A general networking device monitoring method and system

Abstract

This application provides a general networked device monitoring method and system, relating to the field of device operation status monitoring. The method includes: acquiring time-series data of events from the monitored networked device and operating parameters of the monitored networked device's operating status; identifying the operating condition classification of the monitored networked device based on the operating parameters to obtain the current operating condition category; matching a preset operating condition time-series limit model based on the current operating condition category and analyzing the time-series data to obtain time-series offset characteristics; analyzing the time-series offset characteristics through an anomaly analysis model to obtain anomaly identification results and degradation trends; and determining the device operation status monitoring results based on the anomaly identification results and degradation trends. This application, used in the monitoring of general networked devices, solves the technical problem that existing technologies cannot improve the accuracy and timeliness of networked device operation status monitoring while ensuring universality and low modification costs.

Description

Technical Field

[0001] This application relates to the field of equipment operation status monitoring, and in particular to a general networked equipment monitoring method and system. Background Technology

[0002] In existing network device operation monitoring technologies, the determination of whether a device is abnormal is typically made by collecting operational status parameters or event time information. However, existing technologies often rely on single-indicator monitoring or simple threshold judgments, which are insufficient to comprehensively reflect the complex and ever-changing working states of devices during actual operation. When coordinated anomalies occur between multiple functional units or processes within a device, existing methods often fail to accurately identify them, leading to delayed anomaly detection or misjudgments. Furthermore, the operating characteristics of devices fluctuate normally over long-term operation and under different loads and operating conditions; existing monitoring methods lack the ability to effectively distinguish between normal fluctuations and abnormal changes, affecting the reliability of monitoring results. In addition, the large amount of time-related data generated during device operation is easily affected by factors such as system clock deviations, leading to a decrease in the accuracy of monitoring data, a problem that existing technologies do not adequately address. On the other hand, existing monitoring methods focus primarily on alarms after anomalies occur, lacking the ability to analyze trends in device operating status changes, making it difficult to meet the needs of proactive device maintenance and operational risk assessment. Therefore, how to improve the accuracy and timeliness of network device operation status monitoring while ensuring versatility and low modification costs remains a pressing issue that existing technologies need to address. Summary of the Invention

[0003] This application provides a general method and system for monitoring networked devices, which solves the technical problem that existing technologies cannot improve the accuracy and timeliness of monitoring the operating status of networked devices while ensuring universality and low modification costs.

[0004] To achieve the above objectives, this application adopts the following technical solution: Firstly, a general method for monitoring networked devices is provided, comprising: acquiring time-series data of events of the monitored networked devices and operating parameters of the operating status of the monitored networked devices; the time-series data includes: event trigger time, execution unit response time, and communication time; the operating parameters include: processing load, operating mode, resource ratio, task type, and communication status; based on the operating parameters, identifying the operating condition classification of the monitored networked devices to obtain the current operating condition category; matching a preset operating condition time-series limit model based on the current operating condition category, and analyzing the time-series data to obtain time-series offset characteristics; the operating condition time-series limit model consists of a statistical boundary model and a sliding update mechanism, used to limit the normal fluctuation boundary of the time-series characteristics; analyzing the time-series offset characteristics through an anomaly analysis model to obtain anomaly identification results and degradation trends; and determining the monitoring results of the device operating status based on the anomaly identification results and degradation trends.

[0005] In conjunction with the first aspect mentioned above, in one possible implementation, before acquiring the timing data of the events of the monitored networked device and the operating parameters of the monitored networked device's operating status, the method further includes: acquiring the calibration time and the original timestamp data of the events of the monitored networked device, including: the original event trigger time, the original execution unit response time, and the original communication interaction time; based on the calibration time and the original timestamp data of the events of the monitored networked device, periodically monitoring the operating deviation of the system clock of the monitored device, and calculating the clock drift rate of the system clock relative to the calibration time; when the clock drift rate exceeds a preset threshold, calibrating the system clock of the monitored device based on the calibration time, and performing consistency correction or distorted data removal on the collected multi-source event timestamps to obtain the calibrated timing data of the events of the monitored networked device.

[0006] In conjunction with the first aspect mentioned above, in one possible implementation, operating condition classification is achieved by performing cluster analysis on historical operating condition parameters to generate multiple operating condition cluster centers, with each operating condition cluster center corresponding to an operating condition category.

[0007] In conjunction with the first aspect mentioned above, in one possible implementation, based on operating condition parameters, the operating condition classification of the monitored networked device is identified to obtain the current operating condition category, including: normalizing the operating condition parameters to construct an operating condition feature vector; and calculating the similarity between the operating condition feature vector and multiple operating condition categories to determine the current operating condition category.

[0008] In conjunction with the first aspect mentioned above, in one possible implementation, a preset operating condition timing limit model is matched based on the current operating condition category, and the timing data is analyzed to obtain timing offset features, including: obtaining the operating condition timing limit model corresponding to the current operating condition category; calculating the time difference feature between any two of the event trigger time, execution unit response time, and communication time based on the timing data; comparing the time difference feature with the corresponding statistical boundary in the operating condition timing limit model, and calculating the deviation of the time difference feature from the statistical boundary; and determining the timing offset feature that characterizes the degree of deviation of the current multi-source timing data from the operating condition timing limit model based on the deviation.

