely identified by its name, automatically acquires indicators through data collection commands, makes real-time decisions through threshold judgment functions, and records results through anomaly status identifiers. This four-tuple attribute design enables each node to have independent data collection and anomaly judgment capabilities, while the parent-child association mechanism ensures that anomalies can be automatically propagated along the hierarchical order without manual intervention. This pre-defines the troubleshooting path structurally, significantly improving the standardization and automation of fault location.

[0034] Preferably, steps S4 and S5 include: The abnormal indicators in the KPI tree are mapped to the corresponding components of the topology graph using a predefined KPI-topology mapping dictionary; The topology diagram is constructed recursively with the business application layer as the root node, forming a hierarchical structure based on the relationships between the physical components of the system. The path prefix matching algorithm is used to calculate the lowest common ancestor of abnormal paths; Output the complete topological component anomaly dependency chain based on the nearest common ancestor.

[0035] It's important to note that using the business application layer as the root node in the topology graph means selecting the physical entity corresponding to the business application layer in the KPI tree as the starting node of the topology structure. This entity can be a server cluster or microservice instance carrying core application services, existing as the parent node in the topology graph. Sub-components such as database servers, storage arrays, and network switches are recursively attached to it. This design aligns the logical hierarchy with the physical deployment hierarchy, ensuring that the anomaly propagation path continues in the physical space. Recursively building the hierarchical structure refers to the process of expanding the child nodes layer by layer from the root node of the business application layer, based on the actual physical connection relationships between components (such as network reachability, storage mounting relationships, and dependency call relationships). Each child node continues to recursively generate the next generation of nodes based on its child component relationships, ultimately forming a tree graph structure describing the complete physical dependencies of the data center. This structure can be stored in memory as an adjacency list or a nested dictionary, supporting fast traversal and path lookup. The path prefix matching algorithm is a string matching algorithm used to compare the access paths of multiple abnormal components in a topology graph character by character to find the common prefix of all path strings. This algorithm iteratively compares the characters at the same position in each string of the path array, terminating when it encounters the first mismatched character and returning the matched prefix string. The time complexity is O(log n). ,in For the number of paths, This represents the shortest path length. The Lowest Common Ancestor (LCA) refers to the deepest common parent node found when tracing upwards through multiple anomalous component nodes in the topology layer hierarchy. This node represents the earliest branching point of all anomalous paths and can be the root cause of multi-path anomalies. The topology component anomaly dependency chain refers to the complete sequence of components formed by connecting all anomalous child nodes downwards along the topology graph from the LCA node. This chain is output in text or JSON format, containing the name of each component, anomaly indicators, anomaly timestamp, and parent-child dependencies, providing operations personnel with a full-link view from root cause to manifestation.

[0036] Understandably, by introducing a path prefix matching algorithm to calculate the lowest common ancestor (LCA), the root cause clustering problem in the event of concurrent anomalies among multiple components is solved. Traditional monitoring tools can present a flat alarm list when multiple components alarm simultaneously, requiring maintenance personnel to manually analyze the correlation between alarms, making it difficult to quickly identify whether it is a chain reaction caused by multiple independent faults or a single root cause. Therefore, this invention, after mapping the KPI tree anomaly indicators to the topology graph, uses a path prefix matching algorithm to calculate the access paths of all anomaly components. For example, when database server B, storage node C, and network switch D are simultaneously anomaly, the algorithm calculates the access paths of these three components in the topology graph. By comparing characters one by one, it finds that their common prefix path all passes through "application server A". Therefore, "application server A" is the LCA, indicating that all anomalies may be caused by a failure of application server A. Based on the abnormal dependency chain output by the most recent common ancestor, the complete propagation path from application server A to database B, storage C, and network D is further demonstrated, enabling operations and maintenance personnel to immediately identify the root cause of the chain reaction, rather than handling each alarm in isolation. This algorithmic root cause clustering method automates the complex multi-point anomaly correlation analysis, significantly improving the efficiency and accuracy of localization in multi-component failure scenarios.

[0037] Preferably, collecting kernel call stack information includes: The kernel functions related to the anomaly indicators are dynamically hooked using the kprobe probe; Probes are inserted at the entry and exit points of the hooked kernel function to record timestamps and calculate function call time. When a preset exception condition is met, a call stack acquisition mechanism is triggered to capture the address sequence of the kernel call stack. The address sequence is then symbolically parsed to generate a call stack ID. At the same time, the process ID, timestamp, and call stack context information are recorded. The collected event data is transmitted to user space through the event output mechanism. The user space program then aggregates and analyzes the multiple event call chains and outputs the complete kernel call stack.

