A multi-department production collaboration management method, system, device and medium

Abstract

This application provides a multi-department production collaborative management method, system, equipment, and medium, relating to the field of production management technology. The method includes: acquiring business indicator data change events from each business module, generating a time-series sequence and generating a dynamic threshold range based on sliding window statistical characteristics; generating an abnormal signal event when the threshold is exceeded; constructing a correlation graph based on the material hierarchy and business process flow relationships; when an anomaly is detected, locating the starting node in the graph and traversing downstream along directed edges, checking the anomaly status of downstream nodes within the expected time window based on the delay coefficient; when consecutive nodes on the transmission chain have anomalies, determining it as a chain-like risk activation state, calculating the risk coefficient based on the proportion of activated nodes, and generating an early warning report. The technical effect of this application is: taking targeted intervention measures in the early stages of anomaly transmission to reduce risk escalation.

Description

Technical Field

[0001] This application relates to the field of production management technology, specifically to a multi-department production collaborative management method, system, equipment, and medium. Background Technology

[0002] In modern manufacturing, multi-department production collaboration involves close coordination among multiple business modules such as procurement, inventory, production, quality inspection, and sales. The business data of each module is interconnected through material flow and business processes. When an abnormal fluctuation occurs in a particular business module, the anomaly often does not remain confined to that single module but propagates downstream along the material hierarchy and business process flow, creating a chain reaction of risk across modules. For example, abnormal consumption of upstream raw material inventory may lead to a decrease in the number of production work orders executed, resulting in insufficient finished goods inventory and delayed sales shipments. Therefore, how to promptly identify the cross-module transmission relationships of abnormal signals and provide effective early warnings before the chain reaction of risks fully spread has become a pressing technical problem in the field of multi-department production collaboration management.

[0003] Currently, the common approach to detecting business anomalies is to set monitoring metrics and alarm thresholds for each business module. When a module's metric exceeds a preset threshold, an independent alarm is generated, and managers handle each module's alarm information separately. While this method can identify local anomalies to some extent, it lacks the ability to identify the cross-module anomaly propagation patterns. This makes it difficult for managers to grasp the overall risk situation and diffusion trend when faced with a large number of discrete alarm messages, hindering targeted intervention measures in the early stages of anomaly propagation and causing the risk to escalate. Summary of the Invention

[0004] This application provides a multi-department production collaborative management method, system, equipment, and medium for taking targeted intervention measures in the early stages of anomaly transmission to reduce the escalation of risks.

[0005] Firstly, this application provides a multi-department production collaborative management method, applied to a collaborative management system. The collaborative management system connects business data from multiple business modules to a unified database. The method includes: acquiring data change events of business indicators in each business module; normalizing each data change event to generate a time series of each business indicator; generating a threshold interval based on the statistical characteristics of each time series within a sliding window; generating an abnormal signal event when the sequence value of any time series is not within the threshold interval; and constructing an association graph based on the material hierarchy and business process flow relationships in the unified database. The nodes of the association graph correspond to the business indicators of each business module, and directed edges represent the direction of abnormal propagation. It also carries a delay coefficient; obtains the material code of the abnormal signal event, locates the starting node in the association graph according to the material code, and traverses downstream nodes step by step from the starting node along the directed edge to generate multiple transmission links; for each downstream node in each transmission link, determines the expected transmission time window according to the delay coefficient of the directed edge, and checks whether there is an abnormal signal event in the time sequence of each downstream node within the expected transmission time window; when at least two consecutive nodes on the transmission link have the abnormal signal event, the transmission link is determined to be in a chain-like risk activation state, and the risk coefficient is determined according to the ratio of the number of activated nodes to the total number of nodes in the transmission link; when the risk coefficient is greater than a preset threshold, an early warning report is generated.

[0006] By adopting the above technical solutions, the system generates time-series sequences by normalizing data change events of each business module and dynamically generates threshold intervals to detect abnormal signal events based on statistical characteristics within a sliding window. This allows anomaly detection to adapt to the fluctuation patterns of each business indicator. Furthermore, by constructing a correlation graph with delay coefficients based on the material hierarchy and business process flow, and using these delay coefficients to determine the expected transmission time window and check for abnormal signal events at downstream nodes, the system automatically identifies the temporal causal transmission relationship between cross-module anomalies. Finally, by determining that a chain risk is activated when at least two consecutive nodes in the transmission link have abnormal signal events, and by determining the risk coefficient based on the ratio of the number of activated nodes to the total number of nodes in the transmission link, the system quantitatively assesses the severity of chain risks. This enables the system to take targeted intervention measures in the early stages of anomaly transmission, reducing the risk escalation.

[0007] Secondly, this application provides a multi-department production collaborative management system, the system comprising: a first acquisition module, a generation module, a construction module, a second generation module, and an output module; wherein, The first acquisition module is used to acquire data change events of business indicators in each business module, normalize each data change event, and generate a time series sequence of each business indicator; the generation module is used to generate a threshold interval based on the statistical characteristics of each time series sequence within a sliding window; when the sequence value of any time series sequence is not within the threshold interval, an abnormal signal event is generated; the construction module is used to construct an association graph based on the material hierarchy structure and business process flow relationship in the unified database; the nodes of the association graph correspond to the business indicators of each business module, and the directed edges represent the direction of abnormal propagation and carry a delay coefficient; the second generation module is used to acquire the material of the abnormal signal event. The material coding is used to locate the starting node in the association graph, and to traverse downstream nodes step by step from the starting node along the directed edge to generate multiple transmission links. For each downstream node in each transmission link, the expected transmission time window is determined according to the delay coefficient of the directed edge, and the time sequence of each downstream node is checked to see if there are any abnormal signal events within the expected transmission time window. The output module is used to determine that the transmission link is in a chain risk activation state when at least two consecutive nodes on the transmission link have the abnormal signal event, to determine the risk coefficient according to the ratio of the number of activated nodes to the total number of nodes in the transmission link, and to generate an early warning report when the risk coefficient is greater than a preset threshold.

[0008] Thirdly, this application provides an electronic device that adopts the following technical solution: it includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes a computer program of any of the above-mentioned multi-department production collaborative management methods.

[0009] Fourthly, this application provides a computer-readable storage medium that stores a computer program capable of being loaded by a processor and executing any of the aforementioned multi-department production collaborative management methods.

[0010] In summary, this application includes at least one of the following beneficial technical effects: By normalizing data change events from each business module to generate time-series sequences, and dynamically generating threshold intervals based on statistical characteristics within a sliding window to detect abnormal signal events, anomaly detection can adapt to the fluctuation patterns of each business indicator. By constructing a correlation graph with delay coefficients based on the material hierarchy and business process flow, and using these delay coefficients to determine the expected transmission time window and check downstream nodes for abnormal signal events, automatic identification of the temporal causal transmission relationship between cross-module anomalies is achieved. By determining that at least two consecutive nodes in the transmission link have abnormal signal events as a chain risk activation state, and determining the risk coefficient based on the ratio of the number of activated nodes to the total number of nodes in the transmission link, a quantitative assessment of the severity of chain risks is achieved. This allows the system to take targeted intervention measures in the early stages of anomaly transmission, reducing risk escalation. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a multi-department production collaborative management method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the complete technical process of a multi-department production collaborative management method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a multi-department production collaborative management system provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0012] Explanation of reference numerals in the attached figures: 1000, electronic device; 1001, processor; 1002, communication bus; 1003, user interface; 1004, network interface; 1005, memory. Detailed Implementation

[0013] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0014] In the description of the embodiments in this application, words such as "illustrative," "for example," or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "illustrative," "for example," or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Rather, the use of words such as "illustrative," "for example," or "for example" is intended to present the relevant concepts in a specific manner.

[0015] Figure 1This is a flowchart illustrating a multi-department production collaborative management method provided in an embodiment of this application. Figure 1 As shown, the method includes S101-S105: S101: Obtain data change events for business metrics in each business module, normalize each data change event, and generate a time series sequence for each business metric.

[0016] In multi-department collaborative production management scenarios, each business module (such as procurement, sales, inventory, production, and finance) continuously generates business data changes in its own independent data tables. These changes are scattered across different table structures, field systems, and units of measurement. Without unified data collection and standardization, the system cannot perform horizontal comparisons and correlation analyses of the operational status of each module within a unified numerical space and time coordinate. Consequently, it cannot provide a calculable data foundation for subsequent anomaly detection and cross-module propagation tracing. Therefore, the core objective of this step is to transform the raw data change behaviors scattered across various business modules into a time-series sequence with a unified format, time alignment, and consistent units of measurement. This enables subsequent steps to perform statistical analysis and anomaly detection on all business indicators within the same mathematical framework.

[0017] Specifically, the collaborative management system uses the data change capture mechanism provided by the unified database (i.e., ChangeData Capture, a built-in function of the database engine that automatically records changes when data table rows are changed) to monitor the data tables corresponding to preset business indicators in each business module in real time. These business indicators are key metric fields that reflect the operational status of a business module, such as "outstanding purchase orders" in the procurement module, "current available inventory of a certain material" in the inventory module, "cumulative work reports for a certain work order" in the production module, "amount of a customer's order awaiting shipment" in the sales module, and "accounts payable balance" in the finance module. When a target field value in the above data tables is inserted, updated, or deleted, the data change capture mechanism automatically generates a data change event. This data change event carries a change timestamp (i.e., the precise time when the data change was committed in the database transaction log), a changed field identifier (i.e., the unique code of the changed business indicator, used to indicate which business indicator the event belongs to), and the changed value (i.e., the latest value of the field after the change operation). For example, when the available inventory quantity of raw material with material code "M-2024-0371" in the inventory module changes from 500 units to 650 units due to an inbound operation, the system generates a data change event. The change timestamp is the submission time of the inbound transaction "2024-11-08 14:23:17", the change field identifier is "INV_AVAILABLE_QTY_M-2024-0371", and the changed value is 650.