[0009] In conjunction with the first aspect mentioned above, in one possible implementation, the deviation amount Satisfy the following formula:

[0010] in, This represents the actual value of the i-th time difference feature in the current time series data; and These represent the lower and upper boundaries of the statistical boundary model corresponding to the i-th time difference feature under the current working condition category, respectively. This represents the statistical mean of the i-th time difference feature under the current operating condition category; In conjunction with the first aspect mentioned above, in one possible implementation, the time-series offset feature... Satisfy the following formula:

[0011] Where n represents the number of time difference features; This represents the sensitivity weight of the i-th time difference feature under the current working condition category; This indicates the corresponding deviation.

[0012] In conjunction with the first aspect mentioned above, in one possible implementation, an anomaly analysis model is used to analyze the time-series offset features to obtain anomaly identification results and degradation trends. This includes: acquiring time-series offset features within a continuous time window and constructing a time-series offset feature sequence; the time-series offset feature sequence includes a short-term offset feature sequence and a long-term offset feature sequence; based on the time-series offset feature sequence, calculating the statistical feature parameters of the time-series offset features within the current time window, including the mean, variance, and rate of change; comparing the statistical feature parameters with a preset anomaly judgment threshold under the corresponding working condition category; when the statistical feature parameters exceed the corresponding threshold, generating an anomaly identification result; and based on the time-series offset feature sequence, obtaining the degradation trend through a trend prediction model; the trend prediction model includes a time-series encoding module and an attention encoding module.

[0013] In conjunction with the first aspect mentioned above, in one possible implementation, based on the time-series offset feature sequence, a degradation trend is obtained through a trend prediction model, including: performing time position encoding on the time-series offset feature sequence, introducing time step information to obtain a time-aware input sequence; calculating the association weights between each time window of the time-aware input sequence through an attention mechanism to obtain trend features; and calculating the trend change rate of the time-series offset features based on the trend features to obtain a degradation trend strength index; the trend strength index... Satisfy the following formula: Where t represents the time window index, and T represents the number of historical windows used for trend analysis. This indicates the trend characteristics at time t. It represents the trend characteristics at time t-1; based on the degradation trend intensity index and the preset trend judgment interval under the corresponding operating condition category, it outputs the degradation trend of equipment performance; the degradation trend includes: no obvious degradation trend, slow degradation trend and rapid degradation trend.

[0014] In conjunction with the first aspect mentioned above, in one possible implementation, the equipment operating status monitoring result is determined based on the anomaly identification result and the degradation trend, including: determining whether the equipment is in an abnormal state based on the anomaly identification result; determining whether the equipment operating performance shows a degradation change based on the degradation trend; determining the operating status level of the equipment based on the combination relationship between the abnormal state and the degradation change, and outputting the operating status level as the equipment operating status monitoring result.

[0015] Secondly, a general network device monitoring system is provided, comprising: a data acquisition device and an electronic device; wherein, the data acquisition device is used to acquire time-series data of events of the monitored network device and operating parameters of the monitored network device's operating status; the time-series data includes: event trigger time, execution unit response time, and communication time; the operating parameters include: processing load, operating mode, resource ratio, task type, and communication status; the electronic device is used to identify the operating condition classification of the monitored network device based on the operating parameters to obtain the current operating condition category; based on the current operating condition category, a preset operating condition time-series limit model is matched, and the time-series data is analyzed to obtain time-series offset characteristics; the operating condition time-series limit model consists of a statistical boundary model and a sliding update mechanism, used to limit the normal fluctuation boundary of the time-series characteristics; the time-series offset characteristics are analyzed through an anomaly analysis model to obtain anomaly identification results and degradation trends; based on the anomaly identification results and degradation trends, the monitoring results of the device's operating status are determined.

[0016] This application provides a general network device monitoring method and system. By comprehensively analyzing the event timing data and operating parameters generated during the operation of network devices, it can more comprehensively reflect the behavioral characteristics of the devices under actual operating conditions, effectively avoiding the problem of insufficient monitoring accuracy caused by relying solely on a single operating indicator or simple threshold judgment. By distinguishing and processing the device timing characteristics under different operating conditions, the monitoring results can adapt to objective situations such as changes in device load and switching of operating modes, thereby reducing the risk of misjudgment caused by fluctuations in normal operating conditions and improving the reliability of anomaly identification. In addition, by analyzing the relationship between multiple types of time information during device operation, this invention can effectively characterize the collaborative state between different functional links within the device, helping to promptly detect potential anomalies or performance changes that are difficult to identify in a timely manner using traditional monitoring methods, thereby improving the sensitivity and timeliness of device operating status monitoring. Furthermore, based on anomaly identification, this invention analyzes the changing trends of equipment operating status, enabling the monitoring results to not only reflect the current state of the equipment but also the evolution direction of its operating performance. This provides more valuable information for equipment operation assessment and maintenance decisions, facilitating early warning and operational risk control. It solves the technical problem that existing technologies cannot improve the accuracy and timeliness of networked equipment operating status monitoring while ensuring versatility and low modification costs.

