Enterprise operation early warning monitoring method and system based on data analysis
By constructing a dynamic baseline and fusing anomaly detection models, the problems of false alarms, missed alarms, and credibility in traditional early warning methods are solved, enabling adaptive and optimized early warning for enterprise operations.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JIANGSU PROSPECT INFORMATION TECH CO LTD
- Filing Date
- 2026-04-30
- Publication Date
- 2026-06-05
AI Technical Summary
Traditional enterprise operation early warning methods cannot adapt to the cyclical fluctuations of business. Static thresholds lead to false alarms and missed alarms. Monitoring a single indicator is difficult to detect combined risks, lacks the credibility of early warnings, and cannot achieve closed-loop optimization.
By constructing a dynamic baseline, combining an isolated forest model and an LSTM autoencoder model for anomaly detection, and performing nonlinear fusion, the warning level and confidence level are output, and feedback data is collected for dynamic updates.
Dynamic baselines adapt to business cycle fluctuations, improve the interpretability and reliability of early warnings, reduce false alarm and false negative rates, and enable the system to self-optimize.
Smart Images
Figure CN122155538A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of enterprise operation technology, and in particular to an enterprise operation early warning and monitoring method and system based on data analysis. Background Technology
[0002] Enterprise operation monitoring is a crucial means of ensuring business continuity and mitigating operational risks. Traditional operational early warning methods primarily rely on manually set static thresholds, such as triggering alarms when sales fall below a certain fixed value or inventory turnover days exceed a certain limit. However, this method has several drawbacks: Static thresholds cannot adapt to cyclical fluctuations in business. For example, during peak sales seasons, sales naturally increase, and fixed thresholds can easily lead to missed alarms; while during off-seasons, minor fluctuations may trigger false alarms; monitoring single indicators struggles to detect combined risks: some risks manifest as multiple indicators showing slight anomalies simultaneously, with no individual indicator exceeding limits, but the combination constitutes a significant risk; there is a lack of quantification of early warning reliability. Traditional methods only output "whether an alarm is triggered," failing to provide the confidence level of the warning, leading to operational staff struggling to cope with false alarms; and closed-loop optimization is impossible: once deployed, the thresholds and models remain unchanged for a long period, unable to self-adjust based on actual handling effects, and performance gradually declines as business changes.
[0003] In recent years, some companies have attempted to introduce artificial intelligence models for anomaly detection. However, pure AI models suffer from a "black box" problem, poor interpretability, and a tendency to misjudge normal business fluctuations as anomalies. Therefore, how to effectively integrate the interpretability of statistical methods with the complex pattern recognition capabilities of artificial intelligence, and establish a continuously evolving early warning and monitoring system, has become a pressing technical problem to be solved in this field. Summary of the Invention
[0004] The purpose of this invention is to propose a data analysis-based enterprise operation early warning and monitoring method and system to solve the problems in the existing technology, such as static thresholds not being suitable for business fluctuations, single indicators being difficult to detect combined risks, early warnings lacking credibility, and the inability to perform closed-loop optimization.
[0005] To achieve the above objectives, the technical solution proposed by this invention is: a data analysis-based enterprise operation early warning and monitoring method, the method comprising:
[0006] Obtain key performance indicators (KPIs) from multiple dimensions of enterprise operations;
[0007] The metrics for each dimension are decomposed over time to construct a dynamic baseline that changes dynamically with the business cycle, and the deviation strength of the actual values of each metric is calculated based on the dynamic baseline.
[0008] The deviation intensity is input into the statistical process control model and the anomaly detection model respectively to obtain the first output and the second output;
[0009] The first and second outputs are nonlinearly fused, and the fusion risk score and corresponding confidence level are calculated based on the degree of divergence between the first and second outputs.
[0010] The warning level is determined based on the fusion risk score and confidence level, and a structured response plan is generated.
