Automatic monitoring rule generation method based on host portrait

Abstract

The invention discloses an automatic monitoring rule generation method based on a host portrait, particularly relates to the technical field of host monitoring and artificial intelligence, and is used for solving the problems of low host monitoring configuration efficiency, incapability of dynamically adapting along with hardware and business changes and high monitoring efficiency in a large-scale heterogeneous environment. And the problem of low alarm accuracy caused by difficulty in giving consideration to periodic fluctuation and random noise in a traditional threshold algorithm is solved. Through multi-protocol security data acquisition and host portrait recognition based on deep learning, a three-layer dynamic threshold generation mechanism of adaptive smoothing, statistical significance and periodic comparison is fused, so that the effect that a monitoring rule is automatically adapted along with host functions, operation rules and load characteristics is achieved; the problems of low efficiency of traditional static rule configuration and alarm sensitivity imbalance caused by a single threshold aperture in a large-scale heterogeneous environment are effectively solved.

Description

Technical Field

[0001] This invention relates to the fields of host monitoring and artificial intelligence technology, specifically a method for automatically generating monitoring rules based on host profiles. Background Technology

[0002] Currently, host device monitoring primarily employs manual configuration or semi-automated modes based on preset templates. Technicians typically need to know the host device's hardware parameters, system type, and operating services in advance, and manually enter metrics, thresholds, and alarm trigger conditions into the monitoring system. While some existing technologies use fixed templates to improve efficiency, the templates are outdated and lack flexibility, making them difficult to adapt to new host devices or complex, customized business scenarios. This results in extremely low configuration efficiency and a high risk of configuration omissions in large-scale cluster environments.

[0003] Regarding alarm threshold settings, traditional technologies often rely on fixed values ​​or single dynamic algorithms. Fixed empirical thresholds cannot adapt to the periodic fluctuations in host load (such as e-commerce peaks) and short-term sudden jitters, often leading to severe false alarms during peak hours or abnormal missed alarms during off-peak hours. Existing single dynamic algorithms, such as those using only Exponentially Weighted Moving Average (EWMA) for time-series smoothing or relying solely on 3-sigma theory for statistical judgment, often only solve part of the fluctuation adaptation problem and cannot take into account the multiple impacts of time-series trends, statistical significance, and business cycle. Furthermore, when host hardware upgrades or business adjustments occur, existing monitoring systems lack the self-healing capability of dynamic perception, still requiring significant manpower for reconfiguration, which can easily cause a disconnect between monitoring logic and actual operating status.

[0004] In summary, the core problem with existing technologies lies in the fact that the generation and adjustment logic of monitoring rules lacks accurate perception of host identity profiles and cannot achieve deep coupling between multi-dimensional load fluctuation characteristics and dynamic environmental changes. This "static and isolated" monitoring mode is in significant conflict with the "dynamic and differentiated" requirements of large-scale heterogeneous host environments, making it difficult for the monitoring system to maintain high-precision alarm capabilities and automated operation and maintenance efficiency throughout its entire lifecycle. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for automatically generating monitoring rules based on host profiles, thereby resolving the problems mentioned in the background section.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for automatically generating monitoring rules based on host profiles, comprising: S1. Obtain the target host's hardware parameters, operating indicator sequences, and business process data by collecting the protocol stack in conjunction with the instruction whitelist; S2. Perform feature mapping on the acquired data and use a deep learning model to identify the business scenario tags of the target host in order to build a host profile; S3. Based on the host profile, dynamically select smoothing weights for the indicator fluctuation coefficients, perform exponential weighted moving average processing on the running indicator sequence, and output the time-series smoothed sequence. S4. Determine the basic boundary by combining the statistical distribution of three standard deviations of the time-series smoothed sequence, and use the similarity coefficient of historical data from the same period to correct the basic boundary in order to generate a dynamic alarm threshold. S5. Match the logical dependencies of multiple indicators corresponding to business scenario tags, combine dynamic alarm thresholds to generate structured monitoring rules and load them into the monitoring execution unit; S6. Real-time monitoring of the statistical mutation characteristic value of the average indicator. When the statistical mutation characteristic value reaches the preset judgment threshold, the structured monitoring rules and dynamic alarm thresholds are updated synchronously.

[0007] Furthermore, S1 includes: A data channel is established by integrating a remote login protocol, a network management protocol, and a built-in agent program into a data acquisition protocol stack; Match a whitelist of commands consisting of pre-approved read-only system query commands to isolate unauthorized write operations; Establish protocol and field mapping logic to map remote login protocol to system-level operation indicator sequence, network management protocol to underlying hardware parameters, and built-in agent program to application layer business data; A linear interpolation process is performed on the collected raw discrete data to construct a straight line trajectory using adjacent valid known points to compensate for missing sampling points.

[0008] Furthermore, S2 includes: Perform feature mapping to transform the raw metric data into a high-dimensional feature vector that includes hardware features, process features, log features, and time-series metric features. By using deep learning models to extract the spatial correlation of monitoring indicators through convolutional layers and using long short-term memory layers to capture the trend dependence of indicators in the time dimension, business scenario labels can be identified from high-dimensional feature vectors. Version locking is performed on business scenario tags and a hash digest evidence chain is generated to achieve identity locking of hosts in a multi-tenant isolation environment; Based on a two-dimensional index of tenant and host identifiers, the identified host profiles are stored in the tenant logical partition.

[0009] Furthermore, S3 includes: The arithmetic ratio of the standard deviation to the mean of the operating indicator sequence within the observation period is obtained to determine the indicator volatility coefficient. Segmented quantization mapping logic is executed based on the indicator volatility coefficient to select smoothing weights; The original operational index sequence is processed by weighted moving average using smoothing weights. The time-series smoothed sequence is output by assigning different proportions of weights to the original observation value at the current time and the historical smoothed value at the previous time. The time-series smoothed sequence is stored in the runtime context cache partition bound to the host profile.

