Intelligent monitoring method based on AI algorithm and related equipment

Abstract

The invention discloses an intelligent monitoring method based on an AI algorithm and related equipment, and relates to the technical field of operation and maintenance monitoring, and the method comprises the steps: obtaining target response data returned by a monitoring target interface; outputting a candidate threshold rule corresponding to each monitoring index in the response data by using a rule model preset according to an AI algorithm; in response to a selection operation of a user, determining the candidate threshold rule as a first actual threshold rule; or in response to the modification operation of the user, modifying the candidate threshold rule to obtain a second actual threshold rule; if the monitoring index is not matched with the first actual threshold rule or the second actual threshold rule, outputting first alarm data; establishing a corresponding dynamic baseline for each monitoring index; when any monitoring index deviates from the corresponding dynamic baseline setting range, outputting second alarm data; and pushing the first alarm data and the second alarm data to the user. The flexibility and accuracy of operation and maintenance monitoring can be improved.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance monitoring technology, and in particular to an intelligent monitoring method and related equipment based on AI algorithms. Background Technology

[0002] Existing operation and maintenance monitoring systems (such as Zabbix and Prometheus) are primarily based on rules and thresholds, which have significant inherent drawbacks: First, they are complex to configure, requiring manual plugin development and static threshold setting, making them unable to adapt to dynamically changing and complex system environments, resulting in high false alarm and false negative rates. Second, they are essentially "data acquisition and alarm devices," lacking the ability to deeply understand, analyze, and predict monitoring data. When a fault occurs, operations and maintenance personnel still need to manually correlate and analyze massive amounts of alarms, making root cause location inefficient.

[0003] More importantly, traditional systems completely lack AI-driven intelligent analysis capabilities. They cannot autonomously learn normal behavior patterns from historical data, predict performance bottlenecks, or identify unknown and complex anomalies. Currently, AI technology has been maturely applied in fields such as image and speech processing, but in the field of operations and maintenance monitoring (AIOps), especially in lightweight, integrated intelligent monitoring systems oriented towards API interfaces, there are still no mature and easy-to-use solutions. Summary of the Invention

[0004] The main objective of this application is to propose an intelligent monitoring method and related equipment based on AI algorithms to improve the flexibility and accuracy of operation and maintenance monitoring.

[0005] To achieve the above objectives, one aspect of this application proposes an intelligent monitoring method based on AI algorithms, the method comprising the following steps: Obtain the target response data returned by the monitoring target interface; wherein, the target response data includes at least one monitoring metric; The candidate threshold rules corresponding to the monitoring indicators are output using a rule model preset by the AI ​​algorithm. In response to a user's selection operation, the candidate threshold rule is determined as the first actual threshold rule; or, in response to a user's modification operation, the candidate threshold rule is modified to obtain the second actual threshold rule. If the monitoring metric does not match the first actual threshold rule or the second actual threshold rule, then the first alarm data is output. Establish corresponding dynamic baselines for each of the monitoring indicators; wherein each of the dynamic baselines is used to learn the periodic patterns and trend changes of the corresponding monitoring indicator. When any of the monitoring indicators deviates from the corresponding dynamic baseline setting range, a second alarm data is output; The first alarm data and the second alarm data are pushed to the user.

[0006] In some embodiments, obtaining the target response data returned by the monitoring target interface includes the following steps: Add monitoring for the first target interface; A request is initiated to the first target interface based on the HTTP / TCP protocol; Obtain and parse the first response data returned by the first target interface; Obtain the second response data of the second target interface based on the first response data; The first response data and the second response data are stored in key-value pair format.

[0007] In some embodiments, obtaining the second response data of the second target interface based on the first response data includes the following steps: Select at least one of the monitoring metrics as authentication parameters from the first response data of the first target interface; Send a request to the second target interface carrying the authentication parameters; Obtain and parse the second response data returned by the second target interface.

[0008] In some embodiments, establishing a dynamic baseline for each of the monitoring metrics includes the following steps: The historical data of each of the monitoring indicators are used to train the corresponding time series model; wherein, the trained time series model serves as the dynamic baseline for the corresponding monitoring indicator.

[0009] In some embodiments, the method further includes the following steps: The target response data is displayed to the user in a preset format; After each call to the target interface, the target response data is updated accordingly, thereby updating the displayed target response data.

