An agentless intelligent monitoring and alarming method and device

Abstract

This invention provides an agentless intelligent monitoring and alarm method and apparatus, relating to the field of computer technology. The method includes: a cloud center platform acquiring monitoring task configuration information and synchronizing it to an edge collector; the edge collector pulling monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information to obtain monitoring data to be processed; the cloud center platform processing the monitoring data to be processed sent by the edge collector to obtain target monitoring data; the cloud center platform using an anomaly detection model to perform anomaly detection on the target monitoring data, using a time series prediction model to predict the trend of the target monitoring data, adjusting the alarm threshold through an adaptive alarm threshold engine, and comparing the anomaly detection results, trend prediction results, target monitoring data, and alarm threshold to generate alarm information. This invention solves the problems of high deployment and maintenance costs, high security risks, low alarm accuracy, and limited coverage in large-scale complex environments.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an agentless intelligent monitoring and alarm method and device. Background Technology

[0002] IT system monitoring and alerting are key technology areas for ensuring the stable operation of enterprise information systems. As enterprise IT architectures become increasingly complex and distributed, traditional monitoring technologies face numerous challenges. Modern enterprise environments typically include multiple network zones, hybrid cloud deployments, and various infrastructure and application systems, placing higher demands on the coverage and flexibility of monitoring systems.

[0003] Currently, mainstream monitoring systems typically employ an agent-based architecture, deploying monitoring agents on each monitored device. Typical implementations include open-source monitoring systems like Zabbix and Prometheus. These systems collect system metrics and application data, such as CPU, memory, and network performance, by installing a dedicated agent on each monitored host. The data is then transmitted to a central monitoring platform for processing and storage. Such systems usually trigger alarms based on preset static threshold rules and provide dashboards for visualization.

[0004] The main principle of existing technologies is to deploy an Agent process on the monitored object to extract monitoring metrics, logs, and call chain data from the operating system kernel, processes, and middleware. This data undergoes initial local processing and is then transmitted to a central monitoring platform via an encrypted channel, where it is stored in a time-series database or log system. The monitoring platform matches data according to preset static or time-segmented threshold rules. When a metric exceeds the threshold range, an alarm is triggered, and alarm information is sent through predefined notification channels.

[0005] However, this agent-based monitoring system has significant shortcomings in large-scale and complex environments: First, the workload of deploying, upgrading, and maintaining agents for each device is enormous, resulting in a huge operational burden and resource consumption; second, agents need to run with high privileges for extended periods, causing security risks and compliance issues; third, alarm mechanisms based on static thresholds are difficult to adapt to dynamic changes in business load, leading to a large number of false alarms and missed alarms; fourth, monitoring data from multiple tools and systems are scattered across different platforms, forming "data silos" that limit unified management and global analysis capabilities; finally, in multi-network and cross-cloud environments, traditional monitoring systems often have coverage blind spots, making it difficult to achieve comprehensive monitoring. Summary of the Invention

[0006] The purpose of this invention is to provide an agentless intelligent monitoring and alarm method and device, which aims to solve the technical problems of existing agent-based monitoring systems in large-scale and complex environments, such as high deployment and maintenance costs, high security risks, low alarm accuracy, and limited coverage.

[0007] In a first aspect, the present invention provides an agentless intelligent monitoring and alarm method, comprising the following steps:

[0008] The cloud center platform obtains the monitoring task configuration information and synchronizes it to the edge collector through a security control channel based on mutual transport layer security. The monitoring task configuration information includes the monitoring acquisition task, protocol adaptation rules, data filtering conditions, sampling frequency, encryption method and anomaly detection strategy.

[0009] The edge collector pulls monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and performs preprocessing operations such as format conversion, key field extraction, data filtering and compression on the monitoring data to obtain the monitoring data to be processed.

[0010] The cloud center platform decrypts, decompresses, and verifies the integrity of the monitoring data to be processed sent by the edge collector, and performs data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data.

[0011] The cloud center platform uses a preset anomaly detection model to detect anomalies in the target monitoring data, uses a preset time series prediction model to predict trends in the target monitoring data, adjusts alarm thresholds through a preset adaptive alarm threshold engine, and compares the anomaly detection results, trend prediction results, target monitoring data, and alarm thresholds to generate corresponding alarm information.

[0012] In some embodiments, the cloud center platform acquires monitoring task configuration information and synchronizes it to the edge collector via a secure control channel based on mutual transport layer security, including:

[0013] The cloud center platform determines the monitoring object type, key indicators, collection method, protocol parameters and data processing rules based on the pre-set standard monitoring template and the custom monitoring template in order to generate monitoring task templates;

[0014] The cloud center platform obtains the edge collector information of the registered edge collectors, and manages the edge collectors in groups according to network area, business attributes and / or monitoring tasks, and determines the task allocation information of each edge collector. The edge collector information includes collector identifier, network location, resource capabilities and current status.

[0015] The edge collector obtains the monitored objects in the network through network scanning and / or DNS query and reports them to the cloud center platform, so that the cloud center platform generates the monitoring object registration information of the monitored objects. The monitoring object registration information includes object task information, which is used to indicate the association between the monitored object and the monitoring task template.

[0016] The cloud center platform generates monitoring task configuration information based on the monitoring task template, the task allocation information, and the monitoring object registration information. The monitoring task configuration information includes the target object address, access credentials, data collection protocol, sampling frequency, filtering conditions, local processing rules, encryption method, and anomaly detection strategy.

[0017] The cloud center platform synchronously distributes the monitoring task configuration information to the corresponding edge collectors through a secure control channel based on mutual transport layer security.

[0018] In some embodiments, the edge collector pulls monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and performs preprocessing operations on the monitoring data, including format conversion, key field extraction, data filtering, and compression, to obtain monitoring data to be processed, including:

[0019] The corresponding protocol adapter is initialized according to the monitoring task configuration information, and a multi-protocol adapter is established by loading protocol-specific parameters according to the protocol adapter. The protocol-specific parameters include timeout settings, retry policies and connection pool configurations. The protocol adapter is used to adapt to SSH protocol, HTTP protocol, SNMP protocol and JDBC protocol.

[0020] A preset local encrypted storage mechanism is used to save the access credentials information corresponding to the monitored object. The access credentials information includes username, password, API key, and certificate.

[0021] Based on the configured sampling frequency and scheduling strategy, a data acquisition request is initiated to the monitored object through the multi-protocol adapter to obtain the original monitoring data of the monitored object;

[0022] Using a preset data extraction algorithm, unstructured or semi-structured data in the original monitoring data is converted into structured data to obtain the converted original monitoring data. The structured data is used to indicate data in key-value pair format.

[0023] The transformed raw monitoring data is subjected to data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression to obtain the monitoring data to be processed.

[0024] In some embodiments, the cloud center platform decrypts, decompresses, and verifies the integrity of the monitoring data to be processed sent by the edge collector, and performs data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data, including:

[0025] The received monitoring data to be processed is decrypted, and the digital signature and edge collector identity associated with the monitoring data to be processed are verified. The data format and data consistency of the monitoring data to be processed are also verified to obtain the verified monitoring data to be processed.

[0026] The verified monitoring data to be processed is decompressed, and the data is deserialized from the transmission format into a data object in memory using a predefined data mode to obtain the decompressed monitoring data.

[0027] Repeatedly perform data detection and merging, missing value handling, outlier detection and correction, time sequence alignment and data precision adjustment on the decompressed monitoring data to obtain standard monitoring data with a preset standard data model format;

[0028] A real-time aggregation operation is performed on the time-series monitoring data collected at a preset high acquisition frequency in the standard monitoring data to generate statistical values ​​at different time granularities;

[0029] The standard monitoring data is associated with metadata in a preset configuration management database, and context information is added to each standard monitoring data to generate target monitoring data. The target monitoring data is then written into a distributed columnar storage system based on columnar storage. The context information includes asset identifiers, business attributes, topology relationships, and service dependencies.

[0030] In some embodiments, the cloud center platform uses a preset anomaly detection model to detect anomalies in the target monitoring data, uses a preset time series prediction model to predict trends in the target monitoring data, adjusts alarm thresholds through a preset adaptive alarm threshold engine, and compares the anomaly detection results, trend prediction results, the target monitoring data, and the alarm thresholds to generate corresponding alarm information, including:

[0031] The latest target monitoring data is obtained from the distributed columnar storage system. The obtained target monitoring data is then standardized, denoised, feature extracted, and missing value processed, and organized into a feature vector.

[0032] An anomaly detection model is constructed based on a preset isolated forest algorithm. The anomaly detection model is used to identify the feature vector to obtain anomaly detection results. The anomaly detection results include anomaly points and their corresponding anomaly scores, anomaly types, and impact degree evaluation values.

[0033] A time series prediction model is constructed based on a preset autoregressive integral moving average model. The feature vector is input into the time series prediction model, and the feature vector is decomposed into a time series. The time series decomposition result is used to optimize the model parameters of the time series prediction model, and the predicted value of the monitoring data is obtained using the optimized model parameters. The predicted value of the monitoring data within a preset time window is compared with a preset confidence interval to generate a trend prediction result. The time series decomposition result includes time series trend data, seasonal detection results, and residual components. The trend prediction result is used to indicate potential abnormal trends.

[0034] By combining pre-acquired historical data patterns and the current system status, an algorithm combination is used to calculate the alarm threshold of the monitoring indicators. The algorithm combination consists of at least two of the following: a pre-set historical quantile algorithm, a periodic pattern modeling algorithm, a load-related adjustment algorithm, and a fluctuation sensitivity adaptive algorithm.

[0035] When the anomaly detection result, the trend prediction result, and / or the target monitoring data meet at least one alarm condition, a corresponding alarm event is generated. Multi-source information fusion analysis is then performed on the anomaly detection result, the trend prediction result, and the alarm threshold, combining the topological relationships and service dependency information between monitored objects, to obtain the alarm content of the alarm event. The alarm conditions include an anomaly score in the anomaly detection result exceeding a preset anomaly threshold, an anomaly change trend within a preset time window indicated by the trend prediction result exceeding a preset change threshold, and the target monitoring data exceeding the alarm threshold. The alarm content includes an anomaly object identifier, the root cause of the alarm, relevant data of the monitoring indicators, the anomaly score, processing priority, and a suggested processing solution.

[0036] In some embodiments, associating the standard monitoring data with metadata in a preset configuration management database and adding context information to each piece of standard monitoring data includes:

[0037] The dependencies and interaction patterns between the monitored objects are modeled to construct a multi-level directed graph topology model. Each node in the multi-level directed graph topology model represents the monitored object, and the edges in the multi-level directed graph topology model represent one or more of the following relationships between the monitored objects: physical layer device connection relationship, network layer communication relationship, application layer service call relationship, and business layer process dependency.

[0038] Based on a pre-defined directed q-analysis algorithm, q+1 related monitoring objects in the multi-level directed graph topology model are grouped into a q-dimensional simplex. All q-dimensional simplexes are combined into a simplex complex, and the Betti number is calculated. The skeleton structure of the multi-level directed graph topology model is extracted, so that the structural characteristics of the monitoring network to which the monitoring object resides can be determined based on the simplex complex, the Betti number, and the skeleton structure. The Betti number is used to evaluate the topological connectivity of the multi-level directed graph topology model. The skeleton structure is used to describe the critical paths and node set of the topology of the monitoring network. The structural features include critical nodes, highly dependent areas, potential bottlenecks, and redundant paths.

[0039] The time dimension is introduced into the structural features. An analysis time window is determined based on the change frequency of the monitored object. The topology structure at different time points in the analysis time window is compared to identify topological changes. The evolution rate of the topology structure over time is calculated based on the topological changes. High-change regions and stable regions are identified based on the evolution rate and the topological changes. Corresponding resource optimization allocation strategies are generated for the high-change regions and the stable regions. The resource optimization allocation strategies are used to indicate increasing the sampling frequency of the high-change regions and decreasing the analysis frequency of the stable regions.

[0040] Based on the structural characteristics and the resource optimization allocation strategy, a topology criticality index is calculated for each monitored object, the impact propagation path of each potential fault point is calculated, and the monitoring granularity of the monitored object is adjusted according to the topology criticality index, the impact propagation path and the structural characteristics. Redundant paths in the monitoring network are marked according to the structural characteristics. The topology criticality index includes centrality, bridging value and impact range.

[0041] The standard monitoring data, structural features, resource optimization allocation strategy, topological criticality index, impact propagation path, monitoring granularity, and the monitoring network after marking the redundant paths are fused to generate context information.

[0042] In some embodiments, the process of performing data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression on the transformed original monitoring data to obtain the monitoring data to be processed includes:

[0043] An energy and information model is established for each monitoring indicator and processing operation. The energy and information model is used to indicate the degree of contribution of the monitoring indicator to anomaly detection and system status assessment, determine the information value score corresponding to the degree of contribution, quantify the energy consumption of data acquisition, local processing computing, data transmission network, and storage operation, and construct the energy-information trade-off curve corresponding to the monitoring task to identify the optimal operating point.

[0044] Based on the energy and information model, the sampling frequency is adjusted according to the historical fluctuation pattern of the monitoring indicators, the current operating level of the indicators, and the importance of the business. A processing task priority queue is established, and computing resources are reserved for the specified key indicators. This allows the simulation of the behavior characteristics of the specified memristor to allocate resources based on the adjusted sampling frequency, the processing task priority queue, and the reserved computing resources.

[0045] The data precision adjustment strategy is determined based on the preset information value, and a compression optimization strategy is generated using the specific characteristics of the transformed original monitoring data. The data precision adjustment strategy is used to indicate that the preset high precision is maintained for high-value indicators and the bit width or precision is reduced for low-value indicators. The compression optimization strategy is used to indicate that the corresponding time-series compression algorithm is applied to the time-series data in the transformed original monitoring data, key change points are retained, and the compression degree of stable areas is increased.

[0046] Based on the data value of the transformed original monitoring data, the network status and energy level of the monitoring network, a transmission scheduling strategy is determined and a multi-level data transmission strategy is established. The transmission scheduling strategy is used to indicate that high-value data is transmitted first and non-critical data is transmitted in batches with delayed transmission. The multi-level data transmission strategy is used to indicate that critical anomalies are transmitted in real time, important indicators are transmitted in batches periodically, and baseline data is transmitted in large batches at low frequency.

[0047] Energy efficiency is assessed for each monitoring task, and resource allocation is optimized based on a global view. Task sharing among multiple edge nodes is coordinated to obtain the monitoring data to be processed.

[0048] In some embodiments, the construction of an anomaly detection model based on a preset isolated forest algorithm, and the use of the anomaly detection model to identify the feature vector to obtain anomaly detection results, includes:

[0049] The feature vector is encoded using a data preprocessing framework based on integrated spike patch segmentation to obtain multimodal encoded data. The multimodal encoded data includes time-series index encoded data, log event encoded data, topological state encoded data, pulse frequency encoded data, discrete spike sequences, and spike time-series patterns. The pulse frequency is converted from the numerical index in the feature vector through a preset comparison threshold. The discrete spike sequence is mapped from the event data in the feature vector. The spike time-series patterns are converted from the state changes in the feature vector.

[0050] The data preprocessing framework is used to obtain a multi-scale time window. Based on the multi-scale time window, the inherent frequency features of the time series are extracted, and the time granularity of target monitoring data from different sources is aligned. A time and frequency dual-domain representation corresponding to the feature vector is constructed. Based on the multi-scale time window, the inherent frequency features, the aligned time granularity, and the time and frequency dual-domain representation, time stability data is established.

[0051] Using the data preprocessing framework, the feature vector is converted into temporal patches, and spatial features are extracted from the feature vector. Based on the correlation between the temporal patches and the spatial features, feature association relationships are obtained, so that a monitoring data representation is generated based on the multimodal coded data, the temporal stability data, and the feature association relationships.

[0052] The calculation strategy for the monitoring data representation is triggered by a preset peak neural network. The calculation strategy includes generating corresponding calculation peak data when the data change rate of the monitoring data representation exceeds a preset data change threshold, and calculating corresponding resource allocation data when the data change rate of the monitoring data representation is lower than a preset low change threshold.

[0053] A preset peak Transformer network is established. The peak Transformer network is used to extract features at multiple scales by fusing preset temporal attention mechanisms and spatial attention mechanisms, capture feature anomalies at different time spans, and perform hierarchical anomaly detection.

[0054] Based on the complexity and probability of anomalies represented by the monitoring data, allocate corresponding computing resources;

[0055] The isolated forest algorithm is fused with the preset STAS framework to obtain a decision tree. The decision tree is re-evaluated based on the data changes represented by the monitoring data, and the depth and sampling strategy of the decision tree are dynamically adjusted. Based on the computing strategy, the spike Transformer network, the allocated computing resources, the re-evaluation results, the depth and sampling strategy of the decision tree, a spatiotemporally adaptive anomaly detection model is obtained.

[0056] In some embodiments, the monitoring data representation is obtained through the following steps:

[0057] The numerical index is compared with the comparison threshold. The numerical index values ​​exceeding the comparison threshold are converted into high-frequency pulses, and the numerical index values ​​below the comparison threshold are converted into low-frequency pulses. The values ​​are mapped to the corresponding pulse frequency encoded data according to their magnitude, and the time attribute and relative intensity of the feature vector are preserved.

[0058] The alarm events, status changes, and system logs contained in the event-type data are mapped into discrete spike sequences according to event type and importance. The discrete spike sequences include high-amplitude spikes generated by alarm events whose importance is higher than the upper limit of a preset importance range, and medium-amplitude spikes generated by alarm events whose importance is within the importance range.

[0059] The node online / offline status, connection establishment / disconnection, and path change contained in the topology state in the feature vector are converted into spike patterns corresponding to the state change types of the topology state.

[0060] The high-frequency changes within a short time window and the trend changes within a long time window are processed separately to extract the inherent frequency features of the time series, which include periodicity, suddenness, and gradualness.

[0061] A time-frequency dual-domain representation is constructed, which is used to indicate the temporal relationship of the feature vector in the time domain and to analyze the spectral characteristics of the feature vector in the frequency domain.

[0062] A correlation diagram between the time patches and the spatial features is established to obtain a representation of the monitoring data.

[0063] In some embodiments, the cloud center platform acquires monitoring task configuration information and synchronizes it to the edge collector via a secure control channel based on mutual transport layer security. It then discovers monitorable objects in the network through network scanning and DNS queries and reports them to the cloud center platform. Combined with manually added monitoring object information, it generates categorized and stored monitoring object registration information. The system also includes:

[0064] Based on the network address range configuration, a network range scan is performed to detect active hosts in the network by specifying the protocol, and port scans are performed on the detected active hosts to identify the types of services they are running, generating a list of hosts containing IP addresses, open ports and service types;

[0065] Based on the host list, domain name resolution records are obtained through DNS queries, and the domain name information of devices in the network is identified based on the domain name resolution records. Combined with reverse DNS queries, the device attribute information of the devices is determined from the domain name information. The devices include servers, application systems, and network devices, and the device attribute information includes functional roles and business attributes.

[0066] Based on the API interfaces of the cloud center platform, virtualization platform, and container platform, the dynamic resources of the virtual machines, container instances, and microservice components corresponding to the API interfaces are called. The dynamic resources include configuration information, tag attributes, and running status.

[0067] Combining the host list, the device attribute information, and the dynamic resources, the detected monitoring objects are classified according to device type, service attribute, and network location, and an object information database containing object identifier, type, location, attribute, and access method is established.

[0068] The object information database is associated with the monitoring task template to generate monitoring object registration information.

[0069] In some embodiments, the step of performing data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression on the transformed original monitoring data to obtain the monitoring data to be processed further includes:

[0070] The edge collector caches the monitoring data to be processed locally based on a preset circular buffer, forming a local data cache queue. The local data cache queue is used to support the configuration of specified storage capacity and data retention strategy.

[0071] When the edge collector detects a network anomaly or an interruption in the connection with the cloud center platform, it temporarily stores the collected monitoring data to be processed in the local data cache queue. It supports configuring the maximum storage capacity and data retention policy, and realizes data compression and periodic checks to optimize storage space usage.

[0072] When the edge collector detects that the connection with the cloud center platform has been restored by the current network connection status and cloud communication quality, it re-transmits the cached data in the local data cache queue in chronological order.

[0073] The edge collector transmits the monitoring data to be processed from the local data cache queue to the cloud center platform through a preset encrypted channel and a preset transmission strategy. The transmission strategy is used to indicate whether to select a batch transmission mode or a streaming transmission mode based on the amount of monitoring data to be processed and the real-time requirements.

[0074] In some embodiments, writing the target monitoring data into a columnar storage-based distributed columnar storage system further includes:

[0075] Based on the data access frequency and business importance of the target monitoring data, a data lifecycle management strategy is determined. The data lifecycle management strategy is used to instruct the target monitoring data whose data access frequency and business importance exceed the upper limit of a preset normal demand range to be stored in a high-performance storage that supports real-time query; to migrate the target monitoring data whose data access frequency and business importance are within the normal demand range to a storage layer with a cost lower than a preset low-cost threshold; and to compress or archive the target monitoring data whose data access frequency and business importance are lower than the lower limit of the normal demand range to retain only a statistical summary.

[0076] The data lifecycle management strategy is optimized based on the data type, business importance, and compliance requirements of the target monitoring data to obtain a lifecycle optimization strategy. The lifecycle optimization strategy is used to instruct the automatic migration and management of data between different storage layers, so as to optimize storage costs while meeting data retention requirements.

[0077] Based on the target monitoring data, a multidimensional index is created, which is used to indicate queries based on time, object, metric type, and label;

[0078] Based on the multidimensional index and the lifecycle optimization strategy, the target monitoring data is optimized and stored using a preset sharding and replication mechanism to obtain optimized and stored target monitoring data.

[0079] In some embodiments, the alarm content of the alarm event is obtained through the following steps:

[0080] Based on the anomaly detection results, the trend prediction results, and the target monitoring data, different anomaly indicators of the same monitoring object are correlated, and correlation analysis and causal reasoning are performed on the anomaly detection results, the trend prediction results, and the target monitoring data to identify potential root causes of alarms, and to analyze the abnormal states of dependent services and related components to determine the propagation path and scope of impact of the problem.