[0018] After continuously collecting data change events from various business modules, the system performs time granularity alignment processing on these events. Because the frequency of data changes varies significantly across different business modules—for example, the inventory module may generate a large number of change events within minutes due to frequent inbound and outbound operations, while accounts payable in the finance module may only be updated every few days—without unified time granularity, the data sequences of various business indicators will not correspond point-to-point on the timeline. Therefore, the system presets a unified time granularity (e.g., one hour as a time unit), categorizing all data change events into their corresponding time unit intervals according to their change timestamps. When multiple data change events exist for a business indicator within the same time granularity, the system aggregates the multiple changed values ​​within that time unit. The aggregated value selects an appropriate aggregation method based on the semantic nature of the business indicator. For example, for incremental indicators like "cumulative work reports," the maximum value within the time unit is used; for status indicators like "inventory availability," the latest value at the end of the time unit is used; and for flow indicators like "purchase amount," the sum of all changed values ​​within the time unit is used. For business metrics that have no data change events within the same time granularity, the system performs previous value padding. This involves tracing back along the timeline to the time unit where the business metric last generated a data change event, and using the value of that time unit as the fill value for the current empty time unit. This means that unless new changes occur, the business metric will maintain its state after the last change. After this alignment process, each business metric forms a data sequence on the timeline with no missing data and uniform time intervals.

[0019] Subsequently, the system performs dimensionless processing on the time-aligned data sequences of each business indicator. In actual business operations, business indicators from different business modules have completely different physical dimensions and numerical ranges. For example, the unit of available inventory may be "pieces" with a value range of 0 to tens of thousands, while the unit of accounts payable balance is "yuan" with a value range of millions, and the reported work quantity of production work orders may only be a double digit. If the original values ​​are directly used for subsequent threshold determination and cross-indicator comparison, indicators with large numerical ranges will dominate the statistical analysis results, while the fluctuations of indicators with small numerical ranges will be masked. To address this, the system uses the Z-score standardization method to process the data sequences of each business indicator separately. That is, for each business indicator, the mean and standard deviation of all sequence values ​​within a preset backtracking time window are calculated. Then, the value of the business indicator in each time unit is subtracted from the mean and divided by the standard deviation to obtain a dimensionless standardized value. After this processing, the sequence values ​​of all business indicators are mapped to a unified numerical range centered on 0. The meaning of each sequence value is transformed into "the degree of deviation from the historical normal level of the indicator itself", so that business indicators of different modules and different dimensions can be statistically compared and anomaly determined in the same mathematical space.

[0020] Based on the above embodiments, as an optional implementation, in S101, acquiring data change events of business indicators in each business module, normalizing each data change event, and generating a time series sequence of each business indicator specifically includes S11-S13: S11 uses a unified database data change capture mechanism to monitor the data tables corresponding to preset business indicators in each business module in real time. When a field value in the data table changes, a data change event is generated that carries a change timestamp, a changed field identifier, and the changed value.

[0021] In multi-department collaborative enterprise information systems, data from various business modules is stored in different tables within a unified database. When business operators perform routine tasks (such as creating purchase orders, submitting production reports, and confirming shipments), updates to the corresponding fields in these tables are triggered. These changes in field values ​​reflect the underlying data changes in business metrics. Periodically scanning each table for changes using timed polling has two drawbacks: firstly, intermediate state changes occurring during the polling interval may be missed; secondly, high-frequency polling incurs unnecessary performance overhead on the database. Therefore, the system employs a data change capture mechanism provided by the unified database itself to detect data changes in real time. This data change capture mechanism is a built-in change data capture capability of the database system. It identifies insert, update, and delete operations in the data tables by reading the database's transaction logs and outputs the changes in a structured record format without requiring intrusive modifications to the original business logic. The system pre-configures the range of data tables to be monitored. This range covers the data tables corresponding to preset business indicators in each business module. These preset business indicators are key business metrics pre-selected by managers based on the company's operational and management needs and required to be included in the chain-like risk monitoring scope. For example, in the inventory module, the available inventory quantity of materials corresponds to the available inventory field in the inventory master data table; in the production module, the cumulative reported work quantity of work orders corresponds to the cumulative reported work field in the work order progress table; and in the sales module, the pending shipment amount of orders corresponds to the pending shipment amount field in the sales order details table. When the data change capture mechanism detects a change in the field value of the monitored data table, the system generates a data change event. The data change event is a structured record describing a change in a business indicator value. It carries three core pieces of information: a change timestamp, which is the precise moment the database transaction was committed, with millisecond precision, used for subsequent time-series arrangement and time alignment; a change field identifier, which is a unique identifier code for the specific field that has changed, in the format of a combination of "business module name-material code-indicator name" (e.g., "inventory module-M-2024-0371-available inventory quantity"), used to establish a clear correspondence between changes in the underlying database field and the upper-level business indicator; and the changed value, which is the latest value of the field after the change, recorded in the original units (e.g., inventory quantity recorded as 1260 in "pieces", order amount recorded as 385000 in "yuan").Taking a specific scenario as an example, when a warehouse manager performs a material requisition and issuance operation for material "M-2024-0371" in the inventory module, causing the available inventory field of this material in the inventory master data table to be updated from 1500 to 1260, the data change capture mechanism immediately generates a data change event. This event carries the change timestamp "2024-11-18T09:32:17.458", the change field identifier "Inventory Module-M-2024-0371-Available Inventory Quantity", and the changed value "1260".

[0022] S12: Align all data change events according to a unified time granularity, aggregate the values ​​of business metrics that have multiple data change events within the same time granularity, and fill in the previous values ​​for business metrics that do not have data change events within the same time granularity.

[0023] After step S11, the system continuously receives data change event streams from various business modules. However, the data change events for different business metrics exhibit significant unevenness in temporal distribution. Some high-frequency business metrics (such as available inventory quantity which may experience multiple material requisition or warehousing changes per minute during peak production seasons) generate a large number of dense data change events in a short period, while some low-frequency business metrics (such as accounts receivable confirmation amount in the financial module which may only change once during daily settlement) remain in a state of no events for extended periods. If the raw data change event stream is directly used as a time series, the significant differences in time sampling density between different business metrics make comparative analysis and correlation calculations impossible on a unified time coordinate. Therefore, the system needs to align all data change events according to a unified time granularity. The unified time granularity is a fixed time interval pre-set by the system, used to divide a continuous time axis into discrete time intervals of equal length. For example, if set to 1 hour, the time axis is divided into consecutive time intervals such as "2024-11-18T09:00:00 to 2024-11-18T09:59:59" and "2024-11-18T10:00:00 to 2024-11-18T10:59:59". The selection of the unified time granularity needs to strike a balance between time resolution and data stability. If the granularity is too fine (e.g., 1 minute), many low-frequency indicators will have no events within their time intervals, resulting in too many null values. If the granularity is too coarse (e.g., 1 day), the fluctuation details of high-frequency indicators within a day will be over-smoothed, making it impossible to capture short-term anomalies. The system assigns each data change event to its corresponding time interval based on its change timestamp. When multiple data change events exist for the same business indicator within the same time granularity, the system takes the aggregated value as the representative value for that time interval. The calculation rules for the aggregated value are determined based on the semantic characteristics of the business indicators: For status-based indicators (such as available inventory quantity, which represents the inventory status at a certain moment), the aggregated value is taken as the value after the change of the last data change event within the time interval, that is, the end-of-period value represents the indicator status of the time interval; for cumulative indicators (such as the cumulative number of work orders reported, which represents the incremental summation within a period), the aggregated value is taken as the maximum value among the changed values ​​of all data change events within the time interval, that is, the cumulative maximum progress within the period represents the indicator status of the time interval. If there are no data change events for the same business indicator within the same time granularity (i.e., the business indicator has not changed within the time interval), the system performs previous value filling, that is, it traces back along the time axis to the most recent time interval with a valid value, copies its value, and fills it into the currently vacant time interval.The logic behind pre-value padding is as follows: if a business indicator does not generate any data change events within a certain time interval, then the indicator's state within that time interval remains unchanged from its previous value. This assumption aligns with actual business practices (for example, if no inventory inflows or outflows occur, the available inventory quantity remains unchanged). Taking "Inventory Module-M-2024-0371-Available Inventory Quantity" as an example, if this indicator generates three data change events (with changed values ​​of 1450, 1380, and 1260 respectively) within the time interval of "09:00-09:59", then the aggregated value for that time interval is the changed value of the last event, 1260. If this indicator does not generate any data change events within the time interval of "10:00-10:59", then the value for that time interval is obtained by pre-value padding, resulting in 1260.

[0024] S13, perform dimension elimination processing on the data sequences of each business indicator after alignment, map business indicators with different dimensions in different business modules to a unified numerical range, and generate time series sequences of each business indicator.