[0010] In some embodiments, pushing the first alarm data and the second alarm data to the user includes the following steps: If the target interface continuously triggers the generation of the first alarm data or the second alarm data a preset number of times within the set convergence period, then pushes one piece of the first alarm data or the second alarm data to the user. During the set time period, stop pushing the first alarm data and the second alarm data to the user; Select any one of the monitoring metrics and add it to the notification template. Add the first alarm data and the second alarm data to the notification template and push the notification template to the user via email or instant messaging software.

[0011] In some embodiments, the method further includes the following steps: The target response data, the first alarm data, and the second alarm data are analyzed periodically. Based on the analysis results, an optimization suggestion report is generated for the candidate threshold rules and the dynamic baseline.

[0012] To achieve the above objectives, another aspect of this application proposes an intelligent monitoring device based on an AI algorithm, the device comprising: The indicator monitoring unit is used to acquire target response data returned by the monitoring target interface; wherein, the target response data includes at least one monitoring indicator; The threshold rule generation unit is used to output candidate threshold rules corresponding to the monitoring indicators based on the rule model preset by the AI ​​algorithm. A threshold rule determination unit is used to determine the candidate threshold rule as a first actual threshold rule in response to a user's selection operation; or, in response to a user's modification operation, modify the candidate threshold rule to obtain a second actual threshold rule. The first alarm unit is used to output first alarm data if the monitoring indicator does not match the first actual threshold rule or the second actual threshold rule. A baseline establishment unit is used to establish corresponding dynamic baselines for each of the monitoring indicators; wherein each of the dynamic baselines is used to learn the periodic patterns and trend changes of the corresponding monitoring indicators. The second alarm unit is used to output second alarm data when any of the monitoring indicators deviates from the corresponding dynamic baseline setting range; An alarm push unit is used to push the first alarm data and the second alarm data to the user.

[0013] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0014] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0015] To achieve the above objectives, another aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0016] The embodiments of this application include at least the following beneficial effects: This application provides an intelligent monitoring method and related equipment based on AI algorithms. The solution involves acquiring target response data returned by a monitoring target interface; wherein the response data includes at least one monitoring indicator; outputting candidate threshold rules corresponding to the monitoring indicators using a rule model preset by the AI ​​algorithm; determining the candidate threshold rules as the first actual threshold rules in response to a user's selection operation; or, in response to a user's modification operation, modifying the candidate threshold rules to obtain a second actual threshold rule; if the monitoring indicator does not match the first or second actual threshold rule, outputting first alarm data; establishing corresponding dynamic baselines for each monitoring indicator; wherein each dynamic baseline is used to learn the periodic patterns and trend changes of the corresponding monitoring indicator; outputting second alarm data when any monitoring indicator deviates from the set range of the corresponding dynamic baseline; and pushing the first and second alarm data to the user. This application outputs candidate threshold rules corresponding to monitoring indicators through a rule model preset by AI algorithms, and then the user decides whether to adjust the candidate threshold rules, which can improve the flexibility of the candidate threshold rules; by using dynamic baselines, each monitoring indicator can be monitored for abnormality, improving accuracy; this application realizes the monitoring closed loop of deeply integrating AI algorithms into the target interface, realizing the transformation from passive response to active prediction and intelligent diagnosis, reducing false alarms caused by fixed thresholds. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating an AI-based intelligent monitoring method provided in this application embodiment; Figure 2 This is a diagram illustrating the architecture of an intelligent monitoring system provided in an embodiment of this application. Figure 3 A flowchart of the monitoring module provided in an embodiment of this application; Figure 4 This is a flowchart of the API monitoring addition process provided in an embodiment of this application; Figure 5 This is a flowchart illustrating the operation of the API interface monitoring system provided in the embodiments of this application. Figure 6 This is a diagram illustrating the architecture of the AI ​​analysis module provided in an embodiment of this application. Figure 7 An alarm flowchart provided for embodiments of this application; Figure 8 A schematic diagram of the structure of an AI-based intelligent monitoring device provided in an embodiment of this application; Figure 9 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0021] Before providing a detailed description of the embodiments of this application, some related technologies involved in the embodiments of this application will be described first, as follows: This application aims to creatively integrate machine learning and artificial intelligence algorithms into an API monitoring system, constructing an intelligent agent with self-learning, self-analysis, and self-prediction capabilities. The core objectives of this application include: 1. Achieve intelligent cognitive monitoring: Abandon pure rule-driven approaches and introduce AI models to enable the system to learn autonomously from historical API behavior data, dynamically establish a "health baseline," and achieve intelligent perception of unknown anomalies and complex fault modes.

