Log flow dynamic monitoring and tracking method based on industrial internet

Abstract

The application discloses a log flow dynamic monitoring and tracking method based on an industrial internet, and particularly relates to the technical field of log flow data monitoring; the application realizes the integration and whole-process tracing of heterogeneous logs through log standardization processing and identifier injection, and avoids data fragmentation; a baseline is dynamically constructed based on historical normal data, and the performance deviation degree is quantified, so that the traditional fixed threshold is replaced, the abnormal false alarm and missing report rates are greatly reduced; combined with a rolling time window, incidental abnormalities are filtered, only high-frequency persistent problems are upgraded to alarms, operation and maintenance personnel can accurately focus on core faults, invalid troubleshooting work is reduced, and monitoring efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of log stream data monitoring technology, and more specifically, to a method for dynamic monitoring and tracking of log streams based on the Industrial Internet. Background Technology

[0002] As a product of the deep integration of industrial systems and Internet technology, the Industrial Internet is driving the manufacturing industry towards digitalization, networking, and intelligence. During operation, various systems and equipment continuously generate massive amounts of heterogeneous log stream data. This data records key information such as production transactions, equipment status, and system interactions in real time, and is a valuable resource for fault diagnosis, performance optimization, and security auditing.

[0003] However, existing industrial internet log monitoring technologies still face the following problems in practical applications:

[0004] The fixed judgment benchmark is often insufficient in accuracy. Traditional log monitoring often uses static fixed thresholds to judge anomalies, ignoring the dynamic operation characteristics of industrial production transactions. The normal time consumption of different transaction types (such as production and manufacturing, material flow) is different, and the performance fluctuation of the same transaction under different operating conditions also needs to be dynamically adapted. Fixed thresholds can not meet the needs of diverse scenarios, and are prone to false alarms or missed alarms due to changes in operating conditions, affecting the reliability of monitoring.

[0005] In addition, traditional monitoring technologies can only identify the phenomenon of "abnormality" but cannot further distinguish the type of abnormality or trace its root cause. At the same time, abnormal information is mostly presented in the form of text lists, which cannot intuitively show the location, scope of impact and risk level of the abnormality in the business process. This causes maintenance personnel to spend a lot of time sorting out related data, resulting in long troubleshooting cycles and low efficiency.

[0006] To address this, a dynamic monitoring and tracing method for log streams based on the Industrial Internet has been introduced. Summary of the Invention

[0007] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a log stream dynamic monitoring and tracking method based on the Industrial Internet.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] The log stream dynamic monitoring and tracing method based on the Industrial Internet includes:

[0010] S1: Collect log data from the Industrial Internet in real time, mark the transaction type of the log data, and inject an association identifier into each log entry;

[0011] S2: Based on the injected identifier, combined with the baseline range defined by historical log stream data, the log stream data is calculated in real time to identify abnormal links in the current log stream data;

[0012] S3: Continuously scroll through a fixed time window, collect log stream data of the same transaction type in each window, count the number of times it occurs, and upgrade to an alarm if the number of occurrences exceeds a preset threshold.

[0013] S4: Search for the operating parameters of the equipment associated with the alarm process, conduct collaborative evaluation, output the anomaly confidence coefficient to determine the anomaly type, combine the anomaly type and risk level to construct an industrial anomaly topography map and push it for visualization display.

[0014] Specifically, the baseline range definition logic in step S2;

[0015] Retrieve historical transaction data from the database that match the current transaction type;

[0016] The historical transaction data were grouped by transaction type, and the time consumption indicators included the total transaction time and the time of each step. The box method was used to analyze the distribution of the time consumption indicators.

[0017] For the total time dataset and the time dataset for each stage within each group, obtain the first quartile, median, and third quartile; calculate the interquartile range by the difference between the third quartile and the first quartile.

[0018] The total time baseline range and the time baseline range of each stage are defined by combining the distribution analysis results with preset adjustment coefficients.