[0025] After the time alignment and padding process in step S12, each business indicator has a numerical sequence arranged continuously on a unified time coordinate. However, the business indicators in different business modules have completely different dimensions and numerical magnitudes. For example, the value of "available inventory quantity" in the inventory module is in "pieces" and usually ranges from hundreds to thousands; the value of "cumulative work order reporting quantity" in the production module is also in "pieces" but may only range from tens to hundreds; while the value of "accounts receivable confirmed amount" in the finance module is in "yuan" and may reach hundreds of thousands or even millions. If this difference in dimensions and magnitude is not eliminated, when performing correlation strength calculations and abnormal deviation comparisons on the time series data of different business indicators in subsequent steps, indicators with larger numerical magnitudes will dominate the mathematical operations, causing the change signals of indicators with smaller numerical magnitudes but equally important business significance to be submerged. Therefore, the system performs dimension elimination processing on the data sequences of each business indicator output in step S12. The dimensionless elimination process is a mathematical standardization operation aimed at stripping away the physical units and absolute magnitude information of the original values, retaining only the relative fluctuation characteristics of each business indicator's value over time. The specific method employed by the system is as follows: for each business indicator, the mean and standard deviation of its data sequence within a preset historical window period (e.g., all time intervals corresponding to the most recent 30 calendar days) are calculated. Then, the mean is subtracted from the value of the business indicator in each time interval, and the result is divided by the standard deviation to obtain the standardized dimensionless value. The standardized value represents "how many standard deviations the value of this business indicator in the current time interval deviates from its historical normal level," with positive values ​​indicating above the historical mean, negative values ​​indicating below the historical mean, and larger absolute values ​​indicating a more significant deviation. After dimensionless elimination, all business indicators, regardless of their original dimensions and magnitude, are mapped to a unified numerical range centered at zero (usually, most standardized values ​​fall within the range of -3 to +3), making the numerical changes of different business indicators comparable. For specific numerical examples, if the average value of "Inventory Module-M-2024-0371-Available Inventory Quantity" during the historical window period is 1400 units and the standard deviation is 120 units, then its standardized dimensionless value of 1260 units in a certain time interval is (1260 minus 1400) divided by 120, which equals -1.17, indicating that the available inventory in that time interval is 1.17 standard deviations lower than the historical normal. If the average value of "Financial Module-P-2024-0088-Accounts Receivable Confirmation Amount" during the historical window period is 420,000 yuan and the standard deviation is 35,000 yuan, then its standardized dimensionless value of 385,000 yuan in a certain time interval is (385,000 minus 420,000) divided by 35,000, which equals -1.00, indicating that the accounts receivable confirmation amount in that time interval is 1.00 standard deviations lower than the historical normal.As a result, the previously incomparable "1260 items" and "385,000 yuan" are transformed into "-1.17" and "-1.00" that can be measured on the same scale, allowing the system to determine the relative degree to which each indicator deviates from the normal state.

[0026] S102, based on the statistical characteristics of each time series within the sliding window, generate a threshold interval; when the sequence value of any time series is not within the threshold interval, generate an abnormal signal event.

[0027] Specifically, the system performs sliding window statistical analysis on the time series of each business indicator. The sliding window refers to a continuous time interval of a preset length, starting from the current time unit and moving backward in the historical direction. For example, the sliding window length is set to 168 time units (corresponding to the past 7 days of data with a time granularity of 1 hour). This window slides forward unit by unit as time progresses, always covering the historical data closest to the current moment. Within each sliding window, the system calculates two statistical features: a weighted moving average and a weighted standard deviation. The weighted moving average is the weighted average of the sequence values ​​of each time unit within the sliding window, assigned different weights according to their time proximity. Sequence values ​​closer to the current time unit are assigned higher weights, and those farther away are assigned lower weights. The weight allocation uses an exponential decay function; that is, the weight of the k-th historical time unit (k=1 represents the closest time unit, k equal to the window length represents the farthest time unit) is the result of normalizing the sum of all weights by dividing the exponential decay coefficient to the power of k. The reason for using a weighted average instead of a simple arithmetic mean is that the production and operating environment is constantly changing. Data closer to the current moment better reflects the current normal level of business indicators, while older historical data is less representative of the current state. Exponential decay weighting allows the statistical benchmark to track the natural drift trend of business indicators more quickly, avoiding the drag of historical values ​​that could cause the threshold range to deviate from the current actual level. The weighted standard deviation is the square root of the square of the difference between the sequence value of each time unit within the sliding window and the weighted moving average, calculated using the same weighting method. Its physical meaning is the typical fluctuation range of the business indicator around its weighted average level in recent history. More recent data is also given higher weight to reflect changes in fluctuation characteristics in the current period.

[0028] After calculating the weighted moving average and weighted standard deviation, the system generates a threshold range for the business indicator in the current time unit. The upper limit of the threshold range is the sum of the weighted moving average and the weighted standard deviation by a preset multiple, and the lower limit is the difference between the weighted moving average and the weighted standard deviation by a preset multiple. The preset multiple is a sensitivity parameter pre-configured by the system. For example, if it is set to 3, the threshold range is the range covered by 3 times the weighted standard deviation above and below the weighted moving average. The meaning of this threshold range is: if the fluctuation of the business indicator follows an approximately normal distribution, then the fluctuation within 3 times the standard deviation can be regarded as normal random disturbance; exceeding this range indicates that the current value has deviated significantly from the recent normal level. Since both the weighted moving average and the weighted standard deviation are dynamically updated as the sliding window moves, the threshold range is not fixed, but continuously and adaptively adjusted according to the changes in the operating level of the business indicator itself. It can naturally adapt to the migration of the business indicator to the normal level caused by the switching of peak and off-peak seasons, capacity ramp-up, or changes in order structure.

[0029] After the threshold range is generated, the system executes anomaly detection logic on the time series of each business indicator. When the current sequence value of any time series is not within its corresponding threshold range, the system does not immediately generate an abnormal signal event. Instead, it further determines whether the out-of-bounds behavior meets the persistence condition or trend condition to filter out single-point occasional out-of-bounds errors caused by data noise or instantaneous disturbances. The persistence condition means that when a time series continuously exceeds the same boundary of the threshold range for a preset number of consecutive time units (e.g., three consecutive time units), the system determines that the business indicator is experiencing a persistent abnormal deviation rather than an instantaneous fluctuation. The trend condition means that even if the sequence value has not yet broken through the threshold range boundary, but the sequence value shows a monotonically increasing or monotonically decreasing trend drift within the current sliding window (i.e., the sequence value of each time unit within the window shows an uninterrupted upward or downward trend), the system determines that the business indicator is continuously evolving in an abnormal direction and there is a trend risk of breaking through the threshold boundary. The specific method for determining trend drift is as follows: perform linear regression fitting on the sequence values ​​of the most recent preset number of consecutive time units (e.g., the most recent 12 time units) within the sliding window. When the absolute value of the slope of the fitted line exceeds the preset trend sensitivity threshold and the goodness of fit reaches the preset minimum value, it is determined that trend drift exists.

[0030] When any of the above-mentioned persistence or trend conditions is met, the system generates an anomaly signal event. An anomaly signal event is a structured event record used within the system to mark a statistically significant deviation of a certain business indicator at a specific point in time. It carries the following information: the module identifier of the business module to which the corresponding business indicator belongs (used to indicate whether the anomaly occurred in the purchasing, sales, inventory, production, or finance module), the associated material code (i.e., the unique code of the specific material or product monitored by the business indicator, used to locate the starting node on the association graph in subsequent steps), the timestamp of the anomaly signal event (i.e., the time corresponding to the last time unit that triggered the anomaly judgment condition), and the anomaly direction marker (indicating whether the sequence value is out of bounds upwards or downwards, or showing an upward or downward trend). For example, when the time series corresponding to the available inventory quantity of raw material with material code "M-2024-0371" in the inventory module has its standardized sequence value lower than the lower limit of the current threshold range for three consecutive time units, the system generates an abnormal signal event. Its module identifier is "Inventory Module", the material code is "M-2024-0371", the occurrence timestamp is the end time of the third consecutive out-of-bounds time unit, and the abnormal direction is marked as "downward out-of-bounds", indicating that the inventory level of this material has decreased significantly relative to its recent normal level.

[0031] Based on the above embodiments, as an optional implementation, in S102, the statistical features include weighted moving average and weighted standard deviation. A threshold interval is generated based on the statistical features of each time series within the sliding window. When the sequence value of any time series is not within the threshold interval, generating an abnormal signal event specifically includes S21-S22: S21. Generate a threshold interval based on the weighted moving average and the weighted standard deviation. The upper limit of the threshold interval is the sum of the weighted moving average and the weighted standard deviation of a preset multiple, and the lower limit of the threshold interval is the difference between the weighted moving average and the weighted standard deviation of a preset multiple.

[0032] After generating the time series of each business indicator in step S101, the system needs to establish a dynamic benchmark for each time series reflecting its current normal fluctuation range. Since the normal fluctuation center of the business indicators drifts slowly with the business cycle and operating rhythm, a fixed static threshold cannot adapt to this change. Therefore, the system uses a weighted moving average and weighted standard deviation based on a sliding window to dynamically characterize the local fluctuation features of the time series. The sliding window is a data observation range that extends backward from the current time interval, for example, setting the window length to 24 time intervals. The weighted moving average is the weighted sum of each sequence value within the sliding window, weighted in an exponential decay manner. The closer the sequence value is to the current moment, the higher its weight, ensuring that the mean can keep up with recent trends. The weighted standard deviation is a discrete measure calculated by weighting the differences between each sequence value within the sliding window and the weighted moving average using an equal weighting scheme, reflecting the recent fluctuation range of the business indicator around the mean. The system generates a threshold range based on this: the upper limit of the threshold range is the sum of the weighted moving average and the weighted standard deviation of a preset multiple, and the lower limit of the threshold range is the difference between the weighted moving average and the weighted standard deviation of a preset multiple. The preset multiple is a coefficient parameter that controls the width of the threshold range, for example, set to 2. Taking "Inventory Module-M-2024-0371-Available Inventory Quantity" as an example, if the weighted moving average is -0.25, the weighted standard deviation is 0.40, and the preset multiple is 2, then the threshold range is from -1.05 to 0.55.

[0033] S22. When any time series value continuously exceeds the same boundary of the threshold interval within a preset number of time units, or when the sequence value shows a monotonically increasing or monotonically decreasing trend drift within the sliding window, an abnormal signal event is generated. The abnormal signal event carries the module identifier of the business module to which the corresponding business indicator belongs and the associated material code.

[0034] If only a single time interval sequence value exceeding the threshold interval is used as the anomaly trigger condition, then even occasional data fluctuations causing momentary boundary crossings would be judged as anomalies, leading to a large number of noise events entering the subsequent propagation analysis process. Therefore, the system sets two complementary anomaly trigger conditions. The first is the continuous boundary crossing condition: when any time series sequence value continuously exceeds the same boundary of the threshold interval within a consecutive preset number of time units, it is judged as an anomaly. The consecutive preset number is the minimum number of time intervals preset by the system, for example, set to 3. The same boundary means that the sequence value always exceeds the upper limit or always falls below the lower limit within a consecutive time interval, ensuring that only deviations with time persistence are identified as anomalies. The second is the trend drift condition: when any time series sequence value shows a monotonically increasing or monotonically decreasing trend drift within a sliding window, it is judged as an anomaly even if it has not yet exceeded the threshold interval boundary. The trend drift refers to the sequence value gradually shifting in a single direction within the sliding window. Specifically, it is determined by performing linear regression fitting on the sequence values ​​within the window, and the judgment is made when the absolute value of the slope exceeds the preset slope threshold and the goodness of fit meets the standard. This condition is used to capture gradual anomalies that are approaching the boundary at a steady rate, giving managers extra warning time. When any condition is met, the system generates an anomaly signal event, which carries the module identifier of the business module to which the corresponding business indicator belongs and the associated material code. This is used in subsequent step S103 to locate the starting node on the association map and initiate the propagation path search.