[0022] 2. Provide predictive insights: Utilize AI algorithms such as time series forecasting to predict API performance trends and resource requirements in advance, transforming "alarms after a failure occurs" into "early warnings before performance degradation", and enabling proactive operation and maintenance.

[0023] 3. Automated Root Cause Analysis: When a fault occurs, AI technologies such as graph neural networks are used to automatically analyze the alarm propagation chain and system topology, quickly and accurately locate the root cause of the problem, and provide repair suggestions, greatly shortening the average repair time.

[0024] 4. Maintain system usability: Complex AI capabilities are encapsulated into automated workflows, so users do not need to have AI expertise and can enable intelligent monitoring through the configuration interface, thus lowering the application threshold of AIOps.

[0025] 5. Build a closed-loop intelligent operation and maintenance system: Form a complete intelligent closed loop of "data collection -> AI analysis -> intelligent alarm -> root cause location -> feedback optimization", making the monitoring system a continuously evolving "intelligent operation and maintenance expert system".

[0026] This application provides an AI-based intelligent monitoring method and related equipment, relating to the field of operation and maintenance monitoring technology. The AI-based intelligent monitoring method and related equipment provided in this application can be applied to terminals, servers, or software running on terminals or servers. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing an AI-based intelligent monitoring method, but is not limited to the above forms.

[0027] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0028] Reference Figure 1 This application provides an intelligent monitoring method based on AI algorithms, which may include, but is not limited to, steps S100 to S160, as detailed below: S100: Obtain the target response data returned by the monitoring target interface; wherein, the target response data includes at least one monitoring indicator; S110: Output the candidate threshold rules corresponding to the monitoring indicators using the rule model preset according to the AI ​​algorithm; S120: In response to the user's selection operation, determine the candidate threshold rule as the first actual threshold rule; or, in response to the user's modification operation, modify the candidate threshold rule to obtain the second actual threshold rule; S130: If the monitoring indicator does not match the first actual threshold rule or the second actual threshold rule, then output the first alarm data; S140: Establish corresponding dynamic baselines for each of the monitoring indicators; wherein each of the dynamic baselines is used to learn the periodic patterns and trend changes of the corresponding monitoring indicators; S150: When any of the monitoring indicators deviates from the corresponding dynamic baseline setting range, output the second alarm data; S160: Push the first alarm data and the second alarm data to the user.

[0029] Specifically, the target interface can be an API to be monitored or various application interfaces.

[0030] This application embodiment can set alarm threshold rules, then set the monitoring period in hours, minutes and seconds; then set the trigger condition to match any rule or match all rules, and can also set the alarm level, such as urgent, serious and minor.

[0031] Determine the response data obtained from each API monitoring session as the monitoring metric. When a user creates a monitoring session, the AI ​​algorithm recommends initial threshold settings (such as response time, error rate, etc.) based on the API's historical data (if available) or general patterns of similar APIs. For example, for a login API, it might recommend focusing on the error rate; for a query API, it might recommend focusing on the response time.

[0032] Then, the AI ​​algorithm establishes a dynamic baseline for each monitoring metric (such as response time and request volume). This dynamic baseline can learn cyclical patterns (such as daily peaks and weekly troughs) and trend changes. When real-time monitoring data deviates from the baseline by a certain range, the AI ​​algorithm generates an anomaly event and sends an alarm.

[0033] Then, the alarm data corresponding to each monitoring indicator is pushed to the user.

[0034] Optionally, obtaining the target response data returned by the monitoring target interface includes the following steps: Add monitoring for the first target interface; A request is initiated to the first target interface based on the HTTP / TCP protocol; Obtain and parse the first response data returned by the first target interface; Obtain the second response data of the second target interface based on the first response data; The first response data and the second response data are stored in key-value pair format.

[0035] Specifically, first, add monitoring for the new API interface. After successful addition, the system will send a request to the target API based on the HTTP / TCP protocol, obtain and parse the response data. Most interfaces respond with data in application / json format, and the system stores the response data in key-value pair format.

[0036] Additionally, the response data can be passed to other monitoring systems. For example, adding a new monitoring entry for the personal information API can select the token value from the login interface monitoring and use it as a parameter for Authorization authentication, ensuring that this monitoring entry can correctly initiate a request.

[0037] Optionally, obtaining the second response data of the second target interface based on the first response data includes the following steps: Select at least one of the monitoring metrics as authentication parameters from the first response data of the first target interface; Send a request to the second target interface carrying the authentication parameters; Obtain and parse the second response data returned by the second target interface.

