AI real-time monitoring and early warning method oriented to cloud Java application

Abstract

The invention relates to the field of intelligent operation and maintenance, and discloses a cloud Java application-oriented AI real-time monitoring and early warning method, which comprises the following steps of: collecting runtime multi-source data of a cloud Java application; generating a dynamic causal graph representing the causal relationship between the entities; constructing and training a causal constrained space-time diagram neural network model to obtain a coding state; prospective fault deduction is carried out in combination with the fault mode knowledge base; performing multi-dimensional risk assessment, and generating an executable early warning report containing causal interpretation and intervention suggestions; and performing iterative optimization on the dynamic causal diagram, the time-space diagram neural network model and the fault mode knowledge base. Multi-source data during operation are constructed into a time sequence knowledge graph rich in semantics and time evolution in real time, and on the basis of the time sequence knowledge graph, domain knowledge is fused to automatically mine the dynamic causal relationship between entities, so that more accurate coding of a system state and prospective deduction of a future fault path are realized.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology, specifically to an AI real-time monitoring and early warning method for cloud-based Java applications. Background Technology

[0002] With the popularization of cloud computing technology and the widespread application of microservice architecture, cloud-based Java applications have become the core carriers supporting enterprise-critical business operations. These applications typically feature numerous service instances, complex dependencies, lengthy call chains, and dynamic elastic scaling. The stability of their operational status directly affects service availability and user experience. Therefore, efficient and accurate monitoring and fault warning of the operational status of cloud-based Java applications is a key technical aspect of ensuring the high-quality operation of cloud services.

[0003] Existing cloud-based Java real-time monitoring and early warning methods mostly collect system performance indicators and set static or dynamic thresholds to achieve initial anomaly detection. Subsequently, for abnormal indicators that exceed the thresholds, they rely on independent log queries or distributed tracing tools for manual or semi-automatic root cause localization. As a result, the early warning signals can only reflect the abnormal indicators that have already occurred, and cannot proactively predict whether the abnormality will evolve into an actual failure, or how it will evolve, thus limiting the foresight and accuracy of the early warnings. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an AI real-time monitoring and early warning method for cloud-based Java applications, solving the problem that existing cloud-based Java real-time monitoring and early warning methods have limited foresight and accuracy in early warning.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a real-time AI monitoring and early warning method for cloud-based Java applications, comprising the following steps: Collect multi-source runtime data from cloud-based Java applications and construct a time-series knowledge graph in real time that reflects the internal entities and relationships of the application. Based on the temporal knowledge graph, dynamic causal discovery is performed by integrating domain prior knowledge to generate a dynamic causal graph representing the causal relationships between entities. Based on the temporal knowledge graph and the dynamic causal graph, a spatiotemporal graph neural network model with causal constraints is constructed and trained to obtain the encoding state; Based on the encoded state, and combined with the fault mode knowledge base, a forward-looking fault inference is performed to generate at least one fault evolution chain and its probability of occurrence. Based on the fault evolution chain and the dynamic causal graph, a multidimensional risk assessment is performed, and an actionable early warning report containing causal explanations and intervention suggestions is generated, forming early warning feedback data. Based on the early warning feedback data, the dynamic causal graph, the spatiotemporal graph neural network model, and the fault mode knowledge base are iteratively optimized.

[0006] By adopting the above technical solution, a temporal knowledge graph rich in semantics and temporal evolution is constructed in real time from multi-source data during runtime. Based on this, domain knowledge is integrated to automatically mine dynamic causal relationships between entities, thereby providing structured and interpretable causal constraints for subsequent prediction models. This enables more accurate encoding of system states and forward-looking inference of future fault paths, solving the problem of limited foresight and accuracy of existing cloud-based Java real-time monitoring and early warning methods.

[0007] Preferably, the real-time construction of a time-series knowledge graph reflecting the entities and relationships within the application includes the following steps: By using bytecode enhancement technology, probes are implanted at preset execution points in Java applications to collect method call events, lock operation events, and thread state events. Simultaneously, application performance metrics data, distributed tracing data, and structured log data are collected to form the collected data. The collected data is aligned and aggregated according to a unified timestamp to form aggregated data; Based on predefined entity and relationship types, the aggregated data is transformed into graph structure data in real time within the stream processing engine; The graph structure data is persisted as a time-series knowledge graph sequence using a sliding time window as the unit.

[0008] Preferably, the generation of the dynamic causal graph representing the causal relationships between entities includes the following steps: Extract the time-series characteristics of multivariate performance indicators for each entity from the time-series knowledge graph, including response time, throughput, and resource utilization. Formalize the domain knowledge of the Java runtime and microservice architecture into constraint rules about causal direction and causal existence; Within the sliding time window, based on the aforementioned constraint rules, a temporal causal discovery algorithm is executed on the temporal characteristics of the multivariate performance indicators to output causal edges. Integrate all output causal edges to form a dynamic causal graph, and determine and update the dynamic causal graph by comparing the structural differences of the causal graph in adjacent time windows.