[0019] Specifically, the baseline range is defined and expressed;

[0020] Label the first quartile, median, third quartile, and interquartile range as follows: , ;

[0021] The lower baseline limit is defined as follows: ;

[0022] Baseline upper limit definition: ;

[0023] Where k represents the adjustment coefficient, and its value is set to 1.5.

[0024] Specifically, step S2 identifies abnormal segments in the current log stream data;

[0025] After the transaction type marked in the current log stream data is completed, the actual total time is matched with the baseline range of total time. If the actual total time is higher than the baseline range, the performance deviation P is calculated by taking the transaction time of each stage of the current log stream data as the numerator and the upper limit of the baseline range of the corresponding stage as the denominator. Real-time transaction stages with performance deviation P higher than the deviation threshold are marked as abnormal stages.

[0026] Specifically, step S4 outputs the anomaly confidence coefficient for each alarm step;

[0027] Extract the operating parameters of the devices associated with the alarm link within the scrolling window;

[0028] For each operating parameter of the associated device, the weighted processing logic is used to output the abnormal confidence coefficient of the associated device in the alarm loop, based on the preset operating threshold of each operating parameter.

[0029] Specifically, the logic for determining the exception type in step S4;

[0030] The anomaly types include equipment anomalies, root cause anomalies, and ambiguous anomalies;

[0031] If the confidence coefficient of an alarm step is higher than the preset confidence threshold coefficient, the alarm step is determined to be an equipment fault; otherwise, it is determined to be a fuzzy fault.

[0032] Specifically, for alarms classified as fuzzy anomalies, root cause anomaly identification is performed.

[0033] For fuzzy anomalies, retrieve their real-time performance deviation data set, calculate the Euclidean distance between it and the performance deviation sequence of cases of the same transaction type in the historical anomaly pattern library, select the lowest distance and compare it with the preset distance threshold. If it is lower than the threshold, reuse the root cause of the historical case as the current anomaly type; otherwise, maintain the fuzzy anomaly judgment.

[0034] Specifically, the logic for constructing the industrial anomaly topographic map in step S4;

[0035] Draw a horizontal baseline and mark nodes at equal intervals according to the number of transaction stages;

[0036] For each alarm point located on the baseline, the required horizontal upward movement height of the location point is quantified according to the preset height quantization logic. The alarm point is then moved upward by the specified height, adjacent nodes are reconnected, and corresponding colors are marked according to the anomaly type to generate an industrial anomaly topography map.

[0037] Specifically, the specific rules of highly quantified logic;

[0038] The average performance deviation of each window in the alarm process is calculated as the alarm severity value. Combined with the key scores of each process preset in the current log stream, the alarm severity value and key scores of the alarm process are normalized and weighted to obtain the risk level index. The index is then converted into the node movement height through a preset index range and movement height mapping rule.

[0039] The technical effects and advantages of this invention are as follows:

[0040] (1) By standardizing log processing and injecting identifiers, heterogeneous logs are integrated and traced throughout the entire process, avoiding data fragmentation; a baseline is dynamically constructed based on historical normal data and the performance deviation is quantified to replace the traditional fixed threshold, which greatly reduces the false alarm and false negative rate; combined with the rolling time window to filter occasional anomalies, only high-frequency persistent problems are upgraded to alarms, allowing maintenance personnel to accurately focus on core faults, reduce ineffective troubleshooting work, and improve monitoring efficiency;

[0041] (2) Calculate the confidence coefficient of anomalies by collaboratively evaluating equipment operating parameters, clearly distinguish between equipment anomalies, root cause anomalies and fuzzy anomalies, and achieve root cause tracing of fuzzy anomalies by matching with historical anomaly pattern library, thus solving the problem of fuzzy root cause location in traditional monitoring; construct an industrial anomaly topography map to intuitively display the location, type and risk level of anomalies, transform complex log data into visual information, help maintenance personnel quickly grasp the distribution and impact of anomalies, shorten the fault investigation cycle, and ensure the continuity and stability of industrial production. Attached Figure Description

[0042] Figure 1 This is a flowchart of the log stream dynamic monitoring and tracking method based on the Industrial Internet of Things according to the present invention.