[0017] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0018] Figure 1 A system architecture diagram of a general networked device monitoring system provided in this application embodiment; Figure 2 A flowchart illustrating a general network device monitoring method provided in an embodiment of this application; Figure 3 A flowchart illustrating another general network device monitoring method provided in this application embodiment; Figure 4 This is a flowchart illustrating another general network device monitoring method provided in an embodiment of this application. Detailed Implementation

[0019] In the description of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0020] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0021] The general network device monitoring method provided in this application embodiment can be applied to, for example, Figure 1 In the general networked device monitoring system shown, such as Figure 1 As shown, the system includes: a data acquisition device 101 and an electronic device 102; The data acquisition device 101 is used to acquire time-series data of events of the monitored networked devices and operating parameters of the operating status of the monitored networked devices; the time-series data includes: event trigger time, execution unit response time and communication time; the operating parameters include: processing load, operating mode, resource ratio, task type and communication status. Electronic device 102 is used to identify the operating condition classification of the monitored networked device based on operating condition parameters to obtain the current operating condition category; match a preset operating condition time series limit model based on the current operating condition category, and analyze the time series data to obtain time series offset characteristics; the operating condition time series limit model consists of a statistical boundary model and a sliding update mechanism, which is used to limit the normal fluctuation boundary of the time series characteristics; analyze the time series offset characteristics through an anomaly analysis model to obtain anomaly identification results and degradation trends; and determine the equipment operating status monitoring results based on the anomaly identification results and degradation trends.

[0022] To address the technical problem of existing technologies failing to improve the accuracy and timeliness of network device operation status monitoring while ensuring versatility and low modification costs, this application provides a general network device monitoring method. The method includes: acquiring time-series data of events from the monitored network device and operating condition parameters of the monitored network device's operation status; the time-series data includes: event trigger time, execution unit response time, and communication time; the operating condition parameters include: processing load, operating mode, resource allocation, task type, and communication status; based on the operating condition parameters, identifying the operating condition classification of the monitored network device to obtain the current operating condition category; matching a preset operating condition time-series limit model based on the current operating condition category and analyzing the time-series data to obtain time-series offset characteristics; the operating condition time-series limit model consists of a statistical boundary model and a sliding update mechanism, used to limit the normal fluctuation boundary of the time-series characteristics; analyzing the time-series offset characteristics through an anomaly analysis model to obtain anomaly identification results and degradation trends; and determining the device operation status monitoring results based on the anomaly identification results and degradation trends.

[0023] Figure 2 This is a flowchart illustrating the general network device monitoring method provided in the embodiments of this application, as shown below. Figure 2 As shown, the method includes: S201. Obtain the timing data of events of the monitored networked devices and the operating parameters of the monitored networked devices.

[0024] Among them, time-series data refers to a set of data that reflects the execution order and time consumption relationship of different processing links within the device in the time dimension, including event trigger time, execution unit response time, and communication time; operating parameters refer to a set of parameters used to characterize the current operating status and resource usage of the device, including processing load, operating mode, resource ratio, task type, and communication status.

[0025] In one possible implementation, a data acquisition module deployed on the monitored network device or its control system acquires event timestamp data and operating parameter data generated by the device during operation in real time. The event trigger time records the moment a control event or business event is triggered, the execution unit response time records the moment the execution unit responds to the event, and the communication time records the moment event-related data is sent or received in the communication link. Simultaneously, operating parameters such as the device's processing load and operating mode are acquired through system interfaces or operation monitoring interfaces, and the collected data are organized chronologically to form corresponding time-series data and operating parameter sets.

[0026] It should be noted that before acquiring the time-series data of events from the monitored networked devices and the operating parameters of the monitored networked devices' operating status, the acquired data will be calibrated. Specifically, the calibration time and the original timestamp data of the events from the monitored networked devices will be acquired, including: the original event trigger time, the original execution unit response time, and the original communication interaction time. Based on the calibration time and the original timestamp data of the events from the monitored networked devices, the operating deviation of the system clock of the monitored devices will be periodically monitored, and the clock drift rate of the system clock relative to the calibration time will be calculated. When the clock drift rate exceeds a preset threshold, the system clock of the monitored devices will be calibrated based on the calibration time, and the collected multi-source event timestamps will be corrected for consistency or distorted data will be removed to obtain the calibrated time-series data of the events from the monitored networked devices.

[0027] It should be noted that during the data acquisition process, abnormal timestamp data or missing data can be marked or filtered to avoid obvious abnormal data from interfering with the subsequent analysis process. At the same time, the acquisition frequency of time series data and operating parameters can be configured according to the equipment type and business scenario to balance data integrity and system resource consumption.

[0028] As an example, for industrial control equipment, timing data can be obtained by reading the control command trigger time, actuator action response time, and communication module data transmission and reception time. Operating parameters such as CPU load, current operating mode, and communication status can be obtained through the system monitoring interface. The acquisition frequency of timing data and operating parameters is configurable, with a default range of 1-10Hz. 2-5Hz is recommended for industrial control equipment, and 1Hz is recommended for non-real-time monitoring equipment. Data acquisition is achieved through the device's native interface (OPC UA / Modbus / TCP / IP), requiring no additional hardware. The acquisition program consumes ≤10% of the device's CPU and ≤50MB of memory. Single missing data is filled with the previous value; three or more consecutive missing data are filled with linear interpolation; ten or more consecutive missing data trigger an alarm for abnormal acquisition link. The local cache period for raw data is 7 days, with a cache capacity ≥100MB, and it supports resuming data transmission after network interruption.

[0029] This step can acquire multi-dimensional data reflecting the internal operating behavior and operating environment status of the equipment without changing the original control logic of the equipment, providing effective data for subsequent comprehensive analysis of the equipment's operating status.

[0030] S202. Based on the operating condition parameters, identify the operating condition classification of the monitored networked equipment and obtain the current operating condition category.

[0031] Among them, operating condition classification refers to dividing the operating state of equipment into several operating condition categories with similar operating characteristics based on the operating condition parameter characteristics presented during equipment operation, in order to characterize the state differences of equipment under different operating conditions.