[0009] Preferably, the step of performing a time-series causal discovery algorithm on the time-series features of the multivariate performance indicators includes the following steps: For any two feature variables in the time series characteristics of multivariate performance indicators, perform conditional independence tests under a preset set of conditions; Based on the results of the conditional independence test, a preliminary causal graph framework is constructed. Based on the aforementioned constraint rules, the causal direction of the edges in the causal graph skeleton is determined, and the causal edges are output, including direction, time lag, and significance score.

[0010] Preferably, the construction and training of the causal-constrained spatiotemporal graph neural network model includes the following steps: The dynamic causal graph is used to determine the causal neighbor set of each entity node in the temporal knowledge graph. Based on the causal neighbor set, a message passing function for a graph neural network is designed so that node state updates only aggregate information from its causal neighbors. A causal gating mechanism is introduced into the message passing function to construct a spatiotemporal graph neural network model. The gating mechanism dynamically adjusts the weights of each neighbor message by taking causal edge information and the node's own state as input. Based on the spatiotemporal graph neural network model, by stacking multiple layers of networks and temporal coding units, a fused graph structure and encoding state of temporal and causal context are generated. With the goal of predicting future preset performance indicators, the spatiotemporal graph neural network model is trained using historical data.

[0011] Preferably, the introduction of a causal gating mechanism in the message passing function includes the following steps: In the message passing function, the state vector of the current node is concatenated with the causal edge information vector from the causal neighbor set; The concatenated vector is then input into a fully connected layer; Apply a Sigmoid activation function to the output of the fully connected layer to obtain a gating value, which is used to adjust the weights of the corresponding neighbor messages.

[0012] Preferably, the step of performing forward-looking fault simulation by combining a fault mode knowledge base includes the following steps: The encoded state is matched with a predefined fault mode knowledge base to identify fault modes; Based on the matched failure modes, the candidate events and operation and maintenance action space are pruned, and the Monte Carlo tree search algorithm is used to perform inference search in the pruned action space with the current state as the root node. During the inductive search process, a lightweight causal model and failure mode rules are used as simulators to evaluate the state evolution after the action is executed, thereby constructing a search tree; Extract paths from the search tree as fault evolution chains and estimate their occurrence probability.

[0013] Preferably, the multidimensional risk assessment includes the following steps: Based on the access statistics of the fault evolution chain, the probability of its failure occurrence is calculated; The causal confidence of the fault evolution chain is calculated based on the salience score of the causal edge on which each step in the fault evolution chain depends in the dynamic causal graph. For the preset state nodes in the fault evolution chain, recommended intervention measures are retrieved from the fault mode knowledge base; For each intervention measure, quantify its implementation cost, delay in effectiveness, and expected risk reduction effect to form evaluation parameters.

[0014] Preferably, generating an executable early warning report containing causal explanations and intervention recommendations includes the following steps: Based on the probability of occurrence of the fault, the causal confidence level, and the intervention measures, an early warning report is generated, which includes the predicted fault type, time range, probability of occurrence, and causal confidence level. The fault evolution chain is incorporated into the early warning report in the form of a visual graph or a sequential description as a causal explanation; The intervention measures are ranked according to their cost-benefit ratio and added to the early warning report, with each measure accompanied by corresponding evaluation parameters; Add the local dynamic cause-effect graph related to the current warning as an appendix to the warning report to obtain an executable warning report.

[0015] Preferably, the iterative optimization of the dynamic causal graph, the spatiotemporal graph neural network model, and the fault mode knowledge base includes the following steps: Based on early warning feedback data, track the actual operational status after the release of executable early warning reports and record whether the early warning has been verified. When the warning is verified to be true, the salience score of the causal edges involved in the fault evolution chain is increased by a preset ratio, and the fault evolution chain is abstracted into a new fault mode template and added to the fault mode knowledge base. When the warning is verified as false, the significance score of the relevant causal edge is reduced by a preset ratio, and the parameters of the spatiotemporal graph neural network model are fine-tuned using the event sequence containing the warning action and subsequent actual state changes. Based on the verification results of historical warnings, the matching priority of various templates in the fault mode knowledge base is dynamically adjusted.

[0016] This invention provides an AI real-time monitoring and early warning method for cloud-based Java applications. It has the following beneficial effects: 1. This invention constructs a temporal knowledge graph rich in semantics and temporal evolution from multi-source data in real time during runtime, and then integrates domain knowledge to automatically mine dynamic causal relationships between entities. This provides structured and interpretable causal constraints for subsequent prediction models, enabling more accurate encoding of system states and forward-looking inference of future fault paths. It solves the problem that existing cloud-based Java real-time monitoring and early warning methods have limited foresight and accuracy in early warning.

[0017] 2. This invention performs dynamic causal discovery by fusing prior knowledge in the domain with time-series knowledge graphs, thereby automatically and continuously mining and updating causal relationships with time lag and statistical significance between entities within the application, generating a dynamic causal graph, so that the early warning conclusions can obtain clear causal logic support.

[0018] 3. This invention constructs and trains a spatiotemporal graph neural network model with causal constraints for state encoding, and then uses this model in conjunction with a fault mode knowledge base to perform forward-looking fault inference. Furthermore, it uses the Monte Carlo tree search algorithm to simulate multiple future fault evolution paths and their probabilities of occurrence under causal constraints, thereby realizing the transformation from passive anomaly detection to proactive risk prediction, and improving the foresight of early warning and the ability to detect potential cascading faults.

