An artificial intelligence big data server monitoring device and method

Abstract

The application belongs to the field of artificial intelligence, and provides an artificial intelligence big data server monitoring device and method, which comprises a multi-source heterogeneous data fusion module, a dynamic baseline modeling module, a cross-node dependency graph construction module, an abnormal mode identification module, a root cause positioning reasoning module and an online model evolution module. The application fuses physical, system and network layer multi-dimensional state vectors, constructs a dynamic health baseline evolving with load, identifies abnormal propagation modes in combination with a graph neural network and a space-time attention mechanism, reversely reasons root causes based on a Bayesian causal network, and realizes continuous optimization of the model by using incremental learning, so as to effectively solve problems such as data silos, false alarms of static thresholds and difficulty in root cause positioning in a complex coupled environment, and improve fault early warning accuracy and diagnosis efficiency of a super large scale AI cluster.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence, specifically an artificial intelligence big data server monitoring device and method. Background Technology

[0002] The field of artificial intelligence and big data server monitoring technology mainly involves the process of using artificial intelligence (AI) and big data analytics to perceive, identify anomalies, and predict server operating status in real time. It is widely used in cloud computing platforms, data centers, enterprise-level IT infrastructure, and high-concurrency network service systems. By deploying intelligent monitoring devices and supporting methods, multi-dimensional indicators such as server hardware resource utilization, network traffic characteristics, process behavior logs, and temperature and power consumption parameters can be efficiently collected. Combined with machine learning models, this allows for early warning and automatic diagnosis of potential faults, performance bottlenecks, or security threats. This technology not only improves the operational efficiency and system stability of server clusters but also provides data support for resource scheduling, capacity planning, and energy efficiency optimization, thereby reducing operational costs and enhancing service continuity.

[0003] Among them, the AI-based big data server monitoring system refers to a comprehensive architecture integrating sensor modules, data acquisition units, edge computing nodes, and cloud analysis platforms. Its core lies in using AI technologies such as deep learning, time-series prediction, and anomaly detection algorithms to model and infer massive amounts of heterogeneous monitoring data. Typical functions include: real-time acquisition of key performance indicators (KPIs) such as CPU, memory, disk I / O, and network bandwidth; construction of dynamic baselines to identify abnormal patterns deviating from normal behavior; analysis of inter-server dependencies through graph neural networks or attention mechanisms; optimization of alarm thresholds and response actions using reinforcement learning strategies; and generation of interpretable health assessment reports. Such systems have been widely deployed in financial transaction back-end systems, telecommunications core networks, large e-commerce platforms, and national supercomputing centers, significantly improving the autonomous operation and maintenance capabilities of large-scale IT infrastructure.

[0004] While existing AI-powered big data server monitoring technologies have achieved good results in handling high-frequency indicator collection, identifying common hardware faults, and implementing basic threshold alarms, there is still room for improvement in areas such as multi-source heterogeneous data fusion, fine-grained root cause localization, and cross-server correlation fault prediction in complex dynamic environments. Since most existing methods rely on static threshold rules or shallow statistical models, their ability to represent abnormal patterns may be insufficient when dealing with non-steady-state scenarios such as sudden traffic surges, microservice link jitter, or new malicious attacks, leading to high false alarm rates or delayed false positives. Furthermore, current mainstream monitoring systems mostly use offline batch training for model updates, making it difficult to adapt to the rapid evolution of server workloads or behavioral drift caused by new business launches. Simultaneously, in multi-tenant shared environments, the coupling effect of resource contention among different applications makes isolated analysis of single indicators difficult to accurately reflect the overall health status of the system, limiting the in-depth application of monitoring results in high availability assurance and intelligent scheduling decisions.

[0005] To address the problems raised in the background art, those skilled in the art have proposed an artificial intelligence big data server monitoring device and method. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides an artificial intelligence big data server monitoring device and method to solve the problems in the prior art.

