A server health prediction method and system based on multi-time sequence features

Abstract

The application relates to a kind of server health prediction method and system technology field based on multiple time sequence characteristics, disclose a kind of method and system named a kind of server health prediction method and system based on multiple time sequence characteristics, to solve the problem of insufficient and poor real-time prediction of heterogeneous index coupling mining.The characteristics are as follows: deploy multi-dimensional probe to collect physical, kernel and application layer heterogeneous index, perform adaptive preprocessing and time scale alignment;Build multi-scale time-frequency domain feature extraction operator for spatio-temporal coupling correlation analysis, generate a comprehensive feature view reflecting the global state;Use the deep model based on attention mechanism and bidirectional long short-term memory network to output health score and trigger early warning.Through the adoption of the above technical solutions, the application can capture cross-layer weak failure signs, significantly improve the prediction accuracy, real-time and adaptive operation and maintenance capability of the system.

Description

Technical Field

[0001] This invention relates to the fields of computer technology and operation and maintenance monitoring technology, and in particular to a server health prediction method and system based on multiple time series features. Background Technology

[0002] With the rapid development of cloud computing and big data centers, the operational stability of servers as core infrastructure is crucial. Traditional server maintenance relies heavily on reactive measures or simple threshold alarms, which are insufficient to cope with the highly dynamic and high-load operating environment of modern data centers. Therefore, developing efficient and accurate server health prediction methods and systems to anticipate failure risks and achieve proactive maintenance has become a research hotspot for improving system availability.

[0003] A search revealed a method, system, electronic device, and storage medium for server health diagnosis, with publication number CN117194188A, published on December 8, 2023. This patent collects historical indicator data from the server and inputs it into a pre-established time series model for iterative training. Based on new observations, it obtains prediction results and thus diagnoses the server's health status. However, this technical solution mainly focuses on predicting the trend of a single or specific indicator over time, failing to fully consider the complex temporal coupling relationships between multiple heterogeneous indicators within the server (such as CPU, memory, disk I / O, network throughput, etc.). This lack of deep fusion of multi-dimensional time series features may lead to missed or false alarms under complex operating conditions, and the overall accuracy of the prediction needs improvement.

[0004] A search revealed a cloud server health management method and system based on a large model, with publication number CN119065920A and publication date December 3, 2024. This patent utilizes a GRU (Gated Recurrent Unit) model based on error compensation to provide early warnings of performance status data and combines it with a finely tuned large model to output maintenance suggestions. However, although this technical solution introduces a recurrent neural network to process sequential data, its modeling process relies heavily on the error adjustment of a single GRU unit. When processing time series features with ultra-high dimensionality and multiple sampling frequencies, the depth and breadth of feature extraction are limited, making it difficult to uncover deep-seated nonlinear collaborative features. Furthermore, the concatenation mechanism between the early warning model and the large model in this solution may incur significant computational overhead in prediction scenarios with high real-time requirements, making it difficult to achieve ultra-fast response.

[0005] The aforementioned problems indicate that existing server health prediction technologies still have certain shortcomings in multi-feature collaborative analysis, deep time series modeling, and the balance between prediction accuracy and real-time performance. Therefore, this invention provides a server health prediction method and system based on multiple time series features. It aims to optimize the correlation analysis between features through joint mining and fusion modeling of multi-dimensional time series features, thereby improving the accuracy and robustness of prediction results and meeting the needs of modern data centers for efficient and intelligent server health prediction. Summary of the Invention

[0006] The present invention aims to solve the technical problems existing in the above-mentioned background technology, such as low prediction accuracy of single indicators, insufficient mining of heterogeneous indicator coupling relationship, limited depth of ultra-high dimension sequence feature extraction, and imbalance between prediction accuracy and real-time performance, and provides a server health prediction method and system based on multiple time series features.

[0007] To achieve the above-mentioned objectives, this invention provides a server health prediction method based on multiple time series features. This method deploys multi-dimensional monitoring probes at the underlying physical layer, operating system kernel layer, and application middleware layer of the server cluster to achieve real-time acquisition of heterogeneous performance indicators and deep fusion modeling of multimodal spatiotemporal features. The server health prediction method based on multiple time series features of this invention specifically includes the following steps: The first step is to establish a multi-source heterogeneous real-time monitoring data acquisition architecture. This step synchronously collects physical layer hardware status data, kernel layer resource scheduling data, and application layer task execution data of the server through a pre-defined out-of-band management interface and in-band monitoring agent. The physical layer hardware status data includes, but is not limited to, processor core temperature, motherboard voltage fluctuation, cooling fan speed, and memory module checksum count. The kernel layer resource scheduling data includes the processor's time ratio between user mode and kernel mode, local and remote access latency of non-uniform memory access structures, disk I / O wait queue length, and network protocol stack retransmission packet ratio. The application layer task execution data includes process context switching frequency, number of software and hardware interrupts, and response time of specific business logic. During the acquisition process, differentiated sampling frequencies are set for different dimensions of indicators. High-frequency sampling is used for transient electrical signal indicators, and low-frequency sampling is used for capacity indicators with strong trends. A high-precision nanosecond-level timestamp is attached to each acquired data point.