[0010] Furthermore, S4 includes: Select the corresponding historical synchronous sampling window based on the operating rhythm identified from the host profile; Calculate the Pearson correlation coefficient between the historical contemporaneous comparison sequence and the time-series smoothed sequence within the historical contemporaneous sampling window to obtain the similarity coefficient; Calculate the arithmetic ratio of the mean of the historical comparative series to the mean of the time-series smoothed series to determine the adjustment factor; When the similarity coefficient reaches a preset threshold, the basic boundary is corrected using an adjustment coefficient.

[0011] Furthermore, the distribution characteristics of the operational indicator sequence are identified. When the operational indicator sequence exhibits skewed characteristics, the difference between the 75th quartile and the 25th quartile of the time-series smoothed sequence is calculated using the median absolute deviation method to construct an anomaly judgment range. The anomaly detection range is corrected using an adjustment coefficient to determine the dynamic alarm threshold. The generated dynamic alarm thresholds are stored in an in-memory state library in a structured record format with timestamps and version numbers.

[0012] Furthermore, S5 includes: Based on business scenario tags, match the multi-metric logical dependencies composed of logical operators, and combine them with dynamic alarm thresholds to encapsulate them into structured monitoring rules that include object identifiers, triggering operators, alarm levels, and durations. Structured monitoring rules are stored in a central configuration repository indexed by tenant and host identifiers; Utilize a publish-subscribe mechanism to push structured monitoring rules to the monitoring execution unit; The system executes idempotent policies and deduplication logic, eliminating duplicate instructions by comparing the feature values ​​of the rule content to ensure that the target host loads only one set of monitoring rules under the same version number.

[0013] Furthermore, S6 includes: Calculate the standardization deviation of the current instantaneous data of the mean of the operational index sequence relative to the historical baseline data to determine the statistical mutation characteristic value; Identify hardware expansion and major service switching by combining hardware configuration change information; When the statistical mutation characteristic value continuously reaches the judgment threshold within the preset observation window, the host status is confirmed to have undergone a qualitative change, and the self-healing action of monitoring rule recalculation and parameter alignment is automatically triggered. Set an update suppression period, continuously monitor the indicator status during the suppression period, and stop responding to recalculation proposals; Update the triggering basis, parameter comparison, and result snapshot to the evidence chain snapshot library to generate the audit evidence chain.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. By collecting multi-protocol security data and identifying host profiles based on deep learning, and integrating a three-layer dynamic threshold generation mechanism of adaptive smoothing, statistical significance and periodic comparison, the monitoring rules are automatically adapted to the host functions, operating rules and load characteristics. This effectively solves the problems of low efficiency of traditional static rule configuration and imbalance of alarm sensitivity caused by a single threshold in large-scale heterogeneous environments.

[0015] 2. By constructing a closed-loop optimization mechanism based on statistical mutation monitoring, idempotent loading of structured rules, and manual feedback correction, the monitoring logic achieves real-time self-healing as the host hardware and software environment evolves and the business architecture is adjusted. This effectively avoids the risks of monitoring disconnection and alarm drift caused by environmental changes, ensuring the continuous and stable operation of the monitoring system throughout its entire lifecycle. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the automatic generation method for monitoring rules based on host profiles according to the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example: A method for automatically generating monitoring rules based on host profiles, comprising: S1. Obtain the target host's hardware parameters, operational indicator sequences, and business process data by collecting the protocol stack in conjunction with the instruction whitelist. The specific implementation is as follows: The primary aspect of this invention lies in secure data acquisition and alignment. This process, implemented on actual production lines, possesses comprehensive awareness capabilities of physical servers, virtualization platforms, and multi-cloud hosts, and its applicability covers real-time status monitoring tasks for various large-scale heterogeneous host clusters. In this process, the acquisition protocol stack refers to a set of communication protocols used to establish data channels with different types of host environments. By integrating remote login protocols, network management protocols, and built-in agent programs, it ensures stable data transmission across various network environments. The accompanying instruction whitelist is a core security strategy, defined as a pre-approved set of operation instructions containing only read-only system query commands. Its function is to physically isolate any unauthorized write operations, fundamentally preventing the monitoring and sampling process from mistakenly executing high-risk instructions and interfering with the safe operation of the host.

[0019] In the specific execution process, the system needs to accurately extract three types of core information from the target host environment: hardware parameters, operational indicator sequences, and business process data. Specifically, this process establishes precise indicator field mapping logic for different communication protocols: the remote login protocol is mainly used to extract real-time operational indicators at the system level, such as CPU utilization and memory usage as percentages; the network management protocol is specifically used to obtain the host's underlying hardware static parameters, such as the number of CPU cores, the logical capacity of the storage disk, and the media type; and the built-in agent program focuses on collecting application-level business-depth data, such as transaction volume per second, interface response time in milliseconds, and the real-time liveness status of core business processes. This fixed mapping relationship between protocols and fields ensures that data from different sources has a clear physical meaning and business attributes before entering the analysis unit.

[0020] Hardware parameters include descriptions of the host's physical or logical attributes, such as static fields like the total number of CPU cores and the media type of storage disks; operational metrics refer to quantified values ​​that change dynamically over time, such as system load rate as a percentage or network interface throughput bandwidth in bits per second; business process data focuses on application-level status feedback, such as concurrent access volume as the number of requests per unit time, and the real-time liveness status of core application processes.