[0038] Specifically, the page for adding monitoring consists of various API attributes and corresponding text input boxes or selection boxes. Users can fill in relevant information about the target host, such as IP address, port number, request method, header parameters, body parameters, etc. After the information is entered correctly, a request can be sent to the API address.

[0039] Optionally, establishing a corresponding dynamic baseline for each of the monitoring indicators includes the following steps: The historical data of each of the monitoring indicators are used to train the corresponding time series model; wherein, the trained time series model serves as the dynamic baseline for the corresponding monitoring indicator.

[0040] The AI ​​algorithm, based on LSTM neural networks and the Prophet algorithm, establishes a dynamic baseline for each monitoring metric (such as response time and request volume). This baseline can learn cyclical patterns (such as daily peaks and weekly troughs) and trend changes. When real-time monitoring data deviates from the baseline by a certain range, the AI ​​algorithm generates an anomaly event and sends it to the alarm module.

[0041] Optionally, the method further includes the following steps: The target response data is displayed to the user in a preset format; After each call to the target interface, the target response data is updated accordingly, thereby updating the displayed target response data.

[0042] Specifically, all data is written into a form and presented to the user. This data can then be monitored in the alerting module, and the API response speed over a period of time can be displayed as a line graph. Each API call refreshes the saved data.

[0043] Optionally, pushing the first alarm data and the second alarm data to the user includes the following steps: If the target interface continuously triggers the generation of the first alarm data or the second alarm data a preset number of times within the set convergence period, then pushes one piece of the first alarm data or the second alarm data to the user. During the set time period, stop pushing the first alarm data and the second alarm data to the user; Select any one of the monitoring metrics and add it to the notification template. Add the first alarm data and the second alarm data to the notification template and push the notification template to the user via email or instant messaging software.

[0044] Specifically, when a monitoring device triggers an alarm, it enters the alarm convergence submodule. Alarm convergence deduplicates and consolidates identical duplicate alarm messages within a specified time period. Based on convergence rules, the system integrates duplicate alarms to avoid a reception storm caused by a large number of duplicate alarm messages, thus reducing redundant alarms. Alarm convergence is optional; the convergence period for duplicate alarms is set in the convergence strategy, for example, to 60 seconds. Then, one or more existing API monitoring devices are selected. If an API monitoring device triggers six warnings consecutively within one minute, after alarm convergence, only one alarm record will be generated. Next, it enters the alarm silencing submodule. Silent management is typically used during system maintenance or at night / weekends when users don't want to be disturbed by alarms. Similarly, alarm silencing is also optional; alarm silencing rules can be configured for a one-time time period or periodic time periods, supporting matching monitoring devices with different alarm levels. Finally, the system generates alarm records, which users can view in the alarm center.

[0045] The notification module is used to configure alarm notification templates and notification methods. Notification templates can be customized by users and support passing in variables, i.e., response data stored in the monitoring module, and selecting a certain monitoring indicator to add to the template content. Notification methods support email or instant messaging software, etc.

[0046] Optionally, the method further includes the following steps: The target response data, the first alarm data, and the second alarm data are analyzed periodically. Based on the analysis results, an optimization suggestion report is generated for the candidate threshold rules and the dynamic baseline.

[0047] Specifically, AI algorithms periodically (e.g., weekly) analyze monitoring and alarm data to generate optimization suggestion reports. For example, they may suggest adjusting unreasonable thresholds, merging similar alarm rules, or recommending expansion times.

[0048] The following sections will provide a detailed description and explanation of some optional embodiments of this application, using specific application examples.

[0049] The core innovation of this application's embodiments lies in the introduction of an AI intelligent analysis engine, which is deeply integrated with the monitoring and alarm modules to form the processing core of the system. The overall architecture is as follows: Figure 2 As shown.

[0050] Specifically, the data flow is described as follows: (1) Data display: The display module displays monitoring items, alarm lists, notification information, and indicators of response data returned by the monitoring module in the form of charts based on the information of the monitoring and alarm modules configured in the monitoring module.

[0051] (2) Data persistence storage: The monitoring module persists the collected monitoring data to the database according to the time series.

[0052] (3) Data Sharing and Reference: A "shared data pool" is designed so that data obtained by one monitoring system can be provided to another monitoring system as a request parameter to call the API. Different monitoring configurations can establish connections. For example, if monitoring B references {{AuthMonitor.token}} in its header, the system will obtain this variable from the result returned by monitoring A (AuthMonitor) before executing monitoring B, and reference this data when configuring monitoring B to achieve automatic transmission of authentication tokens.