[0035] S103. Based on the material hierarchy and business process flow relationship in the unified database, construct an association graph. The nodes of the association graph correspond to the business indicators of each business module, and the directed edges represent the direction of anomaly propagation and carry a delay coefficient.

[0036] Specifically, the system extracts two types of basic relationship data from a unified database as the basis for constructing the association graph. The first type is the material hierarchy structure, which refers to the composition and composition relationships between materials stored in the unified database in the form of a bill of materials. That is, it records which lower-level materials (raw materials or lower-level semi-finished products) are assembled or processed into each finished or semi-finished product in what quantity proportions. For example, the bill of materials record of finished product "P-2024-0088" shows that it is assembled from one piece each of semi-finished product "S-2024-0152" and semi-finished product "S-2024-0153". Semi-finished product "S-2024-0152" is further processed from three pieces of raw material "M-2024-0371" and two pieces of raw material "M-2024-0402". This material hierarchy reveals the dependencies between materials at different levels. An anomaly in the supply of a lower-level material inevitably affects the production progress of a higher-level material, and changes in the demand for higher-level materials will conversely affect the consumption rate of lower-level materials. The second category is business process flow relationships. Business process flow relationships refer to the order of business processing and data transfer relationships between different business modules in a unified database for the same material or order. Taking the complete lifecycle of a material from procurement to final delivery to the customer as an example, the flow sequence is as follows: the procurement module issues a purchase order and tracks supplier delivery; after delivery, the inventory module performs warehousing and updates available inventory; the production module retrieves materials from inventory according to the production plan and performs processing reporting; after the finished product is completed, the inventory module performs finished product warehousing; finally, the sales module executes outbound delivery according to customer orders, and the finance module confirms revenue and settles accounts receivable. This flow relationship reveals the processing sequence of the same material in different business modules. The processing results of the upstream module constitute the input premise for the downstream module, and anomalies in the upstream module will be transmitted to the downstream module after a certain time delay.

[0037] After extracting the two types of relationship data mentioned above, the system constructs a relational graph using each business indicator in each business module as a node and the transmission logic implied by the material hierarchy and business process flow as directed edges. The relational graph is a directed weighted graph structure, where each node uniquely corresponds to a business indicator defined in step S101 (i.e., a specific measurement field for a specific material in a business module). Node attributes include the module identifier, material code, and indicator type (e.g., "available inventory quantity," "cumulative reported work quantity," "amount to be shipped," etc.). Directed edges between nodes represent the direction of anomaly propagation; that is, the directed edge points from the source indicator where the anomaly may occur first to the target indicator that may be subsequently affected. The arrow direction represents the logical direction of the anomaly signal propagating from upstream to downstream.

[0038] The establishment of directed edges follows two rules. The first is the cross-module rule for the same material: For business indicator nodes corresponding to the same material code in different business modules, the system establishes directed edges based on the processing sequence defined by the business flow relationship. For example, for material "M-2024-0371", the system establishes a directed edge from the "Purchase Order Outstanding Quantity" node in the purchasing module to the "Available Inventory Quantity" node in the inventory module, indicating that anomalies in the purchasing process (such as a supplier's delayed delivery leading to a persistently high outstanding quantity) will be transmitted to the inventory process (causing an abnormal decrease in available inventory); simultaneously, a directed edge is established from the "Available Inventory Quantity" node in the inventory module to the "Cumulative Work Order Reporting Quantity" node in the production module, indicating that inventory shortages will be transmitted to the production process (causing delays in work reporting due to material shortages). The second is the cross-material, same-module rule: For different materials with hierarchical relationships in their material hierarchy, if they all have corresponding business indicator nodes in the same business module, the system establishes directed edges based on the composition relationship. For example, a directed edge is established between the inventory availability node of raw material "M-2024-0371" and the production reporting quantity node of semi-finished product "S-2024-0152" that uses the raw material, indicating that inventory anomalies of lower-level materials will be transmitted to the production progress of higher-level materials; similarly, a directed edge is also established between the production reporting quantity node of semi-finished product "S-2024-0152" and the production reporting quantity node of finished product "P-2024-0088", indicating that production anomalies of lower-level semi-finished products will be transmitted to higher-level assembly processes.

[0039] After determining the connection relationships of directed edges, the system assigns a delay coefficient to each directed edge. The delay coefficient refers to the expected time delay experienced by an abnormal signal when it propagates from the source node to the target node of the directed edge, and its unit is consistent with the unified time granularity set in step S101 (e.g., in hours). The value of the delay coefficient is statistically estimated by the system based on historical business data in the unified database. Specifically, the system backtracks the business processing records in the unified database within a preset historical period (e.g., the past 6 months). For each directed edge, it extracts the historical time point when the business indicator corresponding to the source node changes significantly and the historical time point when the business indicator corresponding to the target node subsequently changes in response. It calculates the time difference between the two and takes the median of all historical time difference samples that meet the conditions as the delay coefficient of the directed edge. The reason for using the median instead of the mean is that in actual business, some extreme cases (such as sudden production stoppages or holiday work stoppages) will produce abnormally large time difference samples. The median has stronger robustness to such outliers and can more accurately reflect the typical propagation delay under normal production rhythm. For example, if the system statistics show that the median delay between the purchase and warehousing completion time of material "M-2024-0371" and its available inventory update time is 2 time units (i.e. 2 hours) in the past 6 months, then the directed edge from the "Purchase Order Undelivered Quantity" node in the procurement module to the "Available Inventory Quantity" node in the inventory module is assigned a delay coefficient of 2; at the same time, if the statistics show that the median delay between the material being issued from inventory and the corresponding work order reporting is 18 time units (i.e. 18 hours), then the corresponding directed edge from the inventory module to the production module is assigned a delay coefficient of 18.

[0040] In addition, the system assigns a transmission strength weight to the directed edges in the association graph. The transmission strength weight is a value between 0 and 1, used to quantify the attenuation of the impact of anomalies from the source node to the target node. Its estimation method is as follows: the system statistically analyzes historical data to determine the conditional probability that the target node will also exhibit anomalies within the time window corresponding to the delay coefficient after an anomaly occurs at the source node; that is, the proportion of times the target node subsequently responds with an anomaly when the source node historically experiences an anomaly deviation. The closer the transmission strength weight is to 1, the more likely the anomaly at the source node will propagate to the target node; the closer it is to 0, the weaker the transmission relationship, and in most cases, the anomaly at the source node can be absorbed by buffering mechanisms in intermediate links (such as safety stock, alternative suppliers, or capacity redundancy) without affecting the target node. For example, if the inventory availability of material "M-2024-0371" experienced an abnormal decline in the past, and the proportion of the work order reporting quantity of its downstream semi-finished product "S-2024-0152" also experienced an abnormal decline in the following 18 hours was 0.72, then the transmission strength weight of this directed edge would be 0.72, indicating that inventory abnormalities would be transmitted to the production stage in approximately 72% of historical cases.

[0041] After completing the creation of all nodes, the connection of directed edges, and the assignment of delay coefficients and transmission strength weights, the system also performs connectivity checks and redundant edge pruning on the association graph. Connectivity checks involve the system checking for isolated nodes (i.e., business indicator nodes that have no directed edge connections to any other nodes). If such nodes exist, it indicates that the business indicator has not formed a transmission relationship with other indicators in the current material hierarchy and business process flow. The system marks these as independent monitoring nodes, which do not participate in chain reasoning in subsequent transmission analysis but still retain their independent anomaly detection function. Redundant edge pruning involves the system identifying and removing directed edges whose transmission strength weights are below a preset minimum threshold (e.g., below 0.1). Such extremely weak transmission relationships rarely produce meaningful anomaly transmissions in actual business operations. Retaining them only increases the computational overhead of subsequent graph searches and introduces noisy paths. Pruning them makes the association graph more concise and focuses on truly business-meaning transmission paths.

[0042] The final output relationship graph is a directed weighted graph that fully describes the topological relationships of abnormal business indicator transmission within and between each business module. Taking a typical manufacturing enterprise that includes five modules—procurement, inventory, production, sales, and finance—and involves 50 types of materials and their hierarchical relationships as an example, its relationship graph may contain approximately 200 to 300 nodes and 500 to 800 directed edges, forming a hierarchical and clearly defined network structure.

[0043] Based on the above embodiments, as an optional implementation method, in S103, constructing the association graph according to the material hierarchy structure and business process flow relationship in the unified database specifically includes S31-S33: S31. Extract the parent-child hierarchy of the material BOM from the unified database to determine the upstream and downstream correspondence of each material in different business modules.

[0044] In a multi-department collaborative business environment, the business indicators processed by different business modules are not isolated from each other, but rather form cross-module interconnected chains through the composition and composition relationships between materials. The system extracts the parent-child hierarchy of the Material Bill of Materials (BOM) from a unified database to determine the upstream and downstream correspondences of each material across different business modules. The Material BOM is a technical document recording the composition structure of materials at each level during product manufacturing. It defines the parent-child hierarchical relationship in a tree-like structure, showing which semi-finished products are assembled from the finished product, and which raw materials are processed from the semi-finished products. The parent-child hierarchy refers to the subordinate association between parent materials (i.e., materials assembled or processed from lower-level materials) and child materials (i.e., input materials used to assemble or process higher-level materials) in the Material BOM. The system traverses all Material BOM records in the unified database, parsing the parent-child hierarchy chains between finished products, semi-finished products, and raw materials layer by layer, thereby determining the upstream and downstream correspondences of each material across different business modules. The upstream and downstream correspondence refers to the causal driving direction between materials and their business indicators, determined by the parent-child hierarchy of the material BOM and the sequence of business processes. That is, changes in the status of a child material in the upstream business process will drive corresponding changes in the parent material in the downstream business process. For example, in a specific scenario, the material BOM records finished product "P-2024-0088" as a child material containing semi-finished product "S-2024-0152". The semi-finished product "S-2024-0152" contains raw material "M-2024-0371" as a child material. Therefore, the system determines that the available inventory status of raw material "M-2024-0371" in the inventory module is upstream of the production progress of semi-finished product "S-2024-0152" in the production module. Furthermore, the production progress of semi-finished product "S-2024-0152" is upstream of the production progress of finished product "P-2024-0088" in the production module.