[0081] Based on the service importance and anomaly severity determined by the anomaly indicators, the root cause of the alarm, the dependent services, the anomaly state, the propagation path, and the scope of impact, the business impact caused by the anomaly is assessed, the processing priority is determined based on the business impact, and alarm content containing the root cause of the alarm, the scope of impact, the processing priority, and the corresponding suggested processing solution is generated.

[0082] Merge similar alarm events within a specified time window, and merge multiple related alarm events into a single root cause alarm event, and push alarms to the merged alarm event within the specified time window according to the processing priority.

[0083] Secondly, the present invention provides an agentless intelligent monitoring and alarm device, comprising: a cloud center platform and an edge collector;

[0084] The cloud center platform is used to obtain monitoring task configuration information and synchronize it to the edge collector through a security control channel based on mutual transport layer security. The monitoring task configuration information includes monitoring collection tasks, protocol adaptation rules, data filtering conditions, sampling frequency, encryption method and anomaly detection strategy.

[0085] The edge collector is used to pull monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and to perform preprocessing operations such as format conversion, key field extraction, data filtering and compression on the monitoring data to obtain monitoring data to be processed.

[0086] The cloud center platform is used to decrypt, decompress, and verify the integrity of the monitoring data to be processed sent by the edge collector, and to perform data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data.

[0087] The cloud center platform is used to detect anomalies in the target monitoring data using a preset anomaly detection model, predict trends in the target monitoring data using a preset time series prediction model, adjust alarm thresholds using a preset adaptive alarm threshold engine, and compare the anomaly detection results, trend prediction results, target monitoring data, and alarm thresholds to generate corresponding alarm information.

[0088] Compared with existing technologies, this invention has the following advantages: it eliminates the need to deploy agents on the monitored objects, significantly reducing deployment and maintenance costs and expanding monitoring coverage; it enables unified monitoring of different types of devices and systems through edge collectors and multi-protocol adaptation; it significantly improves alarm accuracy and reduces false alarms and missed alarms by employing AI-driven anomaly detection and trend prediction combined with adaptive alarm thresholds; it ensures the security and integrity of monitoring data based on secure control channels and data encryption mechanisms; and it achieves synergy between edge intelligent processing and cloud analysis, optimizing network resource utilization and data processing efficiency. Attached Figure Description

[0089] Figure 1 This is a flowchart illustrating an agentless intelligent monitoring and alarm method provided in an embodiment of the present invention.

[0090] Figure 2 This is a schematic diagram of the structure of an agentless intelligent monitoring and alarm device provided in an embodiment of the present invention. Detailed Implementation

[0091] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0092] like Figure 1 As shown, an agentless intelligent monitoring and alarm method includes the following steps S1 to S4.

[0093] S1. The cloud center platform obtains the monitoring task configuration information and synchronizes it to the edge collector through a security control channel based on mutual transport layer security. The monitoring task configuration information includes the monitoring collection task, protocol adaptation rules, data filtering conditions, sampling frequency, encryption method and anomaly detection strategy.

[0094] In this application, the cloud center platform first needs to obtain monitoring task configuration information. This configuration information is a complete set of instructions guiding the edge collectors to perform data acquisition, processing, and transmission. It includes monitoring acquisition tasks, protocol adaptation rules, data filtering conditions, sampling frequency, encryption methods, and anomaly detection strategies. Specifically, the monitoring acquisition task defines the specific metrics and monitoring objects to be collected; the protocol adaptation rules specify the protocols and parameters used when communicating with different types of devices; the data filtering conditions are used to filter valuable data and reduce redundant information; the sampling frequency determines the data acquisition time interval; the encryption method ensures the security of data transmission; and the anomaly detection strategy defines the preliminary anomaly judgment rules.

[0095] After acquiring the monitoring task configuration information, the cloud center platform synchronizes this information to the edge collectors via a secure control channel based on Mutual Transport Layer Security (mTLS). It should be noted that mTLS is a two-way authentication mechanism, unlike traditional one-way TLS (which only verifies the server's identity). mTLS requires both communicating parties to provide certificates and mutually verify each other's identities, thereby establishing a highly secure communication channel. In this application, both the cloud center platform and the edge collectors need to hold valid digitally signed certificates, performing two-way authentication during the communication establishment phase to ensure the secure transmission of configuration information and prevent man-in-the-middle attacks and tampering of configuration information. Therefore, configuring a security mechanism improves the integrity and security of the monitoring system, especially in distributed environments and cross-network area deployment scenarios.

[0096] S2. The edge collector pulls monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and performs preprocessing operations such as format conversion, key field extraction, data filtering and compression on the monitoring data to obtain the monitoring data to be processed.

[0097] In this application, after receiving the configuration information synchronized from the cloud center platform, the edge collector begins collecting monitoring data. It should be noted that this edge collector refers to a lightweight data collection node deployed at the boundaries of various network areas or close to the monitored objects. It can cross network boundaries and access monitored objects in different areas. The edge collector pulls monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information. Furthermore, the multi-protocol adapter is a software module that supports multiple communication protocols and can dynamically select the appropriate protocol for communication based on the type of monitored object and the access method. For example, for Linux servers, the SSH protocol might be used to execute commands to obtain performance data; for network devices, the SNMP protocol might be used to query status information; and for applications, the HTTP protocol might be used to call APIs to obtain health indicators.

[0098] After acquiring the raw monitoring data, the edge data collector performs preprocessing operations, including format conversion, key field extraction, data filtering, and compression. Format conversion transforms heterogeneous data from different sources into a unified format; key field extraction extracts valuable information from complex data structures; data filtering removes outliers and redundant data; and compression reduces data transmission volume and optimizes network resource utilization. Therefore, this application achieves standardized data format, improves data quality, and reduces transmission overhead through preprocessing operations, ultimately obtaining uniformly formatted and reliable monitoring data to be processed.

[0099] S3. The cloud center platform decrypts, decompresses, and verifies the integrity of the monitoring data to be processed sent by the edge collector, and performs data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data.

[0100] In this application, the edge data collector sends preprocessed monitoring data to the cloud center platform. The cloud center platform first decrypts, decompresses, and verifies the integrity of the received data. The decryption process uses the key corresponding to the encryption to recover the original data; the integrity verification verifies the digital signature and checksum to ensure that the data has not been tampered with during transmission. After completing the basic verification, the cloud center platform further performs data cleaning, aggregation, and context enrichment operations.

[0101] Specifically, data cleaning refers to removing noisy data, handling missing and outlier values, and improving data quality; aggregation operations statistically summarize frequently collected raw data according to time windows, generating aggregated views at different time granularities; context enrichment involves associating monitoring data with metadata in the Configuration Management Database (CMDB), adding contextual information such as asset identifiers, business attributes, topology relationships, and service dependencies to each monitoring data record. Contextual information greatly enhances the value of monitoring data, enabling the system to understand the business meaning and relationships behind the data. This results in target monitoring data with rich semantics and high quality.

[0102] S4. The cloud center platform uses a preset anomaly detection model to detect anomalies in the target monitoring data, uses a preset time series prediction model to predict trends in the target monitoring data, adjusts alarm thresholds through a preset adaptive alarm threshold engine, and compares the anomaly detection results, trend prediction results, target monitoring data, and alarm thresholds to generate corresponding alarm information.

[0103] In this application, the cloud center platform utilizes a pre-defined anomaly detection model to detect anomalies in the target monitoring data. It should be noted that the anomaly detection model is a machine learning model capable of automatically identifying abnormal patterns in the data. Simultaneously, the cloud center platform uses a pre-defined time series forecasting model to predict trends in the target monitoring data, anticipating future changes in monitoring indicators and identifying potential problems early.

[0104] It should be noted that by configuring the adaptive alarm threshold engine, the alarm threshold for each monitoring metric can be dynamically adjusted based on historical data patterns and the current system status. Unlike traditional static threshold settings, adaptive thresholds consider changes in business load, time-periodic patterns, and the inherent volatility of the metrics themselves, thus more accurately reflecting the boundaries of normal behavior. Subsequently, anomaly detection results, trend prediction results, target monitoring data, and alarm thresholds are compared. When preset alarm conditions are met, corresponding alarm information is generated. These alarm conditions may include: the anomaly score of the anomaly detection model exceeding the threshold, trend prediction indicating that the metric will exceed the safe range within a specific future timeframe, or the real-time monitoring value exceeding the current adaptive threshold. The generated alarm information includes anomaly description, affected monitoring objects, anomaly severity assessment, possible cause analysis, and handling suggestions, providing comprehensive problem diagnosis and handling guidance for operations and maintenance personnel. Therefore, this application implements a complete monitoring and alarm process from configuration management, data collection, data processing to intelligent analysis, enabling efficient and accurate monitoring of various IT systems without deploying agents, and timely detection and early warning of potential problems.

[0105] In some embodiments, the cloud center platform acquires monitoring task configuration information and synchronizes it to the edge collector via a secure control channel based on mutual transport layer security, including:

[0106] The cloud center platform determines the monitoring object type, key indicators, collection method, protocol parameters and data processing rules based on the pre-set standard monitoring template and the custom monitoring template in order to generate monitoring task templates;

[0107] The cloud center platform obtains the edge collector information of the registered edge collectors, and manages the edge collectors in groups according to network area, business attributes and / or monitoring tasks, and determines the task allocation information of each edge collector. The edge collector information includes collector identifier, network location, resource capabilities and current status.

[0108] The edge collector obtains the monitored objects in the network through network scanning and / or DNS query and reports them to the cloud center platform, so that the cloud center platform generates the monitoring object registration information of the monitored objects. The monitoring object registration information includes object task information, which is used to indicate the association between the monitored object and the monitoring task template.

[0109] The cloud center platform generates monitoring task configuration information based on the monitoring task template, the task allocation information, and the monitoring object registration information. The monitoring task configuration information includes the target object address, access credentials, data acquisition protocol, sampling frequency, filtering conditions, local processing rules, encryption method, and anomaly detection strategy. The cloud center platform synchronously distributes the monitoring task configuration information to the corresponding edge collectors through a security control channel based on mutual transport layer security.

[0110] In this embodiment, the cloud center platform first determines the monitoring object type, key indicators, collection methods, protocol parameters, and data processing rules based on pre-set standard monitoring templates and custom monitoring templates to generate monitoring task templates. A monitoring template is a predefined set of configurations that provides standardized monitoring solutions for specific types of monitoring objects. Standard monitoring templates are pre-set by the system, covering common IT infrastructure and application components such as servers, databases, network devices, and middleware; while custom monitoring templates are created by administrators according to specific business needs, supporting customized monitoring scenarios. The monitoring object type specifies the category of IT assets being monitored, such as physical servers, virtual machines, containers, and network devices; key indicators define the specific indicators to be collected, such as CPU utilization, memory usage, network traffic, and disk I / O; the collection method specifies the method of data acquisition, such as active retrieval, passive reception, or event subscription; protocol parameters include detailed parameters such as the protocol type, port, and timeout settings required for communication with the monitoring object; and data processing rules define the processing logic for the raw data, such as sampling frequency, filtering conditions, and aggregation methods.

[0111] Therefore, by combining the above elements, the cloud center platform generates structured monitoring task templates, facilitating subsequent monitoring task configuration. Templated configuration significantly simplifies the complexity of monitoring configuration, improves configuration efficiency, and ensures consistency in monitoring standards.

[0112] Subsequently, the cloud center platform obtains the edge collector information of the registered edge collectors and groups them according to network region, business attributes, and / or monitoring tasks. Edge collector information is a set of metadata describing the characteristics of the collector node, including key information such as collector identifier, network location, resource capabilities, and current status. The collector identifier is a unique identifier for each edge collector, used for system management and communication addressing; the network location describes the collector's position in the network topology, including IP address, network segment, and network region; resource capabilities reflect the collector's hardware specifications and performance parameters, such as the number of CPU cores, memory capacity, and storage space; and the current status indicates the collector's operating status, such as online, offline, or high load. Thus, the cloud center platform groups the edge collectors and determines the task allocation information for each edge collector. The core idea of ​​group management is to group collectors with similar functions, close locations, or monitoring related objects together for unified configuration and management. For example, it can be divided according to network area (such as production area, test area, DMZ area), or grouped according to business attributes (such as e-commerce system, payment system, logistics system), or grouped according to monitoring task type (such as infrastructure monitoring, application performance monitoring, security monitoring).

[0113] Therefore, by managing by groups, monitoring tasks can be allocated more rationally, ensuring a balanced workload for each edge collector, while maximizing the use of network topology advantages and reducing network overhead caused by cross-regional monitoring.

[0114] Furthermore, the edge data collector acquires monitoring targets in the network and reports them to the cloud center platform through network scanning and / or DNS queries. Network scanning is a proactive discovery technology that identifies active devices and services in the network by sending probe packets and analyzing responses; DNS queries discover systems and services registered in the DNS by resolving records in the Domain Name System.

[0115] It should be noted that network scanning typically includes three steps: IP range scanning, port scanning, and service identification. IP range scanning identifies active hosts on the network; port scanning detects open network ports on hosts; and service identification determines the specific service type running on the port by analyzing protocol characteristics. DNS lookup techniques include forward lookup (obtaining IP from domain name) and reverse lookup (obtaining domain name from IP), as well as the more advanced Service Record (SRV) lookup, used to discover the location of specific services.

[0116] Therefore, the edge collectors report the detected monitoring object information to the cloud center platform, which then generates monitoring object registration information. This registration information includes object task information, that is, the association between the monitored object and the monitoring task template, indicating which monitoring template should be used to monitor a specific object. Thus, through the automatic discovery and registration mechanism, it is possible to dynamically adapt to changes in the network environment, promptly discover new devices and services, and automatically expand the monitoring scope.

[0117] Furthermore, the cloud center platform generates detailed monitoring task configuration information based on monitoring task templates, task allocation information, and monitoring object registration information. This involves combining a general monitoring template with specific monitoring object and edge collector information to generate directly executable monitoring tasks. Specifically, the generated monitoring task configuration information includes several key elements: the target object address indicates the network location of the monitored object; access credentials provide the authentication information required to connect to the monitored object; the data acquisition protocol specifies the protocol type for communication with the object; the sampling frequency determines the data acquisition time interval; filtering conditions are used to filter valuable data; local processing rules guide how the edge collector performs preliminary data processing; encryption methods ensure data transmission security; and the anomaly detection strategy defines the initial anomaly judgment logic. Therefore, the configuration generation mechanism is highly flexible and adaptable, automatically generating the most suitable monitoring task configuration based on different monitoring object types, deployment environments, and business needs, reducing the workload and potential errors of manual configuration.

[0118] Therefore, the cloud center platform synchronously distributes monitoring task configuration information to the corresponding edge collectors through a secure control channel based on Mutual Transport Layer Security (mTLS). mTLS is a two-way authentication mechanism that ensures the authenticity of the identities of both communicating parties and the security of data transmission. Specifically, in mTLS, both the cloud center platform and the edge collectors need to hold digital certificates issued by a trusted Certificate Authority (CA). During the communication establishment phase, both parties verify the validity of each other's certificates, including checking the certificate signature, validity period, and revocation status. Only after both parties have successfully verified each other's identities will an encrypted communication channel be established. This two-way authentication mechanism effectively prevents man-in-the-middle attacks and identity spoofing.

[0119] After establishing a secure channel, the cloud center platform encrypts and transmits the generated monitoring task configuration information to the target edge data collector. The transmission process employs high-strength encryption algorithms to protect the data content and prevent eavesdropping or tampering during transmission. Simultaneously, a digital digest of the configuration data is calculated and a digital signature is attached, enabling the recipient to verify the data's integrity and authenticity. Therefore, this secure configuration distribution mechanism ensures the confidentiality, integrity, and authenticity of the monitoring configuration information. This security mechanism is particularly crucial in multi-network and cross-cloud environments, preventing malicious attacks and protecting sensitive information.

[0120] Therefore, this embodiment completes the entire process from monitoring template management, edge collector management, monitoring object discovery to monitoring task configuration generation and secure distribution through the cloud center platform.

[0121] In some embodiments, the edge collector pulls monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and performs preprocessing operations on the monitoring data, including format conversion, key field extraction, data filtering, and compression, to obtain monitoring data to be processed, including:

[0122] The corresponding protocol adapter is initialized according to the monitoring task configuration information, and a multi-protocol adapter is established by loading protocol-specific parameters according to the protocol adapter. The protocol-specific parameters include timeout settings, retry policies and connection pool configurations. The protocol adapter is used to adapt to SSH protocol, HTTP protocol, SNMP protocol and JDBC protocol.

[0123] A preset local encrypted storage mechanism is used to save the access credentials information corresponding to the monitored object. The access credentials information includes username, password, API key, and certificate.

[0124] Based on the configured sampling frequency and scheduling strategy, a data acquisition request is initiated to the monitored object through the multi-protocol adapter to obtain the original monitoring data of the monitored object;

[0125] Using a preset data extraction algorithm, unstructured or semi-structured data in the original monitoring data is converted into structured data to obtain the converted original monitoring data. The structured data is used to indicate data in key-value pair format.

[0126] The transformed raw monitoring data is subjected to data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression to obtain the monitoring data to be processed.

[0127] In this embodiment, the edge data collector first initializes the corresponding protocol adapter based on the received monitoring task configuration information. The protocol adapter is a software component capable of handling functions such as connection establishment, command sending, data reception, and session management for a specific communication protocol. This protocol adapter acts as a bridge for communication between the edge data collector and various monitored objects, shielding the differences between different protocols and providing a unified data access interface.

[0128] During initialization, the edge collector parses the protocol type in the configuration information and loads the corresponding protocol adapter module. It adopts a plug-in architecture, supporting the dynamic loading of different protocol adapters, including SSH adapters (for connecting to Linux / Unix systems), HTTP adapters (for web services and RESTful APIs), SNMP adapters (for network device monitoring), and JDBC adapters (for database monitoring). After the protocol adapter is initialized, the edge collector configures the adapter's parameters according to the protocol-specific parameters in the configuration information. These protocol-specific parameters include timeout settings (defining the maximum waiting time for a request response), retry policies (specifying the number of retries and intervals after a connection failure), and connection pool configurations (controlling the number of concurrent connections and connection reuse strategies). Therefore, by properly configuring these protocol-specific parameters, resource utilization efficiency can be optimized while ensuring communication reliability.

[0129] Ultimately, the edge data collector establishes a complete multi-protocol adapter system, providing flexible and powerful protocol support for the collection of monitoring data. It can remotely acquire monitoring data through standard protocols without deploying dedicated agent software on the target system.

[0130] Subsequently, the edge data collector uses a pre-defined local encrypted storage mechanism to save the access credentials corresponding to the monitored objects. These access credentials are essential security information for connecting to and authenticating the monitored objects, including various types such as usernames and passwords (for basic authentication), API keys (for service interface calls), and certificates (for certificate authentication). The local encrypted storage mechanism uses high-strength encryption algorithms (such as AES-256) to encrypt and protect the credentials, ensuring that the credentials will not be leaked even if the storage medium is physically accessed. The key management system is responsible for securely generating, storing, and using encryption keys, and may employ hardware security modules (HSMs) or trusted platform modules (TPMs) to further protect the key materials.

[0131] It should be noted that credential usage follows the principle of least privilege, meaning each monitoring task can only access its associated credential information and is only temporarily decrypted and used when needed. Credential usage logs are recorded to facilitate security auditing and anomaly detection. Furthermore, credential management supports periodic credential rotation and validity verification, reducing the security risks associated with unchanging credentials over long periods. Therefore, through credential management, edge data collectors can securely store and use access credentials for monitored objects, achieving agentless monitoring data collection without compromising security.

[0132] Subsequently, the edge data collector, based on the configured sampling frequency and scheduling strategy, initiates data acquisition requests to the monitored objects through a multi-protocol adapter to obtain the raw monitoring data of the monitored objects. The sampling frequency defines the time interval for data acquisition and may be dynamically adjusted based on the importance of the monitored object, the rate of data change, and system resource status. The scheduling strategy specifies constraints such as task execution priority, concurrency, and time windows. Specifically, the form of the data acquisition request depends on the protocol used and the type of monitored object. For server monitoring using the SSH protocol, remote commands such as "top," "vmstat," and "df" may be executed to obtain system performance data; for web service monitoring using the HTTP protocol, health check APIs or performance indicator interfaces may be called; for network device monitoring using the SNMP protocol, specific MIB (Management Information Base) objects may be queried; and for database monitoring using the JDBC protocol, specific SQL queries may be executed to obtain the database status.

[0133] Therefore, the edge collector manages the lifecycle of the aforementioned requests, including establishing connections, sending requests, receiving responses, handling exceptions, and closing connections. This embodiment implements mechanisms such as request timeout control, error retries, concurrency limits, and load balancing to ensure the reliability and efficiency of the data acquisition process. In this way, the edge collector can proactively retrieve raw monitoring data from various monitored objects, providing basic data input for subsequent processing.

[0134] Furthermore, the edge data collector utilizes pre-defined data extraction algorithms to convert unstructured or semi-structured data in the original monitoring data into structured data. The original monitoring data may be in various formats, such as text output, XML, JSON, and binary data, requiring specific parsing algorithms to extract valuable information. These data extraction algorithms include various techniques: regular expression matching for extracting data with specific patterns from text; XPath and JSONPath for extracting values ​​from specific paths in XML and JSON format data; format-specific parsers for handling standardized log formats or binary protocols; and natural language processing techniques for extracting semantic information from unstructured text. Key information in the original data is identified and extracted according to predefined parsing rules. The resulting structured data is organized in key-value pair format, meaning each data point contains a clear identifier (key) and a corresponding numerical value or state (value). This structure provides good data processability and queryability, facilitating subsequent storage, analysis, and visualization. Therefore, this embodiment uses an edge data collector to uniformly convert various heterogeneous original data into a standardized structured format.

[0135] Furthermore, the edge data collector performs a series of preprocessing operations on the transformed raw monitoring data, including data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression, ultimately yielding the monitoring data to be processed. Specifically, data type conversion ensures that data fields have the correct data type, such as converting string-formatted numerical values ​​to integer or floating-point types for easier subsequent calculations; unit standardization converts measurement values ​​from different units to a unified standard unit, such as converting KB, MB, and GB to bytes, or unifying times from different time zones to UTC time; invalid value filtering removes obviously erroneous data points, such as values ​​exceeding the physical possible range, NULL values, or data with incorrect formats; and timestamp normalization ensures that each data point has an accurate timestamp and a unified time format.