[0043] Figure 2 This is a schematic diagram of the industrial anomaly topographic map in this invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] like Figure 1 As shown, the log stream dynamic monitoring and tracing method based on the Industrial Internet includes:

[0046] S1: Collect log data from different levels of the Industrial Internet system in real time and perform standardization processing; that is, for each log, parse its original format and standardize it into a predefined structured data format; after standardization, mark the transaction type of the log data and inject an identifier for association into each collected log.

[0047] Transaction types include manufacturing transactions or material flow transactions, etc.

[0048] Structured data formats must include at least the following fields: timestamp, log level, source device / system ID, original message, and extended fields for association;

[0049] The identifier is a triplet identifier. The specific injection process is as follows: Generate a globally unique span identifier for each log entry to uniquely identify the log instance, and determine whether the log entry belongs to an instance of a cross-system business process.

[0050] If the log is the starting point of a business process, a globally unique trace identifier is generated and used as the root identifier of the transaction.

[0051] If the log is from the middle or end of a business process, then the tracking identifier passed from the upstream is inherited and injected by parsing the message content or by using the communication protocol between upstream and downstream systems.

[0052] At the same time, inject the parent span identifier of its direct upstream link into the log;

[0053] At this point, each log entry is injected with a triplet of association identifiers: [span identifier, tracking identifier, parent span identifier].

[0054] S2: Based on the injected identifier, combined with the baseline range defined by the historical log stream data, the log stream data is calculated in real time to identify abnormal links in the current log stream data;

[0055] S2-1: Based on the transaction type marked by the current log stream data, retrieve the historical transaction data that matches the current transaction type from the database; the historical transaction data are log stream data that have been successfully completed without any anomalies.

[0056] To further explain, based on historical transaction data, a dynamic performance standard that conforms to its historical normal behavior should be established. For example, data from all transactions marked as "successfully" completed within a past period (e.g., 14 days) should be used, including indicators such as total transaction time and the time spent on each key step (e.g., "PLC processing time" and "robot welding time").

[0057] The historical transaction data were grouped by transaction type, and the time consumption indicators included the total transaction time and the time of each step. The box method was used to analyze the distribution of the time consumption indicators.

[0058] For the total time dataset and the time dataset for each stage within each group, obtain the first quartile, median, and third quartile; calculate the interquartile range by the difference between the third quartile and the first quartile.

[0059] Additional explanation: The first quartile is defined as the median of the "lower half" of a dataset, where 25% of the data is smaller than the first quartile and 75% is larger. It represents the lower limit of the normal performance range.

[0060] The third quartile is defined as follows: 75% of the data is smaller than the third quartile, and 25% of the data is larger than the third quartile.

[0061] The total time baseline range and the time baseline range of each stage of the transaction are defined by combining the results of the distribution analysis with preset adjustment coefficients.

[0062] Label the first quartile, median, third quartile, and interquartile range as follows: , ;

[0063] The lower baseline limit is defined as follows: ;

[0064] Baseline upper limit definition: ;

[0065] Where k represents the adjustment coefficient; the value is set to 1.5, and it can be adjusted and set according to the specific industrial scenario of the application. For scenarios with more stringent requirements, the value of k can be increased; for scenarios with more sensitivity, the value of k can be decreased.

[0066] S2-2: After the transaction type marked in the current log stream data is completed, the actual total time is matched with the baseline range of total time. If the actual total time is higher than the baseline range, the performance deviation P is calculated by using the transaction time of each stage of the current log stream data as the numerator and the upper limit of the baseline range of the corresponding stage as the denominator. The stage transaction time represents the total time actually spent by the real-time transaction being processed from start to finish. Real-time transaction stages with performance deviation P higher than the deviation threshold are marked as abnormal stages.

[0067] Explanation of P: P≤0.8: Performance is within the ideal range

[0068] When P≤0.8, it indicates that the actual transaction time of this step is significantly lower than the baseline upper limit of the corresponding step, and is in the ideal range of historical normal operation;

[0069] 0.8 < P ≤ 1: Performance is close to the normal threshold.