[0038] It's important to note that the kprobe probe is a kernel dynamic tracing mechanism based on eBPF (Extended Berkeley Packet Filter) technology. It allows the injection of custom BPF bytecode programs at the entry (kprobe) or exit (kretprobe) of any kernel function without modifying the kernel source code or restarting the system. In this step, the kprobe probe acts as the execution carrier for kernel hooking. By registering with kernel functions related to abnormal indicators (such as the submit_bio function of block_device corresponding to disk I / O latency anomalies), it achieves non-intrusive interception of the kernel execution flow. The probes inserted at the kernel function entry and exit points refer to kprobe and kretprobe probes, respectively. The entry probe is triggered when the target function is called to obtain function parameters and the context before the call; the exit probe is triggered when the target function returns to obtain the return value and execution time. The timestamp is obtained using the bpf_ktime_get_ns() function provided by eBPF, which returns a nanosecond-level high-precision time since system startup, recorded at the entry probe. Exit probe record Function call time This calculation is performed in kernel mode, avoiding the system call overhead and context switching latency of user-mode time acquisition. Predefined exception conditions refer to the judgment logic predefined in the eBPF program, such as... (100 milliseconds) or a function returns an error code (e.g., a return value less than 0), this condition is compiled into BPF bytecode in C language form. When the condition is met, call stack acquisition is triggered in the exit probe. The call stack acquisition mechanism is implemented through the eBPF helper function bpf_get_stackid(), which hashes the kernel call stack address sequence (up to 127 levels) of the current process to generate a unique call stack ID and stores it. In the dedicated mapping of the type, at the same time The hash table records the process ID (via This involves retrieving (timestamps, call stack IDs, and context information such as function parameters and return values) to achieve efficient temporary storage in kernel space. Symbolic resolution refers to the process in user space of converting kernel addresses into function names and line numbers by reading the ` / proc / kallsyms` file or calling the `addr2line` tool. This process is executed after the data is transferred from kernel space to user space, generating human-readable call stack text. The event output mechanism refers to eBPF's... or Technology, through The helper function sends the event data recorded in the hash table to the user-space circular buffer in a zero-copy manner. The user-space program reads the data from the buffer in batches using the libbpf library, avoiding the high overhead of traditional netlink or debugfs methods. The user-space program's aggregation and analysis of multi-event call chains involves receiving multiple event records from kernel space, grouping and sorting them by process ID and timestamp, piecing together discrete events into a complete function call sequence, and searching for complete stack information in the stack_trace mapping by tracing the call stack ID. Finally, it outputs a kernel call stack report containing a timeline, process information, function execution time, and the complete call path.

[0039] Understandably, the kprobe probe technology records the start timestamp at the kernel function entry point associated with the abnormal metric and the end timestamp at the exit point. By calculating the time difference, it accurately captures the function execution time. When the execution time exceeds a preset threshold or an error code is returned, a call stack collection mechanism is immediately triggered. This bidirectional entry-exit probe design not only obtains the function call relationship but also quantifies the latency distribution of kernel operations, enabling precise attribution of business latency caused by kernel function blocking. For example, when disk I / O latency metrics are abnormal, the hooked submit_bio function can capture the processing time of each I / O request at the kernel block level. If a call takes more than 100 milliseconds, the call stack of the current process is immediately collected to reveal whether it is ext4 file system log commit blocking or SCSI driver queue congestion. The collected address sequence is symbolically parsed in user space to generate a unique call stack ID, which is then associated with the process ID and timestamp. This is efficiently transmitted to user space through an event output mechanism. Finally, the user-space program aggregates multiple discrete events in chronological order to form a complete kernel execution timeline. This end-to-end design, encompassing hooking, timing, triggering, acquisition, transmission, and aggregation, transforms the instantaneous execution details of the kernel state into analyzable structured data, providing accurate kernel function-level evidence for root cause analysis.

[0040] Preferably, in step S6, predicting system indicators using a time-series prediction model includes: A dual-path feature extraction structure is constructed, which includes a first path for capturing short-term fluctuations of system indicators and a second path for capturing long-term evolution patterns of system indicators. The short-term fluctuation features extracted by the first path and the long-term evolution features extracted by the second path are adaptively fused to generate fused features; The prediction results of the system indicators are generated based on the fusion features.