[0136] It should be noted that the purpose of data compression is to reduce the amount of data transmitted. To this end, various compression techniques are employed: general compression algorithms (such as gzip and zlib) are used for overall data compression; time-series specific compression algorithms (such as Gorilla and Delta encoding) are optimized for the characteristics of time-series data; differential compression transmits only the changed data portions; and semantic compression selectively reduces precision or frequency based on the business meaning of the data. These techniques significantly reduce the amount of data transmitted while maintaining data validity and availability. Therefore, in this embodiment, through the aforementioned preprocessing and optimization, the raw monitoring data is transformed into high-quality, low-redundancy, and easily transmittable monitoring data ready to be transmitted to the cloud center platform for further processing and analysis. Thus, the edge collector completes the entire process from protocol adaptation, security credential management, data collection to data parsing and preprocessing, achieving efficient monitoring data collection and preliminary processing without an agent, laying a solid foundation for subsequent in-depth analysis and alarm generation.

[0137] In some embodiments, the cloud center platform decrypts, decompresses, and verifies the integrity of the monitoring data to be processed sent by the edge collector, and performs data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data, including:

[0138] The received monitoring data to be processed is decrypted, and the digital signature and edge collector identity associated with the monitoring data to be processed are verified. The data format and data consistency of the monitoring data to be processed are also verified to obtain the verified monitoring data to be processed.

[0139] The verified monitoring data to be processed is decompressed, and the data is deserialized from the transmission format into a data object in memory using a predefined data mode to obtain the decompressed monitoring data.

[0140] Repeatedly perform data detection and merging, missing value handling, outlier detection and correction, time sequence alignment and data precision adjustment on the decompressed monitoring data to obtain standard monitoring data with a preset standard data model format;

[0141] A real-time aggregation operation is performed on the time-series monitoring data collected at a preset high acquisition frequency in the standard monitoring data to generate statistical values ​​at different time granularities;

[0142] The standard monitoring data is associated with metadata in a preset configuration management database, and context information is added to each standard monitoring data to generate target monitoring data. The target monitoring data is then written into a distributed columnar storage system based on columnar storage. The context information includes asset identifiers, business attributes, topology relationships, and service dependencies.

[0143] In this embodiment, the cloud center platform first decrypts the received monitoring data to be processed and verifies the digital signature and edge collector identity associated with the monitoring data. During this process, data decryption refers to using the corresponding key algorithm to restore the encrypted monitoring data to its original form. This embodiment employs a hybrid encryption mechanism, typically combining the advantages of asymmetric encryption (such as RSA or elliptic curve cryptography) and symmetric encryption (such as AES). Specifically, asymmetric encryption is used to securely exchange session keys, while efficient symmetric encryption algorithms are used to encrypt the actual data content.

[0144] It should be noted that digital signature verification ensures data integrity and authenticity. Specifically, the digital signature is generated by encrypting the data digest (calculated using a hash algorithm such as SHA-256) with the sender's private key. The cloud center platform decrypts the signature using the public key of the corresponding edge collector and compares the decryption result with the independently calculated data digest. If the two match, it proves that the data has not been tampered with and indeed originated from the intended edge collector.

[0145] In this embodiment, the collector identifier and authentication token contained in each data packet are verified by an edge collector to ensure the trustworthiness of the data source. A dynamic registry of authorized collectors is maintained, containing each collector's unique identifier, encryption key, and permission scope. Authentication may employ certificate-based authentication (relying on PKI infrastructure) or token-based authentication (such as JWT or OAuth 2.0 protocols).

[0146] After decryption and authentication, the data format and consistency of the monitoring data to be processed are verified. Format verification ensures that the data conforms to predefined structural specifications; consistency verification verifies whether the internal logical relationships of the data are reasonable, such as whether the timestamp is incrementing and whether related fields match. Therefore, this embodiment obtains reliable and correctly formatted monitoring data to be processed through the above verification.

[0147] Next, the cloud center platform decompresses the verified monitoring data to be processed, deserializing it from the transmission format into data objects in memory using a predefined data pattern. Data decompression is the inverse operation of compression, aiming to restore the original form of the data. Specifically, the appropriate decompression method is selected based on the compression algorithm type specified in the data packet. For general compression (such as gzip, zlib), the standard library is used for decompression; for time-series specific compression (such as Gorilla encoding), a dedicated decoder is used; for differential compression, restoration is performed using previous baseline data.

[0148] It should be noted that deserialization is the process of converting a compact transmission format into a data structure that can be operated internally by the system. A predefined data schema guides the deserialization process, ensuring correct parsing and type conversion of data fields. The data schema defines the name, data type, required status, default value, and other attributes of each field, similar to a database table structure or a JSON schema. Commonly used serialization formats include Protocol Buffers, Thrift, Avro, or custom binary formats, which are generally more compact and efficient than text formats (such as JSON and XML). Therefore, the deserialization process needs to handle various edge cases, such as missing fields, version compatibility, and type mismatches. This embodiment implements a robust error handling mechanism that maintains backward compatibility as data formats evolve, while identifying and correcting minor formatting issues. Therefore, converting compressed transmission data into a structured data object in memory, called decompression monitoring data, facilitates efficient subsequent processing and analysis.

[0149] Furthermore, the cloud center platform repeatedly performs data detection and merging, missing value handling, outlier detection and correction, time sequence alignment, and data precision adjustment on the decompressed monitoring data to obtain standard monitoring data with a preset standard data model format.

[0150] For example, data cleaning can improve data quality and includes multiple sub-steps, namely steps 1 to 5.

[0151] Step 1 involves data detection and merging to address duplicate data and multi-source data merging issues. Due to network retransmissions or redundant deployment of edge nodes, duplicate data points may be received. The detection algorithm identifies duplicates based on timestamps, data source identifiers, and content features, and merges them according to a preset strategy (such as retaining the first occurrence, the last occurrence, or combining multiple occurrences). For similar data from different sources, intelligent merging is performed based on data quality scores and source credibility.

[0152] Step 2, missing value handling, involves imputing gaps in the data stream. Missing values ​​may be caused by acquisition failures, transmission interruptions, or equipment malfunctions. An appropriate imputation strategy is selected based on the data characteristics, including: forward imputation (using the previous valid value), linear interpolation (calculating the median value based on the preceding and following valid values), historical pattern-based imputation (referencing historical data from similar time periods), or marking as explicit missing (for cases where reliable imputation is not possible). The selection of the imputation strategy considers factors such as data type, the length of the missing interval, and business importance.

[0153] Step 3: Outlier Detection and Correction. Outliers in the identified data are then appropriately processed. For example, various statistical and machine learning methods are used to detect outliers, such as Z-scores (assessing the standard deviation of data points from the mean), local density methods (based on the distance between data points and their neighbors), or bias detection based on historical patterns. Identified outliers may be replaced with estimated values, marked as outliers but retaining the original values, or, in extreme cases, directly filtered out. Correction strategies are typically determined based on the degree of anomaly and business rules.

[0154] Step 4: Time series alignment resolves the issue of timestamp inconsistencies across different data sources. Monitoring data originates from a distributed environment, which may exhibit clock skew, leading to inconsistent timestamps. By analyzing the correlation and event sequence of time series data, time skews are identified and corrected, aligning all data onto a unified timeline. For periodically collected data, the issue of inconsistent sampling intervals can be addressed by using resampling techniques to standardize data from different frequencies to a uniform time granularity.

[0155] Step 5: Data Precision Adjustment. Optimize storage and computation efficiency based on the data's intended use. For historical data, precision may be reduced to save storage space; for key metrics, high precision is maintained to support accurate analysis. Precision adjustment may include operations such as numerical rounding, timestamp precision adjustment, and enumeration value mapping.

[0156] Therefore, through the above data cleaning steps, the raw monitoring data is transformed into high-quality data that conforms to the preset standard data model, thereby improving the reliability of the analysis.

[0157] Furthermore, the cloud center platform performs real-time aggregation on the time-series monitoring data collected at a preset high collection frequency from the standard monitoring data, generating statistical values ​​at different time granularities. Data aggregation is the process of compressing high-frequency, fine-grained data into coarser-grained summaries, effectively balancing data detail with storage and computational efficiency.

[0158] Specifically, real-time aggregation processing is based on a sliding window mechanism, continuously performing statistical calculations on the latest data. Multiple time windows are defined, such as 1 minute, 5 minutes, 1 hour, and 1 day, to calculate aggregation results at different time granularities. For each time window, various statistical indicators are calculated: central tendency measures (such as mean and median) reflect the typical level of the data; dispersion measures (such as standard deviation and interquartile range) reflect the fluctuation of the data; extreme value statistics (such as maximum, minimum, and 95th percentile) capture marginal situations; and change features (such as slope and rate of change) reflect trend information. The aggregation calculation uses efficient single-pass algorithms (such as the Welford algorithm to calculate the mean and variance) and approximate algorithms (such as t-digest to calculate quantiles), which can process infinite data streams with a space complexity of O(1). This embodiment implements an incremental calculation mode, where new data only needs to update the existing aggregation results without reprocessing all historical data.

[0159] To address this, the aggregation results are stored in time-series format, preserving the time dimension of the original data while significantly reducing the data volume. Different aggregation strategies are applied for different types of metrics: count metrics (such as request count and error count) typically use summation aggregation; status metrics (such as CPU utilization and memory usage) typically use average and quantile aggregation; and event metrics (such as failure occurrence) retain the event itself rather than performing numerical aggregation. Therefore, this embodiment, through multi-granularity aggregation, not only preserves detailed data for short-term analysis but also provides long-term trend data for historical comparison and capacity planning, effectively supporting various application scenarios from real-time monitoring to long-term trend analysis.

[0160] Furthermore, the cloud center platform associates standard monitoring data with metadata in a pre-defined configuration management database (CMDB), adding contextual information to each piece of standard monitoring data to generate target monitoring data. Context association is a crucial step in transforming purely technical metrics into information with business meaning, greatly enhancing the value and interpretability of monitoring data.

[0161] The configuration management database (CMDB) is a centralized knowledge base storing IT asset configuration information, containing metadata such as asset identifiers (unique ID, name, type), business attributes (belonging business system, importance level, responsible person), topological relationships (physical connections, logical dependencies), and service dependencies (upstream and downstream services, call relationships). Monitoring data is associated with the metadata in the CMDB through asset identifiers, enriching the context of the monitoring data. For example, the context association process employs a multi-level matching strategy: precise matching is based on direct association using unique identifiers; fuzzy matching searches for the most likely match based on features such as name and IP address; and rule inference derives other attributes from existing attributes based on predefined rules. This embodiment also implements intelligent matching learning, continuously optimizing the matching algorithm through historical successful matching records.

[0162] After the association is completed, target monitoring data with rich context is generated and written to a distributed columnar storage system. Columnar storage is a database architecture optimized for analytical workloads; it organizes data by column rather than by row, making it particularly suitable for storing and querying time-series data. Its main advantages include: efficient data compression (centralized storage of similar data), optimized query performance (reading only the necessary columns), and good scalability (easy horizontal sharding).

[0163] It should be noted that distributed columnar storage systems achieve high availability and scalability through data sharding and replication mechanisms. Data sharding strategies are typically based on time ranges and monitored objects to ensure that related data resides in the same shard, optimizing query performance. This embodiment employs a strong consistency model to guarantee data accuracy and implements a multi-level storage strategy, storing hot data on high-speed storage and migrating cold data to low-cost storage.

[0164] Therefore, through context association and optimized storage, this embodiment ensures that the monitoring data not only includes technical indicators but also carries rich business semantics. The cloud center platform completes the entire processing flow from data reception, verification, cleaning, aggregation to context enrichment, transforming raw monitoring data into high-quality, high-value target monitoring data, thereby improving the accuracy of anomaly detection and alarms.

[0165] In some embodiments, the cloud center platform uses a preset anomaly detection model to detect anomalies in the target monitoring data, uses a preset time series prediction model to predict trends in the target monitoring data, adjusts alarm thresholds through a preset adaptive alarm threshold engine, and compares the anomaly detection results, trend prediction results, the target monitoring data, and the alarm thresholds to generate corresponding alarm information, including:

[0166] The latest target monitoring data is obtained from the distributed columnar storage system. The obtained target monitoring data is then standardized, denoised, feature extracted, and missing value processed, and organized into a feature vector.

[0167] An anomaly detection model is constructed based on a preset isolated forest algorithm. The anomaly detection model is used to identify the feature vector to obtain anomaly detection results. The anomaly detection results include anomaly points and their corresponding anomaly scores, anomaly types, and impact degree evaluation values.

[0168] A time series prediction model is constructed based on a preset autoregressive integral moving average model. The feature vector is input into the time series prediction model, and the feature vector is decomposed into a time series. The time series decomposition result is used to optimize the model parameters of the time series prediction model, and the predicted value of the monitoring data is obtained using the optimized model parameters. The predicted value of the monitoring data within a preset time window is compared with a preset confidence interval to generate a trend prediction result. The time series decomposition result includes time series trend data, seasonal detection results, and residual components. The trend prediction result is used to indicate potential abnormal trends.

[0169] By combining pre-acquired historical data patterns and the current system status, an algorithm combination is used to calculate the alarm threshold of the monitoring indicators. The algorithm combination consists of at least two of the following: a pre-set historical quantile algorithm, a periodic pattern modeling algorithm, a load-related adjustment algorithm, and a fluctuation sensitivity adaptive algorithm.

[0170] When the anomaly detection result, the trend prediction result, and / or the target monitoring data meet at least one alarm condition, a corresponding alarm event is generated. Multi-source information fusion analysis is then performed on the anomaly detection result, the trend prediction result, and the alarm threshold, combining the topological relationships and service dependency information between monitored objects, to obtain the alarm content of the alarm event. The alarm conditions include an anomaly score in the anomaly detection result exceeding a preset anomaly threshold, an anomaly change trend within a preset time window indicated by the trend prediction result exceeding a preset change threshold, and the target monitoring data exceeding the alarm threshold. The alarm content includes an anomaly object identifier, the root cause of the alarm, relevant data of the monitoring indicators, the anomaly score, processing priority, and a suggested processing solution.

[0171] In this embodiment, the cloud center platform first obtains the latest target monitoring data from the distributed columnar storage system. The obtained target monitoring data is then standardized, denoised, feature-extracted, and missing value processed, organized into feature vectors. Data preparation is a fundamental step in machine learning and anomaly detection, significantly impacting model performance. It should be noted that standardization is the process of converting indicators with different dimensions and ranges to a uniform scale, ensuring that the importance of different indicators is not imbalanced due to different numerical ranges. For example, commonly used standardization methods include: Min-Max standardization linearly scales data to the [0,1] or [-1,1] interval; Z-score standardization converts data into a distribution with a mean of 0 and a standard deviation of 1; Robust standardization scales based on quantiles and is insensitive to outliers. The system automatically selects the appropriate standardization method based on the data distribution characteristics.

[0172] The denoising process aims to reduce random fluctuations in the data and highlight the true signal. Multiple denoising techniques are employed: moving averages (simple, weighted, or exponential) smooth short-term fluctuations; wavelet transform denoising filters high-frequency noise while preserving signal characteristics; and Kalman filtering combines the system's dynamic model with measurement data to provide optimal estimates. The denoising level is dynamically adjusted according to the data type and analysis objectives, achieving a balance between smoothing noise and preserving signal characteristics.

[0173] Feature extraction is the process of deriving useful information from raw monitoring data, significantly improving the model's recognition capabilities. This embodiment generates multiple types of features: statistical features (such as mean, variance, kurtosis, and skewness) describe the data's distribution characteristics; time-domain features (such as peak count, zero-crossing rate, and autocorrelation coefficient) capture time patterns; frequency-domain features (extracted through Fourier transform or wavelet transform) identify periodicity and frequency characteristics; morphological features (such as slope, curvature, and shape indices) describe curve morphology; and contextual features (such as correlation with relevant indicators and system load characteristics) provide environmental information. The feature extraction process employs specialized feature engineering strategies based on different types of monitoring indicators (such as CPU, memory, network, and application indicators).

[0174] Missing value handling builds upon the aforementioned data cleaning and further optimizes for machine learning needs. Complete feature vectors are crucial for model training and inference. This embodiment employs multiple missing value imputation methods: statistical imputation (such as mean, median, and mode) is simple and efficient; model imputation (such as KNN and random forest) considers the relationships between features; and multiple imputation generates multiple possible imputation values ​​to assess uncertainty. This embodiment records the location of missing values, enabling the model to account for data uncertainty.

[0175] Therefore, through the above processing steps, the original monitoring data in this embodiment is converted into well-structured and information-rich feature vectors, providing high-quality input for subsequent anomaly detection and trend prediction.

[0176] Subsequently, the cloud center platform constructs an anomaly detection model based on a pre-defined Isolation Forest algorithm, and uses this model to identify the feature vectors to obtain anomaly detection results. Isolation Forest is an efficient unsupervised anomaly detection algorithm, particularly suitable for high-dimensional data and large-scale monitoring scenarios. Its core idea is that anomalies are more easily "isolated" due to their scarcity and difference from normal data.

[0177] It should be noted that the Isolation Forest algorithm achieves anomaly detection by constructing multiple isolation trees. Each tree recursively partitions the data space by randomly selecting features and split points until a single data point is isolated or the maximum depth is reached. Anomalies can usually be isolated at a shallower tree depth, while normal points require more splits. The algorithm calculates anomaly scores for each data point, defined as a function of the average isolation depth; a higher score indicates a greater likelihood of an anomaly. Optionally, several optimizations can be introduced in the implementation of the Isolation Forest algorithm: adaptive sampling dynamically adjusts the subset size according to the data distribution; feature importance weighting increases the selection probability of key features; multi-scale analysis captures anomalies at different time scales by varying the window size; and ensemble strategies combine model results from multiple parameter configurations to improve stability and accuracy.

[0178] In this embodiment, the anomaly detection model is incrementally updated periodically with the latest data to adapt to the evolution of system behavior. The update strategy is based on concept drift detection, triggering model retraining when the behavior pattern of the monitored object changes significantly. This embodiment also implements model performance monitoring, maintaining detection quality through expert feedback and periodic evaluation. After applying the anomaly detection model, anomaly detection results can be obtained, including anomaly points and their corresponding anomaly scores (indicating the degree of anomaly), anomaly types (such as sudden anomalies, gradual anomalies, and periodic anomalies), and impact assessment values ​​(indicating the potential impact of the anomaly on the system). These rich anomaly features provide a refined decision-making basis for subsequent alarm generation.

[0179] Furthermore, the cloud center platform constructs a time series forecasting model based on a pre-defined Autoregressive Integral Moving Average (ARIMA) model to predict future trends in the monitored data. ARIMA is a classic time series forecasting method that can capture the autocorrelation, trend, and seasonality characteristics of data, making it suitable for forecasting various monitoring indicators. For example, the ARIMA model consists of three core components: the Autoregressive (AR) part models the relationship between current and historical values; the Integral (I) part transforms non-stationary time series into stationary series through differencing; and the Moving Average (MA) part models the relationship between current values ​​and historical error terms.

[0180] In this embodiment, the feature vector is input into the time series prediction model. First, the feature vector is decomposed into time series components, breaking down the original time series into multiple components: the trend component reflects the long-term direction of change; the seasonal component captures periodic patterns (such as daily, weekly, or monthly cycles); and the residual component contains random fluctuations and irregular changes. The decomposition employs classical methods (such as STL decomposition) or modern methods (such as MSTL supporting multiple seasonalities).

[0181] Subsequently, the parameters of the time series forecasting model are optimized using the decomposition results. For the trend component, lower-order differencing and autoregressive parameters may be used; for the seasonal component, a seasonal ARIMA component or Fourier terms may be added; for the residual component, the moving average parameter is adjusted to capture short-term correlations. Parameter optimization employs grid search, the AIC / BIC criterion, or automated methods (such as auto.arima).

[0182] Therefore, the optimized model is used to predict monitoring data values ​​within a future time window, typically ranging from minutes to hours or days, depending on the characteristics of the monitoring indicators and business needs. The prediction result includes a point prediction value and a confidence interval, representing the range of uncertainty in the prediction. The predicted value is compared with the preset confidence interval. When the predicted trajectory exceeds the normal range or shows a clear abnormal trend, a trend prediction result is generated, indicating potential abnormal trends such as resource exhaustion risk, performance degradation trends, or impending periodic anomalies. Therefore, this embodiment can provide early warnings before problems actually occur.

[0183] Furthermore, the cloud center platform combines pre-acquired historical data patterns with the current status and uses a combination of algorithms to calculate alarm thresholds for monitoring indicators. This embodiment overcomes the limitations of traditional static thresholds by using adaptive alarm thresholds, enabling dynamic adjustment of judgment criteria based on environmental changes. It should be noted that the algorithm combination consists of multiple threshold calculation methods: the historical quantile algorithm, based on the statistical distribution of historical data, uses specific quantiles (such as the 95th or 99th percentile) as the threshold benchmark, adapting to the overall distribution characteristics of the data; the periodic pattern modeling algorithm identifies periodic patterns in time series (such as daily, weekly, and monthly variations), setting different thresholds for different time periods to solve the false alarm problem caused by periodic changes in business load; the load-related adjustment algorithm considers the correlation between system load and monitoring indicators, appropriately relaxing thresholds under high load and tightening standards under low load to adapt to workload changes; and the volatility sensitivity adaptive algorithm assesses the inherent volatility of indicators, setting a wider tolerance range for highly volatile indicators and using stricter standards for stable indicators.

[0184] Furthermore, the weights of the algorithm combination are dynamically adjusted based on the metric type, historical accuracy, and current environment. This embodiment implements a meta-learning mechanism, continuously optimizing the weights and parameters of each algorithm by analyzing the accuracy of historical alarms. Threshold calculation not only considers the historical behavior of individual metric but also incorporates the status of related metrics and the overall health of the system, achieving context-aware intelligent thresholding.

[0185] Therefore, the calculated adaptive thresholds typically include multiple levels (such as warning, critical, and emergency levels), forming a tiered alarm mechanism. This embodiment also maintains a historical record of the thresholds, supporting auditing and retrospective analysis of threshold adjustments. This refined threshold management significantly reduces the false alarm rate while maintaining high sensitivity to genuine anomalies.