[0007] An artificial intelligence big data server monitoring device includes a multi-source heterogeneous data fusion module, a dynamic baseline modeling module, a cross-node dependency graph construction module, an anomaly pattern recognition module, a root cause localization and reasoning module, and an online model evolution module; The multi-source heterogeneous data fusion module, based on the sensor array, system log interface and network traffic probe deployed in the server cluster, collects hardware resource utilization, process behavior sequence, temperature and power consumption parameters and network communication characteristics, performs time alignment, format normalization and semantic mapping on monitoring indicators from different data sources, and generates structured multi-dimensional state vectors. The dynamic baseline modeling module extracts historical operating modes through the multidimensional state vector using an adaptive sliding window mechanism, and constructs a dynamic health baseline in a non-steady-state environment by combining variational autoencoder and Gaussian process regression. This baseline is updated in real time as the workload evolves, characterizing the indicator distribution characteristics of the server under normal operating conditions. The cross-node dependency graph construction module, based on the dynamic health baseline, uses graph neural networks to analyze the call links, resource contention relationships, and data flow topology between servers, taking physically or logically adjacent server nodes as graph vertices and their interaction strength as edge weights, to generate a dependency graph that reflects the overall coupling structure of the system. The abnormal pattern recognition module uses the dependency graph and the multidimensional state vector to capture the correlation between local indicator mutations and global propagation paths through a spatiotemporal attention mechanism, identifies abnormal behavior patterns that deviate from the dynamic baseline, and outputs an abnormal event description that includes the abnormal type, confidence level, and scope of impact. The root cause localization inference module, based on the description of the abnormal event, combines a Bayesian causal network to perform reverse reasoning on potential fault sources, calculates the causal contribution of each candidate node in the abnormal propagation path, determines the most likely root cause node according to the maximum a posteriori probability criterion, and generates a root cause localization report. The online model evolution module is used to receive the root cause localization report and continuously flowing monitoring data. It adopts an incremental learning strategy to fine-tune the anomaly detection model and dynamic baseline parameters online, avoiding full retraining and enabling the model parameters to evolve synchronously with business behavior, maintaining sensitivity to new anomaly patterns.

[0008] Furthermore, the multidimensional state vector includes timestamp-aligned CPU utilization sequences, memory allocation rates, disk I / O latency distributions, network packet throughput statistics, process system call frequencies, and chassis temperature gradient data; the dynamic health baseline includes the mean, variance, and higher-order moment features of each performance indicator within a sliding time window; the dependency graph includes server node identifiers, service call directions, resource contention intensity, and data dependency weights; the abnormal event description includes the abnormal start time, the set of involved indicators, the quantified value of the deviation, and the propagation path prediction; the root cause localization report includes a candidate root cause list, causal scores for each node, a summary of the reasoning basis, and confidence intervals; and the online fine-tuning operation includes gradient accumulation updates of model parameters, dynamic reallocation of loss function weights, and a priority sampling strategy for new samples.

[0009] Furthermore, the multi-source heterogeneous data fusion module includes a data acquisition submodule, a time synchronization submodule, and a semantic normalization submodule; The data acquisition submodule acquires raw monitoring signals from the physical layer, system layer, and network layer through hardware sensors deployed on the server motherboard, log hooks in the operating system kernel, and mirror ports of the network switch. The raw monitoring signals include digital temperature readings, process creation / destruction event streams, and TCP connection establishment / disconnection records. The time synchronization submodule applies a timestamp mark from a unified clock source to the original monitoring signal and uses linear interpolation or nearest neighbor filling to process missing sampling points, ensuring that data from different sources are aligned to the same sampling period in the time dimension. The semantic normalization submodule maps the original signal into standardized semantic labels based on a predefined monitoring indicator ontology library, generating a multidimensional state vector with a unified semantic space.

[0010] Furthermore, the dynamic baseline modeling module includes a sliding window management submodule, a feature extraction submodule, and a baseline generation submodule; The sliding window management submodule maintains a variable-length time window. The window length is dynamically adjusted according to the server load fluctuation rate. When the load standard deviation is detected to exceed a preset threshold, the window is automatically shortened. The feature extraction submodule performs principal component analysis and wavelet transform on the multidimensional state vector within the window to extract low-dimensional latent features. The baseline generation submodule inputs the low-dimensional latent features into a variational autoencoder for unsupervised reconstruction. Simultaneously, it utilizes the trend term of the Gaussian process regression fitting index over time, combining the reconstruction error and the trend residual to form the boundary region of the dynamic healthy baseline. satisfy: ; in, For variational autoencoders, the input vector Reconstruction error, For Gaussian process regression at time 1000 The residual term, This is the preset joint threshold.

[0011] Furthermore, the cross-node dependency graph construction module (103) includes a call chain parsing submodule, a resource contention analysis submodule, and a graph construction submodule; The call chain parsing submodule extracts the inter-service call sequence from the distributed tracing system and identifies the request frequency and latency distribution of upstream services to downstream services. The resource contention analysis submodule calculates the resource interference coefficient between different tenant applications based on the usage conflict logs of the shared resource pool. The graph construction submodule defines each server instance as a graph vertex, calculates edge weights based on call frequency, interference coefficient, and data affinity, stores the dependency graph using a sparse matrix, and periodically performs graph pruning to remove weak connections. Edge weights... satisfy: ; in, The frequency of service calls per unit of time. Resource competition coefficient, For data affinity score, These are the normalized weighting coefficients, and .

[0012] Furthermore, the abnormal pattern recognition module includes a local anomaly detection submodule, a spatiotemporal propagation modeling submodule, and a pattern clustering submodule; The local anomaly detection submodule calculates the Mahalanobis distance of a single server's multidimensional state vector relative to a dynamic health baseline, and marks sample points that exceed the confidence ellipsoid. satisfy: ; in, This is the current multidimensional state vector. This is the mean vector of the dynamic health baseline. It is the covariance matrix; The spatiotemporal propagation modeling submodule uses local anomaly points as seeds and performs a random walk with a decay factor on the dependency graph to simulate the diffusion path and intensity decay of the anomaly's influence. The pattern clustering submodule performs density clustering on the results of multiple walks, merges anomalous events with similar propagation topologies, and outputs a structured description of the anomalous events.