[0011] Feedback data on the treatment plan is collected, and the threshold coefficient of the dynamic baseline, the anomaly detection model, and the fusion weight of the nonlinear fusion are dynamically updated based on the feedback data.
[0012] Preferably, the step of performing time-series decomposition on the indicator data for each dimension, constructing a dynamic baseline that changes dynamically with the business cycle, and calculating the deviation strength of the actual values of each indicator based on the dynamic baseline includes:
[0013] The timing decomposition algorithm STL is used to decompose the first time series into its first time series. The original values of the indicators in each dimension Decomposed into trend terms Periodic terms and residuals ,Right now ;
[0014] Based on the standard deviation of the residual term over a business cycle Constructing a dynamic upper bound and dynamic lower bound ,in This is the threshold coefficient;
[0015] Deviation strength , For the first The actual values of indicators in each dimension.
[0016] Preferably, the anomaly detection model includes an isolated forest model and a long short-term memory network (LSTM) autoencoder model;
[0017] The isolated forest model calculates anomaly scores by constructing multiple isolated trees. ,in This represents the average path length. As the normalization factor, This is the input vector for the anomaly detection model;
[0018] The LSTM autoencoder model calculates the reconstruction error through an encoder-decoder structure. ;
[0019] The isolated forest model and the Long Short-Term Memory (LSTM) autoencoder model are fused to obtain the second output.
[0020] Preferably, the step of nonlinearly fusing the first output and the second output, and calculating the fusion risk score and corresponding confidence level based on the degree of divergence between the first output and the second output, includes:
[0021] The nonlinear fusion includes one or more of the following: confidence-based dynamic weight and nonlinear enhancement fusion, and ranking-based ordinal fusion.
[0022] When using confidence-based dynamic weights and nonlinear enhancement fusion, the fusion risk score... ,in The fusion weights are calculated based on historical false positive and false negative rates. and For nonlinear enhancement exponents greater than 1, As a synergistic enhancement factor; As the first output, The second output is the ratio of the absolute value of the maximum deviation intensity to the threshold coefficient among all dimensions of indicators.
[0023] When using ordinal fusion based on ranking, the first and second outputs are converted into percentile rankings in the historical distribution, and the fusion risk score is obtained by product.
[0024] Preferably, the step of nonlinearly fusing the first output and the second output, and calculating the fusion risk score and corresponding confidence level based on the degree of divergence between the first output and the second output, further includes:
[0025] Introducing the degree of divergence ,in This is the first output after normalization;
[0026] Calculate the base confidence level ,in For the total uncertainty of the model, For constant terms, This is the penalty coefficient for the degree of divergence.
[0027] Introducing consistency enhancement factor To obtain the final confidence level , The second output threshold, The degree of divergence threshold, This is the consistency weighting coefficient. It is an exponential function.
[0028] Preferably, determining the early warning level based on the fusion risk score and confidence level includes:
[0029] When the fusion risk score falls within the preset range and the corresponding confidence level is lower than the preset confidence threshold, the warning level is the baseline warning level.
[0030] The baseline warning level is revised based on the aforementioned degree of divergence:
[0031] When the conditions for the baseline warning level are met and the degree of divergence exceeds the first threshold, the warning level is reduced from the baseline warning level to the Level II warning level.
[0032] When the conditions for the baseline warning level are met and the degree of divergence exceeds the second threshold, the warning level is reduced from the baseline warning level to the Level III warning level and marked as requiring manual review.
[0033] The second threshold is greater than the first threshold.
[0034] Preferably, the generation of the structured processing scheme includes:
[0035] Based on the pre-defined rule base for matching early warning levels, when the root cause location matches the preset conditions in the pre-defined rule base, the corresponding standardized handling action is output.
[0036] When there is no match in the rule base, calculate the similarity between the current root cause vector and the cases in the historical case base, retrieve the historical case with the highest similarity and recommend its treatment plan;
[0037] If no match is found in either the rule base or the historical case base, a manual handling task reminder is generated, and solutions for the manual handling task are collected and updated to the preset rule base or the historical case base.