[0186] Furthermore, when the cloud center platform detects that anomaly detection results, trend prediction results, and / or target monitoring data meet at least one alarm condition, it generates a corresponding alarm event and performs multi-source information fusion analysis by combining the topological relationships and service dependency information between monitored objects to obtain the alarm content of the alarm event. Specifically, alarm conditions include multiple triggering mechanisms: the anomaly score in the anomaly detection result exceeds a preset anomaly threshold, indicating that the current data point significantly deviates from the normal pattern; the abnormal change trend indicated in the trend prediction result within a preset time window exceeds a preset change threshold, warning of potential future problems; and the target monitoring data exceeds an adaptive alarm threshold, directly triggering a threshold-based alarm. This multi-dimensional alarm judgment mechanism ensures comprehensive coverage of various anomalies by the system. Once an alarm condition is triggered, a preliminary alarm event is generated, containing basic anomaly information. Subsequently, this embodiment performs multi-source information fusion analysis, which is a key step in transforming isolated alarms into valuable problem diagnoses. The multi-source information fusion combines the topological relationships and service dependency information between monitored objects for in-depth analysis. This embodiment considers the following factors: topology analysis identifies multiple alarms from the same or related components, revealing potential common root causes; service dependency analysis traces the propagation path of problems in the service call chain, distinguishing between root causes and chain reactions; temporal correlation analysis examines the temporal order of alarms to determine the causal chain of events; and pattern matching compares the current alarm combination with known problem patterns to quickly identify common fault types.

[0187] Therefore, this embodiment generates rich alarm content through comprehensive analysis, including anomaly object identifier (uniquely identifying the affected component), alarm root cause (the source of the problem based on causal analysis), relevant data of monitoring indicators (history and context of indicators supporting diagnosis), anomaly score (quantifying the degree of anomaly), processing priority (based on business impact assessment), and suggested handling solutions (handling guidance for identified problems). This embodiment improves the operability of alarms by generating intelligent alarm content, enabling operations and maintenance personnel to quickly understand the essence of the problem and take effective remedial measures. This embodiment also supports automatic alarm classification, routing, and escalation, ensuring that critical issues are addressed promptly. In summary, the cloud center platform realizes a complete intelligent analysis process from data acquisition, anomaly detection, trend prediction, threshold calculation to alarm generation, significantly improving the accuracy, foresight, and operability of alarms, providing strong protection for the stable operation of IT systems.

[0188] In some embodiments, associating the standard monitoring data with metadata in a preset configuration management database and adding context information to each piece of standard monitoring data includes:

[0189] The dependencies and interaction patterns between the monitored objects are modeled to construct a multi-level directed graph topology model. Each node in the multi-level directed graph topology model represents the monitored object, and the edges in the multi-level directed graph topology model represent one or more of the following relationships between the monitored objects: physical layer device connection relationship, network layer communication relationship, application layer service call relationship, and business layer process dependency.

[0190] Based on a pre-defined directed q-analysis algorithm, q+1 related monitoring objects in the multi-level directed graph topology model are grouped into a q-dimensional simplex. All q-dimensional simplexes are combined into a simplex complex, and the Betti number is calculated to extract the skeleton structure of the multi-level directed graph topology model. This allows the structural characteristics of the monitoring network where the monitoring object is located to be determined based on the simplex complex, the Betti number, and the skeleton structure. Here, q≥1, the Betti number is used to evaluate the topological connectivity of the multi-level directed graph topology model, and the skeleton structure is used to describe the critical paths and node sets of the topology of the monitoring network. The structural characteristics include critical nodes, highly dependent areas, potential bottlenecks, and redundant paths.

[0191] The time dimension is introduced into the structural features. An analysis time window is determined based on the change frequency of the monitored object. The topology structure at different time points in the analysis time window is compared to identify topological changes. The evolution rate of the topology structure over time is calculated based on the topological changes. High-change regions and stable regions are identified based on the evolution rate and the topological changes. Corresponding resource optimization allocation strategies are generated for the high-change regions and the stable regions. The resource optimization allocation strategies are used to indicate increasing the sampling frequency of the high-change regions and decreasing the analysis frequency of the stable regions.

[0192] Based on the structural characteristics and the resource optimization allocation strategy, a topology criticality index is calculated for each monitored object, the impact propagation path of each potential fault point is calculated, and the monitoring granularity of the monitored object is adjusted according to the topology criticality index, the impact propagation path and the structural characteristics. Redundant paths in the monitoring network are marked according to the structural characteristics. The topology criticality index includes centrality, bridging value and impact range.

[0193] The standard monitoring data, structural features, resource optimization allocation strategy, topological criticality index, impact propagation path, monitoring granularity, and the monitoring network after marking the redundant paths are fused to generate context information.

[0194] In this embodiment, the dependencies and interaction patterns between monitored objects are first modeled to construct a multi-level directed graph topology model. The aim is to create a comprehensive digital twin network that accurately maps the complex relationships between components in the IT environment. A multi-level directed graph topology model is a mathematical structure composed of nodes and directed edges, capable of representing system components at different levels and their interaction relationships. In this model, nodes represent monitored objects, which can be physical devices (such as servers and network devices), virtual resources (such as virtual machines and containers), software components (such as application processes and microservices), or business functions (such as transaction processing and user login). Each node contains multiple attributes, such as identifier, type, status, performance metrics, and configuration parameters.

[0195] It should be noted that directed edges represent the relationships between monitored objects and are divided into multiple layers: physical layer device connection relationships describe the physical connections between hardware devices, such as network cable connections and connections between servers and storage devices; network layer communication relationships represent communication paths at the network protocol level, including IP routing, VLAN configuration, firewall rules, etc.; application layer service call relationships describe the interactions between software components, such as microservice calls, API dependencies, and data access patterns; and business layer process dependencies represent the logical dependencies between business functions, such as order processing depending on inventory query and payment services.

[0196] The topology modeling process integrates multiple data sources: proactive discovery acquires connection information through network scanning and probing; passive monitoring identifies interaction patterns through traffic analysis and log parsing; a configuration management database provides pre-configured dependencies; application performance monitoring captures real-time call relationships; and a change management system provides the topology change history. The system uses a graph database to store the topology model, supporting efficient relation query and traversal operations.

[0197] Therefore, this embodiment, through multi-level modeling, not only captures the static structure of the IT system, but also reflects the dynamic interactions between components, providing a comprehensive contextual view for subsequent analysis.

[0198] Subsequently, based on a pre-defined directed q-analysis algorithm, a deep analysis of the multi-level directed graph topology model is performed to extract key structural features. Directed q-analysis is an advanced network analysis method derived from algebraic topology, capable of identifying high-dimensional structures and hidden patterns in networks, and is particularly suitable for analyzing the topological characteristics of complex systems. It should be noted that directed q-analysis is used to group q+1 interconnected monitoring objects in the network into a q-dimensional simplex, similar to a geometric concept in mathematics. For example, when q=1, the simplex is a simplex with an edge connecting two nodes; when q=2, the simplex is a triangle composed of three nodes; and so on. All q-dimensional simplexes are combined to form a simplex complex, forming a high-dimensional representation of the original network structure.

[0199] It should be noted that the Betti number is calculated to evaluate the connectivity of the topology. For example, the k-th Betti number represents the number of k-dimensional "holes," such as the 0th Betti number representing the number of connected components and the 1st Betti number representing the number of loops, reflecting the global connectivity and redundancy of the network.

[0200] In this embodiment, the skeleton structure of the multi-level directed graph topology model is also extracted, that is, the smallest subgraph that can preserve the key characteristics of the original topology. Skeleton extraction uses edge centrality measurement and filtering algorithms to retain edges with high centrality while maintaining overall connectivity. The skeleton structure describes the critical paths and node sets of the monitoring network topology, which helps in understanding information flow and dependency chains. Based on the simplex complex, Betti number, and skeleton structure, this embodiment determines the structural characteristics of the monitoring network where the monitored object resides. For example, these characteristics include: critical nodes (nodes with high centrality in the network or located at the intersection of multiple paths), high-dependency regions (network sub-regions with dense dependencies between components), potential bottlenecks (narrow channels connecting different sub-networks, which may become performance or reliability bottlenecks), and redundant paths (paths that provide backup connections when the main path fails).

[0201] Therefore, this embodiment, through topology analysis, surpasses traditional network graph analysis and can identify key structures and potential risk points in complex systems, providing a scientific basis for monitoring strategy optimization and fault impact assessment.

[0202] Furthermore, by introducing the time dimension into structural features, this embodiment analyzes the temporal evolution of the topology, identifies change patterns, and optimizes resource allocation, thereby extending static network analysis into dynamic spatiotemporal analysis and capturing the system's changing characteristics over time.

[0203] Specifically, the analysis time window is first determined based on the frequency of changes to the monitored objects. Different types of components have different change characteristics: network devices and physical servers typically change slowly and can use longer time windows; virtual resources and containers change rapidly and require shorter time windows; microservices and application components change more frequently and may require time windows on the order of minutes. Next, the topology structure at different points in the analysis time window is compared to identify topology changes. The change detection algorithm calculates the differences between consecutive topology snapshots, including node additions and removals, edge changes, and attribute updates. This embodiment not only records change events but also analyzes change patterns, such as typical behavioral patterns like scaling up / shrinking, migration / reorganization, and version upgrades.

[0204] In this embodiment, based on detected topology changes, the evolution rate of the topology over time is calculated, quantifying the degree of change in different regions. The evolution rate can be comprehensively evaluated using indicators such as node change rate, edge change rate, and attribute change rate. By analyzing the evolution rate and topology change patterns, high-change regions and stable regions are identified. High-change regions are network parts with frequently changing topologies, such as elastically scalable microservice clusters; stable regions are parts with relatively fixed topologies, such as core databases or basic networks.

[0205] This embodiment generates corresponding resource optimization allocation strategies for high-variability and stable regions. For high-variability regions, the strategy instructs increasing the sampling frequency to ensure the capture of rapidly changing dynamic characteristics; it may also increase data collection points to improve monitoring coverage; and it may adjust anomaly detection parameters to adapt to the highly variable environment. For stable regions, the strategy instructs reducing the analysis frequency to reduce unnecessary computational overhead; it may merge data points to reduce storage space; and it may also adopt stricter anomaly detection standards to improve alarm accuracy.

[0206] Therefore, this embodiment enables the monitoring system to intelligently allocate limited resources through a time-evolution-based resource optimization strategy, providing high-precision monitoring in critical change areas while avoiding wasting resources in stable areas, thus significantly improving overall monitoring efficiency.

[0207] Subsequently, based on the aforementioned structural characteristics and resource optimization allocation strategies, the topological criticality index is further calculated, the impact propagation path is analyzed, and the monitoring granularity is adjusted accordingly to transform network topology analysis into specific monitoring strategy optimization and achieve precise resource allocation.

[0208] This embodiment calculates a topological criticality index for each monitored object to quantify its importance in the network. For example, criticality indices include: centrality, which measures a node's core position in the network and can be calculated using various algorithms, such as degree centrality (number of direct connections), betweenness centrality (frequency of nodes on the shortest path), and eigenvector centrality (a recursive measure considering the importance of adjacent nodes); bridging value, which assesses a node's role as a connection point between different sub-networks, with nodes having high bridging values ​​being key "bridges" in the network; and influence range, which measures the number of other nodes that a node's failure may affect, calculated by simulating fault propagation.

[0209] In this embodiment, the impact propagation path of each potential failure point is calculated, simulating how the failure spreads within the system. The impact propagation analysis is based on a propagation model on a directed graph, considering the strength of dependencies, redundancy, and fault tolerance between nodes. This embodiment considers various failure scenarios, including single-point failures, cascading failures, and compound failures, assessing the potential impact range and severity of failures in different components.

[0210] Based on the topological criticality indicators, impact propagation paths, and structural characteristics of the monitored objects, this embodiment dynamically adjusts the monitoring granularity. For high-criticality nodes (such as core routers, critical services, or central databases), the number of monitoring indicators may be increased, the sampling frequency increased, and the alarm threshold lowered to ensure the highest level of monitoring coverage. For medium-criticality nodes, a standard monitoring configuration is adopted to balance resource consumption and monitoring effectiveness. For low-criticality nodes, the number of monitoring indicators may be reduced, the sampling frequency decreased, and the alarm threshold increased to conserve monitoring resources. Furthermore, redundant paths in the monitoring network are marked based on structural characteristics; these are paths that can provide backup connections when the main communication path fails. Redundant path marking helps the system understand the network's resilience and provides alternative monitoring paths when the main path is abnormal. Redundant paths may be monitored at a low frequency under normal circumstances, but the monitoring level is quickly increased when the main path encounters problems.

[0211] Therefore, this embodiment, through a key-based refined monitoring strategy, can concentrate limited monitoring resources on the most critical components while maintaining reasonable coverage of the entire network, significantly improving monitoring efficiency and fault detection capabilities.

[0212] Furthermore, standard monitoring data is fused with the structural characteristics, resource optimization allocation strategies, topological criticality indicators, impact propagation paths, monitoring granularity, and the monitoring network after marking redundant paths obtained from the aforementioned analysis. This generates rich contextual information, which is used to transform the raw monitoring data into intelligent information with business significance. The data fusion process is based on a semantic integration framework, unifying data from different sources and formats into a consistent knowledge model. This embodiment uses a graph data model to store the fused data, using attribute graphs or RDF triples to represent monitoring objects, attributes, and relationships. This graph structure is naturally suitable for expressing complex relationships and hierarchical structures.

[0213] Subsequently, the fused contextual information greatly enriches the semantics of the original monitoring data. Each monitoring data point is no longer an isolated technical indicator, but rather a comprehensive information containing rich business and technical context. The contextual information includes: static attributes of the monitored object (such as device type, version, configuration parameters); business attributes (such as the business system to which it belongs, importance level, responsible team); relationship information (such as dependent services, upstream and downstream components, and cluster); topological location (such as network location, architecture level, and deployment environment); historical behavior (such as baseline performance, change patterns, and historical events); and various advanced features obtained from the aforementioned analysis (such as criticality indicators and change characteristics).

[0214] Optionally, this embodiment also implements a dynamic context update mechanism, automatically refreshing relevant context information as the monitored object's state changes, topology is adjusted, or business attributes are updated. Context data employs a multi-level caching strategy, keeping frequently accessed data in memory to ensure query performance; simultaneously, persistent storage is maintained to ensure data durability and consistency. Through this deep context data fusion, a global view and deep understanding of the IT environment are obtained, enabling the interpretation of monitoring data from both business and technical dimensions, significantly improving the accuracy and interpretability of anomaly detection. Context-rich monitoring data supports more accurate root cause analysis, more effective fault location, and more intelligent alarm handling, forming the foundation for advanced AI-driven monitoring.

[0215] Therefore, this embodiment completes the entire process from basic topology modeling to advanced context fusion, transforming raw monitoring data into intelligent information with rich semantics, providing strong context support for anomaly detection and alarm generation, and significantly improving the intelligence level and business value of the entire monitoring system.

[0216] In some embodiments, the process of performing data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression on the transformed original monitoring data to obtain the monitoring data to be processed includes:

[0217] An energy and information model is established for each monitoring indicator and processing operation. The energy and information model is used to indicate the degree of contribution of the monitoring indicator to anomaly detection and system status assessment, determine the information value score corresponding to the degree of contribution, quantify the energy consumption of data acquisition, local processing computing, data transmission network, and storage operation, and construct the energy-information trade-off curve corresponding to the monitoring task to identify the optimal operating point.

[0218] Based on the energy and information model, the sampling frequency is adjusted according to the historical fluctuation pattern of the monitoring indicators, the current operating level of the indicators, and the importance of the business. A processing task priority queue is established, and computing resources are reserved for the specified key indicators. This allows the simulation of the behavior characteristics of the specified memristor to allocate resources based on the adjusted sampling frequency, the processing task priority queue, and the reserved computing resources.

[0219] The data precision adjustment strategy is determined based on the preset information value, and a compression optimization strategy is generated using the specific characteristics of the transformed original monitoring data. The data precision adjustment strategy is used to indicate that the preset high precision is maintained for high-value indicators and the bit width or precision is reduced for low-value indicators. The compression optimization strategy is used to indicate that the corresponding time-series compression algorithm is applied to the time-series data in the transformed original monitoring data, key change points are retained, and the compression degree of stable areas is increased.

[0220] Based on the data value of the transformed original monitoring data, the network status and energy level of the monitoring network, a transmission scheduling strategy is determined and a multi-level data transmission strategy is established. The transmission scheduling strategy is used to indicate that high-value data is transmitted first and non-critical data is transmitted in batches with delayed transmission. The multi-level data transmission strategy is used to indicate that critical anomalies are transmitted in real time, important indicators are transmitted in batches periodically, and baseline data is transmitted in large batches at low frequency.

[0221] Energy efficiency is assessed for each monitoring task, and resource allocation is optimized based on a global view. Task sharing among multiple edge nodes is coordinated to obtain the monitoring data to be processed.

[0222] In this embodiment, an energy and information model is first established for each monitoring indicator and processing operation, combining information theory with energy efficiency to guide data acquisition and processing strategies. The energy and information model is a mathematical model used to quantify the relationship between data value and resource consumption in the monitoring system, providing a scientific basis for resource allocation decisions. In this model, information value analysis focuses on evaluating the contribution of monitoring indicators to anomaly detection and system status assessment. This embodiment quantifies the information value of indicators through multiple methods: information entropy calculation analyzes the uncertainty and information content of indicators; correlation analysis assesses the correlation between indicators and system status or fault events; anomaly detection contribution measures the importance of indicators in historical anomaly identification; and business impact assessment judges the importance of indicators based on their correlation with key business functions. Therefore, this embodiment assigns an information value score to each monitoring indicator based on the above analysis, with a high score indicating that the indicator makes a significant contribution to system status assessment.

[0223] It should be noted that energy consumption analysis focuses on quantifying resource consumption during the monitoring process. This embodiment meticulously assesses energy consumption at each stage: data acquisition energy consumption includes sensor power consumption, the impact of acquisition frequency, and the efficiency of the acquisition method; local processing computing energy consumption considers CPU usage, memory usage, and computational complexity; data transmission network energy consumption depends on data volume, transmission distance, and network protocol efficiency; storage operation energy consumption is related to storage capacity, access frequency, and storage medium type. This energy consumption data is obtained through a combination of actual measurements and theoretical models, forming a complete energy profile.

[0224] Based on information value and energy consumption data, this embodiment constructs an energy-information tradeoff curve, a visualization tool that shows the relationship between information acquisition and energy consumption under different operating strategies. Each point on the curve represents a possible monitoring configuration (such as a combination of sampling frequency, processing depth, and transmission strategies), with the horizontal axis representing energy consumption and the vertical axis representing information value. By analyzing this curve, the system can identify the optimal operating point—at which the marginal information gain equals the marginal energy cost, achieving an optimal balance in resource utilization. Therefore, this embodiment, through the energy and information model, can theoretically understand and optimize the allocation of monitoring resources, significantly improving the resource utilization efficiency of the entire monitoring system.

[0225] Subsequently, based on the energy and information model, this embodiment implements a dynamic resource allocation strategy, intelligently adjusting resource usage according to data characteristics and business importance, thus transforming the theoretical model into a practical operational strategy. Specifically, the sampling frequency is first adjusted based on the historical fluctuation patterns of monitoring indicators, the current indicator performance level, and business importance. The historical fluctuation patterns are derived through time series analysis, including characteristics such as rate of change, periodicity, and suddenness; the current indicator performance level indicates how close the indicator value is to the normal range boundary, with indicators approaching the boundary potentially requiring closer monitoring; business importance is determined based on business impact analysis, reflecting the correlation between the indicator and key business functions. The sampling frequency adjustment follows an adaptive principle: increasing the sampling frequency for indicators with severe fluctuations, approaching thresholds, or those critical to the business; decreasing the sampling frequency for stable, normal, or non-critical indicators; and simultaneously considering the load differences between day and night, and between weekdays and non-weekdays, to achieve time-dimensional adaptation.

[0226] In this embodiment, a priority queue for processing tasks is established to prioritize and allocate resources to monitoring data processing tasks. Queue management is based on a multi-level feedback queue algorithm, combining task urgency (e.g., severity of anomalies, time sensitivity) and importance (e.g., business impact, probability of anomalies) scores. High-priority tasks receive priority processing rights and more computing resources, ensuring that critical data can be processed in a timely manner. Therefore, the dynamic queue adjustment mechanism can automatically adjust the queue structure and processing strategy according to load and data flow characteristics.

[0227] Furthermore, computing resources are reserved for designated key metrics. Resource isolation technologies (such as container limitations and CPU affinity settings) are used to reserve minimum guaranteed resources for critical monitoring tasks, ensuring that the processing of key metrics is not affected even under high load conditions. Therefore, by configuring reservation policies based on risk assessment and business continuity requirements, resource guarantees are typically provided for the most critical infrastructure and core business service metrics.

[0228] In this embodiment, a memristor simulation model is used to guide resource allocation. A memristor, the fourth basic circuit element after resistors, capacitors, and inductors, has the ability to "memorize" the history of current flow. This embodiment uses software to simulate the behavior of memristors, providing insights for resource allocation decisions. The simulation model "memorizes" historical resource usage patterns and predicts future needs based on past resource demands, enabling proactive adjustments to resource allocation. This bio-inspired computational model is particularly suitable for handling time-dependent resource allocation problems, improving the system's adaptability to load changes. Therefore, this embodiment, through a dynamic resource allocation strategy, can intelligently allocate computing and network resources, optimizing overall resource utilization efficiency while ensuring critical monitoring functions.

[0229] Furthermore, this embodiment determines a data precision adjustment strategy based on preset information value and generates a compression optimization strategy using the specific characteristics of the transformed original monitoring data. Differentiated processing strategies are adopted for data of different values ​​to optimize data storage and transmission efficiency. It should be noted that the data precision adjustment strategy is a resource optimization mechanism based on data value. For high-value indicators, a preset high precision is maintained to ensure data quality is not affected. These indicators are typically related to critical system functions, frequent anomaly detection, or high business impact, requiring accurate data to support decision-making. Specifically, this may involve retaining the original precision (e.g., all significant bits of a floating-point number), using high-precision timestamps (milliseconds or microseconds), and complete metadata. For low-value indicators, the bit width or precision is reduced to decrease data storage and processing overhead. This may include rounding (e.g., retaining fewer decimal places), reducing timestamp precision (seconds), simplifying metadata, or using more compact data types (e.g., converting double-precision floating-point to single-precision). Precision adjustment follows a recoverable principle, ensuring that even after precision reduction, the data still meets basic analytical needs and important features are not lost.