[0008] The second step involves adaptive preprocessing and time-scale alignment of the multi-time series data. Since the multi-source data are collected from different subsystems, the original sequences suffer from inconsistent sampling frequencies, time-scale offsets, and missing observations. This step first maps the heterogeneous sampling frequency sequences to a unified time baseline using a combination of linear interpolation and Lagrange polynomial interpolation. Then, a median filtering algorithm based on a sliding window is used to remove random impulse noise from the original sequences. To address the dimensional differences in the data, this step employs a min-max normalization method to map each dimension's indicators to a preset numerical range, thus eliminating the influence of dimensions on subsequent feature fusion.

[0009] The third step involves constructing multi-scale time-domain and frequency-domain feature extraction operators. This step focuses not only on the absolute values ​​of the indicators but also on mining the statistical characteristics of the sequence during its dynamic evolution. In the time domain, multiple sliding observation windows of varying lengths are set to calculate the mean, variance, skewness, kurtosis, and first and second-order differences of the data within each window, thus characterizing the intensity and trend of the indicator's fluctuations. In the frequency domain, a Fast Fourier Transform is used to transform the stationary sequence to the frequency space, extracting the power spectral density distribution characteristics and the dominant frequency component to capture potential periodic load fluctuations and harmonic vibration interference that may exist during server operation.

[0010] The fourth step involves conducting spatiotemporal coupling correlation analysis of multi-dimensional features. This step aims to uncover the nonlinear synergistic relationships between different performance indicators. By constructing a heterogeneous indicator correlation matrix, the cross-correlation coefficients of any two indicator sequences under different time lags are calculated. Furthermore, partial correlation analysis is used to eliminate spurious correlation factors, identifying a feature set with causal linkages. This feature set is then mapped to a high-dimensional feature vector space, forming a comprehensive feature view that reflects the overall operational status of the server.

[0011] The fifth step involves establishing a deep prediction model based on an attention mechanism and a bidirectional long short-term memory network. This model includes an input layer, a spatiotemporal convolutional layer, a bidirectional feature extraction layer, an attention allocation layer, and a prediction output layer. The spatiotemporal convolutional layer uses a one-dimensional convolutional kernel sliding along the time axis to extract local temporal-dependent features. The bidirectional feature extraction layer uses two sets of long short-term memory units in opposite directions to capture the forward causal logic and backward correlation information of the sequence, respectively. The attention allocation layer dynamically adjusts the weight coefficients of each feature component by calculating the contribution of each feature dimension to the health prediction result.

[0012] Step 6: Perform health level prediction and anomaly warning triggering. The fused feature vector is input into the trained deep prediction model, which outputs a server health score for a preset future time window. This step pre-sets multiple health thresholds; when the predicted health score falls below a preset safety threshold, the system automatically triggers an warning mechanism. Simultaneously, by combining feature contribution ranking, the core anomaly indicators causing the health decline are identified, achieving a closed loop from prediction to attribution.

[0013] Furthermore, in the first step, the physical layer hardware status data is collected through the intelligent platform management interface of the baseboard management controller, with a collection frequency set to once per second. Kernel layer resource scheduling data is collected by directly reading the statistical structures of the system kernel during runtime using kernel probe technology, ensuring high-precision performance metrics are obtained without increasing system call overhead. Application layer data is obtained through bytecode instrumentation or side-channel log monitoring to achieve complete tracking of the process by which business load fluctuations affect hardware stress.

[0014] Furthermore, in the second step, a compensation mechanism based on historical trend regression is used to handle missing values. When an observation at a certain time point is missing, the system automatically retrieves the distribution pattern of that indicator at the same time in the previous period, and calculates the most likely replacement value by combining it with the mean shift of the current window, thereby ensuring the logical continuity of the time series.

[0015] Furthermore, in the third step, the length of the multi-scale sliding observation window is set to three levels: seconds, minutes, and hours. The second-level window is used to capture sudden performance spikes, such as instantaneous surges in processor load; the minute-level window is used to identify medium-scale load evolutions, such as sustained occupancy growth caused by memory leaks; and the hour-level window is used to analyze long-term business patterns, such as power consumption fluctuations in data centers during day and night cycles.

[0016] Furthermore, in the fourth step, the spatiotemporal coupling correlation analysis also includes a sequence similarity measurement process based on dynamic time warping. This process can identify fault symptom sequences that have phase deviations but are highly similar in morphology on the time axis. For example, the increase in disk I / O latency often lags behind the increase in memory page swapping rate. Dynamic time warping can accurately latch such causal chains with lag characteristics.

[0017] Furthermore, in the fifth step, the training process of the deep prediction model employs a gradient descent optimization strategy with weight decay. To address the distribution shift of server operating data under different operating conditions, the model introduces an online learning mechanism. When the prediction error detected in real time continuously exceeds a preset fluctuation range, the model will automatically extract data from the most recent observation period for fine-tuning training, ensuring that the model can adaptively update to follow changes in server load characteristics.

[0018] Furthermore, the present invention also provides a server health prediction system based on multiple time series features, the system comprising: The multi-source data acquisition module is used to acquire the raw sequences of heterogeneous performance indicators of the server through monitoring probes at the physical layer, kernel layer, and application layer. The module integrates an interface protocol conversion unit, which can uniformly encapsulate low-level data from different vendors and protocols into a standardized data frame format.

[0019] The data preprocessing module, connected to the multi-source data acquisition module, is used to perform time-stamp alignment, noise smoothing, missing value imputation, and dimension normalization on the raw sequence. This module has a built-in high-performance cache queue, which can support real-time cleaning and transformation of high-concurrency data streams.