[0053] (4) Model training: The AI ​​analysis module regularly retrieves historical data accumulated by the monitoring module and threshold rule data from the alarm module from the database to retrain and optimize the model in the AI ​​algorithm.

[0054] (5) Threshold: The AI ​​analysis module recommends appropriate threshold setting rules based on the monitoring type, scenario, and environment. When the threshold is reached and an alarm is triggered, the AI ​​analyzes the severity of the event based on the health baseline and strategies established through long-term learning, and decides whether to trigger an alarm and the alarm level.

[0055] (6) Closed-loop feedback: Alarm processing status and execution results can be recorded and used as feedback signals to optimize AI analysis strategies.

[0056] Next, the various modules involved in the embodiments of this application will be described.

[0057] I. Monitoring Module.

[0058] The specific process of the monitoring module is as follows: Figure 3 As shown. First, add a new API interface to monitor. After successful addition, the system will send a request to the target API based on the HTTP / TCP protocol, obtain and parse the response data. Most interfaces respond with data in application / json format, and the system stores the response data in key-value pair format. For example, the following is the response data returned when requesting a login interface: { "code": 200, "msg": "Login successful", "token": "34a8a3b1-c2a9-4935-8762-bd098bf55711" } All data is written into a form and presented to the user. This data can then be monitored in the alerting module, and the API response speed over a period of time can be displayed as a line graph. Each API call refreshes the saved data, and the response data can be passed to other monitoring systems. For example, adding a new personal information API monitoring entry can select a token value from the login API monitoring entry as a parameter for Authorization authentication, ensuring that this monitoring entry can correctly initiate the request.

[0059] The page for adding monitoring links consists of various API attributes and corresponding text input or selection boxes. Users can fill in relevant information about the target host, such as IP address, port number, request method, header parameters, body parameters, etc. After confirming the information is correct, a request can be sent to the API address. The specific process for adding monitoring links is as follows: Figure 4 As shown.

[0060] Examples of data sharing and referencing functions: To facilitate understanding of the data sharing and referencing functionality, a common APP API monitoring scenario will be used as an example. Currently, most APPs require users to log in to use all functions. If you want to monitor a page accessible only while logged in (e.g., a user accessing their profile to view their information), you must include the user's token in the request. The token is data returned by the server when the user logs into the APP. Therefore, to monitor the personal information API, you need to first request the login API to obtain the token. Thus, the system needs to add two monitoring APIs: one for the login API and one for the personal information API. First, request the login API, obtain and store the complete response data, which includes the token attribute: { "code": 200, "msg": "Login successful", "token": "34a8a3b1-c2a9-4935-8762-bd098bf55711" } When adding personal information monitoring, selecting this token from login monitoring as the authentication parameter ensures the system can correctly send requests to the personal information API and return the following response data: { "code": "200", "obj": { "id": 124431, "account": "180****2153", "sex": man, "mobile": "180****2153", } } As seen in the example code above, the returned "code" value is 200, indicating a successful request and no errors in the interface. By checking if the status code "code" is 200, we can determine if the personal information interface is functioning correctly; other status codes indicate interface errors. However, there's a problem: we can't call the login API every time we monitor the personal information API. Frequent requests waste server resources and might be mistaken for attacks, leading to IP blocking. Therefore, the monitoring period for the login API can be adjusted to 3 days, and the interface's response time should be monitored. If it's below 1000 ms, an alarm should be triggered, thus completing the monitoring of the login API.

[0061] The flowchart of the API interface monitoring system is as follows: Figure 5 As shown.

[0062] II. AI Analysis Module.

[0063] (1) The AI ​​analysis module recommends appropriate threshold setting rules based on the type, scenario, and environment of the monitoring. Functionality: When a user creates a monitoring point, the AI ​​algorithm recommends initial threshold settings (such as response time, error rate, etc.) based on historical data of the API (if available) or general patterns of similar APIs. For example, for a login API, it might recommend focusing on the error rate; for a query API, it might recommend focusing on the response time.

[0064] Operational process: User creates monitoring -> AI analysis module starts -> Intelligent threshold recommendation process.

[0065] a. Users configure a new monitoring function, selecting the monitoring type (e.g., HTTP API) and scenario (e.g., e-commerce login).

[0066] b. The system calls the "threshold recommendation" function of the AI ​​algorithm and passes in the monitoring response data (type, scene, environment label, etc.).