[0041] It should be noted that the dual-path feature extraction structure refers to two independent processing paths deployed in parallel within a time-series prediction model. The first and second paths share input but have different network depths, time window granularities, and parameter configurations. This structure decouples the processing of short-term transients from the processing of long-term trends, enabling the model to simultaneously extract system behavior patterns at different frequencies. The first path refers to a lightweight processing branch specifically designed to capture short-term fluctuations. It can employ shallow recurrent neural networks (such as a single-layer GRU) with small time steps (such as 5-minute intervals or 10 time steps) and fewer hidden units (such as 64 dimensions). Its role is to keenly perceive instantaneous jumps, sudden spikes, and minute-level load oscillations in system indicators, enabling a rapid response to early signals of abnormal events. The second path refers to a deep processing branch focused on uncovering long-term evolutionary patterns. It can employ multi-layered recurrent neural networks (such as a 3-layer GRU) with larger time steps (e.g., 60-minute intervals, 12 time steps) and more hidden units (e.g., 128 dimensions), and may introduce residual connections to alleviate gradient vanishing. Its role is to capture the daily cycles, weekly trends, and long-term resource consumption patterns of system indicators, providing a stable background baseline for prediction. Short-term fluctuation features refer to the high-dimensional vector representation of the first path's output, encoding information such as instantaneous change rate, local variance, and mutation intensity within the recent time window. This feature is sensitive to anomalies but lacks long-term context. Long-term evolutionary features refer to the deep vector representation of the second path's output, encoding periodic patterns, overall trend, and baseline levels within historical time windows. This feature is robust but may be slow to react to instantaneous anomalies. Adaptive fusion refers to the process of dynamically calculating the weight coefficients of the two path outputs through attention mechanisms or gating units, adjusting the feature fusion ratio in real time according to the current system state (e.g., volatile or stable), and generating fused features. This mechanism allows the model to flexibly balance the contribution of short-term fluctuations and long-term trends. The fusion feature refers to a single feature vector that is combined after adaptive weighting. It contains transient details of the short-term path and trend information of the long-term path. This feature serves as the input to the final prediction layer, supporting high-precision prediction of future indicators.

[0042] Understandably, existing prediction models are mostly single-scale or static feature engineering, making it difficult to simultaneously capture the instantaneous fluctuations and long-term evolution patterns of system load, resulting in insufficient prediction capabilities for sudden failures. This invention designs two heterogeneous processing paths. The first path focuses on recent small-window data, quickly capturing sudden spikes in CPU utilization within 5 minutes or instantaneous jumps in memory usage. The second path scans a wider historical window, uncovering periodic patterns in daily business peaks from 14:00 to 16:00 or weekly trends in resource consumption driven by business growth. After extracting features independently, the two paths do not simply concatenate or add fixed weights. Instead, an attention mechanism is used to calculate the dynamic weights of the two features at the current moment. For example, during periods of system stability, the second path is given higher weights to enhance trend prediction stability, while during periods of severe fluctuation, the weight of the first path is increased to strengthen anomaly detection. The generated fused features simultaneously encode transient details and long-term baselines. After being input into a fully connected prediction layer, the output prediction results reflect both long-term trends and provide early warnings of impending spikes, achieving unified modeling of multi-scale system behavior and significantly enhancing adaptability to complex dynamic environments.

[0043] Preferably, the time series prediction model includes: Feature enhancement is performed on the input system indicator time series data, including extracting time patterns through periodic encoding: ,in Indicates the current time step. Indicates the period length; The enhanced features are input into a bidirectional GRU network for temporal processing, through a reset gate. Filter historical information and update the gate By controlling the information fusion ratio, the final hidden state can be obtained. And through bidirectional fusion, the hidden state including forward and backward information is obtained. ; The GRU output is optimized by supplementing detailed information through residual connections: The final prediction result is obtained through post-processing smoothing. The post-processed smoothed prediction value satisfies the following relationship: ; Model training is performed using the Huber loss function, which satisfies the following relationship: ; in, and These represent the sine and cosine components of the periodic encoding, respectively. Indicates the current time step. Indicates the period length. This indicates a reset of the gate output. This represents the sigmoid activation function. and This represents the weight matrix of the reset gate. Represents the current feature vector. This indicates the hidden state of the previous time step. This indicates an update to the gate output. and This represents the weight matrix of the updated gate. This indicates element-wise multiplication. Indicates the candidate hidden state. and These represent the forward and backward hidden states, respectively. This represents vector concatenation. This indicates the output after residual connection; FC indicates a fully connected layer. This represents the last hidden state of the GRU. This represents the last feature of the input sequence. This represents the predicted value after post-processing smoothing. This represents the predicted value weight, and W represents the historical window size. Indicates historical CPU utilization. y represents the Huber loss value, and y represents the true value. Indicates the predicted value. This indicates the error threshold.