[0020] The feature engineering module extracts multi-scale time-domain statistical features and frequency-domain distribution features from the preprocessed sequence, performs coupling correlation analysis between indicators, and generates a high-dimensional feature matrix. This module includes a dynamic feature selection unit that can automatically filter the most representative subset of indicators based on the current server's service type.

[0021] The deep prediction engine module carries a prediction model based on attention mechanisms and bidirectional long short-term memory networks, mapping high-dimensional feature matrices to health prediction scores. This module improves tensor computation efficiency through hardware acceleration units, ensuring sub-second response times in the prediction process.

[0022] The early warning and visualization module is used to execute multi-level early warnings based on the predicted health score, and to display the changing trends and correlations of each indicator in the form of dynamic graphs. This module supports custom early warning rules, allowing for differentiated alarm strategies to be configured according to the importance level of different business operations.

[0023] Furthermore, the system also includes a feedback self-optimization module. This module compares the predicted health curve with the subsequent actual system state trajectory in real time and calculates the prediction residual. When the residual accumulates to a preset threshold, this module triggers the parameter update logic of the deep prediction engine module.

[0024] Furthermore, the data preprocessing module employs a high-precision crystal oscillator deviation compensation logic when performing time stamp alignment. By calculating the network round-trip delay between the acquisition nodes and the central server, the acquired timestamps are corrected at the microsecond level, ensuring the absolute alignment accuracy of multi-dimensional indicators across nodes on the time axis.

[0025] Furthermore, the feature engineering module introduces a topology-aware weight allocation mechanism when performing association analysis. This mechanism references the physical connection logic within the server; for example, multiple sensor indicators belonging to the same integrated circuit bus are assigned higher prior association weights, thereby improving the physical logic rationality of feature fusion.

[0026] Furthermore, the deep prediction engine module supports distributed deployment. In ultra-large-scale data center scenarios, prediction tasks can be dynamically scheduled to edge computing nodes for execution based on the logical division of the server cluster, thereby reducing the computational pressure on core management nodes and lowering latency caused by data transmission.

[0027] Furthermore, the early warning and visualization module provides a root cause analysis function. When the health prediction value touches the warning line, the system automatically freezes all feature snapshots at the current moment and, through feature contribution analysis, highlights the original indicators with the most significant abnormal fluctuations and their historical evolution paths in the visualization interface, providing maintenance personnel with an intuitive basis for fault location.

[0028] The beneficial effects of this invention are as follows: First, by employing a multi-source heterogeneous data acquisition architecture, this invention breaks through the limitations of traditional solutions that focus only on a single indicator. By fully integrating physical hardware, operating system kernel, and upper-layer application data, this invention can capture subtle fault signs hidden in cross-layer interactions. For example, through correlation analysis, it can be discovered that minute voltage fluctuations may indicate performance degradation of the power module. This degradation often does not directly manifest in the success rate of computing tasks in the early stages, but this invention can detect this risk in advance through the coupling relationship of multi-dimensional sequences.

[0029] Secondly, the multi-scale feature extraction and spatiotemporal coupling modeling method employed in this invention greatly enhances the ability to mine complex nonlinear features. The complementarity of time-domain and frequency-domain features enables the system to cope with short-term sudden load shocks and identify long-term performance degradation trends. The introduced correlation matrix and cross-correlation analysis effectively characterize the dynamic linkage between heterogeneous indicators, effectively reducing the false alarm rate and false negative rate under complex production conditions.

[0030] Third, the bidirectional deep network model based on the attention mechanism designed in this invention, while ensuring prediction accuracy, achieves on-demand feature focusing through an attention weight allocation mechanism. The model can automatically identify the performance indicators that play a dominant role in different operating stages, thereby achieving accurate capture of core anomalies while ensuring global awareness.

[0031] Fourth, the system architecture described in this invention fully considers real-time requirements in its design. By introducing hardware acceleration, distributed deployment, and adaptive sampling and alignment logic, the end-to-end latency from data acquisition to early warning output is ensured to be controlled within an extremely low range. In addition, the introduction of a feedback self-optimization module enables the prediction system to have the ability to continuously evolve, dynamically adjusting the prediction strategy as server hardware ages and business logic evolves, thus ensuring long-term prediction stability.

[0032] In summary, this invention constructs a complete technical framework from bottom-level data perception, mid-level feature fusion to high-level intelligent prediction, solving core problems in modern data center server health management such as the difficulty in modeling multi-indicator coupling, insufficient feature extraction, and inadequate real-time response capabilities. It has extremely high engineering application value and significant technological advancement. Attached Figure Description

[0033] Fig. 1 This is a flowchart illustrating a server health prediction method based on multiple time series features according to an embodiment of the present invention. Fig. 2 This is a structural block diagram of a server health prediction system based on multiple time series features according to an embodiment of the present invention.

[0034] The attached diagram is labeled as follows: 101, Multi-source data acquisition module; 102, Interface protocol conversion unit; 201, Data preprocessing module; 202, High-performance cache queue; 301, Feature engineering module; 302, Dynamic feature selection unit; 401, Deep prediction engine module; 402, Hardware acceleration unit; 501, Early warning and visualization module; 601, Feedback self-optimization module. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] Specific implementation examples are given below.

[0037] See Figs. 1~2This paper presents a server health prediction method and system based on multiple time series features, and provides a comprehensive and in-depth explanation of its physical architecture, logical process, parameter configuration, and experimental verification data.