[0032] In one possible implementation, the collected operating parameters are preprocessed, and the operating parameters with different dimensions and value ranges are normalized to construct a unified dimension operating feature vector. The operating feature vector is then matched with the cluster centers of the pre-established operating condition classification, and the operating condition category corresponding to the current equipment operating status is determined based on the similarity calculation results.

[0033] It should be noted that the operating condition classification model can be pre-generated based on historical operating condition data and remain relatively stable during equipment operation; when the equipment operating environment or business model changes significantly, the operating condition classification model can also be updated or adjusted to ensure the accuracy of the operating condition identification results.

[0034] It should be noted that the working condition classification in this application is achieved by performing cluster analysis on historical working condition parameters to generate multiple working condition cluster centers, and each working condition cluster center corresponds to a working condition category.

[0035] As an example, the operating status of the equipment can be divided into different categories such as high load, low load, and normal operation. When the parameters such as the real-time collected processing load and resource ratio are closer to the characteristics of a certain operating category, the current equipment status is identified as the corresponding operating category.

[0036] Based on the above steps, this step can dynamically identify the operating conditions of the equipment during operation, enabling subsequent analysis processes to be tailored to the actual operating environment of the equipment, thereby improving the rationality of the analysis results.

[0037] S203. Based on the current working condition category, match the preset working condition time series limit model and analyze the time series data to obtain the time series offset characteristics.

[0038] Among them, the operating condition time series limit model refers to a model used to describe the normal fluctuation range of equipment time series characteristics under a specific operating condition category. It consists of a statistical boundary model and a sliding update mechanism. The time series offset feature refers to the feature quantity used to characterize the degree of deviation of the current time series data from the operating condition time series limit model.

[0039] In one possible implementation, after determining the current operating condition category, a model corresponding to the operating condition category is selected from a set of multiple operating condition timing limit models. Subsequently, based on the collected timing data, the time difference characteristics between the event trigger time, the execution unit response time, and the communication time are calculated. The time difference characteristics are then compared with the corresponding statistical boundaries in the selected operating condition timing limit model to calculate the deviation of each time difference characteristic, thereby forming a timing offset characteristic that comprehensively reflects the degree of timing deviation.

[0040] It should be noted that the operating condition time series limit model can be dynamically adjusted through a sliding update mechanism. That is, when the equipment is running stably and without abnormalities, new time series data is gradually incorporated into the model update process to ensure that the model can adapt to long-term changes in the operating characteristics of the equipment.

[0041] Based on the above steps, this step can transform the raw time series data into a feature form that can quantitatively reflect the degree of operational deviation, making the changes in equipment operating status more intuitive and analyzable.

[0042] S204. Analyze the time series offset characteristics through the anomaly analysis model to obtain the anomaly identification results and degradation trend.

[0043] Among them, the anomaly analysis model refers to the analysis model used to analyze the time-series offset characteristics in order to identify the abnormal operating state of the equipment and its changing trend; the degradation trend refers to the direction of continuous change in the operating performance of the equipment over time.

[0044] In one possible implementation, time-series offset features are acquired within a continuous time window, a time-series offset feature sequence is constructed, and the feature sequence is input into an anomaly analysis model for analysis. By processing the changes in the feature sequence in the time dimension, anomaly identification results are output to characterize whether the device is in an abnormal state, and deterioration trend results are output to characterize the direction of changes in the device's operating performance.

[0045] It should be noted that anomaly identification results and degradation trends can be generated independently or simultaneously in the same analysis process; the anomaly identification results focus on whether the current operating status is abnormal, while the degradation trend focuses on the long-term changes in equipment performance.

[0046] Based on the above steps, this process can promptly identify abnormal states during equipment operation and simultaneously reflect the changing trends of equipment performance, thereby improving the timeliness and foresight of monitoring results.

[0047] S205. Based on the anomaly identification results and deterioration trends, determine the equipment operating status monitoring results.

[0048] Among them, the equipment operation status monitoring result refers to the status judgment result used to comprehensively reflect the current operating status of the equipment.

[0049] In one possible implementation, the system determines whether the device is currently in an abnormal state based on the anomaly identification result, and determines whether the device's operating performance is deteriorating based on the degradation trend. Based on the combination relationship between the abnormal state and the degradation change, the system determines the corresponding operating status level of the device, and outputs the operating status level as the final device operating status monitoring result.

[0050] It should be noted that the classification of equipment operating status levels can be set according to specific application scenarios. For example, it can be divided into multiple levels such as normal status, early warning status, and abnormal status to meet different monitoring needs.

[0051] As an example, when no abnormality is detected in the equipment and there is no trend of deterioration, the equipment's operating status can be determined as normal; when no obvious abnormality is detected but there is a trend of deterioration, it can be determined as a warning state; when an abnormal state is detected, it can be determined as an abnormal state.

[0052] Based on the above steps, this step can transform the analyzed anomaly and trend information into intuitive and clear monitoring results, which facilitates unified management and decision support for equipment operation status.