[0070] Within this range, the actual transaction time of the process is close to the baseline upper limit, but it has not exceeded the normal fluctuation range of history, and is in the state of "normal operation but needs attention";

[0071] 1 < P ≤ 1.2: Mild performance abnormality

[0072] When P exceeds 1 and is ≤ 1.2, the actual transaction time of the process has exceeded the baseline limit and is judged as a slight anomaly.

[0073] P > 1.2: Severe performance abnormality

[0074] If P > 1.2, it indicates that the actual transaction time in the process far exceeds the baseline limit, which is a serious anomaly.

[0075] S3: Continuously scroll through the set time window, collect log stream data of the same transaction type in each window, take the currently marked abnormal link as the statistical target, count the number of times the abnormal link appears in the scrolling window and calculate the frequency of occurrence. If the frequency of occurrence of a certain abnormal link is higher than the frequency threshold, then the abnormal link is upgraded to an alarm link.

[0076] It scrolls continuously within a fixed time window (e.g., 5 minutes);

[0077] Within each window, collect all abnormal links with the same source (same transaction type + same source device / system ID + same link name);

[0078] Count the number of times an abnormal link from a specific "source" occurs within each window;

[0079] Judgment logic: If the number of occurrences exceeds a preset threshold (e.g., 3 times / 5 minutes), the "source" will be upgraded from "abnormal process" to "alarm process".

[0080] Filter out occasional, isolated abnormal jitters and focus on persistent, high-frequency issues.

[0081] S4: Collaboratively evaluate the equipment operating parameters during the alarm process to cover key state changes before and after the anomaly occurs; output the anomaly confidence coefficient for each alarm process to determine the anomaly type; anomaly types include equipment anomalies, root cause anomalies, and fuzzy anomalies; combine the anomaly type and risk level of the alarm process to construct an industrial anomaly topography map and push it to the user for visualization.

[0082] S4-1: Extract the operating parameters of the devices associated with the alarm link in the scrolling window; the operating parameters are represented by the number i, where i=1,2,......,x, and x is the total number of operating parameters corresponding to the associated devices; the operating parameters are such as current, temperature, etc., and are specifically set according to the device type.

[0083] For the various operating parameters of the associated devices, the weighted processing logic is used to output the abnormal confidence coefficient of the associated devices in the alarm loop, based on the preset operating thresholds of each operating parameter; the operating thresholds, such as current thresholds and temperature thresholds, are set according to the historical normal baseline performance of the devices;

[0084] The anomaly confidence coefficient of the devices associated with the output alarm loop is as follows:

[0085] Mark the various operating parameters of the associated devices as follows The corresponding running threshold is marked as ;

[0086] Using the formula F= Calculate the anomaly confidence coefficient F; where The preset weighting coefficients for each operating parameter.

[0087] S4-2: If the abnormal confidence coefficient of a certain alarm link is higher than the preset confidence threshold coefficient, the abnormal type of the alarm link is determined to be equipment abnormality; otherwise, it is determined to be fuzzy abnormality.

[0088] S4-3: Retrieve the performance deviation of the alarm link corresponding to the fuzzy anomaly in each window as a real-time data group, and search for historical fuzzy anomaly cases of the same transaction type as the current log stream data in the pre-built historical anomaly pattern library; the historical anomaly pattern library stores the root cause of each fuzzy anomaly of different transaction types in the past; historical fuzzy anomaly cases include root cause anomalies and performance deviation change sequences.

[0089] For the performance deviation change sequence of each group of historical fuzzy anomaly cases and the current real-time data group, the Euclidean distance is used to calculate and output the anomaly similarity distance of each group of historical fuzzy anomaly cases.

[0090] Select the lowest anomaly similarity distance and compare it with the preset distance threshold. If it is lower than the distance threshold, the root cause anomaly of the historical fuzzy anomaly case corresponding to the lowest anomaly similarity distance will be used as the anomaly type of the current alarm link. Otherwise, the alarm link will still be judged as a fuzzy anomaly.