[0021] To ensure the accuracy of subsequent rule generation, the acquisition rhythm is set to a constant sampling period. After acquiring the original discrete data, the system will start the linear interpolation process for preliminary processing. Linear interpolation is a mathematical compensation method that uses adjacent valid known points to construct a straight line trajectory to estimate the value of missing positions. Its purpose is to eliminate the missing isolated sampling points caused by instantaneous network jitter, so that the data stream maintains strict alignment and noise reduction balance on the time axis.

[0022] In the real-time control logic of the production site, if the response time of a single data acquisition request exceeds a preset limit, the system will automatically switch to the fault-tolerant handling procedure, triggering continuous retry actions. If the retry reaches the limit number and still cannot obtain effective feedback, a standardized error code will be pushed to the operation and maintenance unit by the interface protocol defined by natural text. Specifically, when the data acquisition behavior triggers the security red line of the instruction whitelist, a 403 error code will be returned to warn of verification failure; and when the communication link has no data interaction within a specified time, a 504 error code will be returned to indicate communication timeout.

[0023] In a preferred embodiment, the process parameters during this acquisition phase can be finely combined according to the specific production load. Preferably, the acquisition rhythm can be set to once per minute, ensuring that the upper limit of the monitoring rule generation delay for a single host is strictly controlled within ten seconds through high-frequency cyclic probing. Preferably, the timeout threshold for a single request can be set to three seconds. After detecting an acquisition failure, the system preferably performs three immediate retries, with the interval between each retrieval set to two seconds, to avoid transient network congestion.

[0024] Regarding the selection of data collection fields, for example, for application servers, the system focuses on extracting key operational metrics such as memory utilization and transaction volume per second in business processes through the collection protocol stack; while for database hosts, it prioritizes acquiring key operational metrics such as disk read / write latency and cache hit rate. In the data alignment stage, the linear interpolation process preferentially fits the slope based on two valid sample points before and after the missing point, thereby achieving accurate completion of data boundaries in a multi-dimensional coordinate system. Through the above parameterized configuration, this stage of the process can provide consistent, logically aligned, and security-hardened underlying data support for subsequent host profiling, ensuring robust data recording and idempotent data retrieval under any abnormal circumstances.

[0025] This stage of the process establishes a closed-loop data collection system in the field environment, including identity auditing, anomaly retries, and data compensation. The resulting structured data packets are stored in a high-speed cache in a preset format and are then sequentially invoked by the host profile feature extraction logic in the next stage through standardized interfaces.

[0026] S2. Perform feature mapping on the acquired data and use a deep learning model to identify the business scenario tags of the target host to construct a host profile. The specific implementation is as follows: After completing secure data acquisition and alignment, the process proceeds to feature mapping and identity locking. This process, on actual production lines, possesses the capability for deep semantic analysis and logical identity definition of massive amounts of heterogeneous monitoring data. Its applicability covers ultra-large-scale production clusters containing over a thousand different host configurations and over fifty complex business scenarios. In this stage, the system performs feature mapping on the raw discrete data acquired in the preceding stages. Feature mapping refers to the process of transforming unstructured or semi-structured raw indicator data into a computable digital expression in mathematical space through normalization, discretization, and vectorization. Through feature mapping, the system transforms originally independent hardware parameters, indicator values, and process states into high-dimensional feature vectors. These high-dimensional feature vectors are defined as a joint numerical array containing hardware features, process features, log features, and indicator time-series features. As a global feature representation of host status, it can depict the complete picture of the target host in terms of physical attributes and logical operating rules.

[0027] Based on feature generation, the system utilizes a deep learning model to identify high-dimensional feature vectors to obtain the business scenario labels of the target host. Here, the deep learning model specifically refers to a classification and recognition architecture based on the fusion of convolutional neural networks and long short-term memory networks. It extracts the spatial correlation between different monitoring indicators through convolutional layers and captures the trend dependence of indicators in the time dimension using long short-term memory layers, thereby achieving accurate determination of the target host's function.

[0028] During the recognition process of the deep learning model, the system extracts features from the spatial correlation between multi-dimensional monitoring indicators through convolutional layers, such as analyzing the concurrent correlation features between CPU load and disk I / O rate. Simultaneously, it utilizes long short-term memory layers to model the temporal dependencies of time-step sequences over the past 24 hours or week, identifying the trend patterns of data evolution over time. This dual feature processing of spatial and temporal dimensions enables the model to abstract the essential functions of the target host from massive discrete data, achieving accurate determination of business scenario labels.

[0029] The identified business scenario tag is a logical identifier used to describe the core workload attributes of a host, such as e-commerce transaction processing, government office systems, or big data computing. This tag is a core component in building a host profile. A host profile is a logical identity identifier generated based on characteristics such as hardware configuration, operating rhythm, and key business processes. By deeply binding the host's physical resource base with the upper-layer business logic, it forms a digital image used to distinguish different functions such as databases, gateways, or application servers.

[0030] To ensure the stability and compliance of monitoring logic in complex multi-tenant environments, the identified business scenario tags are set as the unique anchor points for subsequent monitoring rule matching. At this stage, all generated tags and profile attributes are version-locked, and a hash digest evidence chain is generated simultaneously. Version locking refers to managing the current identification results through state snapshots, ensuring the consistency of the identification criteria within a specific operational cycle. The hash digest evidence chain refers to generating a unique fingerprint link for host profiles using a one-way encryption algorithm, used to record the generation time, original feature basis, and model version of the identification results. This mechanism ensures that the storage path and calling logic possess physical uniqueness and logical immutability in a multi-tenant isolated environment. Even in scenarios where multiple tenants share a physical cluster, precise routing and secure isolation of monitoring configurations can be achieved through verification of tenant identifiers and hash evidence.