[0045] S32, based on the upstream and downstream correspondence and business process flow relationship, the business indicators of each business module are used as nodes, and directed edges are established between business indicators that have upstream and downstream correspondence. The direction of the directed edges is from the upstream business indicator to the downstream business indicator.

[0046] After determining the upstream and downstream correspondences between materials in step S31, the system needs to map these relationships into a graph structure to support subsequent path search and transmission analysis. Based on the upstream and downstream correspondences and business process flow relationships, the system uses the business indicators of each business module as nodes and establishes directed edges between business indicators with upstream and downstream correspondences. Each node uses the change field identifier defined in step S101 as its unique identifier. Each node represents a specific business indicator of a specific material in a specific business module. For example, "Inventory Module - M-2024-0371 - Available Inventory Quantity" is one node, and "Production Module - S-2024-0152 - Cumulative Work Order Reporting Quantity" is another node. The business process flow relationship refers to the execution order of each business link in the enterprise's business activities. For example, procurement and warehousing precede production material requisition, production completion precedes finished product warehousing, finished product warehousing precedes sales delivery, and sales delivery precedes financial revenue recognition. This relationship determines the flow direction of the same material between different business modules. The system integrates the parent-child hierarchical relationships of the Bill of Materials (BOM) with the business process flow relationships. Directed edges are established between node pairs with upstream and downstream correspondences. The direction of the directed edges points from upstream business indicators to downstream business indicators, indicating that changes in the state of upstream nodes may drive corresponding changes in downstream nodes. Taking the aforementioned material relationships as an example, the system establishes a directed edge from "Inventory Module-M-2024-0371-Available Inventory Quantity" to "Production Module-S-2024-0152-Cumulative Work Order Quantity" (changes in raw material inventory drive changes in semi-finished product production progress), and a directed edge from "Production Module-S-2024-0152-Cumulative Work Order Quantity" to "Production Module-P-2024-0088-Cumulative Work Order Quantity" (completion of semi-finished products drives changes in finished product assembly progress), and so on until the financial confirmation stage at the end of the chain.

[0047] S33. Based on the time difference between the historical data change events of the upstream and downstream nodes connected by each directed edge, calculate the delay coefficient of each directed edge and generate the association graph.

[0048] The directed edges established in step S32 only express the existence and direction of the transmission relationship between nodes, but do not quantify the lag characteristics of the transmission in the time dimension. In actual business, the response of downstream nodes after changes in upstream nodes is not instantaneous, but involves time delays due to factors such as business processing cycles, logistics transportation time, or approval processes, and the delay lengths corresponding to different directed edges are different. If the delay is not quantified, a reasonable time window for verifying the transmission to downstream nodes cannot be determined in subsequent step S104. Therefore, the system calculates the delay coefficient of each directed edge based on the time difference between historical data change events between the upstream and downstream nodes connected by each directed edge. The delay coefficient is a quantitative parameter describing the typical time required for a transmission behavior on a directed edge to propagate from the upstream node to the downstream node. The specific calculation method is as follows: The system backtracks the data change event records of upstream and downstream nodes within a historical period from a unified database, identifies event pairs with causal relationships (i.e., pairing events where the downstream node changes in the same or related direction after the upstream node changes in a specific direction), calculates the time difference between each pair of events, and takes the median of the time differences of all pairing events as the delay coefficient of the directed edge. The median is used instead of the mean to avoid the excessive influence of a few abnormally long delays on the estimation of typical delays. Taking the directed edge from "Inventory Module-M-2024-0371-Available Inventory Quantity" to "Production Module-S-2024-0152-Cumulative Work Order Reporting Quantity" as an example, the system backtracks historical data and finds that after each reduction in raw material inventory (material requisition), semi-finished product work orders begin to be reported on average after about 4 hours. The median of multiple observations is used to determine the delay coefficient of this directed edge as 4 hours. After the system completes the delay coefficient calculation for all directed edges, the association graph is formed by all nodes, directed edges, and the delay coefficients marked on each directed edge. The correlation graph is a weighted directed graph that fully depicts the transmission direction and transmission time characteristics between business indicators of various business modules, providing a dual information basis of topology and time sequence for searching transmission links and determining the expected transmission time window in the subsequent step S104.

[0049] Based on the above embodiments, as an optional implementation, in S33, calculating the delay coefficient of each directed edge according to the time difference between the historical data change events of the upstream and downstream nodes connected by each directed edge specifically includes S331-S333: S331, obtain the first timestamp of the data change event generated by the upstream node connected by each directed edge within a preset historical time period, and the second timestamp of the data change event generated by the corresponding downstream node.

[0050] To calculate the delay coefficient of each directed edge, the system first needs to obtain the actual data change time records of upstream and downstream nodes within a historical period, serving as the raw data source for subsequent calculation of the propagation time difference. The system obtains the first timestamp of the data change event generated by the upstream node connected to each directed edge within a preset historical time period, and the second timestamp of the corresponding data change event generated by the downstream node. The preset historical time period is a pre-defined time range for tracing historical data change records, such as the most recent 90 days. This time range needs to be long enough to accumulate a statistically significant sample size, but should not be too long to avoid introducing outdated data that is no longer representative due to business process adjustments. The data change event refers to a record in the unified database where the value of a certain business indicator has undergone a substantial change. Each record includes the material code to which the change belongs, the changed business indicator field, and the precise time the change occurred. The first timestamp is the time point when the business indicator corresponding to the upstream node is recorded in a data change event, and the second timestamp is the time point when the business indicator corresponding to the downstream node pointed to by the directed edge is recorded in a data change event associated with it. Taking the directed edge from "Inventory Module-M-2024-0371-Available Inventory Quantity" to "Production Module-S-2024-0152-Cumulative Work Order Quantity" as an example, the system retrieves all change records and their timestamps from the unified database for the material "M-2024-0371" whose available inventory quantity has decreased (corresponding to material requisition and outbound operations) within the last 90 days as the first timestamp set. At the same time, it retrieves all change records and their timestamps for the material "S-2024-0152" whose cumulative work order quantity has increased within the same time period as the second timestamp set.

[0051] S332, calculate the difference between the second timestamp and the first timestamp under the same material code to obtain multiple sets of transmission time samples.

[0052] After obtaining the first and second timestamps, the system needs to pair the change events of upstream and downstream nodes according to causal correspondence and calculate the time difference to quantify the actual time spent on the transmission behavior. The system calculates the difference between the second and first timestamps under the same material code to obtain multiple sets of transmission time samples. The same material code refers to the constraint condition for pairing calculation, that is, the data change event of the upstream node and the data change event of the downstream node must belong to the related materials in the same material BOM parent-child link to ensure that there is a real business causal relationship between the two change events rather than a random time coincidence. The specific pairing method is as follows: for each first timestamp record of the upstream node, the record that is closest in time and later than the first timestamp in the second timestamp set of the downstream node is matched, and the time difference between the two is used as a set of transmission time samples. The transmission time sample is a numerical value expressed in time units, representing the length of time that an actual business transmission takes from the occurrence of a change in the upstream node to the response of the downstream node. Taking the aforementioned directed edge as an example, if material "M-2024-0371" is issued from the warehouse at 8:00 AM (first timestamp), and material "S-2024-0152" is recorded as completed at 12:15 PM (second timestamp), then the transmission time sample for this set is 4 hours and 15 minutes. The system repeats the above calculation for all pairable change events within a preset historical time period to obtain multiple sets of transmission time samples. For example, for this directed edge, a total of 47 valid pairs were identified within 90 days, resulting in 47 sets of transmission time samples.

[0053] S333: After removing outliers from multiple sets of transmission time samples, take the median of the remaining samples as the delay coefficient of the directed edge; when the number of transmission time samples is less than the preset minimum sample size, set the delay coefficient of the directed edge to the default process cycle value of the corresponding level in the material hierarchy structure.

[0054] In real-world business environments, individual transmission time samples may deviate significantly from normal levels due to abnormal situations such as equipment failure, system downtime, manual data entry, or holiday shutdowns. Directly taking statistics from all samples would distort the estimation results of the delay coefficient, making it unreliable to accurately reflect typical transmission time under normal business conditions. Therefore, the system removes outliers from multiple sets of transmission time samples and uses the median of the remaining samples as the delay coefficient for the directed edge. Outlier removal refers to identifying and removing abnormal extreme values ​​from the transmission time samples using the interquartile range (IQR) method. Specifically, the first and third quartiles of the sample set are calculated, and the difference between them is defined as the IQR. Samples with values ​​lower than the first quartile minus 1.5 times the IQR or higher than the third quartile plus 1.5 times the IQR are considered outliers and removed. After removing outliers, the system uses the median of the remaining samples as the delay coefficient for the directed edge. The median is chosen over the mean because the median is more robust to the slight skewness that may still exist in the remaining samples, and can more stably reflect the typical level of transmission time. Taking the aforementioned directed edge as an example, after outlier removal from the 47 transmission time samples, 42 samples remain. Taking the median, we get 4.1 hours, and the system sets the delay coefficient of this directed edge to 4.1 hours. Furthermore, for newly introduced materials or materials with low business change frequency, the number of change events that can be paired within the preset historical time period may not be sufficient to form a statistically reliable sample set. When the number of transmission time samples is less than the preset minimum sample size, the system sets the delay coefficient of this directed edge to the default process cycle value of the corresponding level in the material hierarchy. The preset minimum sample size is the minimum quantitative threshold set by the system to determine whether the sample set has statistical reliability. For example, it is set to 10 pairs, meaning that when the number of effective pairs is less than 10, the statistical estimate based on historical data is considered unreliable. The default process cycle value is a typical processing or circulation cycle predefined according to the standard process route of each level of materials in the material BOM. For example, the default process cycle value from raw materials to semi-finished products is 8 hours, and the default process cycle value from semi-finished products to finished products is 12 hours. This value comes from the standard operating time recorded in the enterprise process documents.