[0038] In practical engineering deployment environments, the server health prediction method based on multiple time-series features described in this invention first relies on a highly reliable multi-source heterogeneous real-time monitoring data acquisition architecture. The underlying physical implementation of this architecture primarily depends on the Baseboard Management Controller (BMC) module integrated into the server motherboard. This module, through an intelligent platform management interface, polls sensors distributed across key nodes on the motherboard via the integrated circuit interconnect bus without consuming central processing unit (CPU) computing resources. Specifically, the acquisition of physical layer hardware status data covers the instantaneous current intensity of the processor core, micro-volt fluctuations in the core power supply voltage, hotspot temperatures of the Northbridge chip and memory modules, and the actual rotational speed of the cooling fan driven by a pulse-width modulation (PWM) signal. For the memory module, the system reads the register status of the error checking and correction circuit to statistically analyze the frequency of single-bit flips and multi-bit uncorrectable errors in real time. This physical layer data is sampled at a high frequency of once per second and transmitted in real time to the backend data processing platform via a dedicated out-of-band management network.

[0039] Meanwhile, at the operating system kernel layer, this invention deploys a monitoring agent based on lightweight kernel probe technology. This agent achieves deep capture of resource scheduling metrics by embedding non-blocking monitoring points on critical paths of the kernel's task scheduler, virtual file system layer, and network protocol stack. During operation, the probe records in real time the ratio of time spent by the processor executing business logic in user mode to time spent processing system calls in kernel mode, and accurately measures the access latency of different memory nodes under a non-uniform memory access structure. For the disk I / O system, the monitoring agent not only records the number of read / write operations per second but also monitors the duration of I / O requests in the kernel wait queue. At the network layer, it captures the proportion of retransmitted packets due to link congestion or hardware checksum errors and the number of overflows in the receive ring buffer by reading the statistical structure of the network card driver. To ensure data real-time performance and consistency, each piece of data generated by the kernel probe is immediately appended with a nanosecond-level timestamp generated by a high-precision system timer.

[0040] At the application layer, this invention uses lateral log monitoring and bytecode instrumentation to acquire task execution data directly related to business load. For containerized applications running in a distributed environment, the system tracks the frequency of process context switching and the number of interrupts caused by hardware interrupts or software signals in real time. For specific business logic, such as database queries or remote procedure calls, the monitoring module measures the complete lifecycle time from when a request enters the application framework to when a response is returned. Through this comprehensive awareness from the physical layer to the application layer, this invention constructs a raw data pool that reflects the global operating status of the server.

[0041] After data acquisition, the system enters the adaptive preprocessing and time-stamp alignment stage for multi-time series data. Due to slight differences in clock frequency between the sampling sources of different monitoring items, and the impact of network transmission jitter, the raw data often exhibits time-stamp offsets when it reaches the processing backend. To address this, this invention implements a high-precision crystal oscillator deviation compensation strategy. First, the transmission compensation amount for each timestamp is calculated by measuring the network round-trip delay between the acquisition node and the aggregation server. Then, to address the time-point alignment problem caused by inconsistent sampling frequencies, the system uses a linear interpolation algorithm to process indicators with gentle trends, such as temperature and voltage; while for indicators with highly nonlinear fluctuations, such as processor load and network throughput, a Lagrange multinomial interpolation algorithm is used for resampling. This process maps all heterogeneous sequences to a unified millisecond-level time reference line.

[0042] To address potential sporadic sensor noise in the original sequence, the preprocessing module incorporates a median filtering algorithm based on a sliding window. This algorithm sorts and filters within each sampling window, eliminating random pulses that significantly deviate from physical logic. For missing observations due to network fluctuations, the system employs a compensation mechanism based on historical trend regression. This mechanism automatically traces the evolution of the indicator under similar historical conditions and, combined with the mean shift of other relevant indicators within the current time window, derives the most logically sound replacement value, ensuring the continuity of the time series in subsequent feature extraction. Finally, to eliminate the impact of different units on the convergence speed of the prediction model, the system performs min-max normalization on the processed indicators, linearly mapping all values ​​to a preset normalization interval.

[0043] In the feature engineering phase, this invention constructs multi-scale time-domain and frequency-domain feature extraction operators. In the time domain, the system not only focuses on the absolute amplitude of the indicator but also calculates the mean, standard deviation, skewness, and kurtosis within each sliding observation window (second, minute, and hourly levels) to characterize the dispersion and distribution of the system state. Furthermore, by calculating first-order and second-order differences, the system can identify the rate and acceleration of indicator changes, thereby capturing potential signs of sudden faults. In the frequency domain, the system uses Fast Fourier Transform to convert the time-domain sequence to the frequency domain and extract power spectral density distribution features. By identifying shifts in the dominant frequency component, the system can detect vibration frequency shifts caused by hardware mechanical fatigue or resource contention patterns triggered by periodic service requests.

[0044] The depth of feature engineering is reflected not only in the statistical characteristics of single indicators, but also in the spatiotemporal coupling correlation analysis of multi-dimensional features. This invention constructs a heterogeneous indicator correlation matrix to calculate the cross-correlation coefficients of any two performance sequences under different time lag offsets. Furthermore, using partial correlation analysis, the system can identify and eliminate spurious correlations caused by common driving factors, thereby accurately determining the feature set with causal linkages. For example, when an increase in memory paging rate lags behind an increase in memory allocation speed of a specific process, the system uses dynamic time warping technology to calculate the sequence similarity between the two, locking in this causal chain with time lag characteristics, thus providing a high-value collaborative feature view for subsequent fault prediction.