[0031] In a preferred embodiment, the process performance at this stage is enhanced using a large-scale labeled dataset. Preferably, the base dataset used for model training can cover historical monitoring records of no less than 100,000 hosts, with a total data volume of at least 10 terabytes to ensure the model has sufficient generalization ability. During feature mapping, hardware features preferably include the number of CPU cores and clock speed, total memory capacity, and disk media type; process features preferably include the identifier of the core process, the listening port number, and the startup duration; and time-series indicators preferably include the load fluctuation coefficient and the time-series identifier of the daily or weekly cycle.

[0032] Preferably, the recognition accuracy of the deep learning model can be set to no less than 95%, and the average comprehensive evaluation index in the overall evaluation indicators should reach above 0.92. For newly launched hosts without historical trajectories, the system preferably uses a baseline template matching logic based on hardware parameters and known process information to define a preliminary profile, and sets a similarity threshold of 0.7. When the correlation between the target host and the baseline features in the knowledge base meets the standard, the identity can be quickly locked.

[0033] Within the data security boundary, all sensitive information involved in the mapping, such as host Internet Protocol addresses or hardware serial numbers, is preferably encrypted and de-identified before generating high-dimensional feature vectors. The de-identified features retain only statistical regularities and do not contain the original sensitive fields, thus meeting the enterprise-level Level 3 security compliance requirements. After identification, the host profile is stored in a tenant-exclusive logical partition in a structured data format. Its storage architecture is preferably based on a two-dimensional index of tenant and host identifiers, thus providing stable, encrypted, and traceable identity input for smooth processing and threshold calculation in the next stage.

[0034] Through this end-to-end traceability process, the system has built a rigorous process link on the production site, from the characterization of raw data to the solidification of logical identity, ensuring that the generation of each monitoring rule is traceable, version controllable, and environmentally isolated.

[0035] S3. Based on the host profile, dynamically select smoothing weights for the indicator volatility coefficients, perform exponential weighted moving average processing on the running indicator series, and output a time-series smoothed series. The specific implementation is as follows: After completing feature mapping and locking down the logical identity of the target host, the process officially enters the adaptive smoothing and noise reduction stage. This process has demonstrated excellent time-series data purification capabilities on actual production lines. It can perform deep noise reduction on raw indicator streams with high-frequency random noise generated by heterogeneous host environments. Its applicability is wide and compatible with various industrial-grade monitoring scenarios exhibiting non-stationary fluctuation characteristics, ranging from low-load storage nodes to high-concurrency transaction servers.

[0036] In this stage of the process, based on the host profile output from the preceding steps, the system extracts the index fluctuation coefficient, which accurately reflects the dynamic characteristics of the data. The index fluctuation coefficient is the arithmetic ratio of the standard deviation to the average value of a certain operating index within a specific observation period. Its physical meaning lies in quantifying the dispersion of data distribution and the uncertainty of index operation; it is a core statistic for assessing data quality and fluctuation intensity. Using this coefficient as the core decision-making basis, the system performs a weighted moving average processing on the original operating index sequence by dynamically selecting smoothing weights.

[0037] Weighted moving average processing is defined here as a mathematical processing technique that recursively calculates a value reflecting the data evolution trend by assigning different weights to the current raw observation value and the historical smoothed value from the previous time step. Its purpose is to effectively filter out instantaneous observation spikes caused by hardware jitter, network sampling delays, or non-business-related disturbances through a mathematical low-pass filtering effect, while preserving the statistically significant evolution trend in the indicator sequence. This provides a data benchmark within a stable tolerance range that reflects the true load level for subsequent threshold generation.

[0038] In a preferred embodiment, the process actions at this stage are implemented through a parameterized feedback control closed loop. Preferably, the sample length of the observation period can be set to no less than sixty consecutive sampling points to ensure that the calculated index fluctuation coefficient has statistical significance and stability. The smoothing weight, as the core parameter for adjusting the time series sensitivity and smoothness, can be dynamically and linearly switched within a reference range of 0.2 to 0.4 according to the magnitude of the index fluctuation coefficient.

[0039] The selection of smoothing weights follows a specific segmented quantization mapping logic: when the measured index volatility coefficient is less than 0.2, the smoothing weight is preferably set to 0.1, implementing strong noise reduction by increasing the proportion of historical smoothed values; when the index volatility coefficient is in the range of 0.2 to 0.5, the smoothing weight is preferably set to 0.2 to achieve a balance between real-time responsiveness and trend smoothing; and when the index volatility coefficient is greater than 0.5, indicating that the data is in a high-frequency fluctuation state, the smoothing weight is preferably increased to 0.3, so that the process logic can closely follow the latest real-time observation trend. This segmented weight adjustment based on volatility intensity ensures that the smoothing process has a high degree of adaptability.

[0040] For example, in a representative operating condition monitoring the disk input / output rate of a physical storage server, since such metrics typically exhibit extremely high smoothness, when the metric fluctuation coefficient is measured to be less than 0.2, the smoothing weight is preferably locked at 0.1. In this case, the process logic focuses on using strong smoothing to suppress random noise generated by the measurement system, biasing the weights towards historical smoothed values, thereby outputting a highly regular time-series smoothed sequence.

[0041] In another representative operating scenario, such as e-commerce application servers during peak business hours, the sequence of operating metrics often exhibits drastic and frequent fluctuations characteristic of the business, with the metric fluctuation coefficient typically exceeding the 0.5 threshold. Under such conditions, the smoothing weight can be set to 0.3 or higher, tilting the system weight allocation towards real-time observations. This ensures that the process logic can quickly capture and respond to instantaneous trend changes in business load, avoiding delays in important alarm information caused by excessive smoothing.

[0042] Preferably, after processing through this process, the generated time-series smoothing sequence should be able to filter out more than 90% of the instantaneous non-significant jumps in the original operating indicators, while ensuring that the phase delay between the smoothed numerical trajectory and the actual business evolution trend is strictly controlled within two sampling periods, thereby ensuring data robustness while taking into account the real-time monitoring.