[0091] S4-4: Starting from the origin of the two-dimensional Cartesian coordinate system, draw a straight line of a preset length to the right to represent the baseline; identify the number of stages contained in the transaction type corresponding to the current log stream data, and mark each point at equal distances on the baseline according to the logical sequence of stages. Each point represents a stage, and the number of points is equal to the total number of all monitored transaction stages.

[0092] Additional explanation of the definition of the x-axis:

[0093] The scale unit is centimeters (cm). The basic scale is based on 1cm corresponding to 1 transaction step. The total length is dynamically adjusted according to the total number of transaction steps. The formula is: total length of the horizontal axis = total number of transaction steps × 1cm + 2cm, where the extra 2cm is the reserved display spacing at the origin and end.

[0094] The coordinates represent the sequence of steps in the transaction process. The origin (0,0) is the starting point of the transaction process. The baseline from the origin to the right marks each step node in sequence. The horizontal distance between adjacent step nodes is fixed at 1cm to ensure that the steps are evenly distributed and the process logic is clear and identifiable.

[0095] When no movement height is defined, the ordinate of all node segments is 0.

[0096] For each alarm point located on the baseline, the required horizontal upward movement height of the location point is quantified according to a preset height quantization logic. After quantization, the location point of the alarm point is adjusted according to the corresponding movement height. Using the adjusted location point as the starting point, the line segment between the alarm point and the two adjacent sets of points is reconstructed. A drawing color is set for each of the three types of alarms: equipment anomaly, fuzzy anomaly, and root cause anomaly. For example, red corresponds to equipment anomaly, yellow corresponds to fuzzy anomaly, and blue corresponds to root cause anomaly. After the reconstruction is completed, the location point is replaced with the corresponding color, and then the result is output as an industrial anomaly topography map.

[0097] Additional explanation of the definition of the ordinate:

[0098] The scale unit is centimeters (cm), and the value range is 0-20cm (consistent with the upper limit of the movement height corresponding to the hazard level index). 0cm is the baseline height, and upward is the positive direction of height.

[0099] The coordinates represent the degree of potential abnormality. 0cm represents no abnormality (normal process). The higher the value of the vertical axis, the more serious the degree of abnormality in that process, which intuitively reflects the impact level of abnormality on the industrial production process.

[0100] S4-5: For the performance deviation of the alarm link within each window, calculate the average value as the alarm severity value of the alarm link;

[0101] The key score of each stage corresponding to the current log stream is preset; the key score range is set between 1.213 and 1.579. The higher the key score of the stage in the overall transaction type, the higher the key score is set, which reflects the importance of the stage in the overall business process.

[0102] The critical performance score range of 1.213-1.579 is set by technical personnel based on historical failure impact data of industrial business processes and the importance of the process.

[0103] After normalizing the alarm severity value and key score of the alarm process, the hazard severity index of the alarm process is calculated using weighted processing logic.

[0104] Establish a mapping rule between the hazard severity index and the movement height in advance, and convert the hazard severity index of the alarm process into the movement height based on the mapping rule;

[0105] The mapping rule involves setting up sets of index intervals corresponding to the hazard level index, with each index interval corresponding to a movement height; Example:

[0106] Interval 1: 0.2-0.4; Movement height 5cm;

[0107] Interval 2: 0.4-0.6; Movement height: 7cm;

[0108] Range 3: 0.6-0.8; moving height 10cm;

[0109] Range 4: 0.8-1.0; moving height 12cm; ......;

[0111] The maximum height range for movement is limited to 20cm.

[0112] The above formulas are all dimensionless calculations. Dimensionless calculations can be performed using various methods such as standardization, which will not be elaborated here. The formulas are derived from software simulations based on a large amount of collected data, and the preset parameters in the formulas can be set by those skilled in the art according to the actual situation.

[0113] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, ATA hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state ATA hard disk.