[0045] In the core prediction stage, this invention establishes a deep prediction model based on an attention mechanism and a bidirectional long short-term memory network. The model receives a high-dimensional feature matrix after correlation analysis at the input layer. Subsequently, a spatiotemporal convolutional layer uses multiple one-dimensional convolutional kernels with different receptive fields to extract local dynamic evolution features along the time axis. Next, a bidirectional feature extraction layer uses two sets of long short-term memory units in opposite directions to simultaneously capture the forward evolution logic of the sequence in the historical dimension and the backward correlation information based on recent observations. Building on this, the attention allocation layer plays a crucial role, dynamically calculating the contribution weight of each dimension of features to the future health status based on the current server operating context. Under high-performance computing loads, the attention mechanism automatically increases the weight given to the thermal indicators and voltage stability of the computing units; while under data-intensive loads, it automatically shifts to monitoring interface bandwidth and cache miss rates.

[0046] The model outputs a server health score for a preset future time window. To ensure the scientific validity of the predictions, the system divides the score into multiple levels and pre-sets multiple health thresholds. When the predicted value falls below the warning line, the system not only triggers an alarm but also automatically identifies the core abnormal indicators causing the score drop, based on the distribution of attention weights. In this way, operations and maintenance personnel can clearly see whether the voltage instability is due to aging power modules or system hang risks caused by operating system kernel driver conflicts.

[0047] At the system architecture level, the server health prediction system based on multiple time series features described in this invention consists of a multi-source data acquisition module, a data preprocessing module, a feature engineering module, a deep prediction engine module, an early warning and visualization module, and a feedback self-optimization module. The multi-source data acquisition module integrates an interface protocol conversion unit, ensuring compatibility with different chipsets and operating system distributions. The high-performance cache queue built into the data preprocessing module adopts a lock-free design, supporting tens of thousands of high-concurrency data cleaning tasks per second. The dynamic feature selection unit of the feature engineering module can automatically select the most representative subset of indicators based on the current business type, such as deep learning training, web services, or database clusters, reducing unnecessary computational overhead.

[0048] The deep prediction engine module supports hardware acceleration units, leveraging the parallel computing capabilities of graphics processing units to achieve sub-second response times for model inference. The early warning and visualization module provides an intuitive monitoring panel, displaying the cluster's health status in the form of dynamic heatmaps and topology graphs. Most critically, the feedback self-optimization module compares the health curves predicted by the model with the actual trajectory of the system's subsequent operation in real time. When the prediction residuals exceed a preset tolerance, the module automatically collects real data from the most recent observation period and fine-tunes the prediction model's weights online. This closed-loop learning mechanism allows the system to spontaneously adjust its prediction strategy as server hardware ages naturally and business logic frequently changes, ensuring prediction accuracy throughout its entire lifecycle.

[0049] To verify the technical superiority of this invention, we conducted a comparative experiment in a large-scale data center environment containing one thousand physical nodes. The experiment was divided into two groups: the implementation group used the server health prediction method based on multiple time series features described in this invention; the control group used a traditional monitoring method based on a single indicator threshold trigger. The experiment lasted for ninety calendar days, and the main comparative indicators included prediction accuracy, false alarm rate, early warning time of faults, and system resource utilization.

[0050] The experimental data are shown in the table below: Evaluation index Comparative example (conventional single-index threshold method) Example (method of the present invention) Improvement percentage / improvement range Precision 72.4% 96.8% +24.4% Recall 68.9% 94.5% +25.6% False alarm rate 18.2% 2.1% -16.1% Lead time 12.5 minutes 114.2 minutes +813.6% Fault root cause positioning accuracy 41.2% 92.7% +51.5% Collection and prediction end-to-end delay 5.2 seconds 0.8 seconds -84.6% Single-node additional CPU occupancy 1.2% 0.4% -66.7% The analysis of the experimental data above shows that this invention achieves a qualitative leap in both prediction accuracy and recall. Traditional threshold methods often only trigger alarms the instant a fault has occurred or is about to occur, with an average early warning time of only 12.5 minutes. In contrast, this invention, through in-depth mining of multi-dimensional features and spatiotemporal coupling, can detect sub-health trends in the system approximately 1.9 hours in advance, providing maintenance personnel with invaluable buffer time for virtual machine migration or service cutover. Regarding false alarm rate, this invention effectively eliminates false alarms caused by instantaneous load fluctuations through complex noise filtering and causal analysis, significantly reducing the false alarm rate from 18.2% to 2.1%.

[0051] In a further preferred embodiment, the system of the present invention employs a distributed deployment architecture when processing large-scale cluster data. In this mode, data preprocessing and basic feature extraction tasks are devolved to each edge computing node, with only the compressed and dimensionality-reduced feature matrix uploaded to the central prediction server. This federated collaboration not only significantly reduces the bandwidth pressure on the core network but also improves the overall response speed of the early warning system by performing real-time anomaly shielding at the edge. Furthermore, the system incorporates a hardware abstraction layer for heterogeneous server hardware, such as a hybrid environment containing both domestically produced processor platforms and mainstream international processors. This abstraction layer automatically identifies the underlying register addresses and sensor protocols and encapsulates them into standardized data frames, ensuring the generalization capability of the prediction model in cross-platform applications.