[0043] This adaptive adjustment mechanism ensures that the system can automatically match the optimal smoothing strategy when facing monitoring indicators with different fluctuation characteristics, effectively solving the problem of alarm sensitivity imbalance that is prone to occur when traditional fixed-weight schemes face complex dynamic loads. The processed time-series smoothing sequence will be stored in the runtime context cache partition bound to the host profile in the form of structured time-series records, and will follow the security principle of tenant isolation for real-time invocation by the three-standard-deviation boundary calculation and comparison logic of the next stage.

[0044] S4. Determine the basic boundary by combining the statistical distribution of three standard deviations of the time-series smoothed sequence, and correct the basic boundary using the similarity coefficient of historical data from the same period to generate a dynamic alarm threshold. The specific implementation is as follows: After outputting the time-series smoothed sequence with noise reduction, the process enters the multi-caliber threshold generation and correction stage. This process has the ability to accurately characterize the boundaries of highly regular and complex variability indicators on actual production lines. Its applicable scope covers Internet service hosts with obvious daily and weekly cycle characteristics, as well as infrastructure nodes with stable random distribution.

[0045] In this process, the system determines the basic boundary by combining the statistical distribution of the time-series smoothed sequence with three times the standard deviation. The basic boundary refers to the initial numerical interval constructed based on the normal distribution theory, using the mean and standard deviation of historical data, which can cover 99.73% of the normal data fluctuation range. The specific process first involves statistically modeling the time-series smoothed sequence, calculating the arithmetic mean and standard deviation of the data within the observation window, thereby obtaining preliminary upper and lower thresholds. The physical significance of this step is to determine the natural fluctuation range of the indicator after excluding instantaneous noise from a statistical perspective, providing the first layer of logical reference for alarm judgment.

[0046] To address the technical challenge of a single statistical approach failing to adapt to the cyclical fluctuations of business operations, this phase further introduces a similarity coefficient correction logic based on historical data from the same period. Within a 24-hour observation window, the system calculates the correlation between the current trend and the trend from the same period of the previous cycle. The similarity coefficient is a statistical indicator used to quantify the degree of linear correlation between two discrete time series in their evolutionary trends and numerical distributions; in this process, the Pearson correlation coefficient is preferred for characterization.

[0047] Before performing boundary correction, the periodic adaptation layer dynamically selects a sampling window based on the operating rhythm identified by the host profile. For services identified as having daily periodic characteristics, the system preferentially selects the past 1,440 sampling points as the same-period comparison sequence; while for services identified as having weekly periodic characteristics, the system preferentially selects the past 10,080 sampling points for correlation calculation. By calculating the Pearson correlation coefficient between the current smoothed sequence and the historical same-period sequence within the corresponding time span, it ensures that the similarity assessment is based on a periodic axis with business logical significance.

[0048] If the similarity coefficient reaches a preset threshold, indicating that the current host's load fluctuations have a historically predictable pattern, a periodic adaptation layer is initiated for correction. This correction dynamically fine-tunes the alarm threshold by calculating an adjustment coefficient based on the deviation from the mean of the same period. The adjustment coefficient is defined as the arithmetic ratio of the mean of the data from the same period to the mean of the current data, and its function is to shift or expand the baseline boundary based on historical experience. Through this three-layer fusion mechanism of "smoothing-statistics-periodicity," the dynamic alarm threshold ultimately generated by the process can simultaneously consider the statistical significance of the data and the seasonality of the business, ensuring that the alarm threshold is tightened during low-load periods to capture subtle anomalies, while also being relaxed during peak business periods to avoid false alarms.

[0049] In a preferred embodiment, the process execution at this stage is deeply optimized for different indicator distribution characteristics. Preferably, the sampling window for determining the basic boundary can be set to 1,440 sampling points, covering minute-level data from the past 24 hours, to ensure the robustness of the mean and standard deviation calculations. For the similarity coefficient determination, the threshold is preferably set to 0.7; when the calculation result is greater than or equal to this value, it indicates that the current fluctuation trend is highly correlated with historical patterns.

[0050] When performing boundary correction, the adjustment coefficient is preferably limited to a tolerance range of 0.8 to 1.2. If the calculated adjustment coefficient exceeds this range, the boundary value is truncated to prevent excessive threshold shift due to historical abnormal data. For example, in processing a representative operating condition of an e-commerce server, when entering the daytime business peak period, the system detects that the similarity coefficient between the current operating indicator and the same period yesterday reaches 0.89. Through comparison and calculation, the adjustment coefficient is obtained as 1.05. At this time, the original upper limit of the three-standard-deviation basic boundary can be dynamically corrected from 66.5% to 69.83%, thereby enabling the monitoring logic to automatically adapt to the peak load and successfully avoid invalid alarms caused by normal business growth.

[0051] Furthermore, for indicators that are not normally distributed or exhibit severe skewness, this technique provides a median absolute deviation method based on the interquartile range as an alternative to the three-standard-deviation statistical distribution. The median absolute deviation method is a robust estimation method that quantifies the degree of dispersion by calculating the median of the absolute deviation between data points and the median. It has a strong resistance to extreme outliers.

[0052] In this alternative operating condition, the system uses the difference between the 75th and 25th quantiles of the indicator to construct anomaly judgment range, thereby enhancing its ability to characterize the boundaries of extremely skewed data distributions. Through the above multi-caliber coordination and switching, the system has built a threshold generation logic with adaptive correction and distribution adaptation capabilities in the production field, ensuring that each dynamic alarm threshold has strict mathematical support and business rationality. The finally generated dynamic alarm thresholds are stored in the in-memory state database in a structured record format with timestamps and version numbers, and are read and encapsulated in real time by the structured monitoring rule generation logic in the next stage.