[0230] In this embodiment, the compression optimization strategy fully utilizes the specific characteristics of monitoring data to achieve more efficient data compression. Time-series data is the main data type of monitoring systems, characterized by continuity, periodicity, and local stability. This embodiment applies specialized time-series compression algorithms to time-series data, such as incremental coding (storing the difference between adjacent values ​​rather than absolute values), run-length encoding (compressing repeating value sequences), and predictive coding (storing the deviation between actual and predicted values). These algorithms are more suitable for time-series data than general compression algorithms and can achieve higher compression ratios.

[0231] Optionally, this embodiment also implements an adaptive compression strategy, preserving key change points and increasing compression levels in stable regions. Key change points are moments of significant data change, such as abrupt changes, trend reversals, or increased volatility. These points are crucial for understanding system behavior and require high-precision preservation. This embodiment identifies these key points using rate-of-change analysis, inflection point detection, and anomaly identification algorithms, allocating more storage resources to them. Conversely, stable regions are periods of minimal or simple data change, where more aggressive compression can be applied. This could involve replacing original data points with mathematical models (such as linear functions or polynomial fitting) or significantly reducing the sampling rate to retain only representative samples. Therefore, this embodiment, by configuring a data optimization strategy, significantly reduces data storage and transmission volume while ensuring data quality, thereby improving overall efficiency.

[0232] Furthermore, this embodiment determines the transmission scheduling strategy based on the data value of the converted original monitoring data, the network status of the monitoring network, and the energy level, and establishes a multi-level data transmission strategy to optimize the data transmission process from the edge to the center, balancing real-time requirements and resource constraints. Specifically, the transmission scheduling strategy dynamically determines the priority and timing of data transmission based on data value and system status. Prioritizing the transmission of high-value data ensures that critical information reaches the processing center in a timely manner, supporting rapid decision-making. This embodiment performs real-time evaluation of data value, considering factors such as the importance of indicators, the probability of anomalies, the significance of changes, and business relevance. Data packets with higher scores receive priority processing in the transmission queue and may use reserved bandwidth channels. Non-critical data adopts a batch delayed transmission strategy to reduce transmission frequency and optimize network resource utilization. This embodiment may batch transmit accumulated non-critical data during periods of low network load (such as at night) or dynamically increase the transmission rate when sufficient bandwidth is detected.

[0233] Optionally, transmission scheduling also considers network conditions and energy levels to achieve context-aware adaptive transmission. This embodiment continuously monitors network quality parameters (such as bandwidth, latency, and packet loss rate) and edge node energy status (such as battery level and power consumption). Under resource constraints, it prioritizes the transmission of critical data and may reduce data resolution or increase local processing to alleviate the transmission burden. In extreme cases (such as severe network congestion or extremely low energy), an emergency mode may be activated, transmitting only the most critical abnormal event data.

[0234] It should be noted that the multi-level data transmission strategy is a hierarchical transmission framework that employs different transmission mechanisms for different types and levels of urgency of data. Real-time transmission of critical anomalies is the highest priority category, used to transmit data indicating serious system problems. This type of data is sent immediately using reliable real-time transmission protocols (such as MQTT and WebSockets), possibly with the aid of message queues to ensure delivery, and may trigger proactive push notifications. Periodic batch transmission of important metrics is used for key metrics in routine monitoring. Data is sent in batches at predetermined intervals (such as every minute or every five minutes) to balance real-time performance and efficiency. Large-volume, low-frequency transmission of baseline data is used for historical trend analysis and benchmark comparisons. It may be transmitted in batches hourly or daily, typically using high compression rates and error recovery mechanisms to ensure integrity rather than real-time performance.

[0235] Optionally, this embodiment also implements an intelligent backhaul mechanism to automatically retransmit lost data after a network outage. During network unavailability, edge nodes cache data in local storage and maintain a transmission status log, recording sent and pending data packets. After network recovery, this embodiment determines retransmission priority based on data value and timeliness, potentially discarding outdated, non-critical data and focusing on retransmitting historical data that still has analytical value.

[0236] Therefore, this embodiment improves network resource utilization efficiency through a refined transmission strategy, while ensuring the real-time performance and reliability of key monitoring functions.

[0237] Furthermore, this embodiment performs energy efficiency assessment on each monitoring task and optimizes resource allocation based on a global view, coordinating task sharing among multiple edge nodes to ultimately obtain efficiently processed monitoring data. This achieves system-level resource optimization and ensures maximum overall monitoring efficiency. Energy efficiency assessment is a comprehensive evaluation of the resource utilization efficiency of monitoring tasks. This embodiment calculates energy efficiency indicators for each monitoring task, measuring the information value generated per unit of energy consumption. The calculation formula typically considers multiple factors: information gains (such as improved anomaly detection accuracy and reduced prediction errors), resource consumption (computing, storage, network transmission, and energy), and business impact weights. Through these indicators, this embodiment can identify efficient and inefficient monitoring tasks, providing a basis for resource reallocation.

[0238] Global view optimization is a resource allocation strategy based on the overall state. Unlike local optimization, global optimization considers the resource status, task load, and network connectivity of all edge nodes and the central platform to seek a globally optimal solution. This embodiment maintains a dynamic resource mapping that reflects the computing power, storage space, network status, and energy level of each node in real time. Optimization algorithms (such as multi-objective evolutionary algorithms and heuristic search) use this mapping to find resource allocation schemes that balance multiple objectives: maximizing key indicator coverage, minimizing energy consumption, ensuring response time, and optimizing network utilization. The optimization process considers various constraints, such as the upper limit of node computing power, network bandwidth limitations, and battery life requirements.

[0239] Multi-edge node task sharing is a key mechanism for improving system resilience and efficiency. In a distributed monitoring environment, adjacent edge nodes can collaborate to complete monitoring tasks. This embodiment implements multiple collaboration modes: load balancing transfers some tasks from high-load nodes to low-load nodes; redundant monitoring allows multiple nodes to monitor the same critical object, improving reliability; functional division assigns different types of tasks based on node characteristics, such as nodes with strong computing power handling complex analysis, and nodes with good network conditions handling data relay. The task allocation strategy is dynamically adjusted to respond to changes in node status, network condition fluctuations, and task priority changes.

[0240] Optionally, this embodiment also implements adaptive energy management, adjusting monitoring strategies based on energy supply conditions. For battery-powered edge nodes, this embodiment dynamically adjusts the operating mode according to the power level: a full monitoring mode is used when the power is sufficient; non-critical tasks are gradually reduced and the monitoring cycle is extended when the power decreases; and a minimized mode is entered when the power is critical, retaining only the most essential functions. This embodiment may also adjust the work plan in advance based on energy forecasts (such as solar power supply patterns and peak electricity consumption periods) to achieve proactive resource management based on energy awareness.

[0241] Therefore, this embodiment achieves the most efficient utilization of monitoring resources through global energy efficiency optimization, minimizing resource consumption while ensuring monitoring quality, and generating high-quality, low-overhead monitoring data to be processed, providing a reliable foundation for subsequent analysis. Thus, this embodiment constitutes a complete energy sensing data optimization framework, enabling efficient monitoring under resource constraints, significantly improving the sustainability and adaptability of the monitoring system. Furthermore, by combining information value theory with modern resource management technology, it solves the resource optimization problem in large-scale monitoring systems.

[0242] In some embodiments, the construction of an anomaly detection model based on a preset isolated forest algorithm, and the use of the anomaly detection model to identify the feature vector to obtain anomaly detection results, includes:

[0243] The feature vector is encoded using a data preprocessing framework based on integrated spike patch segmentation to obtain multimodal encoded data. The multimodal encoded data includes time-series index encoded data, log event encoded data, topological state encoded data, pulse frequency encoded data, discrete spike sequences, and spike time-series patterns. The pulse frequency is converted from the numerical index in the feature vector through a preset comparison threshold. The discrete spike sequence is mapped from the event data in the feature vector. The spike time-series patterns are converted from the state changes in the feature vector.

[0244] The data preprocessing framework is used to obtain a multi-scale time window. Based on the multi-scale time window, the inherent frequency features of the time series are extracted, and the time granularity of target monitoring data from different sources is aligned. A time and frequency dual-domain representation corresponding to the feature vector is constructed. Based on the multi-scale time window, the inherent frequency features, the aligned time granularity, and the time and frequency dual-domain representation, time stability data is established.

[0245] Using the data preprocessing framework, the feature vector is converted into temporal patches, and spatial features are extracted from the feature vector. Based on the correlation between the temporal patches and the spatial features, feature association relationships are obtained, so that a monitoring data representation is generated based on the multimodal coded data, the temporal stability data, and the feature association relationships.

[0246] The calculation strategy for the monitoring data representation is triggered by a preset peak neural network. The calculation strategy includes generating corresponding calculation peak data when the data change rate of the monitoring data representation exceeds a preset data change threshold, and calculating corresponding resource allocation data when the data change rate of the monitoring data representation is lower than a preset low change threshold.

[0247] A preset peak Transformer network is established. The peak Transformer network is used to extract features at multiple scales by fusing preset temporal attention mechanisms and spatial attention mechanisms, capture feature anomalies at different time spans, and perform hierarchical anomaly detection.

[0248] Based on the complexity and probability of anomalies represented by the monitoring data, allocate corresponding computing resources;

[0249] The isolated forest algorithm is fused with the preset STAS framework to obtain a decision tree. The decision tree is re-evaluated based on the data changes represented by the monitoring data, and the depth and sampling strategy of the decision tree are dynamically adjusted. Based on the computing strategy, the spike Transformer network, the allocated computing resources, the re-evaluation results, the depth and sampling strategy of the decision tree, a spatiotemporally adaptive anomaly detection model is obtained.

[0250] In this embodiment, the feature vector is first encoded using a data preprocessing framework based on Ensemble SpikePatch Decomposition (ESPD) to obtain multimodal encoded data. A neuroscience-inspired encoding mechanism is employed to convert traditional monitoring data into a brain-like representation, improving the effectiveness of anomaly detection. It should be noted that Ensemble SpikePatch Decomposition (ESPD) is an innovative data preprocessing framework that combines spike neural coding theory from neuroscience with patch processing techniques from computer vision. Spike neural coding simulates the way biological neurons transmit information through discrete electrical impulses (spikes), converting continuous signals into time-coded spike sequences. Patch decomposition decomposes complex data into local substructures (patches), facilitating fine-grained analysis. The ESPD framework combines these two techniques to create a multi-level, multimodal data representation method.

[0251] Multimodal coded data includes various complementary data representation formats. Time-series index coded data preserves the temporal evolution characteristics of the original monitoring indicators, extracting multi-scale features through sliding windows and scaling transformations. Log event coded data transforms unstructured or semi-structured log information into discrete event sequences, extracting key events through natural language processing and pattern matching. Topology state coded data represents the state changes of network and system components, including connectivity status, resource allocation, and component health information.

[0252] In this embodiment, rate coding is used to convert numerical indicators into a neural-like representation. This method converts continuous numerical values ​​into pulse frequencies by setting a preset comparison threshold, simulating the mechanism of encoding information based on the firing frequency of biological neurons. Specifically, values ​​above the threshold generate high-frequency pulses, and values ​​below the threshold generate low-frequency pulses, with the pulse frequency proportional to the original value. This coding preserves the relative intensity and temporal characteristics of the data while providing a sparse representation, facilitating subsequent processing.

[0253] Subsequently, this embodiment maps event-based data (such as alarms, state changes, and log entries) into discrete spike sequences. Events of different types and importance generate spikes with different characteristics: critical alarms generate high-amplitude spikes, indicating significant anomalies; general alarms generate medium-amplitude spikes; and state changes and system logs are mapped to spikes with corresponding characteristics based on their importance. This mapping preserves the temporal order, type information, and importance of events, achieving a unified representation of event data. State changes are converted into spike time-series patterns to capture the dynamic characteristics of topology and configuration. The state changes monitored in this embodiment (such as node online / offline status, connection changes, and path switching) are encoded into specific spike patterns, with different change types corresponding to different pattern characteristics. This encoding enables the system to identify complex state transition sequences and abnormal state change patterns.

[0254] Therefore, by using multimodal neural coding, various heterogeneous monitoring data are transformed into a unified spike representation framework, laying the foundation for subsequent spatiotemporal analysis and anomaly detection.

[0255] Subsequently, this embodiment utilizes a data preprocessing framework to obtain multi-scale time windows. Based on these multi-scale time windows, the inherent frequency features of the time series are extracted, and the time granularity of target monitoring data from different sources is aligned. A dual-domain representation of time and frequency corresponding to the feature vector is constructed, achieving a combination of time-domain and frequency-domain analysis to comprehensively capture the time-frequency characteristics of the data. The multi-scale time window is a set of analysis windows of different lengths used to capture data features across different time spans. This embodiment typically defines a series of window sizes, such as short windows (seconds) for capturing instantaneous changes, medium windows (minutes) for analyzing short-term trends, and long windows (hours or days) for identifying long-term patterns. The window design follows exponential or Fibonacci growth sequences, achieving a balance between coverage and computational efficiency. A sliding window mechanism allows these multi-scale windows to move along the time axis, enabling continuous analysis.

[0256] It should be noted that intrinsic frequency feature extraction is the process of identifying the inherent periodicity and frequency characteristics of a time series. This embodiment employs multiple spectral analysis techniques: Fast Fourier Transform (FFT) decomposes the time series into a combination of sine waves of different frequencies; wavelet transform provides time-frequency localization analysis, which is particularly suitable for processing non-stationary signals; Hilbert-Huang transform is used to analyze the instantaneous frequencies of nonlinear and non-stationary time series. Through these methods, the system extracts the intrinsic frequency features of the time series, including the dominant frequency (the most prominent period in the data), spectral distribution (frequency energy distribution), and frequency variation pattern (frequency evolution over time).

[0257] In this embodiment, temporal granularity alignment is used to address inconsistent sampling rates from different data sources. Data is typically acquired from multiple sources with varying sampling frequencies (ranging from seconds to days). This embodiment unifies the temporal granularity through resampling technology, performing upsampling interpolation on low-frequency data and downsampling on high-frequency data. The alignment process considers data characteristics to select an appropriate interpolation method (such as linear, spline, or physical model-based interpolation) and employs an anti-aliasing filter to prevent information distortion caused by downsampling.

[0258] Based on the above processing, this embodiment constructs a time- and frequency-domain representation to create a comprehensive view of the data. The dual-domain representation simultaneously includes time-domain information (preserving the temporal relationships and trends of the data) and frequency-domain information (revealing periodic patterns and spectral characteristics). Commonly used dual-domain representation forms include time-frequency plots (showing the change of frequency energy over time), wavelet scalar plots (displaying wavelet coefficients at different scales), and Hilbert spectra (describing instantaneous frequency and amplitude). This dual-domain representation can simultaneously capture sudden events (obvious in the time domain) and gradual patterns (visible in the frequency domain), providing comprehensive information for anomaly detection.

[0259] Subsequently, this embodiment establishes time stability data based on time characteristic analysis to describe the time dynamic characteristics of the monitoring indicators. Stability analysis examines the degree of variation of data at different time scales, including short-term fluctuations (variance, volatility), medium-term changes (trend strength, rate of change), and long-term evolution (seasonal intensity, long-term drift). This embodiment compares these stability indicators with historical baselines to identify abnormal stability changes, such as sudden increases in volatility or disruptions in seasonal patterns. Therefore, by constructing a dual-domain representation of time and frequency, a multi-dimensional view of the data is obtained, enabling the identification of complex anomaly patterns that might be overlooked by single-domain analysis, significantly improving the comprehensiveness and accuracy of anomaly detection.

[0260] Furthermore, this embodiment utilizes a data preprocessing framework to convert feature vectors into temporal patches and extract spatial features from the feature vectors. Based on the correlation between temporal patches and spatial features, feature association relationships are obtained, generating a comprehensive monitoring data representation. This achieves the fusion of temporal and spatial features, constructing a comprehensive data representation model. Temporal patch transformation is the process of segmenting a continuous time series into discrete, overlapping time segments. A patch is a local representation of the data, capturing data features within a specific time window. Specifically, this embodiment uses an adaptive segmentation algorithm to determine patch boundaries, possibly based on fixed duration, change detection, or information content. Each patch contains the original data subsequence and extracted features (such as statistics, morphological features, and spectral features). Patch extraction employs a sliding window approach to ensure coverage and smooth transitions across continuous time periods. Patch representation enables the system to focus on the local structure of the data, facilitating the identification of local anomalies and pattern changes.

[0261] In this embodiment, spatial feature extraction focuses on the interrelationships and structural characteristics between monitoring data. In a monitoring system, "space" refers to the indicator space or topological space, where the relationships between different indicators or components constitute the spatial dimension. This embodiment extracts various spatial features: correlation features describe the statistical correlation between different indicators, such as Pearson correlation coefficient, mutual information, and Granger causality; topological features represent the location and connectivity of monitored objects in the network or system structure, such as centrality, clustering coefficient, and topological distance; covariance features capture the collaborative change patterns of multiple indicators, such as principal components, independent components, or common trends. These spatial features reveal the interdependence and influence relationships between system components. Subsequently, this embodiment analyzes the correlation between temporal patches and spatial features, constructing a feature correlation graph. The correlation analysis employs various techniques: conditional correlation analysis examines the correlation of a feature after controlling for the influence of other features; time-delay correlation analysis studies the time delay effect between features; and graphical models (such as Bayesian networks and Markov random fields) capture the probabilistic dependencies between features. Through these analyses, this embodiment establishes a mapping between temporal patterns and spatial structures, and identifies spatiotemporal correlation patterns, such as the correlation between certain spatial structures and specific temporal patterns, or the evolution of spatial relationships over time.

[0262] Furthermore, based on multimodal encoded data, temporal stability data, and feature correlations, this embodiment generates a comprehensive monitoring data representation. This representation integrates multiple dimensions of the original data: time dimension (trend, periodicity, rate of change), frequency dimension (periodicity, spectral distribution), spatial dimension (correlation, topological structure), and semantic dimension (business meaning, component function). The representation model is organized using a tensor or multi-layer graph structure, preserving the relationships and hierarchical structure between dimensions. This embodiment also maintains the temporal evolution of the representation, tracking changes in the data representation itself, which is particularly important for identifying shifts in system behavior patterns. Therefore, this multi-dimensional monitoring data representation provides a comprehensive view of the monitored object, enabling anomaly detection to consider complex spatiotemporal patterns and contextual relationships, significantly improving detection accuracy and interpretability.

[0263] Furthermore, this embodiment establishes a preset peak Transformer network based on a preset peak neural network-triggered computational strategy for representing monitoring data, thereby achieving efficient anomaly detection and feature extraction. This realizes a bio-inspired computational model that significantly improves efficiency and adaptability.

[0264] It should be noted that the spike-triggered computation strategy is an event-driven computational paradigm that mimics the impulse-triggered mechanism in biological neural systems. Unlike traditional fixed-interval computation, spike-triggered computation activates the processing flow only when the data undergoes significant changes, greatly reducing unnecessary computation. To this end, this embodiment defines several triggering conditions: a computation spike is triggered when the data change rate exceeds a preset threshold, initiating an anomaly detection process; changes in data content (such as the emergence of a new pattern) trigger a feature update spike, refreshing the feature representation; changes in system state (such as component going online / offline) trigger a model adjustment spike, updating the model structure.

[0265] After computational spikes are generated, this embodiment allocates corresponding computing resources to execute tasks. Resource allocation follows a priority strategy, with high-priority spikes (such as critical anomaly detection) receiving immediate processing, while low-priority spikes may be queued or processed in parallel. Optionally, this embodiment also implements a spike suppression mechanism, merging multiple similar spikes when they occur within a short period to avoid computational redundancy. During stable periods when the data change rate is below a threshold, the system generates resource allocation data to guide the reallocation of computing resources for other tasks or entry into a low-power state, optimizing overall energy efficiency.

[0266] This implementation utilizes a spike Transformer network, combining the event-driven nature of spike neural networks with the powerful representation capabilities of Transformers. Traditional Transformer architectures have achieved significant success in sequence data processing; their core is the self-attention mechanism, capable of modeling dependencies between any positions within a sequence. The spike Transformer extends this architecture to the spike data processing domain, specifically handling spatiotemporally encoded monitoring data. It should be noted that the network integrates temporal and spatial attention mechanisms for multi-scale feature extraction. The temporal attention mechanism focuses on modeling relationships within a time series, capturing long-distance dependencies and pattern similarities between different time points. This mechanism generates attention weights by calculating query-key-value triples at different positions in the time series, identifying important time points and temporal patterns. The spatial attention mechanism focuses on the relationships between different monitoring metrics or components, constructing a dynamic association graph between components. Through self-attention computation, this embodiment can identify highly correlated component groups and key dependency paths, providing a foundation for anomaly propagation analysis.

[0267] In this embodiment, the Spiral Transformer implements hierarchical anomaly detection, analyzing data at multiple levels of abstraction. Low-level detection focuses on anomalies in the raw signal, such as outliers and abrupt changes; mid-level detection identifies pattern anomalies, such as periodic interruptions and correlation changes; and high-level detection analyzes semantic-level anomalies, such as business process deviations and changes in system behavior. This hierarchical structure enables the system to simultaneously capture anomalies in both micro-details and macro-patterns, providing comprehensive anomaly detection capabilities. Through this spike-driven, high-efficiency computing architecture, this embodiment achieves intelligent allocation of computing resources, focusing on the most valuable data analysis while maintaining awareness of global patterns.