[0052] In the implementation of the early warning and visualization module, this invention introduces a root cause analysis function. When the health prediction score shows a downward trend, the system automatically freezes all original feature snapshots within that time period. By analyzing the weight distribution of the attention mechanism in the deep prediction model, the visualization interface highlights the top three original indicators that contribute the most to the decline in the health score. For example, if the interface shows a significant increase in the contribution of disk write latency and kernel I / O wait queue length, operations personnel can quickly determine that the source of the fault lies in the storage subsystem, rather than the processor or network. This complete logical closed loop from prediction to attribution significantly reduces the reliance on the engineering experience of operations personnel.

[0053] To address the energy conservation and emission reduction needs of modern data centers, the implementation scheme of this invention also integrates a power consumption-aware health prediction strategy. By synchronously collecting power conversion efficiency, input power factor, and cold air pressure of precision air conditioning at the physical layer, the system can dynamically provide optimal performance limits and frequency adjustment suggestions while ensuring the healthy operation of the server. This cross-system collaborative optimization not only extends the physical lifespan of server hardware but also achieves a balance between data center reliability and energy efficiency at the macro level.

[0054] In terms of data storage engineering implementation, this invention adopts a hot-and-cold tiered database architecture. For high-frequency sampling sequences that need to be used in real-time prediction, the system stores them in a memory-based distributed time-series database to meet nanosecond-level data retrieval requirements. For historical monitoring data exceeding seven days, the system performs feature compression based on principal component analysis and archives it into a large-scale distributed file system based on column storage. This design ensures the traceability of massive amounts of data while maximizing storage costs, providing a data foundation for subsequent deep evolution of the model under large sample sizes.

[0055] In summary, the server health prediction method and system based on multiple time series features described in this invention, in its specific implementation, constructs a highly rigorous, responsive, and self-optimizing engineering system through layered concurrent data acquisition, high-precision time-stamp alignment preprocessing, multi-scale feature engineering operators, and a deep prediction network incorporating an attention mechanism. Its implementation covers the entire process from underlying sensor signal processing to upper-layer business logic perception, not only solving the technical dilemmas faced by modern data centers—such as the difficulty in modeling heterogeneous indicator coupling and the challenge of balancing prediction accuracy and real-time performance—but also demonstrating its superior performance and high application value in actual production environments through detailed experimental data. Through the deployment of this system, data centers can achieve a transformation from passive repair requests to proactive predictive maintenance, greatly improving the operational stability of information infrastructure.

[0056] In a deeper level of implementation details, to address the complex electromagnetic interference environment inside the server, this invention introduces a differential sampling verification mechanism during the physical layer acquisition process. When acquiring sensitive electrical signals such as core voltage, the baseboard management controller simultaneously reads the reference ground potential and the target point potential. By performing real-time differential calculations at the hardware link layer, it eliminates the interference of common-mode noise on signal accuracy. This precise control executed at the underlying hardware level ensures that every data point input into the prediction model possesses extremely high physical fidelity.

[0057] Within the data preprocessing module's internal operating logic, the high-performance cache queue employs a persistence technology based on memory-mapped files. This means that even in the event of an occasional restart of the monitoring system, the performance sequences temporarily stored in the queue will not be lost. The system can quickly resume feature extraction and prediction from the point of interruption after resuming operation, ensuring the integrity of the monitoring chain.

[0058] When performing spatiotemporal coupling correlation analysis of multi-dimensional features, the feature engineering module also introduces topology-aware weight allocation logic. The system automatically obtains the hardware connection topology within the server, for example, assigning higher prior correlation weights to the metrics of multiple storage controllers located on the same high-speed peripheral interconnect bus. This feature fusion method, which combines physical connection logic, avoids blindly searching through massive amounts of high-dimensional data and significantly improves the physical semantic expression depth of feature vectors.

[0059] In terms of the training strategy for the deep prediction engine, this invention implements a gradient descent optimization scheme with weight decay. To address the data distribution shifts exhibited by the server under different seasons and business cycles (such as e-commerce promotions versus regular maintenance), the model introduces an online incremental learning mode. This mode allows the model to retain the memory of old health patterns while quickly absorbing newly emerging operational features, ensuring that health prediction results always align with the dynamic evolution of the business.

[0060] In the interactive design of the visual interface, this invention provides a digital twin view of the data center based on 3D modeling. Operations personnel can not only see abstract health scores, but also intuitively observe rack-level temperature gradient changes caused by localized obstruction of heat dissipation airflow in a virtual 3D space. This highly intuitive information presentation method greatly shortens the operational path from identifying potential risks to taking intervention measures.

[0061] Through this series of meticulous and logically rigorous engineering implementations, this invention not only provides a technologically advanced predictive model but also constructs a complete monitoring ecosystem adapted to modern complex computing environments. Its high degree of automation and excellent robustness enable seamless integration into various cloud computing platforms, supercomputing centers, and edge computing gateways, contributing solid technical strength to ensuring the highly reliable operation of global information systems.

[0062] Furthermore, in the implementation details of multi-source data acquisition, this invention employs a non-intrusive side-channel monitoring technique for acquiring application-layer task execution data. Specifically, the system utilizes the operating system's dynamic link library preloading mechanism to intercept the time-consuming processes of critical system calls (such as disk read / write and socket communication) without modifying the business code. This technique ensures zero interference with existing business operations during the deployment of the health prediction system. For kernel-level data capture, this invention utilizes enhanced Berkeley Packet Filter (eBPF) technology. By running verified secure bytecode in kernel space, millisecond-level extraction of kernel structure data is achieved. Compared to the traditional proc filesystem reading method, this approach reduces the system call overhead of the acquisition operation by more than 90%, thus ensuring that under extremely high load conditions, the monitoring behavior itself will not become a negative factor affecting server health.