[0055] S104. Obtain the material code of the abnormal signal event. Based on the material code, locate the starting node in the association graph. Traverse the downstream nodes step by step from the starting node along the directed edge to generate multiple transmission links. For each downstream node in each transmission link, determine the expected transmission time window based on the delay coefficient of the directed edge. Check whether there is an abnormal signal event in the time sequence of each downstream node within the expected transmission time window.

[0056] Specifically, after an abnormal signal event is generated in step S102, the system first obtains the material code carried by the abnormal signal event. The material code is the unique identifier of the specific material recorded in the abnormal signal event in step S102, such as "M-2024-0371". The system also extracts the module identifier and indicator type carried by the abnormal signal event, and uses the material code, module identifier, and indicator type together as the positioning conditions to find the uniquely corresponding node in the association graph, and determines this node as the starting node. The starting node is the business indicator node in the association graph that directly corresponds to the abnormal signal event that triggered this transmission analysis. It is the starting point for subsequent graph traversal. For example, when the material code of the abnormal signal event is "M-2024-0371", the module identifier is "inventory module", and the indicator type is "available inventory quantity", the system locates the node "inventory module-M-2024-0371-available inventory quantity" in the association graph as the starting node. If there is no node in the correlation graph that perfectly matches the abnormal signal event (for example, the business indicator is marked as an independent monitoring node in the connectivity verification in step S103), the system will terminate the current transmission analysis and mark the abnormal signal event as an independent abnormal event, and will not perform subsequent link traversal operations.

[0057] After successfully locating the starting node, the system traverses the associated graph level by level along all directed edges originating from the starting node, generating multiple propagation links. A propagation link is an ordered sequence of nodes that passes through a series of downstream nodes along the directed edge from the starting node. Each propagation link represents the complete propagation path of an abnormal signal from the source indicator to the final affected indicator, potentially following a specific business logic path. The traversal method employs a breadth-first search strategy. The system first visits all direct downstream nodes of the starting node (nodes directly connected to the starting node via a directed edge and pointed to by an arrow). Then, for each direct downstream node, it visits its own direct downstream nodes, expanding outwards layer by layer until it reaches a terminal node with no outgoing edges or the traversal depth reaches the preset maximum propagation level (e.g., a maximum propagation level of 6 means the system tracks the abnormality along a path of at most 6 steps; propagation beyond 6 steps loses its practical warning significance due to excessive attenuation). During traversal, if a node has multiple outgoing edges pointing to different downstream nodes, the path branches at that node, with each branch extending independently to form a different transmission link. The system also performs loop detection during traversal; if an extending path returns to a previously visited node, the system truncates the path to avoid infinite loops in graph regions with circular structures. Furthermore, the system incorporates a transmission strength attenuation determination during traversal: for each extending transmission link, the system continuously calculates the cumulative transmission strength from the starting node to the currently reached node. This cumulative transmission strength is the product of the transmission strength weights of all directed edges traversed along the path. When this product falls below a preset minimum effective transmission strength threshold (e.g., 0.05), the system determines that the actual impact of the abnormal signal continuing to propagate downwards along the path has attenuated to a negligible level, terminating further extension of the path.

[0058] Taking the aforementioned starting node "Inventory Module - M-2024-0371 - Available Inventory Quantity" as an example, the system found two outgoing edges for this node in the association graph: the first outgoing edge points to the node "Production Module - S-2024-0152 - Cumulative Work Order Reporting Quantity" (delay coefficient of 18 time units, transmission strength weight of 0.72), indicating that the inventory abnormality of raw material "M-2024-0371" may be transmitted to the production reporting progress of semi-finished product "S-2024-0152" which uses raw material; the second outgoing edge points to the node "Production Module - S-2024-0153 - Cumulative Work Order Reporting Quantity" (delay coefficient of 24 time units, transmission strength weight of 0.65), indicating that the inventory abnormality of the same raw material may also affect the production progress of another semi-finished product "S-2024-0153" which uses raw material. The system extends downwards along two outgoing edges, reaching the node "Production Module - S-2024-0152 - Cumulative Work Order Quantity". It is found that this node also has an outgoing edge pointing to the node "Production Module - P-2024-0088 - Cumulative Work Order Quantity" (delay coefficient of 36 time units, propagation strength weight of 0.68). This indicates that the semi-finished product production anomaly can be further propagated to the finished product assembly progress using that semi-finished product. Continuing to extend, the outgoing edge of the finished product production node points to the node "Inventory Module - P-2024-0088 - Available Finished Product Inventory Quantity" (delay coefficient of 8 time units, propagation strength weight of 0.81). From there, the finished product inventory node points to the node "Sales Module - P-2024-0088 - Amount of Orders Awaiting Shipment" (delay coefficient of 12 time units, propagation strength weight of 0.77), and finally to the node "Finance Module - P-2024-0088 - Accounts Receivable Confirmation Amount" (delay coefficient of 48 time units, propagation strength weight of 0.60). Therefore, the system generates a complete transmission link as follows: Inventory Module - M-2024-0371 - Available Inventory Quantity → Production Module - S-2024-0152 - Cumulative Work Order Reporting Quantity → Production Module - P-2024-0088 - Cumulative Work Order Reporting Quantity → Inventory Module - P-2024-0088 - Available Finished Goods Inventory Quantity → Sales Module - P-2024-0088 - Amount of Orders Pending Shipment → Finance Module - P-2024-0088 - Confirmed Amount of Accounts Receivable. The directed edge delay coefficients between adjacent nodes in this transmission link are 18, 36, 8, 12, and 48 time units respectively. The cumulative transmission strength of the path is 0.72×0.68×0.81×0.77×0.60, approximately equal to 0.19, which is higher than the minimum effective transmission strength threshold of 0.05. Therefore, the entire path remains effective. Similarly, extending along the second outgoing edge direction can generate one or more conduction links. The system retains all paths that meet the effective conduction strength condition as the candidate conduction link set for this conduction analysis.

[0059] After generating multiple transmission links, the system performs the calculation of the expected transmission time window and anomaly verification for each downstream node in each transmission link. For the nth downstream node in a transmission link, the system accumulates the delay coefficients of all directed edges traversed from the starting node to the downstream node to obtain the cumulative expected delay time of the downstream node relative to the timestamp of the abnormal signal event occurring at the starting node. The expected transmission time window is a time interval formed by expanding a preset tolerance range forward and backward from the timestamp of the abnormal signal event plus the cumulative expected delay time. The preset tolerance range is used to accommodate the transmission time deviation caused by factors such as production rhythm fluctuations, scheduling differences, or logistics uncertainties during the actual transmission process. Its value is the cumulative expected delay time multiplied by a preset tolerance ratio (for example, if the tolerance ratio is set to 0.3, the tolerance range is 30% before and after the cumulative expected delay time). Taking the first downstream node in the above transmission link, "Production Module-S-2024-0152-Cumulative Work Order Quantity," as an example, its cumulative expected delay time is 18 time units (passing through only one directed edge). The preset tolerance ratio is 0.3, so the tolerance range is 18 × 0.3 = 5.4 time units, rounded down to 5 time units. The expected transmission time window is the time interval covered by the 13th to 23rd time units after the timestamp of the abnormal signal event. For the second downstream node, "Production Module-P-2024-0088-Cumulative Work Order Quantity," its cumulative expected delay time is 18 + 36 = 54 time units. The tolerance range is 54 × 0.3 = 16.2 time units, rounded down to 16 time units. The expected transmission time window is the time interval covered by the 38th to 70th time units after the timestamp of the abnormal signal event. Similarly, the further downstream the node is in the transmission chain, the farther its expected transmission time window is from the initial abnormal event, and the tolerance range also increases accordingly due to the increase in cumulative delay. This is consistent with the objective law in actual business that the greater the transmission distance, the greater the time uncertainty.

[0060] After determining the expected transmission time window for each downstream node, the system backchecks the time sequence of the corresponding business indicators for each downstream node to retrieve whether any abnormal signal events generated in step S102 exist within the expected transmission time window. The backcheck operation refers to the system searching the set of abnormal signal events output in step S102 to find records of abnormal signal events whose module identifier, material code, and indicator type completely match the current downstream node, and whose timestamps fall within the expected transmission time window of that downstream node. Simultaneously, the system verifies whether the abnormal direction marker of the matched abnormal signal event is consistent with the abnormal direction marker of the starting node's abnormal signal event in business logic. The direction consistency judgment rule is: if the starting node is a downward out-of-bounds event (e.g., inventory decrease), then the abnormal direction of the downstream node should be consistent with the business transmission logic (e.g., a delayed production reporting progress is a downward out-of-bounds event, and an increase in the amount to be shipped is an upward out-of-bounds event). The system determines the expected abnormal direction of the target node based on the preset direction transmission mapping attribute of the directed edge (i.e., whether the abnormal direction is unidirectional or reverse transmission when the directed edge is transmitted) and compares it with the actual backcheck results.