[0044] It should be noted that periodic encoding refers to encoding discrete time steps... The technique for converting trigonometric function values ​​into continuous values, through calculation and ,in Map the time steps to a preset period length (e.g., 24 hours or 7 days). The smooth curves within the intervals allow the model to explicitly capture fixed periodic patterns such as daily and weekly intervals, avoiding the training difficulties associated with recurrent neural networks that implicitly learn periodic patterns through a large number of parameters. A bidirectional GRU network refers to an architecture that adds a backward processing branch to the standard unidirectional GRU, where the forward GRU processes time-series data from left to right. The backward GRU processes and generates data from right to left. Finally, the pieces were assembled to obtain This design allows the hidden state at each time step to contain both past and future contextual information, enabling more accurate identification of turning points for prediction tasks. (Reset gate) The calculation formula is ,in and For trainable weight matrix, The sigmoid function compresses its output to the (0,1) interval; this gating mechanism determines the hidden state of the previous time step. How much information needs to be forgotten, when Historical information is completely reset when the value approaches zero, making it suitable for handling sudden changes. (Update gate) The calculation formula is Control the current candidate state With historical status The fusion ratio, the final hidden state This achieves smooth information updates and avoids gradient vanishing. Residual connectivity refers to inputting the model into... Access the output layer via a bypass branch. This design supplements the original sequence details that GRU might lose, allowing the prediction results to retain more high-frequency features of the input data. Post-processing smoothing refers to smoothing the original predicted values. Perform moving average correction, formula middle, For smoothing coefficients, For the size of the history window, This operation, using the mean of the most recent W true values, reduces prediction noise and improves curve smoothness. The Huber loss function is a piecewise loss function; when the prediction error... Squared loss is used When the error exceeds Linear loss is used ,in As the error threshold hyperparameter, this design maintains the smoothness of L2 loss when the error is small, which facilitates gradient descent. When the error is large, it switches to L1 loss to enhance robustness to outliers and avoid outliers dominating the training process.

[0045] Understandably, this invention systematically improves the accuracy and robustness of time-series prediction models through a multi-layered design involving feature enhancement, bidirectional GRU modeling, residual connection optimization, and Huber loss training. Specifically, the original time-series data is first periodically encoded, explicitly injecting temporal patterns. This eliminates the need for the model to painstakingly learn daily or weekly cycles from large datasets, significantly reducing training difficulty and sample requirements. The enhanced features are then input into the bidirectional GRU network. The forward branch captures the evolutionary logic from the past to the present, while the backward branch introduces future contextual information. The bidirectional fusion of hidden states enables more accurate identification of time-series turning points. For example, when predicting the inflection point where CPU utilization changes from rising to falling, the backward information can detect the downward trend in advance. The gating mechanisms of the reset and update gates allow the model to adaptively forget historical redundant information and fuse current input, avoiding the long-term dependency problem of standard RNNs and significantly reducing the risk of gradient vanishing. Residual connections directly introduce input information into the output, supplementing details that deep networks might lose. This ensures that the prediction results contain both the abstract patterns extracted by GRU and retain the subtle variations of the original sequence. Post-processing smoothing further eliminates prediction noise through moving averages, making the output curve more consistent with the interpretation habits of operations and maintenance personnel. The Huber loss function applies a quadratic penalty to normal samples during training to ensure fitting accuracy and a linear penalty to outlier samples to prevent overfitting, which can improve the model's generalization ability in real production environments.

[0046] Preferably, step S6 includes post-processing optimization of the prediction results, including: The original forecast results are adjusted for volatility by dynamically scaling the forecast value based on the ratio of real-time volatility to historical benchmark volatility. Among them, the output weight is adaptively adjusted based on the system fluctuation state, the output weight is increased during the period of violent fluctuation, and the output weight is decreased during the period of stability; Peak detection and correction are performed on the prediction results; corrections are made when the predicted value exceeds a dynamic threshold. like Then the predicted value will be corrected to ; Establish a prediction feedback mechanism and output feedback information including volatility labels and peak labels. Volatility labels and peak labels are used to adjust the subsequent prediction weights and trigger health status assessment and early warning mechanisms. in, Indicates time Volatility adjustment factor at that point This represents the volatility of the current time window. Represents historical benchmark volatility. Indicates time step The original predicted value at that location, This represents the mean of historical data. The standard deviation of historical data is represented by the volatility label, the volatility level of the current time window is represented by the peak label, and the presence of abnormal peaks is indicated by the peak label.