[0053] S5. Match the logical dependencies of multiple indicators corresponding to business scenario tags, combine dynamic alarm thresholds to generate structured monitoring rules, and load them into the monitoring execution unit. The specific implementation is as follows: After determining the dynamic alarm threshold, the process proceeds to the rule synthesis and idempotent loading stage. On actual production lines, this process has the capability to transform boundary values ​​generated by high-order algorithms into standardized, executable logical instructions. Its applicability covers the need for fine-grained, multi-dimensional correlation monitoring of large-scale distributed systems, effectively supporting enterprise-level operation and maintenance platforms in the automated encapsulation and rapid distribution of complex business logic.

[0054] In this process, the system first matches the multi-indicator logical dependencies corresponding to business scenario tags, and combines this with the dynamic alarm thresholds generated in the previous steps to generate structured monitoring rules through logical assembly. Multi-indicator logical dependencies refer to a composite judgment logic based on business topology and related influence definitions. Through a combination of logic gate circuits, it stipulates that alarm triggering does not solely depend on the overstepping of a single indicator, but requires multiple complementary indicators to jointly meet the judgment conditions within a specific time window. Structured monitoring rules are digital record documents encapsulated in a unified format, containing monitoring object identifiers, triggering logical operations, alarm severity levels, and dynamic numerical limits. The content architecture of these structured monitoring rules includes a complete logical judgment syntax, supporting composite correlation judgments of multiple indicator operators through logical "AND" or logical "OR" operations.

[0055] The rule fields explicitly define key items such as indicator identifiers, numerical comparison operators, alarm severity levels, trigger determination duration, and alarm suppression strategies. For example, a logical "AND" operator binds the high load threshold of the central processing unit to the business request volume threshold, requiring both conditions to be met simultaneously within a preset duration before an alarm record containing the current value and an environmental snapshot can be output. This record serves as an instruction carrier that can be directly parsed by the monitoring execution unit, achieving a standardized expression of monitoring intent.

[0056] During rule generation and execution, the system uses business scenario tags from the host profile as retrieval keys to retrieve a pre-defined logical framework from the built-in monitoring template library. Subsequently, dynamic alarm thresholds calculated for specific hosts are injected into this framework to form targeted monitoring instructions. The generated rules are stored in a structured string format in a central configuration repository, which is defined as a highly available and strongly consistent distributed storage facility specifically for persistently managing policy snapshots of all hosts. To ensure the real-time delivery of rules, the system uses a publish-subscribe mechanism to push rules to the monitoring execution unit in real time.

[0057] The publish-subscribe mechanism is a message distribution pattern that, through the relay of an event bus, enables monitoring nodes to asynchronously and proactively receive notifications of rule changes to their respective hosts. To ensure the determinism of system status in a production environment, the process flow strictly adheres to idempotency strategies and deduplication logic. Idempotency ensures that the result of repeatedly executing the same configuration operation is completely consistent with the result of a single execution; deduplication logic verifies the rule content using feature values, eliminating redundant instructions with duplicate content or outdated versions. This mechanism ensures that only one set of monitoring rules is effective for the same host under the same version number, fundamentally avoiding system resource contention or duplicate alarm interference caused by policy conflicts.

[0058] In a preferred embodiment, the process details at this stage are optimized through refined logic definitions and transmission control. Preferably, the structured monitoring rules can be encapsulated using an open data exchange format, and the rule content preferably includes a unique rule identifier sequence number, a target host identifier, and hierarchical indicator configuration items. Preferably, the logical dependencies of multiple indicators are set as a composite triggering mechanism. For example, under representative operating conditions for high-concurrency application servers, the alarm triggering logic can be set to generate alarm information only when the indicator load exceeds the standard and the number of related business requests reaches a preset threshold.

[0059] Specifically, the preferred setting is to determine a genuine business pressure anomaly only when the CPU utilization exceeds its corresponding dynamic alarm threshold and the number of requests per second exceeds a quantitative threshold of 3,000. This design can effectively filter out isolated performance fluctuations unrelated to business traffic caused by system background maintenance or short-term computing tasks, and is expected to improve alarm accuracy by more than 40%.

[0060] Preferably, the central configuration repository adopts a key-value pair storage architecture, using tenant identifiers, host identifiers, and version numbers to build a composite index. During the publish / subscribe process, the system preferably sets a maximum delivery delay of five seconds; if a delivery failure is detected, a retry compensation mechanism is automatically initiated. When concurrently processing large-scale host rule updates, the system preferably uses a token bucket algorithm to perform traffic shaping, ensuring that the push rhythm does not exceed the processing load of the monitoring execution unit.

[0061] Preferably, before loading each new rule, the system performs a semantic consistency check on the rule to be applied. If a critical logic deficiency or conflict is detected, a preset error code is automatically returned to ensure the robustness of the loading process. Through this complete process loop, which includes logical matching, structured encapsulation, central storage, and idempotent push, the system builds an efficient transformation path from algorithm model to execution instructions on the production floor, ensuring that every dynamic monitoring rule can accurately, safely, and reliably act on production objectives.

[0062] S6. Real-time monitoring of the statistical abrupt change characteristic value of the average indicator. When the statistical abrupt change characteristic value reaches the preset judgment threshold, the structured monitoring rules and dynamic alarm thresholds are synchronously updated. The specific implementation is as follows: After completing rule synthesis and idempotent loading and entering the real-time execution phase, the process finally enters the mutation monitoring and closed-loop update stage. This process possesses real-time awareness and self-driven optimization capabilities for the evolution of the host operating environment and adjustments to the underlying architecture on actual production lines. Its applicability covers dynamic heterogeneous production environments undergoing rapid evolution, frequent expansion, or rapid iteration of business logic. It ensures long-term synchronization between monitoring logic and physical entities, effectively solving the pain points of monitoring disconnect and alarm drift caused by changes in the software and hardware environment in traditional monitoring rules.