[0038] Preferably, the step of collecting feedback data on the treatment plan and dynamically updating the threshold coefficient of the dynamic baseline, the anomaly detection model, and the fusion weights of the nonlinear fusion based on the feedback data includes:
[0039] Threshold coefficient for dynamic baseline Perform rolling calibration to obtain the calibrated threshold coefficients. ;in For the first The target false alarm rate for each dimension of the metrics. For the first The actual false alarm rate of each dimension of the indicators The learning rate; It is a symbolic function;
[0040] For isolated forest models, the forest is reconstructed using feedback data;
[0041] For the LSTM autoencoder model, fine-tuning is performed using normal indicator data that do not show warnings within a preset time period;
[0042] Fusion weights for the nonlinear fusion The fusion weights are dynamically adjusted. ,in The accuracy of the statistical process control model is determined by statistical analysis of indicator data, including feedback data. The false negative rate of the statistical process control model is calculated based on indicator data, including feedback data. The accuracy of the anomaly detection model is calculated based on statistical data of indicators, including feedback data. The false negative rate of the anomaly detection model is obtained by statistically analyzing indicator data, including feedback data.
[0043] The feedback data includes one or more of the following: the accuracy of the early warning, the effectiveness of the response plan, the indicators that caused the anomaly, the response time, and the response effect.
[0044] A data-driven enterprise operation early warning and monitoring system is used to execute the data-driven enterprise operation early warning and monitoring method.
[0045] A computer-readable storage medium storing a computer program that is executed by a processor to implement the data analysis-based enterprise operation early warning and monitoring method.
[0046] The beneficial effects of this invention are:
[0047] 1. This invention performs time-series decomposition on the indicators of each dimension, constructs a dynamic baseline that changes dynamically with the business cycle, and calculates the deviation strength of the actual values of each indicator based on the dynamic baseline. By adapting to business cycle fluctuations through the dynamic baseline, false alarms and false negatives caused by fluctuations are reduced.
[0048] 2. This invention utilizes the isolated forest model and the LSTM autoencoder model to capture the correlation between indicators, effectively discovering hidden risks where a single indicator is normal but the combination of multiple indicators is abnormal.
[0049] 3. This invention, by nonlinearly fusing the first and second outputs and introducing a degree of divergence, outputs the warning level while providing a corresponding confidence level, enabling managers to judge the credibility of the warning and increasing the interpretability of the warning process.
[0050] 4. This invention dynamically updates the threshold coefficient of the dynamic baseline, the anomaly detection model, and the fusion weight of the nonlinear fusion through feedback data, enabling the system to adapt to business changes and ensuring low false alarm and false negative rates. Attached Figure Description
[0051] Figure 1 This is a flowchart of the enterprise operation early warning and monitoring method based on data analysis according to the present invention. Detailed Implementation
[0052] The following description is intended to disclose the present invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious modifications will occur to those skilled in the art. The basic principles of the invention defined in the following description can be applied to other embodiments, modifications, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the invention.
[0053] It is understood that the term "a" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element can be one, while in another embodiment, the number of the element can be multiple, and the term "a" should not be understood as a limitation on the number.
[0054] refer to Figure 1 The technical solution provided by this invention is: a data analysis-based enterprise operation early warning and monitoring method, the method comprising:
[0055] Step 1: Obtain indicator data from multiple dimensions of enterprise operations.
[0056] Specifically, data is collected in real time from business systems such as ERP (Enterprise Resource Planning), CRM (Customer Relationship Management), and SCM (Supply Chain Management) using a data synchronization ETL tool, with a sampling frequency of once a day. The collected data is then preprocessed across multiple dimensions, including cash flow balance, order turnover days, supplier on-time delivery rate, and customer complaint rate.