[0067] c. The AI ​​algorithm returns a set of recommended threshold parameters based on the built-in rule model (which may be a statistical or machine learning model based on historical monitoring data), such as: response time warning threshold 500ms, critical threshold 1000ms; error rate threshold 1%.

[0068] d. Users can choose to accept the recommendation or modify it manually.

[0069] Example: A user wants to monitor a "payment interface." Based on historical data, the AI ​​algorithm finds that the median response time for similar payment interfaces during peak hours (e.g., 8 PM) is 800ms. Therefore, it recommends setting the warning threshold to 120% of 800ms (960ms) and the critical threshold to 200% of 800ms (1600ms). Additionally, because payment interfaces are sensitive to error rates, an error rate threshold of 0.1% is recommended.

[0070] (2) Intelligent baseline modeling and anomaly detection module.

[0071] Functionality: The AI ​​algorithm, based on LSTM neural networks and the Prophet algorithm, establishes a dynamic baseline for each monitoring metric (such as response time and request volume). This baseline can learn cyclical patterns (such as daily peaks and weekly troughs) and trend changes. When real-time monitoring data deviates from the baseline by a certain range, the AI ​​algorithm generates an anomaly event and sends it to the alarm module.

[0072] Operation process: a. Training Phase: The AI ​​algorithm periodically (e.g., daily) reads historical data (at least two weeks' worth) from the database for each monitoring metric and trains it using a time series model (such as Prophet, LSTM) to obtain a baseline model for that monitoring metric. The model captures daily, weekly, and even yearly periodicity, as well as the impact of special dates (such as holidays).

[0073] b. Prediction phase: Each time monitoring data is reported (or according to a fixed time window, such as 5 minutes), the AI ​​algorithm uses the trained model to predict the expected value range at the current time point (for example, predicting a response time of 200ms, with a fluctuation of 20%).

[0074] c. Anomaly Detection: The actual value is compared with the predicted range. If it exceeds the range, it is marked as an anomaly. Simultaneously, the AI ​​algorithm considers the duration and magnitude of the anomaly to determine whether to trigger an alarm.

[0075] d. Interaction with the alarm system: The AI ​​algorithm writes abnormal events into the "abnormal event table" in the database. The alarm module listens to this table, reads new abnormal events, and generates alarms according to pre-configured alarm rules (e.g., an alarm is triggered if the same monitored item experiences 3 abnormalities within 5 minutes). Simultaneously, the AI ​​algorithm can also directly push abnormal events to the alarm module via a message queue.

[0076] Example: A weather query API experiences high request volume between 8 AM and 10 AM daily, with a baseline response time of 300ms. In the early morning, request volume is low, with a baseline response time of 100ms. One day at 2 AM, the response time suddenly spikes to 400ms. While the absolute value isn't high, it deviates significantly from the baseline (100ms) for that period, triggering an AI algorithm to generate an anomaly event. Upon receiving this event, the alert module checks the monitoring alert rules (e.g., triggering if the abnormal response time persists for 10 minutes during the early morning period) and then generates an alert.

[0077] (3) Output AI analysis reports, including optimization suggestions for monitoring and alarms.

[0078] Function: AI algorithms periodically (e.g., weekly) analyze monitoring and alarm data to generate optimization suggestion reports. For example, they may suggest adjusting unreasonable thresholds, merging similar alarm rules, or recommending expansion times.

[0079] Operation process: a. Data collection: AI algorithms collect monitoring metrics, alarm events, alarm handling records, etc. from the database over a period of time (such as one week).

[0080] b. Analysis: Through statistical analysis, we found that: the alarm threshold of a certain monitoring device is set too low, resulting in frequent alarms; the capacity of a certain service is close to the bottleneck and needs to be expanded; or certain alarm rules are always triggered at the same time and can be merged.

[0081] c. Report generation: The analysis results are generated into a structured report, stored in the database, and sent to the operations and maintenance personnel through the notification module.

[0082] Example: AI algorithm analysis revealed that a certain "product search API" triggered response time alerts every day between 3 PM and 4 PM for the past week, but the actual user experience was not affected (error rate did not increase). Further analysis showed that this period coincided with a promotional event, and the increase in response time was normal. Therefore, the AI ​​report recommends increasing the response time threshold for this API by 50% between 3 PM and 4 PM, or setting a separate threshold for this period.

[0083] The architecture diagram of the AI ​​analysis module is as follows: Figure 6 As shown.