[0063] In this stage of the process, the system utilizes real-time sampled data continuously fed back by the monitoring and execution unit to perform uninterrupted integrity verification of the host status. Statistical mutation eigenvalues ​​are standardized indicators used to quantify the degree of deviation of the current instantaneous collected data from historical benchmark data. In this process, the Z-score statistic is mainly used for characterization, and its core formula is defined as the difference between the instantaneous observation value and the historical mean divided by the historical standard deviation.

[0064] Standardization deviation refers to the process of normalizing the absolute changes of the original indicators through mean and standard deviation, transforming them into statistically significant relative deviation values ​​that can be compared across indicators. This eliminates interference caused by different physical dimensions in the determination of sudden changes. Self-healing refers to the system automatically triggering a closed-loop action of recalculating monitoring rules and aligning parameters without manual intervention after recognizing a qualitative change in the operating environment. Traceability refers to the full recording of the basis, process, parameter comparison, and result snapshots of the update trigger, generating an operational evidence chain with auditable validity to ensure that every rule evolution is traceable.

[0065] In the specific execution process, the monitoring execution unit continuously transmits the latest indicator data back to the analysis logic unit while monitoring the target host in real time. The system quantitatively assesses whether the current host's operating status has experienced a statistically significant drift by monitoring the statistically significant abrupt changes in the average value of the indicators in real time. The judgment logic not only focuses on the fluctuations in the indicator values ​​themselves but also synchronously correlates with changes in the hardware configuration layer. When hardware expansion or a major business switch is detected, the judgment program will be activated immediately. Hardware expansion refers to an increase in the host's underlying physical or virtual resource quotas; a major business switch specifically refers to a fundamental change in core application processes, listening ports, or business logic characteristics. Once the deviation of the indicator value reaches the preset judgment threshold, it is determined that a substantial change has occurred in the current monitoring environment, and the system will immediately trigger a synchronous update program for monitoring rules and dynamic alarm thresholds.

[0066] In a preferred embodiment, the self-healing mechanism's decision logic is robustly reinforced through a refined observation window and continuous trigger thresholds. Preferably, when the system detects a significant change in hardware parameters, such as a 20% change in the number of CPU cores, a 50% change in memory capacity, or a 50% or greater change in disk capacity, the system immediately initiates the instant trigger criterion.

[0067] Preferably, when business characteristics or operational indicators drift, the system, within a set 30-minute observation window, determines whether a qualitative change has occurred by judging whether the statistical mutation characteristic values ​​of five consecutive data points all reach a threshold of 2.5. The threshold of 2.5 is a significance limit set based on normal distribution theory, representing that the current data is in an abnormal range with an extremely low probability, effectively excluding normal instantaneous load fluctuations. Preferably, after confirming the qualitative change in state, the system automatically initiates a synchronous recalculation of rules and thresholds. It re-invokes the host profile recognition logic to determine new business scenario labels and, combined with a three-layer fusion algorithm, recalculates the temporal smoothing weights and statistical boundaries to generate structured monitoring rules adapted to the new state and pushes them for loading in real time.

[0068] After triggering a synchronous recalculation and successfully issuing new rules, the system preferentially sets a 24-hour update suppression period. During this suppression period, the system will continuously monitor the indicator status but will not repeatedly respond to recalculation motions triggered by fluctuations in the same feature value, in order to prevent the monitoring strategy from falling into continuous oscillation due to frequent state fluctuations under extreme operating conditions. At the same time, each statistical mutation feature value that triggers self-healing, the judgment threshold, and the rule version number before and after the update will be stored in the evidence chain snapshot library in the form of structured logs, providing complete audit evidence for subsequent monitoring accuracy evaluation and strategy rollback.

[0069] Preferably, through this closed-loop self-healing mechanism, the system's monitoring continuity on the production site can reach 100%, and hardware changes or business switching can be completed automatically and smoothly without manual intervention. Representative numerical results show that compared with traditional methods that rely on manual reconfiguration or single dynamic thresholds, this process is expected to improve alarm accuracy by more than 40% in actual operation, reduce the number of manual interventions by 95%, and improve alarm processing efficiency by 80%.

[0070] In representative scenarios involving significant business transitions, such as migrating core application processes from one middleware architecture to another, the system can automatically refresh its monitoring strategy immediately after the 30-minute observation window ends by observing synchronous abrupt changes in the mean, standard deviation, and volatility coefficients of key metrics. All updates strictly adhere to version management and rollback mechanisms. After new rules take effect, a 72-hour online evaluation period is preferably initiated, during which the system automatically calculates the false positive rate and the false negative rate.

[0071] Preferably, if the false alarm rate is greater than or equal to 5%, or the missed alarm rate manually marked by operations and maintenance personnel is greater than or equal to 3%, the system will automatically trigger a rollback procedure to restore the stable rules of the previous version and record the anomaly, ensuring the absolute robustness and security compliance of the production environment monitoring logic. This stage of the process, by constructing a highly sensitive feedback loop between the real-time execution layer and the strategy analysis layer, achieves adaptive evolution of the monitoring rules throughout their entire lifecycle, ensuring that every generated rule continuously and accurately reflects the true health status of the host.