[0057] Step 2: Perform time-series decomposition on the metrics for each dimension, construct a dynamic baseline that changes dynamically with the business cycle, and calculate the deviation strength of the actual values of each metric based on the dynamic baseline. This includes the following steps:
[0058] The timing decomposition algorithm STL is used to decompose the first time series into its first time series. The original values of the indicators in each dimension Decomposed into trend terms Periodic terms and residuals ,Right now Taking cash flow balance as an example, we obtain and preprocess the daily cash flow balance data for the past 90 days, and then decompose the cash flow balance data using the STL algorithm.
[0059] Based on the standard deviation of the residual term over a business cycle Constructing a dynamic upper bound and dynamic lower bound ,in This is the threshold coefficient, initially set to 3. When the actual value... When the value exceeds this range, a statistical alert is triggered. Because the dynamic baseline incorporates both trends and cycles, during peak business seasons... The dynamic upper and lower bounds naturally increase, thus avoiding false alarms caused by seasonal fluctuations.
[0060] In this embodiment, a business cycle is chosen to be 30 days to ensure sufficient normal samples, and a robust estimation method is used to calculate... That is, it is calculated based on the interquartile range: .in for The interquartile range.
[0061] Deviation intensity is defined as the degree of actual deviation from the dynamic baseline, i.e., deviation strength. , For the first The actual values of indicators across all dimensions. A positive deviation indicates that the actual value is higher than expected (e.g., cash flow balance is higher than normal), while a negative value indicates that the actual value is lower than expected (e.g., cash flow balance is lower than normal).
[0062] For different dimensions of indicators, the business meaning of the deviation intensity needs to be interpreted according to the characteristics of the indicator. For example, in the cash flow balance indicator (the first dimension indicator), a negative value indicates an anomaly, while in the order turnover days indicator (the second dimension indicator), a positive value indicates an anomaly.
[0063] Step 3: Input the deviation strength into the statistical process control model and the anomaly detection model respectively to obtain the first output and the second output. The anomaly detection model includes an isolated forest model for joint detection of multi-dimensional indicators and a Long Short-Term Memory (LSTM) autoencoder model for time-dependent indicators. The specific steps are as follows:
[0064] The statistical process control model is as follows: ,in This is the first output. The dimension is 4 in this embodiment.
[0065] when When this occurs, it indicates that the data for at least one dimension of the indicator exceeds the range of the dynamic baseline, for example... , If this occurs, a statistical warning will be triggered.
[0066] The first output provides a unified scale to measure the overall deviation of the indicator data, and it is interpretable. Business personnel can directly understand it as "the cash flow balance deviates from the normal level by 3.2 times the standard deviation".
[0067] In this embodiment, the anomaly detection model includes two AI models, which process different combinations of indicator data from different dimensions to adapt to different risk models.
[0068] Specifically, this includes the Isolated Forest model for joint detection of multi-dimensional indicators, which calculates anomaly scores by constructing multiple isolated trees. ,in This represents the average path length. As the normalization factor, In this embodiment, the input vector is used as the anomaly detection model. The Isolation Forest model achieves anomaly detection by constructing multiple isolated trees. Each tree randomly selects features and random split points until each leaf node reaches its maximum depth. Outliers are more likely to be isolated because their feature values deviate from the normal distribution (i.e., the path from the root node to the leaf node is shorter).
[0069] In this embodiment, the specific construction process of the isolated forest model is as follows:
[0070] Number of trees in an isolated forest model Self-sampling size The maximum tree depth is 256. ,for In the The path length in the tree is The average path length is . . For harmonic functions, .
[0071] The abnormality score ranges from 0 to 1, with scores closer to 1 indicating a greater abnormality. A score below 0.5 indicates normality, a score between 0.5 and 0.6 indicates suspiciousness, and a score above 0.6 indicates abnormality.