[0013] Furthermore, the root cause localization reasoning module includes a causal graph construction submodule, a contribution calculation submodule, and a report generation submodule; The causal graph construction submodule constructs a causal chain Bayesian network based on the dependency graph and historical fault knowledge base, which includes the path from resource overload to service latency and from service latency to call failure. The contribution calculation submodule uses the current abnormal event description as an evidence node, executes the belief propagation algorithm, and calculates the posterior probability of each potential root cause node. satisfy: ; in, root cause The prior probability, It is the likelihood function; The report generation submodule arranges candidate root causes in descending order of posterior probability, adds a chain of observational evidence to support the inference, and forms a root cause localization report.

[0014] Furthermore, the online model evolution module includes a sample caching submodule, an incremental training submodule, and a model validation submodule; The sample caching submodule maintains a first-in-first-out buffer queue to store the most recently labeled abnormal samples and normal samples. After each monitoring cycle, the incremental training submodule extracts high information gain samples from the buffer queue and performs small-step gradient updates on the last few layers of the anomaly detection model, adjusting the model parameters. The update satisfies: ; in, For learning rate, For loss function, For high information gain batch data sampled from a buffer queue; The model validation submodule uses the reserved validation set to calculate the change in the F1 score of the updated model. If the performance degradation exceeds the tolerance limit, it rolls back to the parameters of the previous version.

[0015] A method for monitoring artificial intelligence big data servers includes the following steps: S1. Collect multi-source monitoring data through sensor arrays, system log interfaces and network probes, perform time alignment and semantic normalization, and generate multi-dimensional state vectors. S2. Based on multidimensional state vectors, a dynamic health baseline is constructed using an adaptive sliding window and a variational autoencoder to characterize the normal operating status of the server. S3. Based on the service call chain and resource contention relationship, construct a dependency graph that reflects the coupling structure between servers; S4. Combining dynamic health baseline and dependency graph, identify abnormal behavior patterns through spatiotemporal attention mechanism and output abnormal event descriptions; S5. Based on the description of abnormal events and Bayesian causal networks, perform reverse reasoning to determine the most likely root cause node and generate a root cause localization report. S6. Utilize root cause localization reports and new monitoring data to update the anomaly detection model online through an incremental learning strategy, maintaining the model's adaptability to behavioral drift.

[0016] Furthermore, in the step of constructing a dynamic health baseline, the dynamic health baseline... satisfy: ; In the step of constructing the dependency graph, the edge weights... satisfy: ; In the step of identifying abnormal behavior patterns, Mahalanobis distance is used. , satisfy: ; In the step of determining the root cause node, the posterior probability satisfy: ; In the step of updating the anomaly detection model online, the model parameters... The update satisfies: .

[0017] Compared with the prior art, the present invention has the following beneficial effects: The multi-source heterogeneous data fusion module achieves unified semantic modeling of physical, system, and network layer indicators, solving the analytical blind spots caused by data silos in traditional monitoring systems. The dynamic baseline modeling module adopts an adaptive sliding window and a deep generative model, effectively overcoming the false alarm problem of static thresholds in non-steady-state scenarios. The cross-node dependency graph construction module explicitly models the complex coupling relationships between servers, providing a topological basis for root cause localization. The anomaly pattern recognition module introduces a spatiotemporal attention mechanism to accurately capture the correlation between local anomalies and global propagation, significantly reducing the false negative rate. The root cause localization inference module uses Bayesian causal networks for probabilistic back-inference, avoiding the rigid matching defects of rule engines. The online model evolution module continuously optimizes model parameters through incremental learning, enabling the system to autonomously adapt to new fault modes. The synergistic effect of these technologies enables the monitoring device to maintain high-precision, low-latency fault early warning and diagnosis capabilities even in ultra-large-scale, highly dynamic artificial intelligence training clusters, providing reliable support for intelligent operation and maintenance decision-making. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the system architecture of the present invention; Figure 2 This is a flowchart of the multi-source heterogeneous data fusion module of the present invention; Figure 3 This is a flowchart illustrating the execution process of the dynamic baseline modeling module of the present invention. Figure 4 This is a flowchart illustrating the implementation of the cross-node dependency graph construction module of the present invention. Figure 5 This is a flowchart of the anomaly pattern recognition module analysis process of the present invention; Figure 6 This is a flowchart illustrating the root cause localization reasoning module of the present invention. Figure 7 This is a flowchart of the online model evolution module update process of the present invention; Figure 8 This is a flowchart illustrating the implementation steps of the method of the present invention. Detailed Implementation

[0019] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and should not be construed as limiting the scope of the invention.