[0019] 4. This invention generates an executable early warning report containing causal explanations and quantitative intervention suggestions based on multidimensional risk assessment, and uses early warning feedback data to continuously iterate and optimize the causal graph, prediction model and knowledge base, thereby constructing a complete learning closed loop from early warning issuance to effect verification and model self-enhancement. This enables the system to adapt to the dynamic changes of applications and environment, and continuously improve the accuracy and reliability of early warnings and the level of intelligence in operation and maintenance decisions. Attached Figure Description

[0020] Figure 1 This is a flowchart of an AI real-time monitoring and early warning method for cloud-based Java applications proposed in this invention; Figure 2 This is an architecture diagram of an AI real-time monitoring and early warning system for cloud-based Java applications proposed in an embodiment of the present invention. Detailed Implementation

[0021] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Example 1: In a first embodiment of the present invention, the present invention provides an AI real-time monitoring and early warning method for cloud-based Java applications, such as... Figure 1 As shown, it includes the following steps: Collect multi-source runtime data from cloud-based Java applications and construct a time-series knowledge graph in real time that reflects the internal entities and relationships of the application. Furthermore, a time-series knowledge graph reflecting the entities and relationships within the application is constructed in real time, including the following steps: By using bytecode enhancement technology, probes are implanted at preset execution points in Java applications to collect method call events, lock operation events, and thread state events. Simultaneously, application performance metrics data, distributed tracing data, and structured log data are collected to form the collected data. The collected data is aligned and aggregated according to a unified timestamp to form aggregated data; Based on predefined entity and relationship types, the aggregated data is transformed into graph structure data in real time within the stream processing engine; The graph structure data is persisted as a time-series knowledge graph sequence using a sliding time window as the unit.

[0023] Specifically, the real-time construction of a temporal knowledge graph that reflects the internal entities and relationships of an application is the foundation for subsequent intelligent analysis. It aims to transform multi-source heterogeneous streaming observation data from Java application runtime into a semantically rich and temporally evolving graph structure data sequence.

[0024] First, probes are implanted at key execution points of the application using bytecode enhancement technology to collect method call events and related information. Simultaneously, JVM and host machine performance metrics, distributed link data, and structured logs are collected, and all collected data is appended with high-precision timestamps and source identifiers.

[0025] Because different data sources have different collection frequencies and reporting delays, timestamps are corrected using a unified time base, and linear interpolation is used to fill in the gaps in the biased sequence data. Assume a certain performance indicator is... , The observed value is , Target time point The formula for estimating the value is: It takes discrete observation time series and target time points as input, calculates and outputs the estimated value at the target time point. This enables data streams to be aligned on a unified time grid, forming aggregated data.

[0026] Subsequently, in the stream processing engine, based on predefined entity types (such as services, threads, database connection pools, etc.) and relationship types (such as calls, dependencies, etc.), the aggregated data is transformed into graph structure data in real time.

[0027] Finally, by sliding the time window, a snapshot of the graph structure data within the window is persisted, forming a time-series knowledge graph sequence. Each snapshot is represented as... ,in, For the set of entity vertices, For the set of relation edges, The vertex attribute matrix provides structured input for subsequent causal discovery and pattern recognition.

[0028] Based on temporal knowledge graphs, dynamic causal discovery is performed by integrating domain prior knowledge to generate dynamic causal graphs that represent causal relationships between entities. Furthermore, generating a dynamic causal graph representing the causal relationships between entities includes the following steps: Extract time-series characteristics of multivariate performance indicators for each entity from the time-series knowledge graph, including response time, throughput, and resource utilization. Formalize the domain knowledge of the Java runtime and microservice architecture into constraint rules about causal direction and causal existence; Within the sliding time window, based on the constraint rules, a time-series causal discovery algorithm is executed on the time-series characteristics of multivariate performance indicators to output causal edges; Integrate all output causal edges to form a dynamic causal graph, and determine and update the dynamic causal graph by comparing the structural differences of the causal graph in adjacent time windows.

[0029] Furthermore, a time-series causal discovery algorithm is performed on the time-series characteristics of multivariate performance indicators, including the following steps: For any two feature variables in the time series characteristics of multivariate performance indicators, perform conditional independence tests under a preset set of conditions; Based on the results of the conditional independence test, a preliminary causal graph framework is constructed. Based on constraint rules, the causal direction of the edges in the causal graph skeleton is determined, and the causal edges are output including direction, time lag and significance score.

[0030] Specifically, generating dynamic causal graphs that represent causal relationships between entities can provide interpretable early warnings. From the complex dynamic behavior of time-series knowledge graphs, it can automatically mine the causal driving relationships between entities that evolve over time, providing reliable causal mechanism constraints for subsequent predictive modeling.

[0031] First, the temporal characteristics of multivariate performance indicators for each entity are extracted from the temporal knowledge graph. These indicators include response time, throughput, error rate, and resource utilization. The indicator values ​​of each entity within a continuous time window are then organized into a multivariate time series matrix, with each row representing a time point and each column representing a performance indicator, forming the data foundation for causal analysis.