[0268] Subsequently, this embodiment integrates the Isolation Forest algorithm with the pre-defined STAS (Spatio-Temporal Adaptive Sampling) framework to construct a spatio-temporal adaptive anomaly detection model. This creates a dynamic, context-aware anomaly detection system capable of autonomously adapting to different environments and data characteristics. Isolation Forest is an efficient unsupervised anomaly detection algorithm based on the principle of rapidly isolating anomaly points through random spatial partitioning. The algorithm constructs multiple isolation trees, each recursively partitioning the data space by randomly selecting features and split values. Anomalies are typically isolated early (requiring fewer partitioning steps), thus anomalies can be identified through average path length. The advantages of Isolation Forest lie in its high computational efficiency (linear time complexity), low memory consumption, and ease of parallelization, making it particularly suitable for large-scale monitoring data processing. It should be noted that the STAS framework is an innovative spatio-temporal adaptive computational architecture specifically designed for processing dynamically changing monitoring data. The core of the framework includes an adaptive sampling strategy (dynamically adjusting sampling density based on data importance and rate of change), spatio-temporal context integration (considering the temporal history and spatial neighborhood of the data), and resource allocation optimization (allocating computational resources based on data complexity). By configuring STAS, it is possible to optimize the use of computing resources while maintaining detection quality.

[0269] Therefore, this embodiment obtains a decision tree ensemble model by fusing the Isolation Forest and STAS frameworks. The fusion process includes: feature space expansion, which integrates temporal and spatial features into the decision space, enabling the Isolation Forest to simultaneously consider temporal patterns and component relationships; a dynamic sampling strategy that adjusts the sampling ratio based on data importance and degree of change, with higher sampling rates used for key regions; weighted isolation calculation that considers feature importance, with key features having a higher selection probability during tree construction; and an incremental update mechanism that allows the model to continuously optimize with the arrival of new data without requiring complete reconstruction.

[0270] This embodiment triggers a re-evaluation of the decision tree based on changes in the data represented by monitoring data. When a change in data distribution, the emergence of a new pattern, or a system topology adjustment is detected, partial or complete reconstruction of the decision tree is initiated. The re-evaluation process not only updates the tree structure but also dynamically adjusts the tree depth and sampling strategy. For highly variable regions, the tree depth and sampling density may be increased to improve detection accuracy; for stable regions, the model may be simplified to reduce computational overhead.

[0271] Ultimately, this embodiment constructs a complete spatiotemporal adaptive anomaly detection model based on computational strategies, a peak Transformer network, allocated computational resources, re-evaluation results, decision tree depth, and sampling strategies. This model can automatically adapt to changes in data characteristics and states, optimizing resource usage while maintaining high detection accuracy. Model outputs include anomaly scores (quantifying the degree of anomaly), anomaly type classifications (e.g., point anomalies, contextual anomalies, collective anomalies), anomaly explanations (indicating the main features leading to the anomaly), and confidence assessments (representing the reliability of the detection results).

[0272] Therefore, this embodiment achieves efficient and accurate anomaly detection through a spatiotemporal adaptive model, reliably identifying various anomalies in complex and dynamic monitoring environments, providing a solid foundation for timely early warning and fault diagnosis. Thus, this embodiment constitutes an innovative neuro-heuristic anomaly detection framework, combining modern deep learning technology with traditional anomaly detection algorithms to create an efficient, intelligent, and adaptive monitoring system. Simultaneously, through advanced technologies such as multimodal coding, time-frequency analysis, spatiotemporal correlation, attention mechanisms, and adaptive models, this embodiment can accurately identify anomaly patterns from massive amounts of monitoring data, improving operational stability.

[0273] In some embodiments, the monitoring data representation is obtained through the following steps:

[0274] The numerical index is compared with the comparison threshold. The numerical index values ​​exceeding the comparison threshold are converted into high-frequency pulses, and the numerical index values ​​below the comparison threshold are converted into low-frequency pulses. The values ​​are mapped to the corresponding pulse frequency encoded data according to their magnitude, and the time attribute and relative intensity of the feature vector are preserved.

[0275] The alarm events, status changes, and system logs contained in the event-type data are mapped into discrete spike sequences according to event type and importance. The discrete spike sequences include high-amplitude spikes generated by alarm events whose importance is higher than the upper limit of a preset importance range, and medium-amplitude spikes generated by alarm events whose importance is within the importance range.

[0276] The node online / offline status, connection establishment / disconnection, and path change contained in the topology state in the feature vector are converted into spike patterns corresponding to the state change types of the topology state.

[0277] The high-frequency changes within a short time window and the trend changes within a long time window are processed separately to extract the inherent frequency features of the time series, which include periodicity, suddenness, and gradualness.

[0278] A time-frequency dual-domain representation is constructed, which is used to indicate the temporal relationship of the feature vector in the time domain and to analyze the spectral characteristics of the feature vector in the frequency domain.

[0279] A correlation diagram between the time patches and the spatial features is established to obtain a representation of the monitoring data.

[0280] In this embodiment, numerical indicators are first compared with a preset comparison threshold. Numerical indicators exceeding the comparison threshold are converted into high-frequency pulses, while those below the threshold are converted into low-frequency pulses. The numerical values ​​are mapped to corresponding pulse frequency encoded data, and the temporal attributes and relative intensity of the feature vectors are preserved. This process converts traditional numerical monitoring indicators into neural coding forms, laying the foundation for subsequent processing.

[0281] Rate coding is an information encoding method inspired by biological neural systems, mimicking the mechanism by which neurons transmit information by adjusting their firing frequency. In biological neural systems, the greater the stimulus intensity, the higher the neuron firing frequency; similarly, in monitoring systems, the larger or more abnormal the value, the higher the generated pulse frequency. This encoding method is particularly suitable for representing continuously changing analog signals, such as performance indicators like CPU utilization, memory usage, and network traffic.

[0282] In this embodiment, the comparison threshold serves as a reference point for determining the pulse frequency mapping, employing multiple threshold setting strategies: a fixed threshold based on predefined normal range boundaries; a percentile threshold based on specific percentiles (such as the median or 75th percentile) of historical data distribution; and an adaptive threshold dynamically adjusted based on the statistical characteristics of recent data. Different threshold strategies are set for different types of indicators to reflect the characteristics and importance of each indicator. Subsequently, pulse frequency mapping is the core process of converting raw values ​​into pulse sequences. For values ​​exceeding the threshold, this embodiment generates high-frequency pulses, with the frequency proportional to the degree of exceeding the threshold; for values ​​below the threshold, the system generates low-frequency pulses, with the frequency reflecting the closeness of the value to the threshold. The mapping function is typically a piecewise linear or non-linear function to ensure good resolution within critical ranges. For example, a change in CPU utilization from 90% to 100% may map to a larger frequency change, reflecting the importance of the high utilization range compared to a change from 50% to 60%.

[0283] During the encoding process, the temporal attributes and relative intensity of the feature vectors are preserved. Temporal attributes include timestamps, duration, and time-series patterns, ensuring that the pulse sequence accurately reflects the temporal evolution of the data. Relative intensity information is encoded through pulse amplitude, frequency, and pattern, preserving the relative relationships and importance differences between values. The encoding also considers the semantic characteristics of the indicators; for example, growth-type indicators (such as queue length) and periodic indicators (such as daily load curves) use different encoding parameters to best express their characteristics. A significant advantage of pulse frequency encoding is that it provides a sparse representation, reducing storage and computational requirements. Compared to storing precise values ​​at every time point, pulse sequences are generally more compact, especially for long-term stable signals. Furthermore, this encoding method naturally aligns with subsequent spike neural network processing, supporting efficient event-driven computation. Therefore, this embodiment, through this bio-inspired encoding mechanism, transforms traditional monitoring indicators into neuroscience-style representations, providing a new analytical perspective for anomaly detection.

[0284] Furthermore, this embodiment maps the alarm events, state changes, and system logs contained in event-type data into discrete spike sequences according to event type and importance, realizing the processing of non-numerical monitoring information and converting discrete events into a unified neural representation. Event-type data is important non-numerical information in the monitoring system, containing rich system status and behavior records. Alarm events are warning messages actively generated by the system or application, such as resource exhaustion warnings, security threat detection, and component failure notifications; state change records the changes in the state of system components, such as service start / stop, configuration modification, and cluster member changes; system logs are detailed operational records of various system components, including periodic status reports, operation records, and error messages. This event-type data usually exists in text or structured message form and requires special processing to be analyzed in a unified manner with numerical indicators. A discrete spike sequence is a time-coded event representation, where each spike represents the occurrence of a discrete event, and the spike's attributes (such as amplitude, shape, and timestamp) encode the event's characteristics. Unlike continuous pulse frequency coding, discrete spike sequences emphasize the timing and characteristics of events rather than their frequency, making them more suitable for representing discrete, non-periodic events.

[0285] During the mapping process, events are first categorized based on event type and importance. This embodiment typically predefines an event classification system, performing multi-dimensional classification based on event source (e.g., system components, application services), event category (e.g., errors, warnings, messages), and semantic content (e.g., resource-related, security-related, performance-related). Event importance assessment is based on multiple factors: predefined severity (e.g., severe, warning, message), business impact scope, potential risk level, and rarity. The assessment uses a rule engine or machine learning model to assign an importance score to each event. Alarm events with importance exceeding the upper limit of a preset importance interval generate high-amplitude spikes. These spikes are particularly significant in the sequence, indicating critical events requiring immediate attention. High-amplitude spikes may have special shape characteristics or additional markers, allowing downstream analysis modules to prioritize their processing. Alarm events with importance within a preset importance interval generate medium-amplitude spikes, indicating events that require monitoring but are not the most urgent. For low-importance events, the system may generate low-amplitude spikes or spikes only at high aggregation levels to avoid information overload.

[0286] Optionally, spike sequences may also encode relational information between events. Related events may generate specific spike patterns (such as specific intervals or combinations) to reflect the logical connections between events; recurring events may be represented by the accumulation of spike amplitudes to reflect the persistence and severity of the problem; event sequences may be encoded by specific spike timing patterns to represent specific system behavior patterns or fault evolution paths.

[0287] Therefore, by using discrete spike sequence representation, numerical indicators and event information can be processed within a unified framework, enabling integrated analysis of multimodal data and improving the accuracy of system status assessment and anomaly detection.

[0288] Furthermore, this embodiment converts the node online / offline status, connection establishment / disconnection, and path change contained in the topological state of the feature vector into spike patterns corresponding to the state change types, thereby realizing the dynamic changes in processing structure and connection relationships and encoding the topological evolution into an analyzable neural representation.

[0289] Among these, topology status is key information describing the monitored network structure and connectivity. Node online / offline status indicates changes in the availability of system components (such as servers, application instances, and network devices), directly reflecting the system's scale and health. Connection establishment and disconnection record changes in communication links between components, including physical connections (such as network links) and logical connections (such as service call relationships). Path changes indicate adjustments to the flow path of data or requests, such as changes in network routing, modifications to load balancing forwarding rules, or switching of service call paths. These topology changes may originate from normal operations (such as planned maintenance and elastic scaling) or abnormal situations (such as component failures and network partitions).

[0290] Spike pattern conversion maps these topology changes to specific neural activity patterns, similar to spatiotemporal coding in biological neural systems. Different types of topology changes correspond to different spike patterns: node going online may generate a rising edge spike sequence, indicating the addition of a new resource; node going offline may generate a falling edge spike sequence, indicating the departure of a resource; connection establishment may generate a two-node synchronous spike, indicating the formation of a new connection; connection disconnection may generate asynchronous spike pairs, indicating the loss of a connection; path change may generate a spike sequence propagating along a new path, indicating a change in traffic path.

[0291] This embodiment considers the context and importance of changes during the conversion process. Specifically, planned changes (such as scheduled maintenance activities) and unplanned changes (such as sudden failures) may generate spike patterns with different characteristics, distinguishing between normal operation and maintenance and abnormal events; changes in critical nodes or connections generate more significant spike patterns, reflecting their importance in the system; the scale and scope of changes (such as single-point changes or large-scale changes) will also affect the complexity and intensity of the generated spike patterns.

[0292] Furthermore, spike patterns not only encode single change events but can also represent complex sequences of topology evolution. This embodiment may define specific combinations of spike patterns to represent common topology change scenarios, such as cluster expansion (multiple nodes coming online and establishing connections), service migration (old nodes going offline and new nodes coming online and changing paths), or network reorganization (multiple connections being disconnected, established, and changing paths). These pattern combinations provide a foundation for advanced system behavior analysis.

[0293] Therefore, this embodiment, by converting the topological state into a spike pattern, enables the representation and analysis of dynamic changes in network structure within a neural computing framework, thereby achieving continuous monitoring of evolution and identification of abnormal patterns.

[0294] Subsequently, this embodiment processes high-frequency changes within short time windows and trend changes within long time windows, extracting the inherent frequency characteristics of the time series to achieve in-depth analysis of the time characteristics of the data and identify patterns and changes at different time scales. Multi-time scale analysis is an important method for processing time series data, capable of comprehensively capturing data patterns of different periods and durations. Short time windows (e.g., seconds to minutes) focus on capturing high-frequency changes, such as sudden fluctuations, brief peaks, and instantaneous changes. These high-frequency characteristics typically reflect the system's immediate response, transient events, or local anomalies. This embodiment applies high-pass filters or differential operations to short-window data, emphasizing rapidly changing components while calculating local statistical characteristics such as volatility, kurtosis, and local extrema. Long-term windows (e.g., hours to days) focus on trend changes, such as gradual growth, periodic patterns, and long-term drift. These low-frequency characteristics reveal the system's evolutionary trends, cyclical load patterns, or gradual anomalies. This embodiment applies low-pass filters or moving averages to long-window data, smoothing short-term fluctuations, highlighting long-term trends, and analyzing trend slope, persistence, and periodic strength.

[0295] It should be noted that inherent frequency features are the intrinsic periodic properties of time series, reflecting the repetition patterns and rhythmic characteristics of the data. This embodiment extracts several inherent frequency features: periodicity measures the intensity and period length of the repetition pattern of the data, such as daily, weekly, or monthly load cycles; burstiness describes the frequency and intensity of non-periodic drastic changes in the data, such as sudden increases in traffic or performance degradation events; and gradualism quantifies the gradual change characteristics of the data, such as gradual capacity depletion or slow performance decline. Feature extraction employs multiple analytical techniques: spectral analysis (such as Fourier transform and periodograms) identifies the main frequency components; time-frequency analysis (such as wavelet transform and short-time Fourier transform) locates the frequency characteristics at different time points; and autocorrelation analysis assesses the similarity between the time series and its lagged versions, revealing periodicity.

[0296] Furthermore, this embodiment pays particular attention to the temporal evolution of frequency characteristics. Frequency characteristics themselves may change over time, such as an increase or decrease in periodic intensity, a stretching or shrinking of period length, or the emergence of new periods. This embodiment tracks these changes using sliding window spectral analysis or continuous wavelet transform to construct a temporal evolution map of frequency characteristics, identifying mode transition points and anomalous frequency behaviors. This embodiment also analyzes the interactions of characteristics at different time scales, such as how short-term fluctuations affect long-term trends, or how long-term trends modulate short-term patterns, to comprehensively understand the complex dynamics of time series.

[0297] Therefore, this embodiment obtains a comprehensive temporal feature profile of time series data through multi-scale time analysis and intrinsic frequency feature extraction, laying the foundation for identifying complex temporal pattern anomalies. These features are crucial for detecting anomalies that are difficult to detect using simple thresholds, such as pattern interruptions, frequency shifts, or anomalous changes in period intensity.

[0298] Furthermore, this embodiment constructs a time-frequency dual-domain representation. It preserves the temporal relationship of feature vectors in the time domain and analyzes the spectral characteristics of feature vectors in the frequency domain, thus creating a comprehensive view of the data that simultaneously displays temporal evolution and frequency characteristics. The time-frequency dual-domain representation is a two-dimensional data visualization and analysis framework. The horizontal axis represents time, the vertical axis represents frequency, and color or brightness represents energy intensity. This representation is similar to a spectrogram in audio analysis, capable of simultaneously displaying signal changes over time and energy distribution at different frequencies. Dual-domain representation is particularly suitable for analyzing monitoring data with complex time-frequency characteristics, such as indicators that exhibit both long-term trends and periodic fluctuations.

[0299] In the time domain, this embodiment preserves the temporal relationship of the feature vectors, maintaining the temporal order and relative time intervals of the data points. The time domain represents the direct change patterns of the data of interest, such as increases, decreases, jumps, and plateaus in values. This embodiment calculates various features for the time domain data: trend components are extracted through regression or filtering to represent the long-term direction of change; fluctuation components are obtained through detrending to reflect short-term changes; outliers are identified through statistical detection to mark sudden events. Time domain analysis also considers the temporal characteristics of the data, such as autocorrelation structure (the relationship between a value and its historical values), rate of change (first-order difference), and acceleration (second-order difference).

[0300] In the frequency domain, this embodiment analyzes the spectral characteristics of the feature vectors to reveal periodic patterns and frequency distributions in the data. Frequency domain transformation typically employs the Fast Fourier Transform (FFT) or its variants to decompose the time series into combinations of sine waves at different frequencies. This embodiment analyzes several aspects of the spectrum: the dominant frequency component identifies the frequency with the most concentrated energy, usually corresponding to the main period; harmonic structure analysis identifies integer multiples of the dominant frequency, reflecting the complexity of the periodic pattern; band energy calculation calculates the total energy within a specific frequency range to assess the intensity of activity at different time scales; and spectral shape characteristics (such as width and tilt) describe the overall characteristics of the frequency distribution.

[0301] The construction of the dual-domain representation employs various time-frequency analysis techniques: Short-Time Fourier Transform (STFT) divides the long-time sequence into short windows, performs FFT on each window, and generates a time-frequency energy map; Continuous Wavelet Transform (CWT) uses wavelet functions of different scales to analyze the signal, providing multi-resolution time-frequency analysis; Hilbert-Huang Transform (HHT) is particularly suitable for nonlinear and non-stationary signals, providing high-time-resolution frequency information through Empirical Mode Decomposition and Hilbert Spectral Analysis. This embodiment selects an appropriate transform method based on data characteristics and analysis requirements, balancing time and frequency resolution.

[0302] Dual-domain representation provides a powerful analytical foundation for anomaly detection, enabling the identification of complex anomalies that might be overlooked by single-domain analysis: frequency abrupt changes (sudden changes in frequency characteristics, such as periodic interruptions) are significant in the frequency domain but may not be apparent in the time domain; energy migration (the transfer of energy from one frequency band to another) indicates a shift in behavioral patterns; and time-frequency outliers (isolated energy at specific times and frequencies) may indicate localized anomalous events. This embodiment identifies known anomalous patterns and newly emerging anomalous features by comparing observed dual-domain representations with a pre-defined time-frequency pattern library.

[0303] Therefore, this embodiment obtains a comprehensive view of the monitoring data through dual-domain representation of time and frequency, which can detect complex pattern changes and multi-scale anomalies, and greatly improves the sensitivity and accuracy of anomaly detection.

[0304] Furthermore, this embodiment establishes a correlation graph between temporal patches and spatial features to obtain a complete representation of the monitoring data, achieving the fusion of temporal and spatial analysis results and creating a comprehensive data representation model. Temporal patches are local segments of a time series, capturing data features within a specific time window. This embodiment segments continuous time series into overlapping temporal patches, each containing original data and extracted features. Patch extraction employs an adaptive strategy, potentially based on fixed duration, change detection, or information content-based boundary delineation. Each patch contains a multi-dimensional feature vector describing the statistical characteristics (e.g., mean, variance, trend), morphological features (e.g., number of peaks, waveform shape), and spectral features (e.g., dominant frequency, energy distribution) of that time period. Patch representation allows the system to focus on the local structure of the data, facilitating the identification of abnormal patterns within specific time periods.

[0305] It should be noted that spatial features describe the interrelationships and structural characteristics among monitoring indicators. In a monitoring system, the "spatial" dimension refers to the correlation between different indicators or components. This embodiment extracts various spatial features: correlation indicators (such as Pearson correlation coefficient, mutual information, and partial correlation) quantify the statistical relationships between different indicators; topological features (such as centrality, clustering coefficient, and distance metrics) describe the location and connectivity of monitored objects within the system structure; and group features (such as community detection results and principal component analysis) identify closely related sets of indicators. Therefore, these spatial features reveal the interdependencies and influences between components, providing crucial information for understanding overall behavior.

[0306] The correlation graph is a network structure connecting temporal patches and spatial features, revealing the interaction between temporal patterns and spatial structures. This embodiment uses a graph model to represent this correlation, where nodes represent temporal patches or spatial features, and edges represent the strength of the relationship between them. Correlation analysis employs various techniques: conditional correlation analysis assesses the degree of correlation after controlling for the influence of other factors; time-delay correlation analysis studies the time delay effect and identifies the direction of causal relationships; graphical models (such as Bayesian networks) capture probabilistic dependency structures; and tensor decomposition methods process high-dimensional correlation data to extract key patterns. This embodiment pays particular attention to spatiotemporal interaction patterns, such as how specific spatial structures influence temporal evolution or how temporal patterns propagate spatially.

[0307] This embodiment constructs a complete representation of monitoring data through a relational graph. This is a multi-dimensional data model that integrates temporal characteristics, frequency characteristics, spatial relationships, and semantic information. This comprehensive representation is organized using a tensor structure or a multi-layer graph model, preserving the complex relationships between dimensions. Furthermore, this embodiment maintains the dynamic evolution of the representation, tracking changes in relational patterns over time and identifying transition points in behavioral patterns. This comprehensive data representation provides a solid foundation for advanced anomaly detection and system behavior understanding, enabling the identification of complex spatiotemporal anomaly patterns, such as abrupt changes in relational structures, changes in propagation patterns, or system state transitions.

[0308] Therefore, this embodiment achieves a comprehensive transformation from raw monitoring data to neural coding representation, creating a multimodal, multi-scale data representation framework. Through this data representation, combined with neuroscience principles and modern data analysis techniques, a rich information foundation is provided for anomaly detection, significantly improving the intelligence level and anomaly recognition capabilities of the monitoring system.