[0061] The backtracking verification yields three possible results. The first scenario is confirmed transmission: If an anomalous signal event with the same direction does exist within the expected transmission time window of a downstream node, the system marks the downstream node as "transmitted," indicating that the anomalous signal has actually been transmitted along the directed edges of the correlation graph to that node and produced observable anomalous behavior; this transmission has become a fait accompli. The second scenario is transmission not occurring: If the expected transmission time window of a downstream node has completely passed (i.e., the current time has exceeded the right endpoint of the window) but no matching anomalous signal event is found, the system marks the downstream node as "absorbed," indicating that although an anomaly exists upstream, the buffering mechanism of the intermediate links (such as sufficient safety stock or the existence of alternative material sources) has successfully absorbed the impact of the anomaly; transmission is blocked at this node, and further downstream paths after this node no longer need to be tracked. The third scenario is "propagation under observation": If the expected propagation time window for a downstream node has not yet fully arrived (i.e., the current time is still earlier than the right end of the window), the system marks the downstream node as "under observation," indicating that according to the propagation delay pattern, the abnormal signal is expected to arrive at the node within a specific time period in the future. The system needs to perform a backtracking check after the time window ends to finally confirm whether propagation has occurred. For downstream nodes marked as "under observation," the system generates a forward-looking early warning record, which includes the expected time interval during which the node may be affected and the propagation probability estimated based on the cumulative propagation intensity along the path, allowing managers to take preventative measures in advance.

[0062] After the system completes the aforementioned backtracking verification for each downstream node in the transmission link, it marks the transmission status of each node back into the transmission link, forming a complete transmission link record with the transmission verification results. This record clearly shows which intermediate nodes the anomalous signal passes through from the starting node, at which nodes the transmission has been confirmed, at which nodes it has been successfully absorbed, and at which nodes it is still under observation. For multiple transmission links triggered by a single anomalous signal event, the system summarizes them into a transmission link set for that anomalous event, comprehensively depicting the overall diffusion impact originating from that anomalous event.

[0063] Based on the above embodiments, as an optional implementation, in S104, multiple transmission links are generated by traversing from the starting node along the directed edges to the downstream nodes level by level; for each downstream node in each transmission link, the expected transmission time window is determined according to the delay coefficient of the directed edge, and the timing sequence of each downstream node is checked to see if there are any abnormal signal events within the expected transmission time window, specifically including S41-S43: S41: Starting from the starting node, the traversal proceeds downstream level by level along the directed edges using a breadth-first traversal method. The traversal ends when the traversal depth reaches the preset maximum depth or when the current node has no downstream directed edges. The complete path from the starting node to each ending node is taken as a transmission link.

[0064] After an abnormal signal event is generated in step S102, the system needs to determine, based on the association graph, which paths the abnormality may propagate to downstream business modules, thereby defining the scope of nodes that need to be verified for subsequent propagation. The system starts from the starting node and uses a breadth-first traversal to expand downstream along directed edges. Traversal terminates when the traversal depth reaches a preset maximum depth or when the current node has no downstream directed edges. The complete path from the starting node to each ending node is considered a propagation link. The starting node is the node in the association graph corresponding to the business indicator of the abnormal signal event. It is uniquely determined by the module identifier and material code carried by the abnormal signal event. For example, if the abnormal signal event carries the module identifier "Inventory Module" and the material code "M-2024-0371", then the starting node is "Inventory Module - M-2024-0371 - Available Inventory Quantity". Breadth-first traversal is a graph search method that expands hierarchically. The system first visits all direct downstream nodes of the starting node (i.e., nodes directly pointed to by the starting node through directed edges), and then sequentially visits the downstream nodes of each of these direct downstream nodes, progressing layer by layer until the termination condition is met. The preset maximum depth is a pre-set upper limit of the traversal level, for example, set to 5, meaning that a maximum of 5 levels can be expanded downstream from the starting node. Nodes further downstream than this depth are no longer included in the current propagation analysis because the propagation correlation has significantly weakened and the accumulated time uncertainty is too large. The propagation link is an ordered sequence of nodes starting from the starting node and connected to a certain termination node through a series of directed edges, representing a possible path for the anomaly to propagate downstream from the source. Taking the aforementioned starting node as an example, one of the transmission links generated by the system through breadth-first traversal is "Inventory Module - M-2024-0371 - Available Inventory Quantity → Production Module - S-2024-0152 - Cumulative Work Order Reporting Quantity → Production Module - P-2024-0088 - Cumulative Work Order Reporting Quantity → Inventory Module - P-2024-0088 - Finished Goods Warehousing Quantity → Sales Module - P-2024-0088 - Delivery Order Execution Quantity". Another transmission link may branch to different downstream nodes at the second level to form another path.

[0065] S42, for each downstream node in each transmission link, add the timestamp of the occurrence of the abnormal signal event to the cumulative value of the delay coefficient of each directed edge on the path from the starting node to the downstream node to obtain the expected transmission arrival time. Extend the preset tolerance time forward and backward with the expected transmission arrival time as the center to generate the expected transmission time window.

[0066] After generating the transmission links, the system needs to determine the time base for performing transmission verification on each downstream node in each transmission link, i.e., when the abnormal transmission is expected to reach the node. Since the abnormality propagates from upstream to downstream along directed edges with a certain time delay, and the delay of multi-level transmission accumulates step by step, the system must calculate the expected transmission arrival time for each downstream node and generate a reasonable retrieval time range accordingly. For each downstream node in each transmission link, the system adds the timestamp of the abnormal signal event occurrence to the accumulated value of the delay coefficients of each directed edge on the path from the starting node to the downstream node to obtain the expected transmission arrival time. The expected transmission time window is generated by extending a preset tolerance time forward and backward with the expected transmission arrival time as the center. The occurrence timestamp is the time point when the abnormal signal event of the starting node is determined to be generated in step S22, for example, 10:00 on June 15, 2024. The accumulated value of the delay coefficients is the sum of the delay coefficients of each directed edge traversed from the starting node to the target downstream node along the transmission link, representing the expected total time for the abnormal signal to propagate from the source to the node under normal business conditions. The expected transmission arrival time is the sum of the occurrence timestamp and the accumulated delay coefficient, representing the typical moment when the system expects the abnormal impact to reach the downstream node. The preset tolerance duration is a buffer time extended before and after the expected transmission arrival time, for example, set to 2 hours, to absorb time fluctuations caused by batch scheduling differences, process waiting, or system recording delays during the actual transmission process. The expected transmission time window is the time interval defined by the expected transmission arrival time and extended by the preset tolerance duration before and after it, representing the time range within which the system believes the downstream node's response change should fall if affected by the source abnormal transmission. Taking the transmission link "Inventory Module-M-2024-0371-Available Inventory Quantity → Production Module-S-2024-0152-Cumulative Work Order Reporting Quantity → Production Module-P-2024-0088-Cumulative Work Order Reporting Quantity" as an example, the delay coefficient of the first directed edge is 4.1 hours, the delay coefficient of the second directed edge is 6.3 hours, and the timestamp of the abnormal signal event is 10:00. Then, the cumulative delay coefficient of the second downstream node "Production Module-P-2024-0088-Cumulative Work Order Reporting Quantity" is 10.4 hours, the expected transmission arrival time is 20:24, the preset tolerance duration is 2 hours, so the expected transmission time window of this node is from 18:24 to 22:24.

[0067] S43. In the time sequence corresponding to each downstream node, search for whether there is an abnormal signal event that has been generated within the expected transmission time window. If it exists and the material code associated with the abnormal signal event belongs to the same BOM level tree as the material code of the starting node, then it is determined that the abnormal signal event of the downstream node has a transmission correlation with the abnormal signal event of the starting node.

[0068] After determining the expected propagation time window for each downstream node, the system needs to verify whether these downstream nodes have indeed exhibited response changes causally related to the anomaly at the starting node within the expected time frame, thereby distinguishing between genuine cross-module propagation correlations and independent anomalies that are merely coincidental in time. The system searches the time series corresponding to each downstream node for any generated abnormal signal events within the expected propagation time window. If such events exist and the material code associated with the abnormal signal event belongs to the same BOM hierarchy tree as the material code of the starting node, then the system determines that the abnormal signal event of the downstream node has a propagation correlation with the abnormal signal event of the starting node. The generated abnormal signal event refers to an abnormal signal event that was independently triggered and generated in step S22 of the time series corresponding to the downstream node, rather than a newly generated event for this propagation verification. The system searches the time series of the downstream node for any such event records within the time interval covered by the expected propagation time window. The same BOM hierarchy tree means that the material code of the starting node and the material code associated with the abnormal signal event of the downstream node belong to the same composition tree in the parent-child hierarchy structure of the material BOM, i.e., there is a direct or indirect parent-child relationship between them. The purpose of this condition is to exclude situations where business metrics with no material composition relationship between different product lines happen to show anomalies at similar times and are mistakenly judged as having a transmission correlation. The transmission correlation refers to the system's determination, after dual confirmation through time window matching and material relationship verification, that the abnormal signal event at the downstream node is caused by the anomaly at the starting node being transmitted through the business process, rather than being an independent causal conclusion. Taking the aforementioned transmission link as an example, the system searches for the expected transmission time window from 18:24 to 22:24 in the time sequence of "Production Module - P-2024-0088 - Cumulative Work Quantity of Work Orders". It finds that there is an abnormal signal event generated at 20:00 for this node, and its associated material code is "P-2024-0088". The material code of the starting node "M-2024-0371" and "P-2024-0088" belong to the same level tree in the material BOM ("M-2024-0371" is an indirect child material of "P-2024-0088"). Therefore, the system determines that the abnormal signal event of the downstream node has a transmission correlation with the abnormal signal event of the starting node.

[0069] S105. When at least two consecutive nodes on the transmission link have abnormal signal events, the transmission link is determined to be in a chain-like risk activation state. The risk coefficient is determined based on the ratio of the number of activated nodes to the total number of nodes in the transmission link. When the risk coefficient is greater than a preset threshold, an early warning report is generated.