[0053] This application compares the time difference between event trigger time, execution unit response time, and communication time with the statistical boundary model under the current operating condition category, and quantifies the portion exceeding the statistical boundary. This enables the unified mapping of originally scattered and inconsistent multi-source time-series data into offset feature indicators with clear physical meaning and comparability. By introducing time-series offset features, on the one hand, the impact of differences in the absolute value of time-series data under different operating conditions, different equipment, and different tasks on monitoring results can be effectively eliminated. This makes subsequent anomaly analysis no longer dependent on fixed thresholds or single time-series indicators, thereby improving the consistency and stability of monitoring results in cross-operating condition and cross-scenario applications. On the other hand, by continuously quantifying the degree of deviation, the time-series offset features enable changes in equipment operating status to no longer be represented by discrete judgments of "normal" or "abnormal," but to reflect the cumulative trend and direction of change of the offset, providing a continuous and traceable data foundation for degradation trend analysis. Furthermore, the timing offset feature is generated based on the limit model after operating condition matching. Its calculation results can reflect whether the equipment experiences a decline in timing coordination under "normal operating conditions," thereby avoiding false alarms caused by normal operating condition fluctuations such as load changes, task switching, or communication status changes, and improving the accuracy and reliability of anomaly identification results. By compressing complex multi-source timing relationships into clearly structured offset features, the input complexity of the anomaly analysis model is reduced, and the sensitivity of anomaly identification and degradation trend judgment to early equipment anomalies is improved. This solves the technical problem in existing technologies that cannot improve the accuracy and timeliness of networked equipment operation status monitoring while ensuring universality and low modification costs.

[0054] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 3 As shown, the above S203 can be specifically implemented through the following S301 to S304, which are explained in detail below: S301. Based on the current operating condition category, obtain the operating condition time series limit model corresponding to that operating condition category.

[0055] Among them, the working condition time series limit model refers to a model obtained by statistically analyzing historical normal operation data under a specific working condition category to limit the normal fluctuation range of the corresponding time series characteristics. It includes statistical mean and upper and lower boundary parameters set for different time difference characteristics, and can be updated over time.

[0056] In one possible implementation, after identifying the current operating condition category, the system uses the operating condition category as an index condition to call the operating condition time series limit model corresponding to the operating condition category from the pre-built and stored model library; the model contains a set of statistical parameters that match the subsequent time difference characteristics, which are used to perform targeted analysis on the current time series data.

[0057] It should be noted that the time-series limit models for different operating conditions are set independently, and their statistical parameters are generated only based on historical data under the same or similar operating conditions, thereby avoiding the problem of decreased model applicability due to changes in operating conditions.

[0058] As an example, when the current operating condition is identified as "high-load real-time communication operating condition", the system automatically obtains the timing limit model established for the event triggering, execution response and communication process under this operating condition, without calling the model parameters under low-load or non-real-time operating conditions. For example, the operating condition timing limit model corresponds to a medium load and periodic communication operating condition. This model establishes statistical boundary parameters for the time difference characteristics between event trigger time, execution unit response time, and communication time. The statistical mean of the time difference characteristic between event trigger time and execution unit response time is 50ms, the lower boundary is 3ms, and the upper boundary is 70ms. The statistical mean of the time difference characteristic between execution unit response time and communication time is 30ms, the lower boundary is 20ms, and the upper boundary is 45ms. During equipment operation, when the time difference characteristic falls within the corresponding statistical boundary range, the timing behavior is considered to be within the normal fluctuation range. When it exceeds the corresponding boundary range, a non-zero deviation value is assigned to the time difference characteristic based on the deviation calculation rule. The statistical mean and boundary parameters are slowly updated through a sliding update mechanism when the operating condition is confirmed to be stable and no abnormalities occur, thereby forming an operating condition timing limit model that can adaptively adjust with changes in operating conditions.

[0059] Based on the above steps, this step can ensure that the subsequent time series analysis process is always carried out under statistical constraints that match the current operating state of the equipment, thereby improving the relevance and reliability of the time series offset analysis results.

[0060] S302. Based on the timing data, calculate the time difference characteristics between any two of the event trigger time, execution unit response time, and communication time.

[0061] Among them, the time difference feature refers to the feature quantity formed by the difference between timestamps of different stages in the same event link, which is used to reflect the timing relationship of events in the internal processing and communication process of the device.

[0062] In one possible implementation, the system extracts the corresponding event trigger time, execution unit response time, and communication time for the same event instance, and calculates the difference between the event trigger time and the execution unit response time, the difference between the execution unit response time and the communication time, or the difference between the event trigger time and the communication time, according to a preset combination method, to obtain one or more time difference features.

[0063] It should be noted that the above time difference characteristics are calculated only on the premise that the timestamp has been calibrated to ensure consistency, so as to avoid time difference distortion caused by system clock deviation or data anomaly.

[0064] As an example, for a control command event of a networked device, the system can calculate the processing delay consumed from the triggering of the command to the start of the execution unit's response, and the communication delay consumed from the completion of the execution response to the communication feedback, respectively as independent time difference features.

[0065] Based on the above steps, this step transforms multi-source timestamp data into time difference features with clear physical meaning, enabling subsequent analysis to directly reflect the timing performance of the device's internal processing and communication processes.

[0066] S303. Compare the time difference feature with the corresponding statistical boundary in the operating condition time series limit model, and calculate the deviation of the time difference feature from the statistical boundary.

[0067] The statistical boundary refers to the normal fluctuation range set by the operating condition time series limit model for each time difference feature under the current operating condition category, including the lower boundary and the upper boundary.

[0068] In one possible implementation, the system reads the corresponding statistical mean and upper and lower boundary parameters in the working condition time series limit model for each time difference feature, compares the actual value of the current time difference feature with the statistical boundary, and calculates the corresponding deviation based on whether it exceeds the boundary and the direction of the exceedance.