[0072] The six stages of the process described in this invention are interconnected. Starting with secure data acquisition, it proceeds through profile recognition, adaptive smoothing, multi-caliber threshold generation, and idempotent rule loading, ultimately achieving closed-loop optimization through mutation monitoring. By deeply coupling static host identity profiles with dynamic temporal features, this process constructs a highly intelligent, secure, reliable, and self-evolving monitoring system in complex industrial-grade operation and maintenance scenarios, providing a complete technical implementation path for the efficient governance of large-scale heterogeneous host clusters.

[0073] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A host image-based monitoring rule automatic generation method, characterized by, include: S1. Obtain the target host's hardware parameters, operating indicator sequences, and business process data by collecting the protocol stack in conjunction with the instruction whitelist; S2. Perform feature mapping on the acquired data and use a deep learning model to identify the business scenario tags of the target host in order to build a host profile; S3. Based on the host profile, dynamically select smoothing weights for the indicator fluctuation coefficients, perform exponential weighted moving average processing on the running indicator sequence, and output the time-series smoothed sequence. S4. Determine the basic boundary by combining the statistical distribution of three standard deviations of the time-series smoothed sequence, and use the similarity coefficient of historical data from the same period to correct the basic boundary in order to generate a dynamic alarm threshold. S5. Match the logical dependencies of multiple indicators corresponding to business scenario tags, combine dynamic alarm thresholds to generate structured monitoring rules and load them into the monitoring execution unit; S6. Real-time monitoring of the statistical mutation characteristic value of the average indicator. When the statistical mutation characteristic value reaches the preset judgment threshold, the structured monitoring rules and dynamic alarm thresholds are updated synchronously.

2. The method of claim 1, wherein the host image-based monitoring rule is automatically generated by the host image-based monitoring rule generation server. S1 includes: A data channel is established by integrating a remote login protocol, a network management protocol, and a built-in agent program into a data acquisition protocol stack; Match a whitelist of commands consisting of pre-approved read-only system query commands to isolate unauthorized write operations; Establish protocol and field mapping logic to map remote login protocol to system-level operation indicator sequence, network management protocol to underlying hardware parameters, and built-in agent program to application layer business data; A linear interpolation process is performed on the collected raw discrete data to construct a straight line trajectory using adjacent valid known points to compensate for missing sampling points.

3. The method of claim 1, wherein S2 include: Perform feature mapping to transform the raw metric data into a high-dimensional feature vector that includes hardware features, process features, log features, and time-series metric features. By using deep learning models to extract the spatial correlation of monitoring indicators through convolutional layers and using long short-term memory layers to capture the trend dependence of indicators in the time dimension, business scenario labels can be identified from high-dimensional feature vectors. Version locking is performed on business scenario tags and a hash digest evidence chain is generated to achieve identity locking of hosts in a multi-tenant isolation environment; Based on a two-dimensional index of tenant and host identifiers, the identified host profiles are stored in the tenant logical partition.

4. The method of claim 1, wherein S3 include: The arithmetic ratio of the standard deviation to the mean of the operating indicator sequence within the observation period is obtained to determine the indicator volatility coefficient. Segmented quantization mapping logic is executed based on the indicator volatility coefficient to select smoothing weights; The original operational index sequence is processed by weighted moving average using smoothing weights. The time-series smoothed sequence is output by assigning different proportions of weights to the original observation value at the current time and the historical smoothed value at the previous time. The time-series smoothed sequence is stored in the runtime context cache partition bound to the host profile.

5. The method of claim 1, wherein the method further comprises: S4 includes: Select the corresponding historical synchronous sampling window based on the operating rhythm identified from the host profile; Calculate the Pearson correlation coefficient between the historical contemporaneous comparison sequence and the time-series smoothed sequence within the historical contemporaneous sampling window to obtain the similarity coefficient; Calculate the arithmetic ratio of the mean of the historical comparative series to the mean of the time-series smoothed series to determine the adjustment factor; When the similarity coefficient reaches a preset threshold, the basic boundary is corrected using an adjustment coefficient.

6. The method for automatically generating monitoring rules based on host profiles according to claim 5, characterized in that: Identify the distribution characteristics of the operational indicator sequence. When the operational indicator sequence exhibits skewed characteristics, use the median absolute deviation method to calculate the difference between the 75th quartile and the 25th quartile of the time-series smoothed sequence to construct an anomaly judgment range. The anomaly detection range is corrected using an adjustment coefficient to determine the dynamic alarm threshold. The generated dynamic alarm thresholds are stored in an in-memory state library in a structured record format with timestamps and version numbers.

7. The method for automatically generating monitoring rules based on host profiles according to claim 1, characterized in that, S5 includes: Based on business scenario tags, match the multi-metric logical dependencies composed of logical operators, and combine them with dynamic alarm thresholds to encapsulate them into structured monitoring rules that include object identifiers, triggering operators, alarm levels, and durations. Structured monitoring rules are stored in a central configuration repository indexed by tenant and host identifiers; Utilize a publish-subscribe mechanism to push structured monitoring rules to the monitoring execution unit; The system executes idempotent policies and deduplication logic, eliminating duplicate instructions by comparing the feature values ​​of the rule content to ensure that the target host loads only one set of monitoring rules under the same version number.

8. The method of claim 1, wherein S6 include: Calculate the standardization deviation of the current instantaneous data of the mean of the operational index sequence relative to the historical baseline data to determine the statistical mutation characteristic value; Identify hardware expansion and major service switching by combining hardware configuration change information; When the statistical mutation characteristic value continuously reaches the judgment threshold within the preset observation window, the host status is confirmed to have undergone a qualitative change, and the self-healing action of monitoring rule recalculation and parameter alignment is automatically triggered. Set an update suppression period, continuously monitor the indicator status during the suppression period, and stop responding to recalculation proposals; Update the triggering basis, parameter comparison, and result snapshot to the evidence chain snapshot library to generate the audit evidence chain.

Images