[0047] It should be noted that volatility adjustment refers to a post-processing operation that dynamically scales the prediction results after the model outputs the original forecast values, based on the recent volatility of the system. This is achieved by calculating real-time volatility. Compared with historical benchmark volatility ratio As an adjustment coefficient, when the system is in a period of severe fluctuation. Increase prediction weights to amplify anomalous signals during stable periods ( The weights are attenuated during real-time fluctuations to suppress noise interference, a mechanism that allows the prediction results to adaptively match the dynamic characteristics of the current system. This refers to the standard deviation of the system indicator values ​​within the most recent time window (such as the most recent 30 minutes or 60 sampling points). Historical benchmark volatility. The standard deviation is calculated over a historically stable period (such as a stable period of the past 7 days) and serves as a benchmark for judging the current volatility. Volatility adjustment factor. ,when This period can be identified as a period of drastic fluctuations. During a stable period, this coefficient is directly used as a multiplicative scaling factor for the predicted value. Peak detection and correction refers to the process of identifying outliers and applying boundary constraints to the prediction results, using dynamic thresholds. Based on historical data averages and standard deviation Calculate when the predicted value When the value exceeds this threshold, it is identified as an abnormal spike, and... Revised to Suppression is implemented to prevent predicted values ​​from deviating from the reasonable range due to model overshoot. The prediction feedback mechanism refers to a closed-loop design where the volatility levels and peak identification results extracted in the post-processing stage are output as labels and fed back to the model input or early warning decision module, forming an iterative cycle of "prediction-detection-feedback-re-prediction". Volatility labels are discrete classification identifiers, based on... Values ​​are classified as high volatility ( ), medium fluctuation ( ), low volatility Three levels are used to guide whether to enable the enhancement mode in subsequent predictions. The spike label is a Boolean identifier, when... The time value is recorded as True, otherwise False, used to trigger emergency alerts and adjust the prediction sensitivity of subsequent time steps. Health status assessment refers to a quantitative scoring system constructed by comprehensively considering prediction deviation rate, volatility stability, and peak frequency. Volatility and peak labels serve as important input dimensions to help assess the system's current health level. The alert mechanism refers to tiered alarm actions triggered based on peak and volatility labels. A red alert is immediately issued when the peak label is True, and a yellow alert is issued when the volatility label indicates high volatility and the predicted value is close to the threshold, achieving dynamic risk response.

[0048] Understandably, post-processing optimization upgrades model predictions from unidirectional output to dynamic adaptive output, solving the problems of inaccuracy in traditional prediction models during periods of severe volatility and delayed response to abnormal spikes. Specifically, after the original predicted values ​​are generated, the current volatility is first calculated and compared with historical benchmarks, dynamically adjusting the output weights. For example, when the business system enters a period of severe volatility due to promotional activities, the CPU volatility may suddenly increase from the benchmark of 5% to 15%. At this point, the predicted value is boosted by 1.2 times to provide early warning of resource bottlenecks and avoid the risk of underestimation caused by the heavy weighting of stable options. Simultaneously, a spike detection mechanism prevents the model from overshooting due to outliers in the training data; when the predicted value exceeds... Correct it back at that time This ensures that the prediction results are within a statistically reasonable range, avoiding erroneous expansion caused by inflated predictions. The generated volatility and peak labels are not only used for current-time alerts, but also fed back to the model to adjust subsequent prediction weights. For example, when the peak label is True for several consecutive times, the system automatically reduces the learning rate and enables a conservative prediction mode.

[0049] Preferably, a feature engineering process is included before step S6, the feature engineering process including: Constructing a multi-dimensional feature system: Extracting periodic features of time series through periodic encoding, calculating statistical features using a sliding window, selecting lag features, and identifying fluctuation patterns by combining difference operations; The volatility coefficient is constructed based on statistics within a predefined time window; The output weights of the prediction model are adaptively adjusted based on the volatility coefficient, with the output weights being increased during periods of severe volatility and decreased during periods of stability.

[0050] It should be noted that feature engineering refers to the process of constructing a new set of features with stronger expressive power through mathematical transformations, statistical calculations, and pattern extraction before inputting raw time-series data into a prediction model. This process expands the low-dimensional original sequence into a high-dimensional feature matrix, enabling subsequent deep learning models to more efficiently capture the implicit patterns in the data. A multi-dimensional feature system refers to a composite feature set composed of periodic features, statistical features, lag features, and fluctuation features. Each dimension characterizes the intrinsic properties of time-series data from a different perspective, forming complementary information sources and enhancing the model's comprehensive perception capabilities. Periodic encoding refers to the technique of converting timestamp information into trigonometric function values, using sine waves... Cosine The function maps discrete time steps to a continuous periodic space, enabling the model to explicitly perceive fixed periodic patterns such as daily and weekly intervals. A sliding window calculates statistical features within a time frame of length... Within a continuous window, statistics such as mean, standard deviation, maximum, minimum, skewness, and kurtosis are calculated. The window slides along the time axis, traversing the entire sequence. The generated statistical feature sequence reflects the local aggregation characteristics and dispersion of the indicators. Lag features refer to the feature vector formed by concatenating the current indicator value with historical values ​​from 1 to N previous times, directly introducing autocorrelation and enabling the model to learn short-term dependencies in the sequence. Difference operations refer to calculating the first or second difference between indicator values ​​at adjacent times, used to extract rate of change information and identify trend reversals and acceleration / deceleration patterns. Volatility patterns refer to system state patterns defined by combinations of difference signs and amplitudes. For example, continuous positive differences indicate upward acceleration, alternating positive and negative differences indicate oscillation, and large differences indicate drastic changes. This pattern helps the model identify whether the system is in a stable, climbing, or peak state. A predefined time window refers to a fixed-length observation interval set by the user, such as 30 minutes, 1 hour, or 1 day. This window is used to calculate real-time volatility. and benchmark volatility This is the foundation for constructing volatility coefficients. The calculation of volatility coefficients in feature engineering differs from post-processing volatility adjustment; here, it refers to constructing volatility coefficients at the model input stage. As an independent feature dimension, it is directly input into the model so that the network learns state awareness, rather than being multiplicatively adjusted at the output.