[0069] It should be noted that when the time difference feature falls within the statistical boundary range, the deviation is set to zero; when the time difference feature exceeds the statistical boundary, the deviation increases as the degree of deviation increases, in order to reflect the severity of the abnormal offset.

[0070] As an example, if the actual value of a certain time difference feature is higher than the statistical upper boundary of that feature under the current operating conditions, the system calculates a positive deviation based on the difference between the feature and the upper boundary, which is used to describe abnormal delays in the processing or communication process.

[0071] Preferred deviation Satisfy the following formula:

[0072] in, This represents the actual value of the i-th time difference feature in the current time series data; and These represent the lower and upper boundaries of the statistical boundary model corresponding to the i-th time difference feature under the current working condition category, respectively. This represents the statistical mean of the i-th time difference feature under the current operating condition category.

[0073] Based on the above steps, this step can quantify whether the time difference feature is abnormal and the degree of abnormality, providing a comparable data foundation for subsequent unified modeling and comprehensive analysis.

[0074] S304. Based on the deviation, determine the time series offset feature that characterizes the degree of deviation of the current multi-source time series data from the operating condition time series limit model.

[0075] Among them, the time series offset feature refers to the overall offset index obtained by comprehensively calculating the deviations corresponding to multiple time difference features, which is used to reflect the overall anomaly level of the current multi-source time series data.

[0076] In one possible implementation, the system performs weighted summation on the deviations corresponding to each time difference feature, where the weight parameter is used to characterize the sensitivity of different time difference features to the equipment operating status under the current operating condition category, thereby obtaining single or multi-dimensional time series offset features as output results.

[0077] It should be noted that the weight parameters can be preset based on historical statistical results or operating condition characteristics. The weight settings can be different for different operating condition categories in order to enhance the response capability of the offset features to key time-series anomalies.

[0078] As an example, in scenarios with high real-time requirements, communication-related time difference features can be given higher weights, making the time-series offset features more sensitive to communication delay anomalies. The time-series offset feature S ranges from [0,1]. The closer S is to 1, the greater the deviation; S=0 indicates no deviation. When S∈[0,0.2], it is within the normal deviation range; S∈(0.2,0.5] indicates a slight deviation; and S∈(0.5,1] indicates a severe deviation. The S value is calculated in real time, with a calculation time of ≤50ms, adapting to the real-time monitoring requirements of the edge side.

[0079] Preferred, time-series offset features Satisfy the following formula:

[0080] Where n represents the number of time difference features; This represents the sensitivity weight of the i-th time difference feature under the current working condition category; This indicates the corresponding deviation.

[0081] Based on the above steps, this step realizes the centralized expression of multi-source time-series anomaly information, enabling the time-series operating status of the equipment under the current operating conditions to be intuitively characterized by a small number of features, which facilitates subsequent anomaly identification and degradation trend analysis.

[0082] This application transforms the original time-series data—multi-source, discrete, and strongly influenced by operating conditions—during equipment operation into time-series offset features with clear physical meaning and quantifiable deviation. This avoids noise interference and incomparability issues arising from direct analysis based on original timestamps. Furthermore, it enables fair and stable measurement of time-series behavior under different operating conditions within the constraints of their respective operating condition time-series limit models. Simultaneously, through refined modeling and boundary comparison of the time difference between any two key time nodes, it not only captures single-point anomalies but also reflects the overall changing trend of time-series collaborative relationships. This allows subsequent anomaly identification and degradation trend analysis to rely no longer on empirical thresholds but on offsets based on operating condition perception and statistical constraints, thereby improving the sensitivity of monitoring results to performance degradation, potential faults, and changes in operating conditions.

[0083] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 4 As shown, the above S204 can be implemented by the following S401 to S404, which are explained in detail below: S401. Obtain time-series offset features within a continuous time window and construct a time-series offset feature sequence.

[0084] Among them, the time-series offset feature sequence refers to a set of numerical sequences arranged in chronological order to reflect the degree of deviation of the equipment's operating sequence from the operating condition reference. It includes short-term offset feature sequences and long-term offset feature sequences. The short-term offset feature sequence is used to describe the instantaneous fluctuations of the equipment within a smaller time scale, while the long-term offset feature sequence is used to describe the continuous change trend of the equipment within a larger time scale.

[0085] In one possible implementation, the system acquires the temporal offset feature S at the edge or monitoring node with a fixed sampling period and caches it according to a preset time window. The short-term time window is used to store the temporal offset features within the most recent consecutive sampling periods, and the long-term time window is used to store the temporal offset feature sequence formed by summarizing multiple short-term windows, thus forming two sequence inputs with different time scales.

[0086] It should be noted that the lengths of the short-term and long-term time windows can be configured according to the device type, data sampling frequency, and monitoring sensitivity requirements. There is no fixed ratio between the two, so as to ensure that rapid anomalies can be reflected without amplifying occasional jitter.

[0087] As an example, for a device with a sampling period of 1 second, the short-term offset feature sequence can be composed of offset features within the last 60 seconds, and the long-term offset feature sequence can be composed of offset features aggregated at the minute or hourly granularity within the last 24 hours.

[0088] Based on the above steps, by simultaneously constructing short-term and long-term time series offset feature sequences, subsequent analysis can take into account both instantaneous anomalies and gradual changes, avoiding the omission or misjudgment of anomalies caused by a single time scale.