[0032] Subsequently, the domain prior knowledge of the Java runtime environment and microservice architecture is formalized into causal directions and existing constraint rules, such as garbage collection events may lead to an increase in thread pause time, and changes in downstream services will not directly affect the request rate of upstream services at earlier points in time. These are encoded into logical assertions to ensure that causal relationships conform to timing and logic.

[0033] Within a sliding time window, based on constraint rules, a time-series causal discovery algorithm is executed. Its core components include conditional independence testing and causal direction determination. For any variable... and The independence of two conditions under a given condition set S can be tested by calculating the partial correlation coefficient. The formula is as follows: ,in For variables and Pearson correlation coefficient, For variables With the set of condition variables The correlation coefficient vector, set of condition variables The inverse matrix of the correlation coefficient matrix among all internal variables. set of condition variables With variables The correlation coefficient vector, taking the correlation coefficient matrix between the original variables as input, is obtained by controlling the condition set. The impact of the output of the purified partial correlation coefficient .like If the absolute value is below the significance threshold, the two conditions are considered independent.

[0034] Next, based on the aforementioned formalized domain constraint rules, the causal direction of the edges in the causal graph skeleton is determined. For example, for an edge in the skeleton connecting variables A and B, if the domain rule explicitly states that A may cause B but B cannot cause A, then the direction is determined to be A→B. In cases where there is no clear domain direction, more conditional independence tests or temporal lag information are used to infer the direction. Based on the test results, the causal graph skeleton is constructed, and the direction of the edges is determined by combining the domain constraint rules. When there are no clear rules, additional tests or temporal information are used to output causal edges containing causal variables, outcome variables, time lags, and significance scores.

[0035] Finally, the causal edges are integrated to form a dynamic causal graph for the current window. By comparing the differences in graph structure between adjacent windows, it is determined whether the causal mechanism has changed significantly, such as set symmetry difference and graph edit distance. If the threshold is exceeded, the model is updated to achieve adaptive evolution of the causal graph, providing key prior structural knowledge for subsequent causal constraint prediction models.

[0036] Based on temporal knowledge graphs and dynamic causal graphs, a spatiotemporal graph neural network model with causal constraints is constructed and trained to obtain the encoded state; Furthermore, a causal-constrained spatiotemporal graph neural network model is constructed and trained, including the following steps: Determine the causal neighbor set for each entity node in the temporal knowledge graph based on the dynamic causal graph; Based on the causal neighbor set, a message passing function for a graph neural network is designed so that node state updates only aggregate information from its causal neighbors. A causal gating mechanism is introduced into the message passing function to construct a spatiotemporal graph neural network model. The gating mechanism dynamically adjusts the weight of each neighbor message by taking causal edge information and the node's own state as input. Based on the spatiotemporal graph neural network model, by stacking multiple layers of networks and temporal coding units, the encoded state of the fused graph structure, temporal and causal context is generated; With the goal of predicting future preset performance indicators, a spatiotemporal graph neural network model is trained using historical data.

[0037] Furthermore, a causal gating mechanism is introduced into the message passing function, including the following steps: In the message passing function, the state vector of the current node is concatenated with the causal edge element information vector from the causal neighbor set; The concatenated vector is then input into a fully connected layer; Apply a Sigmoid activation function to the output of the fully connected layer to obtain a gating value, which is used to adjust the weights of the corresponding neighbor messages.

[0038] Specifically, a spatiotemporal graph neural network model with causal constraints is constructed and trained, integrating dynamic causal structure knowledge into neural network learning. By clearly defining the causal dependencies between modeling entities, more accurate and interpretable encoding and prediction of states can be achieved.

[0039] Based on the dynamic causal graph, a causal neighbor set is determined for each entity node in the temporal knowledge graph. For entity nodes... Its causal neighbor set consists of all pointers in the dynamic causal graph. Each causal edge is composed of the source nodes corresponding to its edges. Additional time lag and significance score Time lag Indicates the cause node The state needs to be in advance within a certain time unit to affect the result node. The current state ensures that node information aggregation only considers nodes with direct causal impact.

[0040] Based on causal neighbor sets, a message passing function for a graph neural network is designed, where node state updates primarily depend on the historical states of causal neighbors. In the The hidden state of the layer is updated by aggregating all causal neighbors. The state is adjusted according to the time lag.

[0041] A causal gating mechanism is introduced into the message passing function to adjust the information flow intensity between different causal neighbors. The gating value is calculated as follows: ,in, It is a node No. The hidden state vector of the layer, It is a causal side The metadata embedding vector is fused with time lag, saliency score, and type features. This is a vector concatenation operation. and It is the first The trainable weight matrix and bias vector of the layer gating mechanism. The Sigmoid activation function takes the current state of the target node and the causal edge features from specific causal neighbors as input, and after linear transformation and nonlinear activation, outputs a scalar gating value. Mediation of neighbors For nodes Contribution weight for state updates.

[0042] A complete model is built based on the gating mechanism, with nodes... No. The layer state is obtained by aggregating the gating adjustment messages of all causal neighbors. In some scenarios, an attention mechanism is combined to distinguish the importance of neighbors. Multiple layers of networks are stacked and connected to recurrent units such as GRUs at the top layer to capture spatial causal dependencies and temporal dynamic evolution, generating an encoded state for each entity node that integrates the local graph structure, historical temporal patterns, and causal context.