[0020] As attached Figure 1 As shown: An artificial intelligence big data server monitoring device includes: The multi-source heterogeneous data fusion module is based on sensor arrays, system log interfaces and network traffic probes deployed in server clusters. It collects hardware resource utilization, process behavior sequences, temperature and power consumption parameters and network communication characteristics. It performs time alignment, format normalization and semantic mapping on monitoring indicators from different data sources to generate structured multi-dimensional state vectors. The dynamic baseline modeling module extracts historical operating patterns through a multidimensional state vector and an adaptive sliding window mechanism. It then combines variational autoencoders and Gaussian process regression to construct a dynamic health baseline under unsteady conditions. This baseline is updated in real time as the workload evolves, representing the index distribution characteristics of the server under normal operating conditions. Based on the dynamic health baseline, the cross-node dependency graph construction module uses graph neural networks to analyze the call links, resource contention relationships and data flow topology between servers. It takes physically or logically adjacent server nodes as graph vertices and their interaction strength as edge weights to generate a dependency graph that reflects the overall coupling structure of the system. The anomaly pattern recognition module utilizes dependency graphs and multidimensional state vectors to capture the correlation between local indicator mutations and global propagation paths through a spatiotemporal attention mechanism, identify abnormal behavior patterns that deviate from the dynamic baseline, and output an anomaly event description that includes anomaly type, confidence level, and scope of impact. The root cause localization inference module uses anomaly event descriptions and Bayesian causal networks to reverse reason about potential fault sources, calculates the causal contribution of each candidate node in the anomaly propagation path, determines the most likely root cause node based on the maximum a posteriori probability criterion, and generates a root cause localization report. The online model evolution module receives root cause localization reports and continuously flowing monitoring data. It uses an incremental learning strategy to fine-tune the anomaly detection model and dynamic baseline parameters online, avoiding full retraining and allowing the model parameters to evolve synchronously with business behavior, maintaining sensitivity to new anomaly patterns.

[0021] The multidimensional state vector includes timestamp-aligned CPU utilization sequences, memory allocation rates, disk I / O latency distributions, network packet throughput statistics, process system call frequencies, and chassis temperature gradient data. The dynamic health baseline includes the mean, variance, and higher-order moment features of each performance indicator within a sliding time window. The dependency graph includes server node identifiers, service call directions, resource contention intensity, and data dependency weights. The anomaly description includes the anomaly start time, the set of involved indicators, the quantified value of the deviation, and the propagation path prediction. The root cause localization report includes a list of candidate root causes, causal scores for each node, a summary of the reasoning basis, and confidence intervals. Online fine-tuning operations include gradient accumulation updates of model parameters, dynamic redistribution of loss function weights, and priority sampling strategies for new samples.

[0022] Please see Figure 1 and Figure 2The multi-source heterogeneous data fusion module includes: The data acquisition submodule acquires raw monitoring signals from the physical layer, system layer, and network layer through hardware sensors deployed on the server motherboard, log hooks in the operating system kernel, and mirror ports of the network switch. The raw monitoring signals include digital temperature readings, process creation / destruction event streams, and TCP connection establishment / disconnection records. The time synchronization submodule applies a timestamp from a unified clock source to the original monitoring signal and uses linear interpolation or nearest neighbor padding to process missing sampling points, ensuring that data from different sources are aligned to the same sampling period in the time dimension. The semantic normalization submodule maps the original signal into standardized semantic labels based on a predefined monitoring indicator ontology library, for example, mapping " The content is parsed as “system average load”, and “NVMe temperature sensor reading” is mapped as “storage device thermal status”, generating a multi-dimensional state vector with a unified semantic space.

[0023] This embodiment requires further explanation; please refer to [link / reference]. Figure 1 and Figure 3 The dynamic baseline modeling module includes: The sliding window management submodule maintains a variable-length time window. The window length is dynamically adjusted according to the server load fluctuation rate. When the load standard deviation is detected to exceed the preset threshold, the window is automatically shortened to enhance response sensitivity. The feature extraction submodule performs principal component analysis and wavelet transform on the multidimensional state vector within the window to extract low-dimensional latent features and retain key patterns that are sensitive to anomalies. The baseline generation submodule inputs low-dimensional latent features into a variational autoencoder for unsupervised reconstruction. Simultaneously, it utilizes Gaussian process regression to fit the trend term of the index over time. The reconstruction error and trend residual together constitute the boundary region of the dynamic healthy baseline, using the following formula: ; in, Indicates time The dynamic health baseline area For variational autoencoders, the input vector Reconstruction error, For Gaussian process regression at time 1000 The residual term, This is the preset joint threshold.