[0063] In the deep processing stage of feature engineering, this invention pays particular attention to the feature drift phenomenon. During long-term server operation, due to hardware aging (such as the degradation of electrolytic capacitor capacity and wear and tear of solid-state drive flash memory), the baseline values ​​of certain indicators will slowly and gradually shift. The feature extraction operator of this invention decouples this normal change caused by hardware aging from the sudden shift caused by fault symptoms by introducing a long-period moving average baseline. This enables the model to distinguish between aging servers and deteriorating servers, thereby achieving more targeted health classification.

[0064] In the internal tensor operations of the deep prediction engine, this invention employs a sparse activation strategy. During model inference, only neurons highly relevant to the current runtime context are activated to participate in the computation. For example, when the system is idle, model branches related to high-concurrency network processing enter a dormant mode. This on-demand computation logic, combined with the fixed-point computation optimization of the hardware acceleration unit, enables the system to maintain real-time monitoring around the clock with extremely low power consumption.

[0065] The early warning and visualization module incorporates a multi-criteria decision analysis mechanism when triggering early warnings. The system doesn't rely solely on a single predicted value; it also comprehensively considers the importance level of the current business, the server's role in the cluster (e.g., whether it's the master node), and historical maintenance records. Through this comprehensive assessment, the system can provide more operationally relevant recommendations, such as suggesting replacing the power supply unit during the next off-peak period or immediately performing a master-slave switchover.

[0066] The feedback self-optimization module employs a shadow model-based hot-switching mechanism when updating the model. The system runs a candidate model trained on new data in parallel and compares its performance with the current online model in real time. Only when the candidate model significantly outperforms the online model on the most recent thousand prediction samples will the system smoothly update the model online via pointer switching, ensuring the continuity of the prediction service.

[0067] This invention also considers application scenarios in multi-tenant cloud environments. When collecting application-layer metrics, the system can automatically identify the logical boundaries of different tenants, ensuring that the granularity of health prediction can be refined to individual virtual machines or containers. For any health risks discovered, the system can accurately locate the affected tenant's business and automatically trigger the cloud platform's scheduling interface to achieve silent migration of the tenant's business on the faulty node.

[0068] Finally, in the dynamic mining of heterogeneous indicator coupling relationships, this invention introduces a feature interaction graph network based on an attention mechanism. This network treats each monitoring indicator as a node in a graph, and the connection weights between nodes are updated in real time based on correlation analysis. When an abnormal fluctuation occurs in the indicator of a local node, the abnormal signal propagates along the graph structure, enabling the model to identify a chain reaction caused by the failure of a hardware unit. This topology-aware predictive logic gives this invention a high level of modeling depth for the increasingly complex hardware and software interactions within modern servers.

[0069] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A server health prediction method based on multiple time series features, characterized in that, The method includes the following steps: Step 1, constructing a multi-source heterogeneous real-time monitoring data acquisition architecture, synchronously acquiring physical layer hardware status data, kernel layer resource scheduling data, and application layer task execution data of the server through a preset out-of-band management interface and in-band monitoring agent; wherein, different sampling frequencies are set for indicators of different dimensions, and nanosecond-level timestamps are attached to each acquired data; Step 2, performing adaptive preprocessing and time-scale alignment of multi-time series data, performing phase correction on the acquired timestamps through crystal oscillator deviation compensation logic, and mapping the heterogeneous sampling frequency sequences to a unified time reference line using a combination of linear interpolation and Lagrange polynomial interpolation, while using a median filtering algorithm based on sliding windows to remove random impulse noise, and performing min-max normalization processing; Step 3, constructing multi-scale time-domain and frequency-domain feature extraction operators, in the time domain, by setting multiple sliding observation windows of different lengths, calculating the statistical characteristic values ​​of the data in each window to characterize the fluctuation intensity and trend of the indicators; in the frequency domain, using fast Fourier transform to extract power spectral density distribution features and main frequency components, capturing the period Step 4: Implement spatiotemporal coupling correlation analysis of multi-dimensional features. By constructing a heterogeneous index correlation matrix, calculate the cross-correlation coefficients of different performance index sequences under different time lags, and use partial correlation analysis to eliminate spurious correlation factors, determine the feature set with causal linkage, thereby generating a high-dimensional comprehensive feature view that can reflect the global operating status of the server. Step 5: Establish a deep prediction model based on attention mechanism and bidirectional long short-term memory network. The deep prediction model includes a spatiotemporal convolutional layer, a bidirectional feature extraction layer, and an attention allocation layer. The spatiotemporal convolutional layer is used to extract local time-dependent features, the bidirectional feature extraction layer is used to capture the forward causal logic and backward correlation information of the sequence, and the attention allocation layer dynamically adjusts the weight coefficients of each dimension feature on the health prediction result. Step 6: Execute health level prediction and anomaly warning trigger. Input the high-dimensional comprehensive feature view into the trained deep prediction model, output the server health score value within the future preset time window, and trigger the warning mechanism according to the preset multi-level health threshold. At the same time, combine the feature contribution ranking to perform attribution analysis of abnormal indicators.