[0309] In some embodiments, the cloud center platform acquires monitoring task configuration information and synchronizes it to the edge collector via a secure control channel based on mutual transport layer security. It then discovers monitorable objects in the network through network scanning and DNS queries and reports them to the cloud center platform. Combined with manually added monitoring object information, it generates categorized and stored monitoring object registration information. The system also includes:

[0310] Based on the network address range configuration, a network range scan is performed to detect active hosts in the network by specifying the protocol, and port scans are performed on the detected active hosts to identify the types of services they are running, generating a list of hosts containing IP addresses, open ports and service types;

[0311] Based on the host list, domain name resolution records are obtained through DNS queries, and the domain name information of devices in the network is identified based on the domain name resolution records. Combined with reverse DNS queries, the device attribute information of the devices is determined from the domain name information. The devices include servers, application systems, and network devices, and the device attribute information includes functional roles and business attributes.

[0312] Based on the API interfaces of the cloud center platform, virtualization platform, and container platform, the dynamic resources of the virtual machines, container instances, and microservice components corresponding to the API interfaces are called. The dynamic resources include configuration information, tag attributes, and running status.

[0313] Combining the host list, the device attribute information, and the dynamic resources, the detected monitoring objects are classified according to device type, service attribute, and network location, and an object information database containing object identifier, type, location, attribute, and access method is established.

[0314] The object information database is associated with the monitoring task template to generate monitoring object registration information.

[0315] In this embodiment, firstly, a network range scan is performed based on a network address range configuration. This involves probing active hosts in the network using a specified protocol and performing port scans on the detected active hosts to identify the types of services they are running, generating a host list containing IP addresses, open ports, and service types. A network range scan refers to the system quickly identifying running hosts in the network using low-interference probing methods such as the ICMP protocol (i.e., the ping command) or TCP SYN probes, based on a pre-configured IP address range (e.g., 192.168.1.0 / 24). A progressive scanning strategy is adopted, first using a broad scan at a lower frequency to identify active IPs, and then performing a more granular port scan on these active IPs. Port scanning involves sending TCP / UDP probe packets to common service ports of the target host (e.g., 80, 443, 22, 3306, etc.) and determining the service type based on the response. To reduce the impact on the production environment, this embodiment limits the scan rate and implements an intelligent retry mechanism, while avoiding known sensitive service ports. The scan results form a structured host list, recording the network location, accessibility, and basic service characteristics of each device.

[0316] Next, based on the host list, domain name resolution records are obtained through DNS queries. Based on these records, the domain name information of devices in the network is identified. Combined with reverse DNS queries, the device attribute information is determined from the domain name information. The devices include servers, application systems, and network devices, and the device attribute information includes functional roles and business attributes. A DNS query refers to the system using the Domain Name System (DNS) protocol to query the domain name information corresponding to IP addresses in the host list. The system first performs a reverse DNS query (PTR record query) to convert the IP address into the corresponding domain name. This step is crucial for understanding the network topology because domain names typically contain semantic information about device function and location; for example, "db-prod-01.internal.company.com" indicates a production environment database server. This embodiment also performs forward DNS queries to obtain A, CNAME, and SRV records, discovering related services that may not have been directly scanned. By analyzing the naming patterns and hierarchical structure of domain names, this embodiment can extract attribute information such as device type (e.g., web, db, cache), environment type (e.g., prod, test, dev), and organization affiliation. This attribute information provides the foundation for subsequent monitoring classification and strategy application.

[0317] Then, based on the API interfaces of the cloud center platform, virtualization platform, and container platform, the system calls the dynamic resources of the virtual machines, container instances, and microservice components corresponding to the API interfaces. These dynamic resources include configuration information, tag attributes, and running status. API interface calls refer to the system connecting to the application programming interfaces of various management platforms through pre-configured secure access credentials to obtain more detailed resource information. For virtualization platforms (such as VMware vSphere and KVM), the system obtains the virtual machine's specifications, host relationships, resource allocation, and health status through its management API. For container platforms (such as Kubernetes), the system calls the Kubernetes API to obtain container orchestration information, Pod status, service definitions, and namespace partitioning. For cloud platforms (such as AWS and Azure), this embodiment obtains cloud resource instance information, network configuration, and security group rules through the cloud service provider's API. This embodiment implements automated retry and error handling mechanisms for API access, ensuring reliable data acquisition even in the face of temporary network fluctuations or service throttling. Dynamic resource information obtained through APIs is typically more comprehensive and accurate than network scanning, revealing the logical topology relationships within the virtualization layer.

[0318] Subsequently, combining the host list, device attribute information, and dynamic resources, the detected monitoring objects are classified according to device type, business attributes, and network location, and an object information database containing object identifiers, types, locations, attributes, and access methods is established. Object classification refers to establishing a unified monitoring object model and classification system by comprehensively analyzing the information collected in the previous steps. This embodiment adopts a multi-dimensional classification method: classified by device type into servers, network devices, storage devices, application systems, etc.; classified by business attributes into core businesses, support systems, development and testing, etc.; and classified by network location into different security zones, geographical locations, or network segments. The classification process uses a rule engine and pattern matching algorithm, which can handle incomplete or conflicting information. For example, when the information obtained from network scanning and API is inconsistent, this embodiment decides which information to use based on the credibility weight, or marks it as an abnormal situation requiring manual confirmation. The object information database is stored using a graph database structure, with each monitoring object as a node containing rich attribute tags, and the relationships between objects are connected by edges. This structure facilitates the expression of complex dependencies and hierarchical structures, providing a foundation for subsequent monitoring strategy formulation.

[0319] Finally, the object information database is associated with the monitoring task template to generate monitoring object registration information. Task association refers to the system matching discovered monitoring objects with predefined monitoring task templates to determine the specific monitoring operation that should be performed for each object. The monitoring task template is a predefined set of monitoring configurations based on the characteristics of different types of objects, including a set of collection indicators, collection frequency, protocol parameters, etc. In this embodiment, basic matching is first performed based on object type, such as associating all database servers with the "database monitoring template"; then, it is refined according to business attributes, such as database servers for core businesses may require higher monitoring frequency; finally, adjustments are made considering factors such as network location, such as monitoring across wide area networks may require a lower sampling frequency to reduce network overhead. The association process uses multi-level matching rules, supporting both exact and fuzzy matching to ensure that each monitoring object can find a suitable template. The generated monitoring object registration information includes a unique object identifier, applicable template, custom parameters, and access method, serving as the basis for subsequent monitoring task execution. This embodiment periodically re-executes this process to ensure the timeliness and completeness of monitoring coverage.

[0320] In some embodiments, the step of performing data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression on the transformed original monitoring data to obtain the monitoring data to be processed further includes:

[0321] The edge collector caches the monitoring data to be processed locally based on a preset circular buffer, forming a local data cache queue. The local data cache queue is used to support the configuration of specified storage capacity and data retention strategy.

[0322] When the edge collector detects a network anomaly or an interruption in the connection with the cloud center platform, it temporarily stores the collected monitoring data to be processed in the local data cache queue. It supports configuring the maximum storage capacity and data retention policy, and realizes data compression and periodic checks to optimize storage space usage.

[0323] When the edge collector detects that the connection with the cloud center platform has been restored by the current network connection status and cloud communication quality, it re-transmits the cached data in the local data cache queue in chronological order.

[0324] The edge collector transmits the monitoring data to be processed from the local data cache queue to the cloud center platform through a preset encrypted channel and a preset transmission strategy. The transmission strategy is used to indicate whether to select a batch transmission mode or a streaming transmission mode based on the amount of monitoring data to be processed and the real-time requirements.

[0325] In this embodiment, a circular buffer is a special data structure whose memory space is organized in a ring. When a write operation reaches the end of the buffer, it automatically returns to the beginning of the buffer to continue writing, overwriting the oldest data. This structure is particularly suitable for temporary data storage in edge acquisition devices because it can efficiently manage data flow within a fixed-size memory space and avoid the risk of memory leaks. The edge acquisition device establishes multi-level circular buffers for monitoring data of different priorities: key indicators use high-priority buffers to ensure priority retention when capacity is limited; general indicators use standard buffers; and low-value data uses overwriteable buffers. The size of the buffers can be adjusted through configuration, typically determined based on the hardware resources of the edge node, the amount of monitoring data, and the reliability of the network connection. This embodiment also implements data retention strategies, including time-based retention (e.g., retaining data from the most recent 30 minutes) and capacity-based retention (e.g., retaining a maximum of 100MB of data). When the buffer approaches its capacity limit, the system triggers compression or aggregation operations to reduce storage space usage while retaining critical information.

[0326] Next, network anomaly detection refers to the edge collector continuously monitoring the connection status with the cloud center platform to promptly identify network interruptions or quality degradation. This embodiment implements a multi-layered connection detection mechanism: TCP connection status monitoring, periodic heartbeat packet exchange, data transmission latency measurement, and application layer confirmation mechanism. When any detection mechanism reports an anomaly, the system enters a network anomaly handling mode. In this mode, newly collected monitoring data is no longer attempted to be transmitted in real time, but is instead categorized according to data importance: critical alarm data triggers backup notification channels locally (such as SNMP traps); regular monitoring data is stored in a local buffer queue, awaiting retransmission after network recovery. Data retention strategies become particularly important during network anomalies, and this embodiment dynamically adjusts strategies to extend data retention time. For example, by increasing data compression ratio, reducing sampling frequency, or only storing aggregated statistical values, data for as long a period of time as possible can be retained within limited storage space. This embodiment also periodically checks storage usage, and when approaching the capacity limit, cleans up low-value data according to predefined priority rules to ensure that high-value data is not lost due to insufficient storage.

[0327] Then, connection recovery detection refers to confirming that the network connection with the cloud center platform has been restored to stability through multiple consecutive successful connection tests. To avoid frequent mode switching caused by short-lived connections, this embodiment implements a state stability confirmation mechanism, requiring the connection state to remain stable within a certain time window (e.g., 30 seconds) before triggering a mode transition. After connection recovery, the system initiates a data retransmission process, a controlled process designed to efficiently and reliably transmit locally accumulated historical data to the cloud platform without affecting the real-time transmission of new data. The retransmission process has the following characteristics: time-sequential processing to ensure the temporal integrity of data; priority-based processing, transmitting high-value historical data first; bandwidth control to limit retransmission traffic and avoid consuming excessive network resources and affecting normal business operations; breakpoint resumption, supporting continuation from the breakpoint after another network interruption during retransmission; and batch optimization, merging small data packets into larger batches to improve transmission efficiency. This embodiment also records the retransmission progress and status so that execution can be resumed in the event of anomalies, ensuring data integrity.

[0328] Finally, an encrypted channel refers to a data transmission path established using a secure transmission protocol to ensure that monitoring data is not accessed or tampered with during transmission. This embodiment uses the TLS 1.3 protocol to establish an encrypted channel, supporting forward secrecy and secure cipher suites, while implementing a certificate pinning mechanism to prevent man-in-the-middle attacks. The transmission strategy refers to the system dynamically selecting the optimal data transmission method based on data characteristics and network conditions. This embodiment supports two main transmission modes: batch transmission mode, suitable for historical data retransmission and non-real-time monitoring data, which packages multiple data points into larger data blocks to reduce transmission overhead and increase throughput; and streaming transmission mode, suitable for monitoring data with high real-time requirements, which uses a low-latency transmission mechanism to ensure that data arrives at the cloud platform for processing in a timely manner. This embodiment dynamically selects the transmission mode based on multiple factors, including: data timeliness (real-time alarm data is transmitted via streaming); data size (small data volumes can be transmitted in real time, while large data volumes are prioritized for batch transmission); network conditions (when bandwidth is limited, critical data is prioritized for streaming transmission, while non-critical data is transmitted in batches with a delay); and cloud platform load (when high processing pressure is detected on the cloud platform, the transmission rhythm is adjusted to avoid a cascading failure effect). This intelligent transmission mechanism ensures reliable operation in various network environments.

[0329] In some embodiments, writing the target monitoring data into a columnar storage-based distributed columnar storage system further includes:

[0330] Based on the data access frequency and business importance of the target monitoring data, a data lifecycle management strategy is determined. The data lifecycle management strategy is used to instruct the target monitoring data whose data access frequency and business importance exceed the upper limit of a preset normal demand range to be stored in a high-performance storage that supports real-time query; to migrate the target monitoring data whose data access frequency and business importance are within the normal demand range to a storage layer with a cost lower than a preset low-cost threshold; and to compress or archive the target monitoring data whose data access frequency and business importance are lower than the lower limit of the normal demand range to retain only a statistical summary.

[0331] The data lifecycle management strategy is optimized based on the data type, business importance, and compliance requirements of the target monitoring data to obtain a lifecycle optimization strategy. The lifecycle optimization strategy is used to instruct the automatic migration and management of data between different storage layers, so as to optimize storage costs while meeting data retention requirements.

[0332] Based on the target monitoring data, a multidimensional index is created, which is used to indicate queries based on time, object, metric type, and label;

[0333] Based on the multidimensional index and the lifecycle optimization strategy, the target monitoring data is optimized and stored using a preset sharding and replication mechanism to obtain optimized and stored target monitoring data.

[0334] In this embodiment, data lifecycle management refers to automatically planning the movement of data between different storage layers by assessing changes in the value of monitored data, thereby optimizing the balance between storage costs and access performance. This embodiment employs a multi-dimensional evaluation method to determine data value: data access frequency (tracking the frequency and patterns of data queries, with frequently accessed data having higher real-time value); business importance (based on the business attributes and criticality of the monitored object, data from core business systems has higher importance); data freshness (newer data generally has higher analytical value, decreasing over time); and anomaly correlation (historical data related to identified anomalies has higher diagnostic value). Based on these dimensions, this embodiment classifies data into hot data, warm data, and cold data. Hot data is stored in a high-performance storage layer (such as in-memory databases or SSD storage), supporting millisecond-level real-time queries; warm data is stored in a standard performance layer (such as HDD storage), balancing cost and performance; and cold data is compressed and stored in a low-cost archiving layer (such as object storage), retaining only necessary statistical summaries and key event records.

[0335] Next, lifecycle optimization refers to further refining and optimizing data management strategies by analyzing data characteristics and usage patterns from more dimensions. Additional factors considered in this embodiment include: data type characteristics—different types of monitoring data (such as time-series metrics, log events, and topology changes) have different storage characteristics and value decay curves; seasonal access patterns—some data may be accessed frequently during specific time periods (such as the end-of-month reporting period), requiring dynamic adjustment of storage strategies; compliance and audit requirements—some data must be retained for a specific duration due to compliance needs and cannot be simply compressed or deleted; and dynamic changes in storage costs—quotas and migration thresholds for each storage layer are dynamically adjusted based on actual storage usage and cost budget. The optimized lifecycle strategy supports more granular data management, including: condition-triggered migration—automatically triggering data migration based on multi-condition rules; partial field retention—only key fields can be retained for cold data, while low-value details are deleted; time-sharded storage—different storage strategies are used for data in different time ranges; and a pre-warming mechanism—data can be migrated from cold storage to hot storage in advance based on anticipated access demand. This embodiment implements a strategy execution engine that automatically executes data migration and transformation tasks according to predefined scheduling plans or trigger conditions, while recording operation logs for auditing.

[0336] Multidimensional indexes refer to composite index structures built for monitoring data, supporting efficient querying and analysis of data from multiple dimensions. This embodiment employs a combined indexing strategy, creating different types of indexes based on query pattern characteristics: time-dimensional indexes, optimized for time-range queries of time-series data, using hierarchical time partitioning and timeline index structures; object-dimensional indexes, optimized for queries of specific monitored objects, establishing a fast mapping from object IDs to data locations; metric-type indexes, optimized for queries of specific types of monitoring metrics, such as CPU utilization and memory consumption; and tag-dimensional indexes, optimized for queries based on tags and attributes, supporting multi-tag combined condition queries. The creation process of multidimensional indexes considers query frequency and pattern analysis, prioritizing optimization of the index structure for high-frequency query patterns. This embodiment implements an adaptive indexing mechanism, dynamically adjusting the indexing strategy according to actual query patterns: automatically identifying frequent query patterns and creating dedicated indexes for them; identifying inefficient indexes and removing or reconstructing them; and optimizing index parameters based on data distribution characteristics. Multidimensional indexes significantly improve data query performance, enabling the system to support complex real-time analysis and visualization needs, while providing efficient data access capabilities for anomaly detection and alarm assessment.

[0337] Finally, sharding and replication mechanisms refer to achieving storage scalability and high availability by horizontally partitioning data (sharding) and creating multiple data replicas (replication). Sharding divides a dataset into multiple smaller segments according to specific rules (such as time range, object ID hash, etc.) and distributes them across multiple nodes. This embodiment employs intelligent sharding strategies: time-priority sharding, allocating data from different time periods to different shards for easy historical data archiving; object affinity sharding, allocating data of related objects to the same shard as much as possible to reduce cross-shard queries; and load-balanced sharding, dynamically adjusting shard allocation to avoid performance issues caused by the concentration of hot data. Replication maintains copies of the same data on multiple storage nodes to improve data availability and read performance. This embodiment implements a multi-level replication strategy: multiple replicas of critical data to ensure high availability of important data; geographically distributed replication, replicating across data centers or regions to provide disaster recovery capabilities; and read / write separation, using replicas to distribute the read load and improve query performance. This embodiment also implements a data consistency guarantee mechanism to ensure data accuracy in a distributed environment: a write confirmation policy that requires confirmation from a majority of replicas before a write is considered successful; conflict detection and resolution to handle data conflicts caused by concurrent writes; and automatic repair to detect and repair damaged or inconsistent data replicas. Through these optimized storage mechanisms, this embodiment can efficiently manage massive amounts of monitoring data while ensuring data availability and consistency.

[0338] In some embodiments, the alarm content of the alarm event is obtained through the following steps:

[0339] Based on the anomaly detection results, the trend prediction results, and the target monitoring data, different anomaly indicators of the same monitoring object are correlated, and correlation analysis and causal reasoning are performed on the anomaly detection results, the trend prediction results, and the target monitoring data to identify potential root causes of alarms, and to analyze the abnormal states of dependent services and related components to determine the propagation path and scope of impact of the problem.

[0340] Based on the service importance and anomaly severity determined by the anomaly indicators, the root cause of the alarm, the dependent services, the anomaly state, the propagation path, and the scope of impact, the business impact caused by the anomaly is assessed, the processing priority is determined based on the business impact, and alarm content containing the root cause of the alarm, the scope of impact, the processing priority, and the corresponding suggested processing solution is generated.

[0341] Merge similar alarm events within a specified time window, and merge multiple related alarm events into a single root cause alarm event, and push alarms to the merged alarm event within the specified time window according to the processing priority.

[0342] In this embodiment, firstly, indicator correlation refers to the comprehensive analysis of multiple abnormal indicators from the same monitored object to discover their inherent connections. For example, when a server simultaneously exhibits high CPU utilization, increased memory usage, and prolonged response time, these indicators collectively point to a problem of excessive system load. This embodiment employs time series correlation analysis to calculate the temporal correlation and similarity of change patterns among different indicators, identifying highly correlated indicator groups. Correlation analysis involves the system performing statistical analysis on multi-source monitoring data to find correlations and patterns between indicators. This embodiment implements several correlation analysis algorithms: Pearson correlation coefficient calculation to identify linear correlations; Dynamic Time Warping (DTW) algorithm to identify similar patterns in time series, even with time offsets; and Granger causality test to assess whether a change in one indicator can predict a change in another. Causal inference in this embodiment involves inferring causal chains between abnormal indicators based on prior knowledge and statistical evidence. This embodiment uses a Bayesian network model to represent dependencies between components and fault propagation paths, deriving the most likely root cause from observed anomalies. Propagation path analysis refers to the system determining how a problem spreads from its source to related systems based on service dependency graphs and historical fault patterns. This embodiment constructs a service dependency graph to represent the call relationships and data flow between monitored objects. Then, based on the anomaly sequence and component status, it simulates the propagation process of the fault along the dependency relationship to determine the scope of impact and critical path.

[0343] Next, business impact assessment refers to transforming technical anomalies into an impact assessment from a business perspective, helping decision-makers understand the severity and urgency of the problem. This embodiment assesses business impact based on the following dimensions: service importance, assigning importance weights to each service according to its business criticality (e.g., the core transaction system has the highest importance); anomaly severity, assessing the degree of impact of the anomaly on service functionality and performance (e.g., complete unavailability, severe performance degradation, or minor impact); impact scope, assessing the number of affected users, number of business processes, or data volume; and duration, assessing the duration the anomaly has lasted and the estimated recovery time. Processing priority is the process by which the system assigns a processing order to alarm events based on the business impact assessment results. This embodiment uses a multi-factor weighting model to calculate priority scores, considering factors including: the severity of business impact, potential economic losses, recovery difficulty, spread risk, and time-based eavesdropping. Priorities are typically divided into multiple levels, such as P0 (highest, requiring immediate action) to P3 (low, can be planned). Alarm content generation is the process by which the system transforms the analysis results into structured, actionable alarm information. The generated alarm content includes the following key elements: alarm identifier and timestamp; detailed description of the abnormal object and indicator; root cause analysis results, explaining the most likely fault point and cause; impact scope and severity assessment; handling priority and suggested response time; suggested handling solutions, based on specific operational steps provided by historical similar cases and knowledge base; relevant evidence and indicator data to support the analysis conclusions; and related events and contextual information to provide a broader fault background. This embodiment uses natural language generation technology to organize these elements into a clearly structured and easy-to-understand alarm description, enabling operations and maintenance personnel to quickly grasp the key points of the problem.

[0344] Finally, alarm merging is the process of reducing the number of alarms and preventing alarm storms by identifying and combining related alarms. This embodiment implements several alarm merging strategies: time window merging, which merges alarms of the same type that occur within a short period of time (e.g., 5 minutes) into a single event and records the number of occurrences; similarity merging, which merges similar alarms based on alarm attribute similarity (e.g., same component, similar error code); and state change suppression, which retains only the latest state and records the change frequency when the object state changes repeatedly (e.g., service restarts continuously). Root cause merging is the process by which the system identifies multiple causally related alarms and organizes them into a hierarchical structure centered on the root cause. For example, when a database failure causes multiple application service anomalies, the database failure is identified as the root cause, and the application service alarms are identified as related alarms. This embodiment uses root cause analysis algorithms based on topology and time series: topology dependency analysis, which infers the fault propagation path based on the service dependency graph; time series correlation analysis, which identifies leading events based on the time sequence of alarm occurrences; and fault mode matching, which compares the current alarm combination with historical fault modes to identify known fault scenarios. Alarm push is the process of sending processed alarm information to relevant personnel or systems. This embodiment implements differentiated push strategies based on alarm priority and type: high-priority alarms are pushed through multiple channels (such as SMS, telephone, and instant messaging) to ensure timely response; medium- and low-priority alarms are pushed via email or alarm platforms; specific types of alarms are pushed to dedicated teams (such as notifying the network team of network issues). This embodiment also implements intelligent push rhythm control to avoid interference caused by excessive notifications in a short period: minimum intervals are set for alarms of the same type; different notification strategies are used during working hours and non-working hours; low-priority alarms are accumulated and summary reports are pushed in batches periodically. Through these mechanisms, this embodiment can provide comprehensive monitoring coverage while avoiding alarm overload, ensuring that the operations and maintenance team can focus on the most important issues.