[0051] Understandably, constructing a multi-dimensional feature system before prediction can solve the problem of traditional model feature engineering being static and singular, unable to comprehensively characterize the dynamic characteristics of the system. Specifically, feature enhancement is performed during the data input stage: periodic encoding explicitly injects time regularity, eliminating the need for the model to implicitly learn daily and weekly cycles from massive samples; sliding window statistics extract local means and variances, smoothing minute-level spikes into identifiable local trends; lag features directly introduce autoregressive information, strengthening the model's ability to capture recent dependencies; differencing operations extract rates of change, enabling the model to perceive accelerations and inflection points; and a comprehensively constructed fluctuation coefficient serves as a state indicator. When the system enters a period of severe fluctuation, this coefficient increases significantly, allowing the model to automatically identify a high-risk state and internally adjust gating weights to enhance attention to abnormal patterns. This multi-dimensional feature construction method expands the original one-dimensional time series into a multi-dimensional feature matrix containing periodicity, statistics, lag, differencing, and state coefficients, enabling subsequent networks to learn multi-perspective patterns in parallel, significantly improving the model's ability to represent complex system behavior, and effectively solving the prediction accuracy bottleneck caused by single features.

[0052] Preferably, the triggering of the early warning mechanism includes: The ability to detect abnormal spikes is enhanced by using a spike-sensing branch, and abnormal spikes are identified based on statistics within a predefined time window. A composite loss function is used for model training, which includes basic prediction accuracy loss and volatility matching loss. A health assessment score is constructed based on prediction bias rate and volatility stability; By setting multiple warning thresholds and combining predicted values, confidence intervals, and health assessment scores, dynamic warning triggering can be achieved.

[0053] It should be noted that the spike-aware branch refers to an auxiliary detection branch added in parallel outside the main body of the time-series prediction model. This branch can be a lightweight convolutional neural network or a simple threshold comparison module, specifically designed to identify abrupt changes that exceed the normal range. The input to this branch is the original time-series data or residual sequence, and the output is the probability of spike presence or a Boolean identifier. A multi-branch feature fusion mechanism enhances the model's sensitivity to sudden anomalies. The statistic for the predefined time window refers to the mean calculated within a fixed-length sliding window. Standard deviation Aggregate indicators such as maximum value (max) and minimum value (min) are used, with a window length that can be set to 30 minutes or 1 hour. This statistic serves as a dynamic benchmark to identify anomalous spikes that deviate significantly from recent normal behavior. Anomalous spike identification refers to using the current indicator value... Compared with window statistics, when The time was determined to be a peak, among which A value of 2.5 to 3.0 can be used. This recognition process is executed synchronously during model forward propagation, providing an independent basis for triggering early warnings. The composite loss function refers to the training objective function composed of a weighted sum of two or more sub-losses, including the basic prediction accuracy loss. Matching loss with volatility The total loss can be ,in and With adjustable weighting coefficients, this design ensures that the model maintains its ability to fit fluctuation patterns while pursuing high point prediction accuracy. (Base prediction accuracy loss) Mean squared error (MSE) or Huber loss can be used to measure the point-by-point deviation between predicted and true values, with the goal of minimizing the error to make the model output as close as possible to the true time series curve. Volatility matching loss. By calculating the difference sequence loss or variance between the predicted sequence and the true sequence, for example... This forces the model to generate a prediction curve that matches the amplitude of fluctuations in the actual data, avoiding the loss of peak information due to oversmoothing. Prediction bias rate is a measure of the degree of deviation between the predicted and actual values ​​over a certain period of time, and can be used as a metric for... This reflects the magnitude of the systematic error in the model's predictions. Volatility stability refers to assessing the smoothness of the predicted sequence by calculating the standard deviation of the changes in predicted values ​​between adjacent time steps. A higher volatility stability score indicates a smoother prediction curve, avoiding false alarms caused by frequent fluctuations. The health assessment score is a composite score built upon prediction bias rate and volatility stability, for example... ,in and The weighting parameter quantifies the health of the system; a higher score indicates greater system stability. Multi-level warning thresholds refer to setting different levels of risk thresholds, such as Level 1 (emergency), Level 2 (warning), and Level 3 (concern). Each threshold level corresponds to different combinations of predicted values, confidence intervals, and health scores, enabling tiered responses. ,in The standard deviation of the model output or the standard deviation of historical prediction errors. A value of 1.96 (95% confidence level) can be used, as this interval assesses the reliability of the prediction. Dynamic early warning triggering means that the early warning logic is not fixed, but rather dynamically combines three conditions: whether the predicted value exceeds the threshold, whether the confidence interval includes the risk area, and whether the health score is below the safety line. The corresponding level of early warning is triggered only when the combined conditions are met. This mechanism avoids false alarms or missed alarms caused by a single threshold.