[0024] This embodiment requires further explanation; please refer to [link / reference]. Figure 1 and Figure 4 The cross-node dependency graph building module includes: The call chain parsing submodule extracts the inter-service call sequence from the distributed tracing system and identifies the frequency and latency distribution of requests from upstream services to downstream services. The resource contention analysis submodule calculates the resource interference coefficient between different tenant applications based on the usage conflict logs of the shared resource pool (such as CPU cores and memory bandwidth). The graph construction submodule defines each server instance as a graph vertex, calculates edge weights based on call frequency, interference coefficient, and data affinity, stores the dependency graph using a sparse matrix, and periodically performs graph pruning to remove weak connections. The edge weight calculation formula is as follows: ; in, For nodes and Edge weights between them The frequency of service calls per unit of time. Resource competition coefficient, For data affinity score, For normalized weight coefficients, satisfying .

[0025] This embodiment requires further explanation; please refer to [link / reference]. Figure 1 and Figure 5 The abnormal pattern recognition module includes: The local anomaly detection submodule calculates the Mahalanobis distance of the multidimensional state vector of a single server relative to the dynamic health baseline and marks sample points that exceed the confidence ellipsoid. The spatiotemporal propagation modeling submodule uses local anomalies as seeds and performs random walks with decay factors on the dependency graph to simulate the diffusion path and intensity decay of the anomaly's influence. The pattern clustering submodule performs density clustering on the results of multiple walks, merges anomalous events with similar propagation topologies, and outputs structured descriptions of the anomalous events. The Mahalanobis distance calculation formula is as follows: ; in, This is the current multidimensional state vector. This is the mean vector of the dynamic health baseline. Let be the covariance matrix.

[0026] This embodiment requires further explanation; please refer to [link / reference]. Figure 1 and Figure 6 The root cause localization reasoning module includes: The causal graph construction submodule constructs a Bayesian network containing typical causal chains such as "resource overload to service delay, service delay to call failure" based on the dependency graph and historical fault knowledge base; The contribution calculation submodule uses the current abnormal event description as evidence nodes, executes the belief propagation algorithm, and calculates the posterior probability of each potential root cause node. The report generation submodule sorts candidate root causes in descending order of posterior probability, adds a chain of observational evidence supporting the inference, and forms a root cause localization report. The posterior probability calculation formula is as follows: ; in, In order to observe evidence The root cause The posterior probability, Let it be its prior probability. Likelihood function.

[0027] This embodiment requires further explanation; please refer to [link / reference]. Figure 1 and Figure 7 The online model evolution module includes: The sample caching submodule maintains a first-in-first-out buffer queue to store the most recently labeled abnormal samples and normal samples. After each monitoring cycle, the incremental training submodule extracts high information gain samples from the buffer queue and performs small-step gradient updates on the last few layers of the anomaly detection model. The model validation submodule uses the retained validation set to calculate the change in the F1 score of the updated model. If the performance degradation exceeds the tolerance limit, it rolls back to the previous version of the parameters to ensure model stability. The gradient update formula is: ; in, For the model at time The parameters, For learning rate, For loss function, This is high information gain batch data sampled from a buffer queue.

[0028] Please see Figure 8 A method for monitoring artificial intelligence big data servers, which is based on the aforementioned artificial intelligence big data server monitoring device, includes the following steps: S1: Collect multi-source monitoring data through sensor arrays, system log interfaces and network probes, perform time alignment and semantic normalization, and generate multi-dimensional state vectors; S2: Based on a multidimensional state vector, a dynamic health baseline is constructed using an adaptive sliding window and a variational autoencoder to characterize the normal operating status of the server. S3: Based on the service call chain and resource contention relationship, construct a dependency graph that reflects the coupling structure between servers; S4: Combining dynamic health baseline and dependency graph, identify abnormal behavior patterns through spatiotemporal attention mechanism and output abnormal event descriptions; S5: Based on the description of abnormal events and Bayesian causal networks, perform reverse reasoning to determine the most likely root cause node and generate a root cause localization report; S6: Utilize root cause localization reports and new monitoring data to update the anomaly detection model online through an incremental learning strategy, maintaining the model's adaptability to behavioral drift.

[0029] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

[0030] To enable those skilled in the art to fully understand and implement this invention, the specific implementation principles of this invention are further supplemented below with a specific application scenario.

[0031] In a large-scale artificial intelligence training platform, a heterogeneous cluster consisting of 200 GPU servers is deployed to support multi-tenant parallel training tasks. This platform runs hundreds of deep learning jobs daily, and these jobs dynamically compete for computing resources, GPU memory bandwidth, and network throughput, leading to highly unstable system behavior. In this scenario, traditional monitoring systems based on static thresholds frequently issue false alarms about "excessive GPU utilization" or fail to detect training stagnation caused by distributed communication bottlenecks. To address these issues, the monitoring device proposed in this invention is deployed in this cluster, and its operation process is as follows: First, such as Figure 1 and Figure 2 As shown, the multi-source heterogeneous data fusion module synchronously collects data on the physical layer (GPU core temperature and power consumption), the system layer (process fork / exit event streams), and the network layer (RDMA connection establishment / disconnection records) through hardware sensors (such as the IPMI interface) deployed on each server motherboard, eBPF log hooks in the operating system kernel, and sFlow probes accessing the mirror port of the switch. The time synchronization submodule uses PTP (Precision Time Protocol) as a unified clock source, timestamps the three types of raw signals at the nanosecond level, and fills in missing points caused by sampling frequency differences with linear interpolation to ensure that all indicators are aligned to a 100ms sampling period.