[0114] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0115] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0117] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0118] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0119] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable ATA hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A log flow dynamic monitoring and tracking method based on an industrial internet, characterized in that, include: S1: Collect log data from the Industrial Internet in real time, mark the transaction type of the log data, and inject an association identifier into each log entry; S2: Based on the injected identifier, combined with the baseline range defined by historical log stream data, the log stream data is calculated in real time to identify abnormal links in the current log stream data; S3: Continuously scroll through a fixed time window, collect log stream data of the same transaction type in each window, count the number of times it occurs, and upgrade to an alarm if the number of occurrences exceeds a preset threshold. S4: Search for the operating parameters of the equipment associated with the alarm process, conduct collaborative evaluation, output the anomaly confidence coefficient to determine the anomaly type, combine the anomaly type and risk level to construct an industrial anomaly topography map and push it for visualization display.

2. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 1, characterized in that: Baseline range definition logic in step S2; Retrieve historical transaction data from the database that match the current transaction type; The historical transaction data were grouped by transaction type, and the time consumption indicators included the total transaction time and the time of each step. The box method was used to analyze the distribution of the time consumption indicators. For the total time dataset and the time dataset of each stage within each group, obtain the first quartile, median, and third quartile; The interquartile range is obtained by calculating the difference between the third quartile and the first quartile. The total time baseline range and the time baseline range of each stage are defined by combining the distribution analysis results with preset adjustment coefficients.

3. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 2, characterized in that: Baseline range definition performance; The first quartile, median, third quartile, and interquartile range are labeled as , ; The lower limit of the baseline is defined as: ; Baseline upper limit definition: ; Where k represents the adjustment coefficient, and its value is set to 1.

5.

4. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 3, characterized in that: In step S2, abnormal elements in the current log stream data are identified. After the transaction type marked by the current log stream data is completed, the actual total time is matched with the baseline range of total time. If the actual total time is higher than the baseline range, the performance deviation P is calculated by taking the transaction time of each stage of the current log stream data as the numerator and the upper limit of the baseline range of the corresponding stage as the denominator. Real-time transaction segments whose performance deviation P exceeds the deviation threshold are marked as abnormal segments.

5. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 1, characterized in that: In step S4, the anomaly confidence coefficient for each alarm stage is output. Extract the operating parameters of the devices associated with the alarm link within the scrolling window; For each operating parameter of the associated device, the weighted processing logic is used to output the abnormal confidence coefficient of the associated device in the alarm loop, based on the preset operating threshold of each operating parameter.

6. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 5, characterized in that: The logic for determining the exception type in step S4; The anomaly types include equipment anomalies, root cause anomalies, and ambiguous anomalies; If the confidence coefficient of an alarm step is higher than the preset confidence threshold coefficient, the alarm step is determined to be an equipment fault; otherwise, it is determined to be a fuzzy fault.

7. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 6, characterized in that: For alarms classified as fuzzy anomalies, root cause anomaly identification is performed. For fuzzy anomalies, retrieve their real-time performance deviation data set, calculate the Euclidean distance between it and the performance deviation sequence of cases of the same transaction type in the historical anomaly pattern library, select the lowest distance and compare it with the preset distance threshold. If it is lower than the threshold, reuse the root cause of the historical case as the current anomaly type; otherwise, maintain the fuzzy anomaly judgment.

8. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 1, characterized in that: The specific logic for constructing the industrial anomaly topographic map in step S4; Draw a horizontal baseline and mark nodes at equal intervals according to the number of transaction stages; For each alarm point located on the baseline, the required horizontal upward movement height of the location point is quantified according to the preset height quantization logic. The alarm point is then moved upward by the specified height, adjacent nodes are reconnected, and corresponding colors are marked according to the anomaly type to generate an industrial anomaly topography map.

9. The log stream dynamic monitoring and tracking method based on the Industrial Internet according to claim 7, characterized in that... The specific rules of highly quantifiable logic; The average performance deviation of each window in the alarm process is calculated as the alarm severity value. Combined with the key scores of each process preset in the current log stream, the alarm severity value and key scores of the alarm process are normalized and weighted to obtain the risk level index. The index is then converted into the node movement height through a preset index range and movement height mapping rule.

Images