[0054] Understandably, a complete intelligent early warning system is constructed through a four-pronged mechanism: a peak-sensing branch, a composite loss function, a health assessment score, and a multi-level dynamic threshold. This system encompasses anomaly detection, model training, health assessment, and early warning triggering. Specifically, a peak-sensing branch is added at the model architecture level. This branch operates independently of the main prediction path and specifically monitors abrupt changes in the original sequence. When a sudden jump in CPU utilization is detected, it triggers an early warning. Regardless of the output of the main prediction path, the system directly triggers the peak label, achieving a zero-delay response to sudden anomalies. During the training phase, using only the basic prediction accuracy loss would cause the model to overfit smooth curves and ignore peak patterns. The composite loss function forces the model to fit both the trend and fluctuation amplitude during training through a volatility matching term, ensuring that the prediction curve remains steep at peaks rather than being overly smooth. Before triggering an alert, the system calculates the prediction deviation rate and volatility stability to construct a health assessment score. When the deviation rate remains high and the volatility is unstable, the health score decreases. Even if the predicted value does not exceed the threshold, the alert trigger threshold is lowered in advance, enabling risk prediction in sub-healthy states. The multi-level alert threshold expands the single threshold to a combination of conditions: "predicted value > threshold and lower confidence interval > threshold and health score < 60," ensuring that alerts are triggered with high confidence. This end-to-end optimization from architecture, training, evaluation to decision-making enables the alert mechanism to have independent perception of peaks, forced learning of fluctuation patterns, comprehensive assessment of system health, and intelligent decision-making capabilities based on multiple factors, significantly improving the accuracy and foresight of alerts.

[0055] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0056] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. An operating system fault detection method based on time-series prediction and root cause analysis, characterized in that, Includes the following steps: S1: Collect system data and log data; S2: Construct a KPI tree based on the collected system data and log data. The KPI tree has the business layer as the root node and includes several levels. Each level includes several nodes, and each node is associated with data collection commands and abnormal status indicators. S3: Traverse the KPI tree, and for each node, execute the associated data acquisition command to obtain real-time system performance indicators, and update the abnormal status identifier based on the real-time system performance indicators; S4: In response to the detection of an abnormal state identifier in the KPI tree, the abnormal indicators in the KPI tree are mapped to a topology graph through a predefined KPI-topology mapping dictionary, wherein the topology graph represents the relationship between physical components of the system; S5: Based on the mapping in the topology graph, locate the abnormal components and output the abnormal dependency chain. Use the BCC tool to hook the kernel functions related to the abnormal indicators, collect kernel call stack information, and perform root cause analysis based on the collected kernel call stack information. S6: Use a time-series prediction model to predict system indicators. The time-series prediction model is based on a multi-scale recurrent neural network that fuses dynamic features. Based on the prediction results of the time-series prediction model, trigger an early warning mechanism.

2. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 1, characterized in that, In step S2, constructing the KPI tree includes: Set the business layer as the root node of the KPI tree; Child nodes are added under the root node based on a predefined hierarchical order, which includes a business processing delay layer, a business application layer, a database layer, and a system layer. Each node is assigned a name, data acquisition command, threshold judgment function, and abnormal status identifier. The hierarchical structure of the KPI tree is constructed by associating child nodes with parent nodes.

3. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 2, characterized in that, Steps S4 and S5 include: The abnormal indicators in the KPI tree are mapped to the corresponding components of the topology graph using a predefined KPI-topology mapping dictionary; The topology diagram is constructed recursively with the business application layer as the root node, forming a hierarchical structure based on the relationships between the physical components of the system. The path prefix matching algorithm is used to calculate the lowest common ancestor of abnormal paths; Output the complete topological component anomaly dependency chain based on the nearest common ancestor.

4. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 1, characterized in that, Collecting kernel call stack information includes: The kernel functions related to the anomaly indicators are dynamically hooked using the kprobe probe; Probes are inserted at the entry and exit points of the hooked kernel function to record timestamps and calculate function call time. When a preset exception condition is met, a call stack acquisition mechanism is triggered to capture the address sequence of the kernel call stack. The address sequence is then symbolically parsed to generate a call stack ID. At the same time, the process ID, timestamp, and call stack context information are recorded. The collected event data is transmitted to user space through the event output mechanism. The user space program then aggregates and analyzes the multiple event call chains and outputs the complete kernel call stack.

5. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 1, characterized in that, In step S6, using a time-series forecasting model to predict system indicators includes: A dual-path feature extraction structure is constructed, which includes a first path for capturing short-term fluctuations of system indicators and a second path for capturing long-term evolution patterns of system indicators. The short-term fluctuation features extracted by the first path and the long-term evolution features extracted by the second path are adaptively fused to generate fused features; The prediction results of the system indicators are generated based on the fusion features.

6. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 1, characterized in that, Time series prediction models include: Feature enhancement is performed on the input system indicator time series data, including extracting time patterns through periodic encoding: ,in Indicates the current time step. Indicates the period length; The enhanced features are input into a bidirectional GRU network for temporal processing, through a reset gate. Filter historical information and update the gate By controlling the information fusion ratio, the final hidden state can be obtained. And through bidirectional fusion, the hidden state including forward and backward information is obtained. ; The GRU output is optimized by supplementing detailed information through residual connections: The final prediction result is obtained through post-processing smoothing. The post-processed smoothed prediction value satisfies the following relationship: ; Model training is performed using the Huber loss function, which satisfies the following relationship: ; in, and These represent the sine and cosine components of the periodic code, respectively. Indicates the current time step. Indicates the period length. This indicates a reset of the gate output. This represents the sigmoid activation function. and This represents the weight matrix of the reset gate. Represents the current feature vector. This indicates the hidden state of the previous time step. This indicates an update to the gate output. and This represents the weight matrix of the updated gate. This indicates element-wise multiplication. Indicates the candidate hidden state. and These represent the forward and backward hidden states, respectively. This represents vector concatenation. This indicates the output after residual connection; FC indicates a fully connected layer. This represents the last hidden state of the GRU. This represents the last feature of the input sequence. This represents the predicted value after post-processing smoothing. This represents the predicted value weight, and W represents the historical window size. Indicates historical CPU utilization. y represents the Huber loss value, and y represents the true value. Indicates the predicted value. This indicates the error threshold.

7. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 1, characterized in that, Step S6 includes post-processing optimization of the prediction results, including: The original forecast results are adjusted for volatility by dynamically scaling the forecast value based on the ratio of real-time volatility to historical benchmark volatility. Among them, the output weight is adaptively adjusted based on the system fluctuation state, the output weight is enhanced during the period of violent fluctuation, and the output weight is weakened during the period of stability; Peak detection and correction are performed on the prediction results; corrections are made when the predicted value exceeds a dynamic threshold. like Then the predicted value will be corrected to ; Establish a prediction feedback mechanism and output feedback information including volatility labels and peak labels. Volatility labels and peak labels are used to adjust the subsequent prediction weights and trigger health status assessment and early warning mechanisms. in, Indicates time Volatility adjustment factor at that point This represents the volatility of the current time window. Represents historical benchmark volatility. Indicates time step The original predicted value at that location, This represents the mean of historical data. The standard deviation of historical data is represented by the volatility label, the volatility level of the current time window is represented by the peak label, and the presence of abnormal peaks is indicated by the peak label.

8. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 7, characterized in that, Prior to step S6, feature engineering processing is also included, which includes: Constructing a multi-dimensional feature system: Extracting periodic features of time series through periodic encoding, calculating statistical features using a sliding window, selecting lag features, and identifying fluctuation patterns by combining difference operations; The volatility coefficient is constructed based on statistics within a predefined time window; The output weights of the prediction model are adaptively adjusted based on the volatility coefficient, with the output weights being increased during periods of severe volatility and decreased during periods of stability.

9. The operating system fault detection method based on time-series prediction and root cause analysis according to claim 8, characterized in that, The triggering of the early warning mechanism includes: The ability to detect abnormal spikes is enhanced by using a spike-sensing branch, and abnormal spikes are identified based on statistics within a predefined time window. A composite loss function is used for model training, which includes basic prediction accuracy loss and volatility matching loss. A health assessment score is constructed based on prediction bias rate and volatility stability; By setting multiple warning thresholds and combining predicted values, confidence intervals, and health assessment scores, dynamic warning triggering can be achieved.

Images