[0043] Finally, targeting key performance indicators for predicting future preset time windows, the model was fully trained using historical time-series knowledge graph sequences and corresponding dynamic causal graphs as training data. A loss function measures the difference between predicted and actual values. Through training and optimization of the model and its internal causal gating mechanism, the model was able to accurately reflect and utilize the causal interactions between entities to reason about their states.

[0044] Based on the encoded state, combined with the fault mode knowledge base, a forward-looking fault inference is performed to generate at least one fault evolution chain and its probability of occurrence. Furthermore, by combining the failure mode knowledge base, forward-looking failure simulations are performed, including the following steps: The encoded state is matched with a predefined fault mode knowledge base to identify fault modes; Based on the matched failure modes, the candidate events and operation and maintenance action space are pruned, and the Monte Carlo tree search algorithm is used to perform inference search in the pruned action space with the current state as the root node. During the inductive search process, a lightweight causal model and failure mode rules are used as simulators to evaluate the state evolution after the action is executed, thereby constructing a search tree; Extract paths from the search tree as fault evolution chains and estimate their occurrence probability.

[0045] Specifically, based on the coding state combined with the fault mode knowledge base, forward-looking fault inference is carried out to realize predictive early warning reasoning, which aims to simulate possible future fault evolution paths and make predictions before the problem actually occurs.

[0046] First, the encoded states of all current entity nodes are matched against a predefined fault mode knowledge base to identify potential active fault modes. The fault mode knowledge base stores various known fault scenario templates, each containing anomaly initiation conditions, intermediate state sequences, and fault features. Matching is completed by calculating cosine similarity, using the following formula: ,in, It is the current global state vector. It is the first Feature vectors of each fault mode template For vector dot product operation, The similarity value (sim) is the Euclidean norm, quantifying the degree of matching. Patterns with similarity exceeding a threshold are selected as active fault modes.

[0047] Next, the event and operation / maintenance action space is intelligently pruned based on active failure modes. (Complete action space) It includes possible events and feasible operational actions. By retaining actions relevant to the current failure mode and removing irrelevant actions, a focused action subspace is obtained. This improves subsequent search efficiency.

[0048] Then, using the current encoding state as the root node, the Monte Carlo tree search algorithm is used to... The deduction process involves constructing a search tree through four iterative steps: Selection: Recursively select child nodes from the root node to expandable leaf nodes, using a variant of the UCT formula for balanced exploration and exploitation. ,in, For state nodes, As candidate actions, This is a long-term evaluation value for the action. This represents the total number of state visits. This represents the number of times the action is executed in this state. To explore constants, choose the action that maximizes the weighted sum. .

[0049] Expand: For leaf nodes that are not fully expanded, from Choose a new action Extended functionality: Generate new states using a lightweight simulator. .

[0050] Simulation: From The simulator begins rapid scrolling to a preset depth or terminal state. Combining a simplified causal model with a failure mode rule base, the state prediction formula is: ,in, To simplify the causal model, Its parameters, This represents the evolutionary deviation corresponding to the failure mode.

[0051] Backpropagation: converting the simulated reward values... Backtrack to the root node and update the visit count of node-action pairs on the path. and average return estimates .

[0052] After multiple iterations, the path with the most visits or the worst average return is extracted from the search tree as the most likely failure evolution chain, clearly presenting the complete causal sequence from the current state to the failure. Simultaneously, the frequency of this path's selection at the root node is used to estimate the relative probability of the failure, providing a quantitative basis for risk assessment and generating future risk scenarios with temporal causal logic.

[0053] Based on the failure evolution chain and dynamic causal graph, a multi-dimensional risk assessment is conducted, and an actionable early warning report containing causal explanations and intervention suggestions is generated, forming early warning feedback data; Furthermore, a multidimensional risk assessment is conducted, including the following steps: Based on the access statistics of the fault evolution chain, the probability of its failure occurrence is calculated; The causal confidence of the fault evolution chain is calculated based on the salience scores of the causal edges on which each step in the fault evolution chain depends in the dynamic causal graph. For preset state nodes in the fault evolution chain, recommended intervention measures are retrieved from the fault mode knowledge base; For each intervention measure, quantify its implementation cost, effectiveness delay, and expected risk reduction effect to form evaluation parameters.

[0054] Furthermore, generating an actionable alert report that includes causal explanations and intervention recommendations includes the following steps: Based on the probability of failure occurrence, causal confidence level, and intervention measures, an early warning report is generated, which includes the predicted failure type, time range, probability of occurrence, and causal confidence level. The failure evolution chain is incorporated into the early warning report as a causal explanation, presented as a visual graph or sequential description. Intervention measures are ranked according to their cost-benefit ratio and added to the early warning report, with each measure accompanied by corresponding evaluation parameters; Add the local dynamic cause-effect graph related to the current warning as an appendix to the warning report to obtain an executable warning report.