[0072] Obtain the corresponding metric data for a business cycle (30 days) under normal conditions, calculate the mean and standard deviation of their anomaly scores, and convert the anomaly scores into anomaly probabilities using a normal cumulative function. The formula for the normal cumulative function is: , The mean, Standard deviation, The Gaussian error function is... The input variable is the anomaly score output by the Isolation Forest model. In this embodiment, the input variable is the anomaly score. The probability of an anomaly is 1.
[0073] It also includes an LSTM autoencoder model for time-dependent metric detection. This model calculates the reconstruction error using an encoder-decoder structure. And dynamically set the anomaly threshold based on the reconstruction error distribution of recent normal samples, specifically:
[0074] For indicator data with strong time-series dependence, such as cash flow balance, the time-series model LSTM autoencoder model is used alone to capture trend anomalies.
[0075] Obtain recent (7 days) indicator data for the relevant dimension (e.g., cash flow balance), and construct an input vector with a window length of 7: .
[0076] The input is fed into the LSTM autoencoder model, and the output is the reconstruction error. .in for The refactoring item.
[0077] The reconstruction error is converted into an anomaly probability 2 using an exponentially weighted moving average: ,in The average error of the reconstructed indicator data that is currently in a normal state is used. When the probability of anomaly 2 is greater than a preset threshold... This is an anomaly. This represents the standard deviation of the reconstruction error of indicator data that has recently been in a normal state.
[0078] By fusing the outputs of the LSTM autoencoder model and the isolated forest model, a second output is obtained. ,in , These are the probability of anomaly one and the probability of anomaly two.
[0079] In this embodiment, the structure of the LSTM autoencoder is as follows: the number of hidden units in the LSTM layer of the encoder is 32, the input dimension is 1, and the output dimension is 32.
[0080] Take the output of the last time step as the encoding vector;
[0081] The decoder's LSTM layer has 32 hidden units, an output dimension of 1, and the output is a reconstructed sequence. .
[0082] Step 4: Perform nonlinear fusion of the first and second outputs, and calculate the fusion risk score and corresponding confidence level based on the degree of divergence between the first and second outputs. This includes the following steps:
[0083] A confidence-based dynamic weighting and nonlinear enhancement fusion method is used to nonlinearly fuse the first and second outputs to obtain a fusion risk score. ,in The fusion weights are calculated based on historical false positive and false negative rates. and For nonlinear enhancement exponents greater than 1, As a synergistic enhancement factor; As the first output, This is the second output.
[0084] ;in This refers to the accuracy rate of the recent statistical process control model (i.e., the proportion of times the model's judgment of an abnormal indicator matches the actual abnormal situation out of the total number of warnings). This refers to the recent underreporting rate of the statistical process control model (i.e., the proportion of times when the indicator is actually abnormal but the model does not issue an early warning, out of the total number of early warnings). This represents the accuracy of recent anomaly detection models. This represents the false negative rate of the machine anomaly detection model.
[0085] Introducing the degree of divergence ,in This is the first output after normalization;
[0086] Calculate the base confidence level ,in For the total uncertainty of the model, For constant terms, This is the penalty coefficient for the degree of divergence.
[0087] Introducing consistency enhancement factor To obtain the final confidence level , The second output threshold, The degree of divergence threshold, This is the consistency weighting coefficient. It is an exponential function. Second output threshold. .
[0088] In some preferred embodiments, a ranking-based ordinal fusion method can also be used. Specifically, the first and second outputs are converted into percentile rankings in the historical distribution, and the fusion risk score is obtained through a product. For example, if the first output corresponding to a certain dimension's indicator ranks 7th in the historical first output data, and the number of historical first output data is 1000, then the percentile ranking is... .
[0089] Step 5: Determine the warning level based on the fusion risk score and confidence level, and generate a structured response plan. The specific steps are as follows:
[0090] When the integration risk score falls within the preset range And the corresponding confidence level is lower than the preset confidence threshold. At that time, the warning level is the baseline warning level, namely the Level 1 warning level. To integrate the upper and lower limits of risk.