[0032] Subsequently, the semantic normalization submodule, based on a predefined monitoring ontology library, will... "Output" The field is mapped to "GPU computing unit activity". “ in The value is interpreted as "memory page error rate", which ultimately generates a multidimensional state vector containing 128 features, and is then input into subsequent modules.

[0033] Next, as Figure 3 As shown, the dynamic baseline modeling module initiates an adaptive sliding window mechanism. When the CPU load standard deviation of a server exceeds 0.35 (a preset threshold) within 5 minutes, the sliding window management submodule automatically shortens the window length from 30 minutes to 10 minutes to improve the response speed to sudden load spikes. The feature extraction submodule performs principal component analysis on the data within the window, retaining the top 20 principal components with a cumulative variance contribution rate of 95%, and extracts high-frequency abrupt change features using wavelet transform. The baseline generation submodule inputs this low-dimensional feature into a pre-trained variational autoencoder (VAE) to calculate the reconstruction error. Simultaneously, Gaussian process regression (GPR) was used to fit the long-term trend of GPU memory usage to obtain the residual term. The weighted sum of the two is then compared with the threshold. Comparison, dynamic delineation of health baseline regions This effectively distinguishes between normal training peaks and real anomalies.

[0034] Subsequently, as Figure 4 As shown, the cross-node dependency graph construction module extracts service call chains from the Jaeger distributed tracing system, identifying that the parameter server of job A frequently calls the data loader of job B, with a call frequency of up to 120 times / second. Simultaneously, the resource contention analysis submodule, based on cgroups logs, discovers that the two jobs share the memory bandwidth of the same NUMA node, with an interference coefficient... The graph construction submodule uses 200 servers as vertices, according to the formula... ; Calculate edge weights (where data affinity is used) (Determined by the proportion of shared HDFS file blocks), a sparse adjacency matrix is ​​constructed, and graph pruning is performed once per hour to remove weak connections with a weight lower than 0.1, forming a dependency graph that reflects the true coupling structure.

[0035] Based on this, such as Figure 5 As shown, the anomaly pattern recognition module calculates the Mahalanobis distance from the multidimensional state vector of a server. When the value exceeds 3.0 (corresponding to a 99.7% confidence ellipsoid), it is marked as a local outlier. The spatiotemporal propagation modeling submodule uses this point as a seed and performs a random walk with a decay factor of 0.85 on the dependency graph to simulate the process of the anomaly's influence spreading along the high-weight edges. After 10 rounds of walks, the pattern clustering submodule uses the DBSCAN algorithm to cluster the path endpoints and finds that multiple outliers converge on the same upstream parameter server. Therefore, it outputs an anomaly event description: "Starting at 14:23:05, involving GPU utilization, NVLink throughput and TCP retransmission rate, deviation quantization value is 4.2, and the predicted propagation path covers 8 downstream training nodes."

[0036] Then, as Figure 6 As shown, the root cause localization inference module calls the causal graph construction submodule, which loads a Bayesian causal chain based on the historical fault database: "Memory leak to persistently high GPU utilization, persistently high GPU utilization to communication timeout, communication timeout to training crash". The contribution calculation submodule uses the above abnormal events as evidence E, executes the belief propagation algorithm, and calculates the posterior probability of "parameter server memory leak" among the candidate root causes. The causality score was significantly higher than that of other nodes. Based on this, the report generation submodule generates a root cause localization report, listing the top three candidate root causes and their causality scores. The study also included a chain of observational evidence showing that "GPU memory usage is increasing unidirectionally with no signs of release."

[0037] Finally, as Figure 7 As shown, the online model evolution module stores the labeled sample into the FIFO queue of the sample cache submodule; at the end of the next monitoring cycle, the incremental training submodule extracts the batch of data with the highest information gain from it. Perform small steps on the last two layers of the VAE decoder. Gradient update; the model validation submodule evaluates the F1 score on the reserved validation set. If the decrease exceeds 2%, a parameter rollback mechanism is triggered to ensure model stability. Through this mechanism, the system successfully improved the detection rate of the novel "gradient synchronization deadlock" anomaly from 41% to 89% within two weeks, while keeping the false positive rate below 3%.