[0055] Specifically, a multi-dimensional risk assessment is conducted on the failure evolution chain and dynamic causal graph, generating an actionable early warning report that includes causal explanations and intervention recommendations, and forming early warning feedback data. This process transforms the prospectively extrapolated potential failure paths into quantifiable risk indicators and actionable operational guidelines, completing a closed loop from prediction to decision-making.

[0056] Multidimensional risk assessment includes the following sub-steps: Calculate the probability of failure occurrence: Based on the access statistics of the failure evolution chain in the Monte Carlo tree search, the ratio of the number of path visits to the total number of searches is used as the relative probability estimate of the occurrence of the failure evolution chain.

[0057] Causal confidence is calculated by using a weighted average based on the significance scores of the causal edges that each step of the failure evolution chain depends on in the dynamic causal graph. The formula is as follows: ,in, For the first Each step corresponds to a saliency score of the causal edge, reflecting the statistical robustness of the causal relationship and the degree of domain knowledge support. For the first The weight of each step can be set according to the step's temporal position or the criticality of the involved entity, and the output is a scalar value between 0 and 1 to quantify the reliability of the predicted path.

[0058] Retrieve intervention measures: For key state nodes in the fault evolution chain, retrieve matching recommended intervention measures from the fault mode knowledge base, which pre-stores known fault scenarios and corresponding mitigation and repair operations.

[0059] Quantitative evaluation parameters: Calculate the implementation cost, effectiveness delay and expected risk reduction effect of each intervention measure. The implementation cost takes into account the impact of manpower, resources and business. The expected risk reduction effect is estimated by simulation through a lightweight causal model.

[0060] Based on the above assessment results, an actionable early warning report is generated: The main body of the report clearly lists the predicted fault type, the possible time range, the probability of occurrence, and the causal confidence level; it incorporates a visual graph or sequential description of the fault evolution chain, clarifying the causal evolution logic from the current state to the fault; it sorts the intervention measures according to the benefit-cost ratio, the ratio of the expected risk reduction effect to the execution cost, and each measure is accompanied by quantitative parameters such as execution cost, effective delay, and expected risk reduction effect; it also includes a local dynamic causal graph closely related to the fault evolution chain, providing a deep causal structure basis to support the early warning conclusion, and finally forming an early warning report with complete information, clear basis, and actionable recommendations, providing key feedback data for operation and maintenance response and iterative optimization.

[0061] Based on early warning feedback data, the dynamic causal graph, spatiotemporal graph neural network model, and fault mode knowledge base are iteratively optimized.

[0062] Furthermore, the dynamic causal graph, spatiotemporal graph neural network model, and fault mode knowledge base are iteratively optimized, including the following steps: Based on early warning feedback data, track the actual operational status after the release of executable early warning reports and record whether the early warning has been verified. When the warning is verified to be true, the salience score of the causal edges involved in the fault evolution chain is increased by a preset ratio, and the fault evolution chain is abstracted into a new fault mode template and added to the fault mode knowledge base. When the warning is verified as false, the significance score of the relevant causal edge is reduced by a preset ratio, and the parameters of the spatiotemporal graph neural network model are fine-tuned using the event sequence containing the warning action and subsequent actual state changes. Based on the verification results of historical warnings, the matching priority of various templates in the fault mode knowledge base is dynamically adjusted.

[0063] Specifically, the dynamic causal graph, spatiotemporal graph neural network model, and fault mode knowledge base are iteratively optimized based on early warning feedback data to form a core learning and adaptation closed loop. Relying on actual operation and maintenance feedback, the accuracy of early warning, the reliability of causal discovery, and the completeness of the knowledge base are improved, thus achieving continuous optimization.

[0064] Iterative optimization begins with tracking the actual operational status after the release of executable early warning reports. By combining real-time collected multi-source runtime data, the matching of the predicted fault type and time range with the actual observed events is recorded, the early warning verification results are clarified, and the feedback information is ensured to be objective and timely.

[0065] When the warning is verified as true, the fault evolution chain and its underlying causal logic are confirmed. The significance score of the causal edges involved in the evolution chain is increased by a preset ratio, and the update formula is as follows: ,in, For entities Pointing to entity The significance score of the causal edge quantifies the confidence level of the causal relationship. A preset gain coefficient between 0 and 1 controls the magnitude of score enhancement. The input is the old significance score and the gain coefficient, and the output is the updated, higher significance score. Simultaneously, the validated complete failure evolution chain is abstracted into a new failure mode template, key state sequences and causal transition features are extracted, and after being associated with validated intervention measures, they are incorporated into the failure mode knowledge base to enrich the scope of failure cognition.

[0066] When the warning is verified as false, there is a deviation between the prediction and the actual situation. The significance score of the relevant causal edge is reduced by a preset ratio, and the attenuation formula is as follows: ,in, The preset attenuation factor is between 0 and 1. Furthermore, using the warning trigger action and subsequent actual state change sequence as monitoring signals, the loss between the model prediction and the actual state is calculated. The spatiotemporal graph neural network model parameters are fine-tuned through backpropagation to correct prediction bias.

[0067] Finally, based on the statistical analysis of historical early warning verification results, the matching priority of various templates in the fault mode knowledge base is dynamically adjusted: the priority of frequently verified true templates is increased, the priority of templates that are associated with multiple false alarms is decreased, the knowledge base retrieval efficiency is optimized, the overall accuracy and timeliness of early warnings are improved, and the monitoring and early warning system is continuously learned and optimized in a dynamic operating environment.