[0091] The baseline warning level is revised based on the aforementioned degree of divergence:
[0092] When the baseline warning level conditions are met and the degree of divergence exceeds the first threshold. At that time, the warning level was lowered from the baseline warning level to the Level II warning level.
[0093] When the baseline warning level conditions are met and the degree of divergence exceeds the second threshold. When this happens, the warning level is reduced from the baseline warning level to the third-level warning level and marked as requiring manual review; in this embodiment, the second threshold is greater than the first threshold. This is the adjustment amount for the tiered threshold.
[0094] For the isolated forest model, the average path reduction method is used to calculate the contribution of the deviation strength or the actual value of the index in each dimension of the anomaly detection model's input vector to the anomaly score (i.e., the change in the average path length across all trees). The root cause causing the warning is determined based on the magnitude of the contribution.
[0095] For example, the contributions of cash flow balance, order turnover days, supplier on-time delivery rate, and customer complaint rate are respectively... ,if Therefore, the root cause of the anomaly is the abnormal cash flow balance.
[0096] The root cause vector is ,in They are respectively The normalized value.
[0097] Based on the pre-defined rule base for matching early warning levels, when the root cause location matches the preset conditions in the pre-defined rule base, the corresponding standardized handling action is output.
[0098] If no match is found in the rule base, the similarity between the current root cause vector and cases in the historical case base is calculated. The historical case with the highest similarity is retrieved, and its handling plan is recommended. For example, if the anomaly handling plan in a historical case includes the contribution of cash flow balance, order turnover days, supplier on-time delivery rate, and customer complaint rate at the time of the anomaly, and is represented in vector form, then the cosine similarity with the root cause vector is calculated. If the similarity is greater than 0.9, then the handling plan for that historical case is obtained.
[0099] When no match is found in either the rule base or the historical case base, a manual handling task reminder is generated, and solutions for the manual handling task are collected and updated to the preset rule base or historical case base. This includes updating the rule base or historical case base in vector form the contribution of the causes of the anomaly identified during manual handling, such as cash flow balance, order turnover days, supplier on-time delivery rate, and customer complaint rate.
[0100] The structured treatment plan includes action steps, expected results, and alternative solutions. For example, if the root cause is a deviation of 3.2 standard deviations from normal due to cash flow balance, and historical cases are retrieved with a similarity of 92%, then the treatment plans for those historical cases are obtained as follows:
[0101] Action steps: Confirm the payment progress of major clients and suspend unnecessary marketing expenses;
[0102] Expected result: Increase cash flow balance;
[0103] Alternative solution: Confirm the payment progress of small customers.
[0104] Step 6: Collect feedback data on the treatment plan, and dynamically update the threshold coefficient of the dynamic baseline, the anomaly detection model, and the fusion weights of the nonlinear fusion based on the feedback data. This specifically includes the following steps:
[0105] After completing the process, the business personnel record the following feedback data in the system:
[0106] Accuracy of this warning: accurate or false alarm; Effectiveness of the response plan: effective or ineffective; Indicators causing the anomaly; Time spent on the response and its effects (recovering customers, increasing cash flow balance, etc.).
[0107] Threshold coefficient for dynamic baseline Perform rolling calibration to obtain the calibrated threshold coefficients. ;in For the first The target false alarm rate for each dimension of the metrics. For the first The actual false alarm rate of each dimension of the indicators The learning rate; It is a symbolic function.
[0108] For the isolated forest model, the forest is reconstructed using feedback data: the forest is reconstructed using multi-dimensional metrics data containing feedback data over three business cycles (e.g., 90 days).
[0109] For the LSTM autoencoder model, fine-tuning is performed using normal indicator data without warnings within a preset time period: every morning, the model is updated online using normal indicator data without warnings. and standard deviation .