2. The server health prediction method based on multiple time series features according to claim 1, characterized in that, In step one, the physical layer hardware status data is collected through the intelligent platform management interface of the baseboard management controller, with a collection frequency set to once per second. The collected indicators include processor core temperature, motherboard voltage fluctuation, cooling fan speed, and memory module checksum error count. The kernel layer resource scheduling data is collected by directly reading the statistical structure of the system kernel during runtime using kernel probe technology. The collected indicators include the proportion of time the processor spends in user mode and kernel mode, the local and remote access latency of non-uniform memory access structures, disk I / O wait queue length, and the retransmission packet ratio of the network protocol stack. The application layer task execution data is obtained through bytecode instrumentation or side log monitoring. The collected indicators include process context switching frequency, number of software and hardware interrupts, and response time of specific business logic.

3. The server health prediction method based on multiple time series features according to claim 1, characterized in that, In step two, a compensation mechanism based on historical trend regression is used to handle missing data values: when an observation value is found to be missing at a certain time point, the system automatically retrieves the distribution pattern of the indicator at the same time in the previous period, and calculates the corresponding replacement value through regression algorithm in combination with the mean drift within the current sliding observation window, so as to ensure the logical continuity of the time series.

4. The server health prediction method based on multiple time series features according to claim 1, characterized in that, In step three, the length of the multi-scale sliding observation window is set to three levels: second, minute, and hour. The second-level window is used to capture sudden performance spikes, the minute-level window is used to identify medium-scale load evolution and memory leak trends, and the hour-level window is used to analyze long-term business patterns and power consumption fluctuations. The statistical characteristic values ​​include the mean, variance, skewness, kurtosis, and first and second-order difference values ​​of the data within the sliding observation window.

5. The server health prediction method based on multiple time series features according to claim 1, characterized in that, In step four, the spatiotemporal coupling correlation analysis also includes a sequence similarity measurement process based on dynamic time warping. By calculating the shortest warped path between two index sequences with phase deviation but similar morphology, the causal chain of fault symptoms with hysteresis characteristics is identified. At the same time, the correlation analysis also introduces a topology-aware weight allocation mechanism, referring to the physical connection logic inside the server, to assign higher prior correlation weights to multiple sensor indicators belonging to the same integrated circuit bus.

6. The server health prediction method based on multiple time series features according to claim 1, characterized in that, In step five, the training process of the deep prediction model adopts a gradient descent optimization strategy with weight decay and introduces an online learning mechanism: when the prediction error monitored in real time continuously exceeds the preset fluctuation range, the model automatically extracts the data of the most recent observation period for incremental fine-tuning training; the attention allocation layer calculates the matching degree between the feature vector of the current system context and the feature vector of each dimension indicator to achieve precise focus on the core abnormal factors.

7. A server health prediction system based on multiple time series features, characterized in that, The system includes: a multi-source data acquisition module (101), used to acquire the original sequence of heterogeneous performance indicators of the server through monitoring probes of the physical layer, kernel layer and application layer; the multi-source data acquisition module (101) integrates an interface protocol conversion unit (102), used to uniformly encapsulate the underlying data of different manufacturers and protocols into a standardized data frame format; a data preprocessing module (201), connected to the multi-source data acquisition module (101), used to perform time-scale alignment, noise smoothing, missing value imputation and dimension normalization processing on the original sequence; the data preprocessing module (201) has a built-in high-performance cache queue (202) to support real-time cleaning of high-concurrency data streams; and a feature engineering module (301), used to extract multi-scale data from the preprocessed sequence. The time-domain statistical characteristics and frequency-domain distribution characteristics of the degree are analyzed, and the coupling correlation analysis between the indicators is performed to generate a high-dimensional feature matrix; the feature engineering module (301) includes a dynamic feature selection unit (302) for automatically selecting the most representative subset of indicators according to the current server's business type; the deep prediction engine module (401) is used to carry a prediction model based on attention mechanism and bidirectional long short-term memory network, and map the high-dimensional feature matrix to a health prediction score; the deep prediction engine module (401) improves tensor operation efficiency through hardware acceleration unit (402); the early warning and visualization module (501) is used to execute multi-level early warnings based on the predicted health score, and display the indicator change trend, correlation relationship and root cause backtracking results in the form of dynamic graph.

8. A server health prediction system based on multiple time series features according to claim 7, characterized in that, The system also includes a feedback self-optimization module (601), which compares the predicted health curve with the subsequent actual system state trajectory in real time to calculate the prediction residual, and triggers the parameter update logic of the deep prediction engine module (401) when the residual accumulates to a preset threshold. The feedback self-optimization module (601) adopts a shadow model hot-switching mechanism to perform a smooth switching of prediction weights when the performance evaluation of the candidate model is better than that of the current online model.

9. A server health prediction system based on multiple time series features according to claim 7, characterized in that, The deep prediction engine module (401) supports a distributed deployment architecture. In ultra-large-scale data center scenarios, prediction tasks are dynamically scheduled to edge computing nodes for execution based on the logical division of the server cluster. The system adopts a cold and hot layered architecture in terms of data storage logic. It stores recent high-frequency performance sequences in a memory-level time-series database and archives long-term historical data to a big data platform based on columnar storage after dimensionality reduction by principal component analysis.

10. A server health prediction system based on multiple time series features according to claim 7, characterized in that, The early warning and visualization module (501) provides an automated operation and maintenance interface, which is connected to the container orchestration system and hardware power management controller of the data center. When the health prediction value touches the early warning line, the system automatically freezes the feature snapshot at the current moment and highlights the abnormal fluctuation indicators in the visualization interface according to the feature contribution analysis. At the same time, the system triggers the smooth migration program or security protection program through the automated operation and maintenance interface.

Images