[0038] All content not described in detail in the specification belongs to the prior art known to those skilled in the art, and the version parameters of each software component are not specifically limited. They can be implemented using conventional open source frameworks (such as PyTorch, Prometheus, and OpenTelemetry). The middleware and communication protocols not mentioned in this technical solution are not shown in the figure because they belong to the prior art, and will not be described here.

[0039] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An artificial intelligence big data server monitoring device, characterized in that: The device includes a multi-source heterogeneous data fusion module, a dynamic baseline modeling module, a cross-node dependency graph construction module, an anomaly pattern recognition module, a root cause localization inference module, and an online model evolution module; The multi-source heterogeneous data fusion module, based on the sensor array, system log interface and network traffic probe deployed in the server cluster, collects hardware resource utilization, process behavior sequence, temperature and power consumption parameters and network communication characteristics, performs time alignment, format normalization and semantic mapping on monitoring indicators from different data sources, and generates structured multi-dimensional state vectors. The dynamic baseline modeling module extracts historical operating modes through the multidimensional state vector using an adaptive sliding window mechanism, and constructs a dynamic health baseline in a non-steady-state environment by combining variational autoencoder and Gaussian process regression. This baseline is updated in real time as the workload evolves, characterizing the indicator distribution characteristics of the server under normal operating conditions. The cross-node dependency graph construction module, based on the dynamic health baseline, uses graph neural networks to analyze the call links, resource contention relationships, and data flow topology between servers, taking physically or logically adjacent server nodes as graph vertices and their interaction strength as edge weights, to generate a dependency graph that reflects the overall coupling structure of the system. The abnormal pattern recognition module uses the dependency graph and the multidimensional state vector to capture the correlation between local indicator mutations and global propagation paths through a spatiotemporal attention mechanism, identifies abnormal behavior patterns that deviate from the dynamic baseline, and outputs an abnormal event description that includes the abnormal type, confidence level, and scope of impact. The root cause localization inference module, based on the description of the abnormal event, combines a Bayesian causal network to perform reverse reasoning on potential fault sources, calculates the causal contribution of each candidate node in the abnormal propagation path, determines the most likely root cause node according to the maximum a posteriori probability criterion, and generates a root cause localization report. The online model evolution module is used to receive the root cause localization report and continuously flowing monitoring data. It adopts an incremental learning strategy to fine-tune the anomaly detection model and dynamic baseline parameters online, avoiding full retraining and enabling the model parameters to evolve synchronously with business behavior, maintaining sensitivity to new anomaly patterns.

2. The artificial intelligence big data server monitoring device as described in claim 1, characterized in that: The multidimensional state vector includes timestamp-aligned CPU utilization sequences, memory allocation rates, disk I / O latency distributions, network packet throughput statistics, process system call frequencies, and chassis temperature gradient data; the dynamic health baseline includes the mean, variance, and higher-order moment features of each performance indicator within a sliding time window; the dependency graph includes server node identifiers, service call directions, resource contention intensity, and data dependency weights; the abnormal event description includes the anomaly start time, the set of involved indicators, the quantified value of the deviation, and the propagation path prediction; the root cause localization report includes a candidate root cause list, causal scores for each node, a summary of the reasoning basis, and confidence intervals; the online fine-tuning operation includes gradient accumulation updates of model parameters, dynamic reallocation of loss function weights, and a priority sampling strategy for new samples.

3. The artificial intelligence big data server monitoring device as described in claim 1, characterized in that: The multi-source heterogeneous data fusion module includes a data acquisition submodule, a time synchronization submodule, and a semantic normalization submodule; The data acquisition submodule acquires raw monitoring signals from the physical layer, system layer, and network layer through hardware sensors deployed on the server motherboard, log hooks in the operating system kernel, and mirror ports of the network switch. The raw monitoring signals include digital temperature readings, process creation / destruction event streams, and TCP connection establishment / disconnection records. The time synchronization submodule applies a timestamp mark from a unified clock source to the original monitoring signal and uses linear interpolation or nearest neighbor filling to process missing sampling points, ensuring that data from different sources are aligned to the same sampling period in the time dimension. The semantic normalization submodule maps the original signal into standardized semantic labels based on a predefined monitoring indicator ontology library, generating a multidimensional state vector with a unified semantic space.

4. The artificial intelligence big data server monitoring device as described in claim 1, characterized in that: The dynamic baseline modeling module includes a sliding window management submodule, a feature extraction submodule, and a baseline generation submodule; The sliding window management submodule maintains a variable-length time window. The window length is dynamically adjusted according to the server load fluctuation rate. When the load standard deviation is detected to exceed a preset threshold, the window is automatically shortened. The feature extraction submodule performs principal component analysis and wavelet transform on the multidimensional state vector within the window to extract low-dimensional latent features. The baseline generation submodule inputs the low-dimensional latent features into a variational autoencoder for unsupervised reconstruction. Simultaneously, it utilizes the trend term of the Gaussian process regression fitting index over time, combining the reconstruction error and the trend residual to form the boundary region of the dynamic healthy baseline. satisfy: ； in, For variational autoencoders, the input vector Reconstruction error, For Gaussian process regression at time 1000 The residual term, This is the preset joint threshold.