[0110] Fusion weights for the nonlinear fusion The fusion weights are dynamically adjusted. ,in The accuracy of the statistical process control model is determined by statistical analysis of indicator data, including feedback data. The false negative rate of the statistical process control model is calculated based on indicator data, including feedback data. The accuracy of the anomaly detection model is calculated based on statistical data of indicators, including feedback data. The false negative rate of the anomaly detection model is calculated based on indicator data, including feedback data.
[0111] The present invention also provides a data analysis-based enterprise operation early warning and monitoring system, the system being used to execute the data analysis-based enterprise operation early warning and monitoring method.
[0112] The present invention also provides a computer-readable storage medium storing a computer program that is executed by a processor to implement the data analysis-based enterprise operation early warning and monitoring method described above.
[0113] The processes described above with reference to the flowcharts in the embodiments disclosed in this invention can be implemented as computer software programs. The embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), it performs the functions defined in the methods of this application. It should be noted that the computer-readable medium described above in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wire segments, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless segments, wire segments, optical fibers, RF, etc., or any suitable combination thereof.
[0114] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation that may be implemented in systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0115] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are merely examples and do not limit the present invention. The purpose of the present invention has been fully and effectively achieved, and the functions and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the stated principles, the implementation of the present invention may have any changes or modifications.
Claims
1. A data-driven enterprise operation early warning and monitoring method, characterized in that, The method includes: Obtain key performance indicators (KPIs) from multiple dimensions of enterprise operations; The metrics for each dimension are decomposed over time to construct a dynamic baseline that changes dynamically with the business cycle, and the deviation strength of the actual values of each metric is calculated based on the dynamic baseline. The deviation intensity is input into the statistical process control model and the anomaly detection model respectively to obtain the first output and the second output; The first and second outputs are nonlinearly fused, and the fusion risk score and corresponding confidence level are calculated based on the degree of divergence between the first and second outputs. The warning level is determined based on the fusion risk score and confidence level, and a structured response plan is generated. Feedback data on the treatment plan is collected, and the threshold coefficient of the dynamic baseline, the anomaly detection model, and the fusion weight of the nonlinear fusion are dynamically updated based on the feedback data.
2. The enterprise operation early warning and monitoring method based on data analysis according to claim 1, characterized in that, The process involves time-series decomposition of the indicators for each dimension, constructing a dynamic baseline that changes dynamically with the business cycle, and calculating the deviation strength of the actual values of each indicator based on the dynamic baseline, including: The timing decomposition algorithm STL is used to decompose the first time series into its first time series. The original values of the indicators in each dimension Decomposed into trend terms Periodic terms and residuals ,Right now ; Based on the standard deviation of the residual term over a business cycle Constructing a dynamic upper bound and dynamic lower bound ,in This is the threshold coefficient; Deviation strength , For the first The actual values of indicators in each dimension.
3. The enterprise operation early warning and monitoring method based on data analysis according to claim 2, characterized in that, The anomaly detection model includes the isolated forest model and the Long Short-Term Memory (LSTM) autoencoder model. The isolated forest model calculates anomaly scores by constructing multiple isolated trees. ,in This represents the average path length. As the normalization factor, This is the input vector for the anomaly detection model; The LSTM autoencoder model calculates the reconstruction error through an encoder-decoder structure. ; The isolated forest model and the Long Short-Term Memory (LSTM) autoencoder model are fused to obtain the second output.
4. The enterprise operation early warning and monitoring method based on data analysis according to claim 3, characterized in that, The step of nonlinearly fusing the first output and the second output, and calculating the fusion risk score and corresponding confidence level based on the degree of divergence between the first output and the second output, includes: The nonlinear fusion includes one or more of the following: confidence-based dynamic weight and nonlinear enhancement fusion, and ranking-based ordinal fusion. When using confidence-based dynamic weights and nonlinear enhancement fusion, the fusion risk score... in The fusion weights are calculated based on historical false positive and false negative rates. and The nonlinear enhancement exponent is greater than 1. As a synergistic enhancement factor; As the first output, This is the second output; The first output is the ratio of the absolute value of the maximum deviation intensity to the threshold coefficient among all dimensions of indicators; When using ordinal fusion based on ranking, the first and second outputs are converted into percentile rankings in the historical distribution, and the fusion risk score is obtained by product.