[0068] Example 2: In a second embodiment of the present invention, the present invention provides an AI real-time monitoring and early warning system for cloud-based Java applications, such as... Figure 2 As shown, it includes the following modules: The data collection and construction module is used to collect multi-source runtime data from cloud-based Java applications and build a time-series knowledge graph that reflects the internal entities and relationships of the application in real time. Fusion Generation Module: Used to perform dynamic causal discovery based on temporal knowledge graphs and integrate domain prior knowledge, generating dynamic causal graphs that represent causal relationships between entities; The training module is used to build and train a spatiotemporal graph neural network model with causal constraints based on temporal knowledge graphs and dynamic causal graphs, and to obtain the encoded state. Combined with the inference module: It is used to perform forward-looking fault inference based on the encoded state and combined with the fault mode knowledge base, and generate at least one fault evolution chain and its probability of occurrence; Assessment and early warning module: It is used to conduct multi-dimensional risk assessment based on the failure evolution chain and dynamic cause-effect graph, and generate an actionable early warning report containing causal explanations and intervention suggestions, forming early warning feedback data; Feedback optimization module: Used to iteratively optimize the dynamic cause-effect graph, spatiotemporal graph neural network model, and fault mode knowledge base based on early warning feedback data. In cloud-based Java application clusters of large e-commerce platforms, especially during the "Double Eleven" shopping festival, applications face extremely high instantaneous concurrent requests and complex microservice call chains. Traditional monitoring methods mainly rely on threshold alerts and post-event log analysis, which are insufficient to detect cascading failure risks caused by hidden resource contention, slow SQL queries, or abnormal dependencies between services during peak business periods. This leads to delayed fault response, severely impacting user experience and platform stability. To address these issues, this invention provides an AI real-time monitoring and early warning system for cloud-based Java applications, with the following architecture: Figure 2 As shown. The specific implementation process of this system is as follows: First, the data collection module collects multi-source runtime data from each microservice in real time through implanted probes and builds a time-series knowledge graph in a streaming manner, thereby transforming discrete indicators and events into dynamic graphs with entity relationships, providing a structured foundation for global state awareness.

[0069] Next, the fusion generation module uses this graph to incorporate domain knowledge of the microservice architecture to perform dynamic causal discovery, generating a dynamic causal graph that depicts the influence relationships between services, enabling the system to understand the potential propagation paths of faults.

[0070] Subsequently, a training module is constructed to train a causal-constrained spatiotemporal graph neural network model using temporal knowledge graphs and dynamic causal graphs, thereby obtaining the encoded state of the fused graph structure, temporal and causal context, and achieving accurate encoding of the future state of the system.

[0071] Then, the coded state is matched with the fault mode knowledge base by the inference module, and a forward-looking fault inference is performed by Monte Carlo tree search to generate multiple possible fault evolution chains and their occurrence probabilities, thereby achieving predictive fault discovery.

[0072] Subsequently, the assessment and early warning module conducts a multi-dimensional risk assessment of the deduced failure chain and generates an actionable early warning report containing causal explanations and specific intervention suggestions, providing clear action guidance for operations and maintenance personnel.

[0073] Finally, the feedback optimization module continuously iterates and optimizes the dynamic cause-effect graph, prediction model, and knowledge base based on the subsequent verification results of the warning, enabling the system to learn and evolve autonomously from historical experience.

[0074] Through the coordinated operation of the above modules, the system can accurately predict potential cascading failures before peak business periods, guide maintenance personnel to make precise interventions, and thus effectively ensure the stable operation of cloud-based Java applications and business continuity.

[0075] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A real-time AI monitoring and early warning method for cloud-based Java applications, characterized in that, Includes the following steps: Collect multi-source runtime data from cloud-based Java applications and construct a time-series knowledge graph in real time that reflects the internal entities and relationships of the application. Based on the temporal knowledge graph, dynamic causal discovery is performed by integrating domain prior knowledge to generate a dynamic causal graph representing the causal relationships between entities. Based on the temporal knowledge graph and the dynamic causal graph, a spatiotemporal graph neural network model with causal constraints is constructed and trained to obtain the encoding state; Based on the encoded state, and combined with the fault mode knowledge base, a forward-looking fault inference is performed to generate at least one fault evolution chain and its probability of occurrence. Based on the fault evolution chain and the dynamic causal graph, a multidimensional risk assessment is performed, and an actionable early warning report containing causal explanations and intervention suggestions is generated, forming early warning feedback data. Based on the early warning feedback data, the dynamic causal graph, the spatiotemporal graph neural network model, and the fault mode knowledge base are iteratively optimized.

2. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 1, characterized in that: The real-time construction of a time-series knowledge graph reflecting the entities and relationships within the application includes the following steps: By using bytecode enhancement technology, probes are implanted at preset execution points in Java applications to collect method call events, lock operation events, and thread state events. Simultaneously, application performance metrics data, distributed tracing data, and structured log data are collected to form the collected data. The collected data is aligned and aggregated according to a unified timestamp to form aggregated data; Based on predefined entity and relationship types, the aggregated data is transformed into graph structure data in real time within the stream processing engine; The graph structure data is persisted as a time-series knowledge graph sequence using a sliding time window as the unit.

3. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 1, characterized in that: The generation of the dynamic causal graph representing the causal relationships between entities includes the following steps: Extract the time-series characteristics of multivariate performance indicators for each entity from the time-series knowledge graph, including response time, throughput, and resource utilization. Formalize the domain knowledge of the Java runtime and microservice architecture into constraint rules about causal direction and causal existence; Within the sliding time window, based on the aforementioned constraint rules, a temporal causal discovery algorithm is executed on the temporal characteristics of the multivariate performance indicators to output causal edges. Integrate all output causal edges to form a dynamic causal graph, and determine and update the dynamic causal graph by comparing the structural differences of the causal graph in adjacent time windows.

4. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 3, characterized in that: The step of performing a time-series causal discovery algorithm on the time-series features of the multivariate performance indicators includes the following steps: For any two feature variables in the time series characteristics of multivariate performance indicators, perform conditional independence tests under a preset set of conditions; Based on the results of the conditional independence test, a preliminary causal graph framework is constructed. Based on the aforementioned constraint rules, the causal direction of the edges in the causal graph skeleton is determined, and the causal edges are output, including direction, time lag, and significance score.

5. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 1, characterized in that: The construction and training of the causal-constrained spatiotemporal graph neural network model includes the following steps: The dynamic causal graph is used to determine the causal neighbor set of each entity node in the temporal knowledge graph. Based on the causal neighbor set, a message passing function for a graph neural network is designed so that node state updates only aggregate information from its causal neighbors. A causal gating mechanism is introduced into the message passing function to construct a spatiotemporal graph neural network model. The gating mechanism dynamically adjusts the weights of each neighbor message by taking causal edge information and the node's own state as input. Based on the spatiotemporal graph neural network model, by stacking multiple layers of networks and temporal coding units, a fused graph structure and encoding state of temporal and causal context are generated. With the goal of predicting future preset performance indicators, the spatiotemporal graph neural network model is trained using historical data.

6. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 5, characterized in that: The introduction of a causal gating mechanism in the message passing function includes the following steps: In the message passing function, the state vector of the current node is concatenated with the causal edge information vector from the causal neighbor set; The concatenated vector is then input into a fully connected layer; Apply a Sigmoid activation function to the output of the fully connected layer to obtain a gating value, which is used to adjust the weights of the corresponding neighbor messages.

7. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 1, characterized in that: The method of combining a fault mode knowledge base to perform forward-looking fault simulation includes the following steps: The encoded state is matched with a predefined fault mode knowledge base to identify fault modes; Based on the matched failure modes, the candidate events and operation and maintenance action space are pruned, and the Monte Carlo tree search algorithm is used to perform inference search in the pruned action space with the current state as the root node. During the inductive search process, a lightweight causal model and failure mode rules are used as simulators to evaluate the state evolution after the action is executed, thereby constructing a search tree; Extract paths from the search tree as fault evolution chains and estimate their occurrence probability.

8. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 1, characterized in that: The multidimensional risk assessment includes the following steps: Based on the access statistics of the fault evolution chain, the probability of its failure occurrence is calculated; The causal confidence of the fault evolution chain is calculated based on the salience score of the causal edge on which each step in the fault evolution chain depends in the dynamic causal graph. For the preset state nodes in the fault evolution chain, recommended intervention measures are retrieved from the fault mode knowledge base; For each intervention measure, quantify its implementation cost, delay in effectiveness, and expected risk reduction effect to form evaluation parameters.

9. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 1, characterized in that: The process of generating an actionable early warning report that includes causal explanations and intervention recommendations includes the following steps: Based on the probability of occurrence of the fault, the causal confidence level, and the intervention measures, an early warning report is generated, which includes the predicted fault type, time range, probability of occurrence, and causal confidence level. The fault evolution chain is incorporated into the early warning report in the form of a visual graph or a sequential description as a causal explanation; The intervention measures are ranked according to their cost-benefit ratio and added to the early warning report, with each measure accompanied by corresponding evaluation parameters; Add the local dynamic cause-effect graph related to the current warning as an appendix to the warning report to obtain an executable warning report.

10. The AI ​​real-time monitoring and early warning method for cloud-based Java applications according to claim 1, characterized in that: The iterative optimization of the dynamic causal graph, the spatiotemporal graph neural network model, and the fault mode knowledge base includes the following steps: Based on early warning feedback data, track the actual operational status after the release of executable early warning reports and record whether the early warning has been verified. When the warning is verified to be true, the salience score of the causal edges involved in the fault evolution chain is increased by a preset ratio, and the fault evolution chain is abstracted into a new fault mode template and added to the fault mode knowledge base. When the warning is verified as false, the significance score of the relevant causal edge is reduced by a preset ratio, and the parameters of the spatiotemporal graph neural network model are fine-tuned using the event sequence containing the warning action and subsequent actual state changes. Based on the verification results of historical warnings, the matching priority of various templates in the fault mode knowledge base is dynamically adjusted.

Images