[0084] III. Alarm Notification Module.

[0085] In the alarm module, alarm rules need to be set for each monitoring item for the monitoring to take effect. The specific process is as follows: Figure 7 As shown.

[0086] First, set the alarm threshold rules. The response data obtained from each API monitoring is used as the monitoring metric. Taking the data obtained from the login interface of the monitoring module as an example, the rules are as follows: 1. "code" = 200, meaning the status code value is 200.

[0087] 2. The token must conform to the format “xxx-xxx-xxx-xxx”, where “xxx” is a number or uppercase and lowercase letter.

[0088] 3. The interface response time is less than or equal to 1000ms.

[0089] Then set the monitoring period in hours, minutes, and seconds; next, set the trigger condition to match any rule or all rules, and you can also set the alarm level, such as urgent, critical, or minor; finally, the system calls the interface periodically according to the set monitoring period to detect and calculate indicator data, and determines whether to trigger an alarm by comparing the results.

[0090] When a monitoring device triggers an alarm, the alarm convergence submodule is invoked. Alarm convergence deduplicates and consolidates identical, repetitive alarm messages within a specified time period. Based on convergence rules, the system integrates duplicate alarms to prevent a reception storm caused by a large number of duplicate alarm messages, thus reducing redundant alarms. Alarm convergence is an optional configuration. The convergence strategy sets the convergence period for duplicate alarms, for example, 60 seconds. Then, one or more existing API monitoring devices are selected. If an API monitoring device triggers six warnings consecutively within one minute, after alarm convergence, only one alarm record will be generated. Next, the alarm silencing submodule is invoked. Silent management is typically used during system maintenance or at night / weekends when users want to avoid alarm disturbances. Similarly, alarm silencing is also optional. Alarm silencing rules can be configured for a one-time period or periodic periods, supporting matching monitoring devices with different alarm levels. Finally, the system generates alarm records, which users can view in the alarm center.

[0091] The notification module is used to configure alarm notification templates and notification methods. Notification templates can be customized by users and support passing in variables, i.e., response data stored in the monitoring module, and selecting a certain monitoring indicator to add to the template content. Notification methods support email or instant messaging software, etc. The embodiments of this application include at least the following beneficial effects: Compared with traditional operation and maintenance monitoring systems based on rules and static thresholds, the embodiments of this application transform the operation and maintenance work from a "human experience-driven, passive response" mode to a new "data intelligence-driven, proactive prediction" mode.

[0092] This application incorporates AI algorithms, representing not merely a technological tool upgrade, but a comprehensive leap forward in operational concepts and efficiency. It injects the core capabilities of AI algorithms—perception, cognition, prediction, and decision-making—into every aspect of operational monitoring, building a robust "digital immune system" for enterprises. This not only significantly reduces operational costs and business risks but also liberates the operations team from repetitive and inefficient tasks, enabling them to truly become the core force ensuring and driving high-quality business development, possessing extremely high commercial value and technological advancement.

[0093] Reference Figure 8 This application also provides an AI-based intelligent monitoring device that can implement the aforementioned AI-based intelligent monitoring method. The device includes: The indicator monitoring unit is used to acquire target response data returned by the monitoring target interface; wherein, the target response data includes at least one monitoring indicator; The threshold rule generation unit is used to output candidate threshold rules corresponding to the monitoring indicators based on the rule model preset by the AI ​​algorithm. A threshold rule determination unit is used to determine the candidate threshold rule as a first actual threshold rule in response to a user's selection operation; or, in response to a user's modification operation, modify the candidate threshold rule to obtain a second actual threshold rule. The first alarm unit is used to output first alarm data if the monitoring indicator does not match the first actual threshold rule or the second actual threshold rule. A baseline establishment unit is used to establish corresponding dynamic baselines for each of the monitoring indicators; wherein each of the dynamic baselines is used to learn the periodic patterns and trend changes of the corresponding monitoring indicators. The second alarm unit is used to output second alarm data when any of the monitoring indicators deviates from the corresponding dynamic baseline setting range; An alarm push unit is used to push the first alarm data and the second alarm data to the user.

[0094] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0095] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method of this application. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0096] It is understood that the content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the methods of this application, and the beneficial effects achieved are also the same as those achieved by the methods of this application.

[0097] Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 101 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 102 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 102 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 102 and is called and executed by the processor 101. Input / output interface 103 is used to implement information input and output; The communication interface 104 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 105 transmits information between various components of the device (e.g., processor 101, memory 102, input / output interface 103, and communication interface 104); The processor 101, memory 102, input / output interface 103 and communication interface 104 are connected to each other within the device via bus 105.