5. The enterprise operation early warning and monitoring method based on data analysis according to claim 4, characterized in that, The step of nonlinearly fusing the first output and the second output, and calculating the fusion risk score and corresponding confidence level based on the degree of divergence between the first output and the second output, further includes: Introducing the degree of divergence ,in This is the first output after normalization; Calculate the base confidence level in For the total uncertainty of the model, For constant terms, This is the penalty coefficient for the degree of divergence. Introducing consistency enhancement factor Obtain the final confidence level The second output threshold, The degree of divergence threshold, This is the consistency weighting coefficient. It is an exponential function.
6. The enterprise operation early warning and monitoring method based on data analysis according to claim 5, characterized in that, The determination of the early warning level based on the fusion risk score and confidence level includes: When the fusion risk score falls within the preset range and the corresponding confidence level is lower than the preset confidence threshold, the warning level is the baseline warning level. The baseline warning level is revised based on the aforementioned degree of divergence: When the conditions for the baseline warning level are met and the degree of divergence exceeds the first threshold, the warning level is reduced from the baseline warning level to the Level II warning level. When the conditions for the baseline warning level are met and the degree of divergence exceeds the second threshold, the warning level is reduced from the baseline warning level to the Level III warning level and marked as requiring manual review. The second threshold is greater than the first threshold.
7. The enterprise operation early warning and monitoring method based on data analysis according to claim 6, characterized in that, The generation of structured processing solutions includes: Based on the pre-defined rule base for matching early warning levels, when the root cause location matches the preset conditions in the pre-defined rule base, the corresponding standardized handling action is output. When there is no match in the rule base, calculate the similarity between the current root cause vector and the cases in the historical case base, retrieve the historical case with the highest similarity and recommend its treatment plan; If no match is found in either the rule base or the historical case base, a manual handling task reminder is generated, and solutions for the manual handling task are collected and updated to the preset rule base or the historical case base.
8. The enterprise operation early warning and monitoring method based on data analysis according to claim 7, characterized in that, The process of collecting feedback data on the treatment plan and dynamically updating the threshold coefficient of the dynamic baseline, the anomaly detection model, and the fusion weights of the nonlinear fusion based on the feedback data includes: Threshold coefficient for dynamic baseline Perform rolling calibration to obtain the calibrated threshold coefficients. in For the first The target false alarm rate for each dimension of the metrics. For the first The actual false alarm rate of each dimension of the indicators The learning rate; It is a symbolic function; For isolated forest models, the forest is reconstructed using feedback data; For the LSTM autoencoder model, fine-tuning is performed using normal indicator data that do not show warnings within a preset time period; Fusion weights for the nonlinear fusion The fusion weights are dynamically adjusted. in The accuracy of the statistical process control model is determined by statistical analysis of indicator data, including feedback data. The false negative rate of the statistical process control model is calculated based on indicator data, including feedback data. The accuracy of the anomaly detection model is calculated based on statistical data of indicators, including feedback data. The false negative rate of the anomaly detection model is obtained by statistically analyzing indicator data, including feedback data. The feedback data includes one or more of the following: the accuracy of the early warning, the effectiveness of the response plan, the indicators that caused the anomaly, the response time, and the response effect.
9. A data-driven enterprise operation early warning and monitoring system, characterized in that: The system is used to execute the enterprise operation early warning and monitoring method based on data analysis as described in any one of claims 1-8.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that is executed by a processor to implement the data analysis-based enterprise operation early warning and monitoring method according to any one of claims 1-8.