[0089] S402. Based on the time series offset feature sequence, calculate the statistical feature parameters of the time series offset feature within the current time window.

[0090] Among them, the statistical characteristic parameters include the mean, variance of the degree of dispersion, and rate of change reflecting the speed of change, which are used to describe the overall distribution of the time series offset characteristics and to characterize the stability and fluctuation characteristics of the equipment operating status within the current time window.

[0091] In one possible implementation, the system performs sliding statistical calculations on the short-term and long-term offset feature sequences respectively to obtain the rate of change of the mean, variance, and the difference in offset features between adjacent time points within the corresponding time window, and outputs the calculation results as the statistical feature parameters of the current window.

[0092] It should be noted that the calculation process of statistical characteristic parameters is based solely on the time-series offset characteristic sequence itself, without introducing additional operating condition parameters, thereby ensuring that the statistical results are comparable and stable within the same operating condition category.

[0093] As an example, if the mean of the time-series offset feature continues to rise and the rate of change increases positively within a short-term time window, it can reflect that the device response behavior gradually deviates from the normal state during that period.

[0094] Based on the above steps, by transforming the original offset features into statistical feature parameters, the anomaly judgment no longer relies on single-point values, but is based on the analysis of the overall distribution and changing trends, thereby improving the robustness of monitoring and judgment.

[0095] S403. Compare the statistical feature parameters with the preset anomaly judgment threshold under the corresponding working condition category. When the statistical feature parameters exceed the corresponding threshold, generate anomaly identification results.

[0096] Among them, the anomaly judgment threshold refers to the range of parameters used to distinguish between normal and abnormal states, which is obtained from historical normal operation data statistics under different operating conditions.

[0097] In one possible implementation, the system compares the mean, variance, and rate of change calculated within the current time window with the corresponding preset anomaly judgment thresholds under the current working condition category. When any statistical feature parameter exceeds the corresponding threshold range, an anomaly is determined to exist within the current time window, and an anomaly identification result is generated.

[0098] It should be noted that the anomaly identification results may include anomaly flags, anomaly type, or anomaly severity, but are not limited to specific forms of expression, so that the subsequent state comprehensive judgment module can use them flexibly.

[0099] As an example, when the rate of change of the short-term offset feature sequence exceeds the rate of change threshold under the operating condition category, while the long-term sequence is still within the normal range, it can be determined as a transient anomaly; when both exceed the limits simultaneously, it can be determined as a persistent anomaly.

[0100] Based on the above steps, by combining statistical thresholds of working condition perception for anomaly judgment, false alarms caused by uniform thresholds in complex operating environments are avoided, thereby improving the accuracy and pertinence of anomaly identification.

[0101] S404. Based on the time-series offset feature sequence, the degradation trend is obtained through a trend prediction model.

[0102] The trend prediction model refers to the model structure used to extract time dependencies from time-series offset feature sequences and predict future change directions. It includes a time-series encoding module for introducing time sequence information and an attention encoding module for modeling time correlations.

[0103] In one possible implementation, the system performs time position encoding on the time-series offset feature sequence, introducing time step information to obtain a time-aware input sequence; it then calculates the correlation weights between time windows of the time-aware input sequence using an attention mechanism to obtain trend features; based on these trend features, it calculates the rate of change of the time-series offset features to obtain a degradation trend strength index; the trend strength index... Satisfy the following formula: Where t represents the time window index, and T represents the number of historical windows used for trend analysis. This indicates the trend characteristics at time t. It represents the trend characteristics at time t-1; based on the degradation trend intensity index and the preset trend judgment interval under the corresponding operating condition category, it outputs the degradation trend of equipment performance; the degradation trend includes: no obvious degradation trend, slow degradation trend and rapid degradation trend.

[0104] As an example, when the trend prediction model outputs results showing that the offset feature has a continuous upward trend over multiple consecutive time windows, it can be determined that the device has a performance degradation trend, and further distinguished as slow or rapid degradation.

[0105] Based on the above steps, by introducing a trend prediction model to analyze the time series offset characteristics, the monitoring system can not only identify current anomalies, but also perceive the direction of equipment performance changes in advance, providing a more forward-looking basis for operational status assessment.

[0106] This application's embodiments achieve anomaly identification and degradation trend judgment of equipment operating status through hierarchical analysis of time-series offset features. By simultaneously constructing short-term and long-term time-series offset feature sequences, both instantaneous anomalies and continuous changes are taken into account; then, the offset features are transformed into statistical feature parameters to reduce noise interference and improve judgment stability; adaptive anomaly identification is achieved by combining thresholds under different operating conditions; and further, the temporal evolution of the offset features is modeled to identify the direction and intensity of performance degradation, thereby realizing dynamic and continuous monitoring of equipment operating status.

[0107] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0108] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

Claims

1. A method of monitoring a general networking device, characterized by, include: Acquire the timing data of events from the monitored network devices and the operating parameters of the monitored network devices; The timing data includes: event trigger time, execution unit response time, and communication time; the operating parameters include: processing load, operating mode, resource allocation, task type, and communication status. Based on the operating parameters, the operating condition classification of the monitored network device is identified to obtain the current operating condition category; Based on the current operating condition category, a preset operating condition time series limit model is matched, and the time series data is analyzed to obtain time series offset features; the operating condition time series limit model consists of a statistical boundary model and a sliding update mechanism, which is used to limit the normal fluctuation boundary of the time series features. The time-series offset features are analyzed using an anomaly analysis model to obtain anomaly identification results and degradation trends; Based on the anomaly identification results and degradation trends, the equipment operating status monitoring results are determined.