[0098] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method of this application.

[0099] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0100] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0101] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0102] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0103] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0104] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0105] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0106] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0107] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0108] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0109] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0110] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0111] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0112] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. An intelligent monitoring method based on AI algorithms, characterized in that, The method includes the following steps: Obtain the target response data returned by the monitoring target interface; wherein, the target response data includes at least one monitoring metric; The candidate threshold rules corresponding to the monitoring indicators are output using a rule model preset by the AI ​​algorithm. In response to a user's selection operation, the candidate threshold rule is determined as the first actual threshold rule; or, in response to a user's modification operation, the candidate threshold rule is modified to obtain the second actual threshold rule. If the monitoring metric does not match the first actual threshold rule or the second actual threshold rule, then the first alarm data is output. Establish corresponding dynamic baselines for each of the monitoring indicators; wherein each of the dynamic baselines is used to learn the periodic patterns and trend changes of the corresponding monitoring indicator. When any of the monitoring indicators deviates from the corresponding dynamic baseline setting range, a second alarm data is output; The first alarm data and the second alarm data are pushed to the user.

2. The intelligent monitoring method based on AI algorithm according to claim 1, characterized in that, The process of obtaining the target response data returned by the monitoring target interface includes the following steps: Add monitoring for the first target interface; A request is initiated to the first target interface based on the HTTP / TCP protocol; Obtain and parse the first response data returned by the first target interface; Obtain the second response data of the second target interface based on the first response data; The first response data and the second response data are stored in key-value pair format.

3. The intelligent monitoring method based on AI algorithm according to claim 2, characterized in that, The step of obtaining the second response data of the second target interface based on the first response data includes the following steps: Select at least one of the monitoring metrics as authentication parameters from the first response data of the first target interface; Send a request to the second target interface carrying the authentication parameters; Obtain and parse the second response data returned by the second target interface.

4. The intelligent monitoring method based on AI algorithm according to claim 1, characterized in that, The establishment of corresponding dynamic baselines for each of the monitoring indicators includes the following steps: The historical data of each of the monitoring indicators are used to train the corresponding time series model; wherein, the trained time series model serves as the dynamic baseline for the corresponding monitoring indicator.

5. The intelligent monitoring method based on AI algorithm according to claim 1, characterized in that, The method further includes the following steps: The target response data is displayed to the user in a preset format; After each call to the target interface, the target response data is updated accordingly, thereby updating the displayed target response data.

6. The intelligent monitoring method based on AI algorithm according to claim 1, characterized in that, The step of pushing the first alarm data and the second alarm data to the user includes the following steps: If the target interface continuously triggers the generation of the first alarm data or the second alarm data a preset number of times within the set convergence period, then pushes one piece of the first alarm data or the second alarm data to the user. During the set time period, stop pushing the first alarm data and the second alarm data to the user; Select any one of the monitoring metrics and add it to the notification template. Add the first alarm data and the second alarm data to the notification template and push the notification template to the user via email or instant messaging software.

7. A smart monitoring method based on AI algorithm according to any one of claims 1 to 6, characterized in that, The method further includes the following steps: The target response data, the first alarm data, and the second alarm data are analyzed periodically. Based on the analysis results, an optimization suggestion report is generated for the candidate threshold rules and the dynamic baseline.

8. An intelligent monitoring device based on AI algorithms, characterized in that, The device includes: The indicator monitoring unit is used to acquire target response data returned by the monitoring target interface; wherein, the target response data includes at least one monitoring indicator; The threshold rule generation unit is used to output candidate threshold rules corresponding to the monitoring indicators based on the rule model preset by the AI ​​algorithm. A threshold rule determination unit is used to determine the candidate threshold rule as a first actual threshold rule in response to a user's selection operation; or, in response to a user's modification operation, modify the candidate threshold rule to obtain a second actual threshold rule. The first alarm unit is used to output first alarm data if the monitoring indicator does not match the first actual threshold rule or the second actual threshold rule. A baseline establishment unit is used to establish corresponding dynamic baselines for each of the monitoring indicators; wherein each of the dynamic baselines is used to learn the periodic patterns and trend changes of the corresponding monitoring indicators. The second alarm unit is used to output second alarm data when any of the monitoring indicators deviates from the corresponding dynamic baseline setting range; An alarm push unit is used to push the first alarm data and the second alarm data to the user.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.

Images