[0345] like Figure 2 As shown, the agentless intelligent monitoring and alarm device 20 includes: a cloud center platform 21 and an edge collector 22;

[0346] The cloud center platform 21 is used to obtain monitoring task configuration information and synchronize it to the edge collector through a security control channel based on mutual transport layer security. The monitoring task configuration information includes monitoring collection tasks, protocol adaptation rules, data filtering conditions, sampling frequency, encryption method and anomaly detection strategy.

[0347] The edge collector 22 is used to pull monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and to perform preprocessing operations such as format conversion, key field extraction, data filtering and compression on the monitoring data to obtain monitoring data to be processed.

[0348] The cloud center platform 21 is used to decrypt, decompress, and verify the integrity of the monitoring data to be processed sent by the edge collector, and to perform data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data.

[0349] The cloud center platform 21 is used to perform anomaly detection on the target monitoring data using a preset anomaly detection model, perform trend prediction on the target monitoring data using a preset time series prediction model, adjust the alarm threshold through a preset adaptive alarm threshold engine, and compare the anomaly detection result, trend prediction result, target monitoring data and alarm threshold to generate corresponding alarm information.

[0350] The apparatus in this application embodiment can execute the method provided in this application embodiment, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of each embodiment of this application. For detailed functional descriptions of each module of the apparatus, please refer to the descriptions in the corresponding methods shown above, which will not be repeated here.

[0351] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An agentless intelligent monitoring and alarm method, characterized in that, Includes the following steps: The cloud center platform obtains the monitoring task configuration information and synchronizes it to the edge collector through a security control channel based on mutual transport layer security. The monitoring task configuration information includes the monitoring acquisition task, protocol adaptation rules, data filtering conditions, sampling frequency, encryption method and anomaly detection strategy. The edge collector pulls monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and performs preprocessing operations such as format conversion, key field extraction, data filtering and compression on the monitoring data to obtain the monitoring data to be processed. The cloud center platform decrypts, decompresses, and verifies the integrity of the monitoring data to be processed sent by the edge collector, and performs data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data. The cloud center platform uses a preset anomaly detection model to detect anomalies in the target monitoring data, uses a preset time series prediction model to predict trends in the target monitoring data, adjusts alarm thresholds through a preset adaptive alarm threshold engine, and compares the anomaly detection results, trend prediction results, target monitoring data, and alarm thresholds to generate corresponding alarm information.

2. The method according to claim 1, characterized in that, The cloud center platform acquires monitoring task configuration information and synchronizes it to the edge collectors through a secure control channel based on mutual transport layer security, including: The cloud center platform determines the monitoring object type, key indicators, collection method, protocol parameters and data processing rules based on the pre-set standard monitoring template and the custom monitoring template in order to generate monitoring task templates; The cloud center platform obtains the edge collector information of the registered edge collectors, and manages the edge collectors in groups according to network area, business attributes and / or monitoring tasks, and determines the task allocation information of each edge collector. The edge collector information includes collector identifier, network location, resource capabilities and current status. The edge collector obtains the monitored objects in the network through network scanning and / or DNS query and reports them to the cloud center platform, so that the cloud center platform generates the monitoring object registration information of the monitored objects. The monitoring object registration information includes object task information, which is used to indicate the association between the monitored object and the monitoring task template. The cloud center platform generates monitoring task configuration information based on the monitoring task template, the task allocation information, and the monitoring object registration information. The monitoring task configuration information includes the target object address, access credentials, data collection protocol, sampling frequency, filtering conditions, local processing rules, encryption method, and anomaly detection strategy. The cloud center platform synchronously distributes the monitoring task configuration information to the corresponding edge collectors through a secure control channel based on mutual transport layer security.

3. The method according to claim 2, characterized in that, The edge collector pulls monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and performs preprocessing operations on the monitoring data, including format conversion, key field extraction, data filtering, and compression, to obtain monitoring data to be processed, including: The corresponding protocol adapter is initialized according to the monitoring task configuration information, and a multi-protocol adapter is established by loading protocol-specific parameters according to the protocol adapter. The protocol-specific parameters include timeout settings, retry policies and connection pool configurations. The protocol adapter is used to adapt to SSH protocol, HTTP protocol, SNMP protocol and JDBC protocol. A preset local encrypted storage mechanism is used to save the access credentials information corresponding to the monitored object. The access credentials information includes username, password, API key, and certificate. Based on the configured sampling frequency and scheduling strategy, a data acquisition request is initiated to the monitored object through the multi-protocol adapter to obtain the original monitoring data of the monitored object; Using a preset data extraction algorithm, unstructured or semi-structured data in the original monitoring data is converted into structured data to obtain the converted original monitoring data. The structured data is used to indicate data in key-value pair format. The transformed raw monitoring data is subjected to data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression to obtain the monitoring data to be processed.

4. The method according to claim 3, characterized in that, The cloud center platform decrypts, decompresses, and verifies the integrity of the monitoring data to be processed sent by the edge collector, and performs data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data, including: The received monitoring data to be processed is decrypted, and the digital signature and edge collector identity associated with the monitoring data to be processed are verified. The data format and data consistency of the monitoring data to be processed are also verified to obtain the verified monitoring data to be processed. The verified monitoring data to be processed is decompressed, and the data is deserialized from the transmission format into a data object in memory using a predefined data mode to obtain the decompressed monitoring data. Repeatedly perform data detection and merging, missing value handling, outlier detection and correction, time sequence alignment and data precision adjustment on the decompressed monitoring data to obtain standard monitoring data with a preset standard data model format; A real-time aggregation operation is performed on the time-series monitoring data collected at a preset high acquisition frequency in the standard monitoring data to generate statistical values ​​at different time granularities; The standard monitoring data is associated with the metadata in the preset configuration management database, and context information is added to each standard monitoring data to generate target monitoring data. The target monitoring data is then written into a distributed columnar storage system based on columnar storage. The context information includes asset identifier, business attributes, topology relationships, and service dependencies.

5. The method according to claim 4, characterized in that, The cloud center platform uses a preset anomaly detection model to detect anomalies in the target monitoring data, uses a preset time series prediction model to predict trends in the target monitoring data, adjusts alarm thresholds through a preset adaptive alarm threshold engine, and compares the anomaly detection results, trend prediction results, the target monitoring data, and the alarm thresholds to generate corresponding alarm information, including: The latest target monitoring data is obtained from the distributed columnar storage system. The obtained target monitoring data is then standardized, denoised, feature extracted, and missing value processed, and organized into a feature vector. An anomaly detection model is constructed based on a preset isolated forest algorithm. The anomaly detection model is used to identify the feature vector to obtain anomaly detection results. The anomaly detection results include anomaly points and their corresponding anomaly scores, anomaly types, and impact degree evaluation values. A time series prediction model is constructed based on a preset autoregressive integral moving average model. The feature vector is input into the time series prediction model, and the feature vector is decomposed into a time series. The time series decomposition result is used to optimize the model parameters of the time series prediction model, and the predicted value of the monitoring data is obtained using the optimized model parameters. The predicted value of the monitoring data within a preset time window is compared with a preset confidence interval to generate a trend prediction result. The time series decomposition result includes time series trend data, seasonal detection results, and residual components. The trend prediction result is used to indicate potential abnormal trends. By combining pre-acquired historical data patterns and the current system status, an algorithm combination is used to calculate the alarm threshold of the monitoring indicators. The algorithm combination consists of at least two of the following: a pre-set historical quantile algorithm, a periodic pattern modeling algorithm, a load-related adjustment algorithm, and a fluctuation sensitivity adaptive algorithm. When the anomaly detection result, the trend prediction result, and / or the target monitoring data meet at least one alarm condition, a corresponding alarm event is generated. Multi-source information fusion analysis is then performed on the anomaly detection result, the trend prediction result, and the alarm threshold, combining the topological relationships and service dependency information between monitored objects, to obtain the alarm content of the alarm event. The alarm conditions include an anomaly score in the anomaly detection result exceeding a preset anomaly threshold, an anomaly change trend within a preset time window indicated by the trend prediction result exceeding a preset change threshold, and the target monitoring data exceeding the alarm threshold. The alarm content includes an anomaly object identifier, the root cause of the alarm, relevant data of the monitoring indicators, the anomaly score, processing priority, and a suggested processing solution.

6. The method according to claim 5, characterized in that, The step of associating the standard monitoring data with metadata in a preset configuration management database and adding context information to each piece of standard monitoring data includes: The dependencies and interaction patterns between the monitored objects are modeled to construct a multi-level directed graph topology model. Each node in the multi-level directed graph topology model represents the monitored object, and the edges in the multi-level directed graph topology model represent one or more of the following relationships between the monitored objects: physical layer device connection relationship, network layer communication relationship, application layer service call relationship, and business layer process dependency. Based on a pre-defined directed q-analysis algorithm, q+1 related monitoring objects in the multi-level directed graph topology model are grouped into a q-dimensional simplex. All q-dimensional simplexes are combined into a simplex complex, and the Betti number is calculated. The skeleton structure of the multi-level directed graph topology model is extracted, so that the structural characteristics of the monitoring network to which the monitoring object resides can be determined based on the simplex complex, the Betti number, and the skeleton structure. The Betti number is used to evaluate the topological connectivity of the multi-level directed graph topology model. The skeleton structure is used to describe the critical paths and node set of the topology of the monitoring network. The structural features include critical nodes, highly dependent areas, potential bottlenecks, and redundant paths. The time dimension is introduced into the structural features. An analysis time window is determined based on the change frequency of the monitored object. The topology structure at different time points in the analysis time window is compared to identify topological changes. The evolution rate of the topology structure over time is calculated based on the topological changes. High-change regions and stable regions are identified based on the evolution rate and the topological changes. Corresponding resource optimization allocation strategies are generated for the high-change regions and the stable regions. The resource optimization allocation strategies are used to indicate increasing the sampling frequency of the high-change regions and decreasing the analysis frequency of the stable regions. Based on the structural characteristics and the resource optimization allocation strategy, a topology criticality index is calculated for each monitored object, the impact propagation path of each potential fault point is calculated, and the monitoring granularity of the monitored object is adjusted according to the topology criticality index, the impact propagation path and the structural characteristics. Redundant paths in the monitoring network are marked according to the structural characteristics. The topology criticality index includes centrality, bridging value and impact range. The standard monitoring data, structural features, resource optimization allocation strategy, topological criticality index, impact propagation path, monitoring granularity, and the monitoring network after marking the redundant paths are fused to generate context information.

7. The method according to claim 6, characterized in that, The transformed original monitoring data undergoes data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression to obtain the monitoring data to be processed, including: An energy and information model is established for each monitoring indicator and processing operation. The energy and information model is used to indicate the degree of contribution of the monitoring indicator to anomaly detection and system status assessment, determine the information value score corresponding to the degree of contribution, quantify the energy consumption of data acquisition, local processing computing, data transmission network, and storage operation, and construct the energy-information trade-off curve corresponding to the monitoring task to identify the optimal operating point. Based on the energy and information model, the sampling frequency is adjusted according to the historical fluctuation pattern of the monitoring indicators, the current operating level of the indicators, and the importance of the business. A processing task priority queue is established, and computing resources are reserved for the specified key indicators. This allows the simulation of the behavior characteristics of the specified memristor to allocate resources based on the adjusted sampling frequency, the processing task priority queue, and the reserved computing resources. The data precision adjustment strategy is determined based on the preset information value, and a compression optimization strategy is generated using the specific characteristics of the transformed original monitoring data. The data precision adjustment strategy is used to indicate that the preset high precision is maintained for high-value indicators and the bit width or precision is reduced for low-value indicators. The compression optimization strategy is used to indicate that the corresponding time-series compression algorithm is applied to the time-series data in the transformed original monitoring data, key change points are retained, and the compression degree of stable areas is increased. Based on the data value of the transformed original monitoring data, the network status and energy level of the monitoring network, a transmission scheduling strategy is determined and a multi-level data transmission strategy is established. The transmission scheduling strategy is used to indicate that high-value data is transmitted first and non-critical data is transmitted in batches with delayed transmission. The multi-level data transmission strategy is used to indicate that critical anomalies are transmitted in real time, important indicators are transmitted in batches periodically, and baseline data is transmitted in large batches at low frequency. Energy efficiency is assessed for each monitoring task, and resource allocation is optimized based on a global view. Task sharing among multiple edge nodes is coordinated to obtain the monitoring data to be processed.

8. The method according to claim 7, characterized in that, The anomaly detection model is constructed based on a preset isolated forest algorithm. This model is then used to identify the feature vectors to obtain anomaly detection results, including: The feature vector is encoded using a data preprocessing framework based on integrated spike patch segmentation to obtain multimodal encoded data. The multimodal encoded data includes time-series index encoded data, log event encoded data, topological state encoded data, pulse frequency encoded data, discrete spike sequences, and spike time-series patterns. The pulse frequency is converted from the numerical index in the feature vector through a preset comparison threshold. The discrete spike sequence is mapped from the event data in the feature vector. The spike time-series patterns are converted from the state changes in the feature vector. The data preprocessing framework is used to obtain a multi-scale time window. Based on the multi-scale time window, the inherent frequency features of the time series are extracted, and the time granularity of target monitoring data from different sources is aligned. A time and frequency dual-domain representation corresponding to the feature vector is constructed. Based on the multi-scale time window, the inherent frequency features, the aligned time granularity, and the time and frequency dual-domain representation, time stability data is established. Using the data preprocessing framework, the feature vector is converted into temporal patches, and spatial features are extracted from the feature vector. Based on the correlation between the temporal patches and the spatial features, feature association relationships are obtained, so that a monitoring data representation is generated based on the multimodal coded data, the temporal stability data, and the feature association relationships. The calculation strategy for the monitoring data representation is triggered by a preset peak neural network. The calculation strategy includes generating corresponding calculation peak data when the data change rate of the monitoring data representation exceeds a preset data change threshold, and calculating corresponding resource allocation data when the data change rate of the monitoring data representation is lower than a preset low change threshold. A preset peak Transformer network is established. The peak Transformer network is used to extract features at multiple scales by fusing preset temporal attention mechanisms and spatial attention mechanisms, capture feature anomalies at different time spans, and perform hierarchical anomaly detection. Based on the complexity and probability of anomalies represented by the monitoring data, allocate corresponding computing resources; The isolated forest algorithm is fused with the preset STAS framework to obtain a decision tree. The decision tree is re-evaluated based on the data changes represented by the monitoring data, and the depth and sampling strategy of the decision tree are dynamically adjusted. Based on the computing strategy, the spike Transformer network, the allocated computing resources, the re-evaluation results, the depth and sampling strategy of the decision tree, a spatiotemporally adaptive anomaly detection model is obtained.

9. The method according to claim 8, characterized in that, The monitoring data representation is obtained through the following steps: The numerical index is compared with the comparison threshold. The numerical index values ​​exceeding the comparison threshold are converted into high-frequency pulses, and the numerical index values ​​below the comparison threshold are converted into low-frequency pulses. The values ​​are mapped to the corresponding pulse frequency encoded data according to their magnitude, and the time attribute and relative intensity of the feature vector are preserved. The alarm events, status changes, and system logs contained in the event-type data are mapped into discrete spike sequences according to event type and importance. The discrete spike sequences include high-amplitude spikes generated by alarm events whose importance is higher than the upper limit of a preset importance range, and medium-amplitude spikes generated by alarm events whose importance is within the importance range. The node online / offline status, connection establishment / disconnection, and path change contained in the topology state in the feature vector are converted into spike patterns corresponding to the state change types of the topology state. The high-frequency changes within a short time window and the trend changes within a long time window are processed separately to extract the inherent frequency features of the time series, which include periodicity, suddenness, and gradualness. A time-frequency dual-domain representation is constructed, which is used to indicate the temporal relationship of the feature vector in the time domain and to analyze the spectral characteristics of the feature vector in the frequency domain. A correlation diagram between the time patches and the spatial features is established to obtain a representation of the monitoring data.

10. The method according to claim 9, characterized in that, The cloud center platform acquires monitoring task configuration information and synchronizes it to the edge collector via a secure control channel based on mutual transport layer security. It then discovers monitorable objects in the network through network scanning and DNS queries and reports them to the cloud center platform. Combined with manually added monitoring object information, it generates categorized and stored monitoring object registration information, which also includes: Based on the network address range configuration, a network range scan is performed to detect active hosts in the network by specifying the protocol, and port scans are performed on the detected active hosts to identify the types of services they are running, generating a list of hosts containing IP addresses, open ports and service types; Based on the host list, domain name resolution records are obtained through DNS queries, and the domain name information of devices in the network is identified based on the domain name resolution records. Combined with reverse DNS queries, the device attribute information of the devices is determined from the domain name information. The devices include servers, application systems, and network devices, and the device attribute information includes functional roles and business attributes. Based on the API interfaces of the cloud center platform, virtualization platform, and container platform, the dynamic resources of the virtual machines, container instances, and microservice components corresponding to the API interfaces are called. The dynamic resources include configuration information, tag attributes, and running status. Combining the host list, the device attribute information, and the dynamic resources, the detected monitoring objects are classified according to device type, service attribute, and network location, and an object information database containing object identifier, type, location, attribute, and access method is established. The object information database is associated with the monitoring task template to generate monitoring object registration information.

11. The method according to claim 10, characterized in that, The process of performing data type conversion, unit standardization, invalid value filtering, timestamp normalization, and data compression on the transformed original monitoring data to obtain the monitoring data to be processed also includes: The edge collector caches the monitoring data to be processed locally based on a preset circular buffer, forming a local data cache queue. The local data cache queue is used to support the configuration of specified storage capacity and data retention strategy. When the edge collector detects a network anomaly or an interruption in the connection with the cloud center platform, it temporarily stores the collected monitoring data to be processed in the local data cache queue. It supports configuring the maximum storage capacity and data retention policy, and realizes data compression and periodic checks to optimize storage space usage. When the edge collector detects that the connection with the cloud center platform has been restored by the current network connection status and cloud communication quality, it re-transmits the cached data in the local data cache queue in chronological order. The edge collector transmits the monitoring data to be processed from the local data cache queue to the cloud center platform through a preset encrypted channel and a preset transmission strategy. The transmission strategy is used to indicate whether to select a batch transmission mode or a streaming transmission mode based on the amount of monitoring data to be processed and the real-time requirements.

12. The method according to claim 11, characterized in that, The step of writing the target monitoring data into a distributed columnar storage system based on columnar storage further includes: Based on the data access frequency and business importance of the target monitoring data, a data lifecycle management strategy is determined. The data lifecycle management strategy is used to instruct the target monitoring data whose data access frequency and business importance exceed the upper limit of a preset normal demand range to be stored in a high-performance storage that supports real-time query; to migrate the target monitoring data whose data access frequency and business importance are within the normal demand range to a storage layer with a cost lower than a preset low-cost threshold; and to compress or archive the target monitoring data whose data access frequency and business importance are lower than the lower limit of the normal demand range to retain only a statistical summary. The data lifecycle management strategy is optimized based on the data type, business importance, and compliance requirements of the target monitoring data to obtain a lifecycle optimization strategy. The lifecycle optimization strategy is used to instruct the automatic migration and management of data between different storage layers, so as to optimize storage costs while meeting data retention requirements. Based on the target monitoring data, a multidimensional index is created, which is used to indicate queries based on time, object, metric type, and label; Based on the multidimensional index and the lifecycle optimization strategy, the target monitoring data is optimized and stored using a preset sharding and replication mechanism to obtain optimized and stored target monitoring data.

13. The method according to claim 12, characterized in that, The alarm content of the alarm event is obtained through the following steps: Based on the anomaly detection results, the trend prediction results, and the target monitoring data, different anomaly indicators of the same monitoring object are correlated, and correlation analysis and causal reasoning are performed on the anomaly detection results, the trend prediction results, and the target monitoring data to identify potential root causes of alarms, and to analyze the abnormal states of dependent services and related components to determine the propagation path and scope of impact of the problem. Based on the service importance and anomaly severity determined by the anomaly indicators, the root cause of the alarm, the dependent services, the anomaly state, the propagation path, and the scope of impact, the business impact caused by the anomaly is assessed, the processing priority is determined based on the business impact, and alarm content containing the root cause of the alarm, the scope of impact, the processing priority, and the corresponding suggested processing solution is generated. Merge similar alarm events within a specified time window, and merge multiple related alarm events into a single root cause alarm event, and push alarms to the merged alarm event within the specified time window according to the processing priority.

14. An agentless intelligent monitoring and alarm device, characterized in that, include: Cloud center platform and edge collectors; The cloud center platform is used to obtain monitoring task configuration information and synchronize it to the edge collector through a security control channel based on mutual transport layer security. The monitoring task configuration information includes monitoring collection tasks, protocol adaptation rules, data filtering conditions, sampling frequency, encryption method and anomaly detection strategy. The edge collector is used to pull monitoring data through a multi-protocol adapter corresponding to the monitoring task configuration information, and to perform preprocessing operations such as format conversion, key field extraction, data filtering and compression on the monitoring data to obtain monitoring data to be processed. The cloud center platform is used to decrypt, decompress, and verify the integrity of the monitoring data to be processed sent by the edge collector, and to perform data cleaning, aggregation, and context enrichment operations to obtain the target monitoring data. The cloud center platform is used to detect anomalies in the target monitoring data using a preset anomaly detection model, predict trends in the target monitoring data using a preset time series prediction model, adjust alarm thresholds using a preset adaptive alarm threshold engine, and compare the anomaly detection results, trend prediction results, target monitoring data, and alarm thresholds to generate corresponding alarm information.

Images