2. The method of claim 1, wherein, Before acquiring the timing data of events from the monitored networked devices and the operating parameters of the monitored networked devices, the method further includes: Acquire calibration time and raw timestamp data of events on the monitored networked devices, including: raw event trigger time, raw execution unit response time, and raw communication interaction time; Based on the calibration time and the original timestamp data of the events of the monitored networked devices, the operating deviation of the system clock of the monitored devices is periodically monitored, and the clock drift rate of the system clock relative to the calibration time is calculated. When the clock drift rate exceeds a preset threshold, the system clock of the monitored device is calibrated based on the calibration time, and the timestamps of the collected multi-source events are corrected for consistency or distorted data is removed to obtain the time-series data of the monitored network device events after calibration.

3. The method of claim 1, wherein, The operating condition classification is achieved by performing cluster analysis on historical operating condition parameters to generate multiple operating condition cluster centers, and each operating condition cluster center is assigned to an operating condition category.

4. The method of claim 3, wherein, The step of identifying the operating condition classification of the monitored networked device based on the operating condition parameters to obtain the current operating condition category includes: The operating condition parameters are normalized to construct the operating condition feature vector; The similarity between the working condition feature vector and multiple working condition categories is calculated to determine the current working condition category.

5. The method of claim 1, wherein, Based on the current operating condition category, a preset operating condition time series limit model is matched, and the time series data is analyzed to obtain time series offset features, including: Based on the current operating condition category, obtain the operating condition time series limit model corresponding to that operating condition category; Based on the timing data, calculate the time difference characteristics between any two of the event trigger time, execution unit response time, and communication time; The time difference feature is compared with the corresponding statistical boundary in the working condition time series limit model, and the deviation of the time difference feature from the statistical boundary is calculated. Based on the deviation, a time series offset feature is determined to characterize the degree of deviation of the current multi-source time series data from the operating condition time series limit model.

6. The method of claim 5, wherein, the deviation amount satisfies the following equation: wherein, represents the actual value of the i-th time difference feature in the current time series data; and respectively represent the lower boundary and the upper boundary of the statistical boundary model corresponding to the i-th time difference feature under the current working condition category; represents the statistical mean of the i-th time difference feature under the current working condition category; The timing offset feature satisfies the following equation: wherein n represents the number of time difference features; represents the sensitivity weight corresponding to the i-th time difference feature under the current working condition category; represents the corresponding deviation amount.

7. The method of claim 1, wherein, The analysis of the time-series offset features using an anomaly analysis model yields anomaly identification results and degradation trends, including: Temporal offset features are acquired within a continuous time window to construct a temporal offset feature sequence; the temporal offset feature sequence includes a short-term offset feature sequence and a long-term offset feature sequence. Based on the time series offset feature sequence, calculate the statistical feature parameters of the time series offset feature within the current time window, including mean, variance and rate of change; The statistical feature parameters are compared with a preset anomaly detection threshold under the corresponding working condition category. When the statistical feature parameters exceed the corresponding threshold, an anomaly identification result is generated. Based on the time-series offset feature sequence, a degradation trend is obtained through a trend prediction model; the trend prediction model includes a time-series encoding module and an attention encoding module.

8. The method according to claim 7, characterized in that, The process of obtaining the degradation trend based on the time-series offset feature sequence through a trend prediction model includes: The temporal offset feature sequence is encoded by time position, and time step information is introduced to obtain a time-aware input sequence. The correlation weights between time windows of the time-aware input sequence are calculated using an attention mechanism to obtain trend features; Based on the aforementioned trend characteristics, the rate of change of the time series offset characteristics is calculated to obtain a degradation trend intensity index; the trend intensity index Satisfy the following formula: Where t represents the time window index, and T represents the number of historical windows used for trend analysis. This indicates the trend characteristics at time t. This indicates the trend characteristics at time t-1; Based on the degradation trend intensity index and the preset trend judgment interval under the corresponding operating condition category, the degradation trend of the equipment performance is output; the degradation trend includes: no obvious degradation trend, slow degradation trend and rapid degradation trend.

9. The method of claim 1, wherein, The determination of equipment operating status monitoring results based on the anomaly identification results and degradation trends includes: Determine whether the device is in an abnormal state based on the anomaly identification results; Determine whether the equipment's operating performance is deteriorating based on the degradation trend; Based on the combination relationship between the abnormal state and the deterioration change, the operating status level of the equipment is determined, and the operating status level is output as the equipment operating status monitoring result.

10. A general networking device monitoring system, characterized by, The system includes: a data acquisition device and an electronic device; The data acquisition device is used to acquire time-series data of events of the monitored networked device and operating parameters of the monitored networked device's operating status; the time-series data includes: event trigger time, execution unit response time, and communication time; the operating parameters include: processing load, operating mode, resource ratio, task type, and communication status. The electronic device is used to identify the operating condition classification of the monitored network device based on the operating condition parameters to obtain the current operating condition category; match a preset operating condition time series limit model based on the current operating condition category, and analyze the time series data to obtain time series offset features; the operating condition time series limit model consists of a statistical boundary model and a sliding update mechanism, used to limit the normal fluctuation boundary of the time series features; analyze the time series offset features through an anomaly analysis model to obtain anomaly identification results and degradation trends; and determine the equipment operating status monitoring results based on the anomaly identification results and degradation trends.

Images