5. The artificial intelligence big data server monitoring device as described in claim 1, characterized in that: The cross-node dependency graph construction module (103) includes a call chain parsing submodule, a resource contention analysis submodule, and a graph construction submodule; The call chain parsing submodule extracts the inter-service call sequence from the distributed tracing system and identifies the request frequency and latency distribution of upstream services to downstream services. The resource contention analysis submodule calculates the resource interference coefficient between different tenant applications based on the usage conflict logs of the shared resource pool. The graph construction submodule defines each server instance as a graph vertex, calculates edge weights based on call frequency, interference coefficient, and data affinity, stores the dependency graph using a sparse matrix, and periodically performs graph pruning to remove weak connections. Edge weights... satisfy: ； in, The frequency of service calls per unit of time. Resource competition coefficient, For data affinity score, These are the normalized weighting coefficients, and .

6. The artificial intelligence big data server monitoring device as described in claim 1, characterized in that: The abnormal pattern recognition module includes a local anomaly detection submodule, a spatiotemporal propagation modeling submodule, and a pattern clustering submodule; The local anomaly detection submodule calculates the Mahalanobis distance of a single server's multidimensional state vector relative to a dynamic health baseline, and marks sample points that exceed the confidence ellipsoid. satisfy: ； in, This is the current multidimensional state vector. This is the mean vector of the dynamic health baseline. It is the covariance matrix; The spatiotemporal propagation modeling submodule uses local anomaly points as seeds and performs a random walk with a decay factor on the dependency graph to simulate the diffusion path and intensity decay of the anomaly's influence. The pattern clustering submodule performs density clustering on the results of multiple walks, merges anomalous events with similar propagation topologies, and outputs a structured description of the anomalous events.

7. The artificial intelligence big data server monitoring device as described in claim 1, characterized in that: The root cause localization reasoning module includes a cause-effect graph construction submodule, a contribution calculation submodule, and a report generation submodule; The causal graph construction submodule constructs a causal chain Bayesian network based on the dependency graph and historical fault knowledge base, which includes the path from resource overload to service latency and from service latency to call failure. The contribution calculation submodule uses the current abnormal event description as an evidence node, executes the belief propagation algorithm, and calculates the posterior probability of each potential root cause node. satisfy: ； in, root cause The prior probability, It is the likelihood function; The report generation submodule arranges candidate root causes in descending order of posterior probability, adds a chain of observational evidence to support the inference, and forms a root cause localization report.

8. The artificial intelligence big data server monitoring device as described in claim 1, characterized in that: The online model evolution module includes a sample caching submodule, an incremental training submodule, and a model validation submodule; The sample caching submodule maintains a first-in-first-out buffer queue to store the most recently labeled abnormal samples and normal samples. After each monitoring cycle, the incremental training submodule extracts high information gain samples from the buffer queue and performs small-step gradient updates on the last few layers of the anomaly detection model, adjusting the model parameters. The update satisfies: ； in, For learning rate, For loss function, For high information gain batch data sampled from a buffer queue; The model validation submodule uses the reserved validation set to calculate the change in the F1 score of the updated model. If the performance degradation exceeds the tolerance limit, it rolls back to the parameters of the previous version.

9. A method for monitoring artificial intelligence big data servers, executed based on the artificial intelligence big data server monitoring device according to any one of claims 1 to 8, characterized in that: Includes the following steps: S1. Collect multi-source monitoring data through sensor arrays, system log interfaces and network probes, perform time alignment and semantic normalization, and generate multi-dimensional state vectors. S2. Based on multidimensional state vectors, a dynamic health baseline is constructed using an adaptive sliding window and a variational autoencoder to characterize the normal operating status of the server. S3. Based on the service call chain and resource contention relationship, construct a dependency graph that reflects the coupling structure between servers; S4. Combining dynamic health baseline and dependency graph, identify abnormal behavior patterns through spatiotemporal attention mechanism and output abnormal event descriptions; S5. Based on the description of abnormal events and Bayesian causal network, perform reverse reasoning to determine the most likely root cause node and generate a root cause localization report. S6. Utilize root cause localization reports and new monitoring data to update the anomaly detection model online through an incremental learning strategy, maintaining the model's adaptability to behavioral drift.

10. The method for monitoring an artificial intelligence big data server as described in claim 9, characterized in that: In the step of constructing a dynamic health baseline, the dynamic health baseline... satisfy: ； In the step of constructing the dependency graph, the edge weights... satisfy: ； In the step of identifying abnormal behavior patterns, Mahalanobis distance is used. , satisfy: ； In the step of determining the root cause node, the posterior probability satisfy: ； In the step of updating the anomaly detection model online, the model parameters... The update satisfies: 。

Images