[0070] A chain-like risk activation state refers to a transmission link whose overall transmission state has transformed from a theoretically potential risk path to an active risk state where continuous abnormal propagation is actually occurring. The core condition for determining whether a transmission link has entered a chain-like risk activation state is that at least two consecutive nodes on the transmission link both exhibit abnormal signal events. Two consecutive nodes refer to two adjacent nodes in the ordered node sequence of the transmission link (i.e., the source node and the target node directly connected by a directed edge). The presence of abnormal signal events means that both nodes are marked as "transmitted" in the back-check verification in step S104 (for the starting node, it is itself the node corresponding to the abnormal signal event that triggered the transmission analysis, and is naturally in an abnormal state). The reason for setting the judgment condition as "at least two consecutive nodes" rather than triggering it with a single anomaly at the starting node is that an anomaly at a single node may be due to random deviations of the business indicator itself or the influence of external factors unrelated to this transmission link. Only when the anomaly signal has successfully propagated along the directed edge to at least one direct downstream node and generated a consistent anomaly response within its expected propagation time window can it be confirmed, both statistically and logically, that "the transmission behavior is indeed happening," rather than merely remaining a theoretical speculation. This judgment condition constitutes a dividing standard between "potential risks" and "actual risks that are spreading," effectively avoiding overreaction to single-point anomalies that have not yet formed actual transmission.

[0071] When the system performs a judgment on the transmission link, it checks the transmission status of adjacent nodes one by one along the ordered node sequence of the transmission link, starting from the starting node. If both the starting node and its first direct downstream node are in an abnormal state (the starting node is naturally abnormal, and the first downstream node is marked as "transmitted" in the back check in step S104), then the pair of adjacent nodes satisfies the condition that "both consecutive nodes have abnormal signal events", and the transmission link is judged to be in a chain-like risk activation state. If the first direct downstream node of the starting node is marked as "absorbed", but a deeper node after that downstream node independently generates an abnormality due to the convergence of other transmission paths (this situation may occur in actual business scenarios where multiple transmission links converge at a certain intermediate node), the system continues to check whether there are other adjacent node pairs that satisfy the condition. As long as there is any pair of adjacent nodes in the transmission link that are both in an abnormal state, the transmission link enters the chain-like risk activation state. Taking the transmission link exemplified in step S104, "Inventory Module-M-2024-0371-Available Inventory Quantity → Production Module-S-2024-0152-Cumulative Work Order Reporting Quantity → Production Module-P-2024-0088-Cumulative Work Order Reporting Quantity → Inventory Module-P-2024-0088-Finished Goods Available Inventory Quantity → Sales Module-P-2024-0088-Amount of Orders Pending Shipment → Finance Module-P-2024-0088-Accounts Receivable Confirmation Amount", as an example, if the starting node "Inventory Module-M-2024-0371-Available Inventory Quantity" is in an abnormal state (triggering the abnormal signal event for this analysis), and the first downstream node "Production Module-S-2024-0152-Cumulative Work Order Reporting Quantity" is also confirmed to have an abnormal signal event with the same direction within its expected transmission time window, then the transmission link satisfies the judgment condition of the chain-like risk activation state.

[0072] After determining that the transmission link has entered a chain-like risk activation state, the system further calculates the risk coefficient of the transmission link to quantify its risk severity. The system first counts the total number of nodes on the transmission link that have been confirmed to be in an abnormal state, defining this as the number of activated nodes. The number of activated nodes includes the starting node itself, all downstream nodes marked as "transmitted" in step S104, and all downstream nodes marked as "to be observed" but ultimately confirmed to be abnormal during subsequent continuous monitoring. The system also counts the total number of nodes contained in the transmission link from the starting node to the final terminating node (including the starting and terminating nodes), defining this as the total number of nodes in the transmission link. The risk coefficient is calculated by dividing the number of activated nodes by the total number of nodes in the transmission link; that is, the risk coefficient is equal to the ratio of the number of activated nodes to the total number of nodes in the transmission link. The ratio ranges from greater than zero to less than or equal to 1. The lower limit is constrained by the minimum determination condition for the activation state of a chain risk – at least two consecutive abnormal nodes mean that at least two nodes are activated. Therefore, for a transmission link containing six nodes, the minimum risk coefficient is approximately 2 divided by 6, which is about 0.33. The closer the risk coefficient is to 1, the higher the proportion of business processes in the transmission link the anomaly has penetrated, and the more severe the spread of the chain risk. A lower risk coefficient indicates that although the anomaly has begun to propagate, it is still in its early stages, and many downstream processes have not yet been affected.

[0073] Let's continue with the above transmission link as an example. The total number of nodes in this transmission link is 6 (including all nodes, including the starting node). If the starting node "Inventory Module - M-2024-0371 - Available Inventory Quantity" is in an abnormal state at the current moment, the first downstream node "Production Module - S-2024-0152 - Cumulative Work Order Reporting Quantity" has been confirmed to have propagated, the second downstream node "Production Module - P-2024-0088 - Cumulative Work Order Reporting Quantity" has also been confirmed to have propagated, the third downstream node "Inventory Module - P-2024-0088 - Finished Goods Available Inventory Quantity" is marked as "Under Observation", the fourth downstream node "Sales Module - P-2024-0088 - Amount of Orders to be Shipped" is also marked as "Under Observation", and the final node "Finance Module - P-2024-0088 - Accounts Receivable Confirmation Amount" has not yet entered the expected propagation time window, then the current number of activated nodes is 3 (the starting node plus the two downstream nodes whose propagation has been confirmed), and the risk coefficient is 3 divided by 6, which equals 0.50. If, as time progresses, a third downstream node is also confirmed to have an abnormal signal event within its expected propagation time window, the number of activated nodes is updated to 4, and the risk coefficient is correspondingly updated to 4 divided by 6, approximately equal to 0.67. Therefore, the risk coefficient is an indicator that dynamically evolves with the propagation process, and the system recalculates its value each time a new downstream node's propagation status is confirmed.

[0074] After calculating the risk coefficient, the system compares it with a preset threshold to determine whether an early warning report needs to be generated. The preset threshold is a pre-configured benchmark for determining the severity of risk. Its value is set by management based on the company's risk tolerance and business sensitivity. For example, a threshold of 0.5 indicates that when more than half of the nodes in a transmission chain have been penetrated by an abnormal signal, the severity of the chain risk has reached a level requiring management attention and intervention. Setting the preset threshold requires a balance between timely and accurate early warnings: a threshold set too low will trigger warnings for many links only in the early stages of transmission, increasing the processing burden on management; a threshold set too high may trigger warnings only when the anomaly has already transmitted to critical business links at the end of the chain, losing the window of opportunity for early intervention. In practice, the system supports configuring differentiated preset thresholds for different types of transmission chains. For example, for critical business nodes at the end of the transmission chain that directly affect customer satisfaction and cash flow, such as sales delivery or financial settlement, the preset threshold can be set to a lower 0.4 to improve warning sensitivity; while for paths at the end of the transmission chain that only involve internal intermediate processes, the preset threshold can be set to a higher 0.6 to reduce non-critical warnings.

[0075] When the risk coefficient of a certain transmission link exceeds a preset threshold, the system generates an early warning report for that transmission link. The early warning report is a structured risk notification document output by the system to management personnel, containing the following complete information: a complete path description of the transmission link, i.e., the complete ordered sequence of nodes from the starting node to the ending node and the delay coefficients of the directed edges between adjacent nodes; the current transmission status of each node ("transmitted", "absorbed", or "to be observed"); for nodes confirmed to have transmitted data, the specific timestamp of their abnormal signal event and the magnitude of the abnormal deviation (i.e., the degree to which the node's sequence value exceeds the threshold interval boundary); the current value of the risk coefficient and its excess relative to the preset threshold; and the cumulative transmission strength of the transmission link (i.e., the transmission strength weights of each directed edge calculated in step S104). The system includes a series of interconnected data points (multiplication of multiple data points), used to help determine the reliability of the transmission chain; the expected time interval of each downstream node in the "to be observed" state (i.e., its expected transmission time window), allowing managers to understand when the anomaly is expected to reach which unaffected business links if no intervention is taken; and a potential business impact assessment automatically generated by the system based on the business module and material hierarchy of the end node of the transmission chain. For example, if the end of the transmission chain points to the sales and delivery node of the finished product "P-2024-0088", the system will query the current number and amount of customer orders to be delivered for that finished product and indicate in the early warning report the scale of customer orders that may be affected if the chain risk is not intervened.

[0076] Based on the above embodiments, as an optional implementation, in S105, determining the risk coefficient according to the ratio of the number of activated nodes to the total number of nodes in the transmission link specifically includes S51-S55: S51, obtain the position number of each node in the transmission link along the directed edge direction, and use the quotient of the number of activated nodes and the total number of nodes in the transmission link as the basic activation ratio.

[0077] After determining the conduction correlation in step S43, the system has identified which downstream nodes in each conduction link have a conduction correlation with the starting node's abnormal signal events. These nodes confirmed to have a conduction correlation are the activated nodes. To quantify the spread of the anomaly along the conduction link, the system first needs to determine the topological position of each node in the link and calculate the basic spread ratio. The system obtains the position number of each node along the directed edge direction in the conduction link and uses the quotient of the number of activated nodes and the total number of nodes in the conduction link as the basic activation ratio. The position number refers to the sequential numbering of each node in the conduction link from the starting node to the ending node along the directed edge direction. The position number of the starting node is 1, the position number of its direct downstream node is 2, and so on until the ending node. The number of activated nodes is the total number of downstream nodes in the conduction link that have a conduction correlation with the starting node's abnormal signal event as determined in step S43. The total number of nodes is the total number of nodes included in the conduction link from the starting node to the ending node. The basic activation ratio is the ratio of the number of activated nodes to the total number of nodes, reflecting the coverage breadth of anomaly propagation on this link. Taking the propagation link "Inventory Module-M-2024-0371-Available Inventory Quantity → Production Module-S-2024-0152-Cumulative Work Order Reporting Quantity → Production Module-P-2024-0088-Cumulative Work Order Reporting Quantity → Inventory Module-P-2024-0088-Finished Goods Warehousing Quantity → Sales Module-P-2024-0088-Delivery Order Execution Quantity" as an example, the total number of nodes in this link is 5. If the nodes with position numbers 2 and 3 are determined to be activated nodes, then the number of activated nodes is 2, and the basic activation ratio is 2 divided by 5, which equals 0.4.

[0078] S52 assigns position weights to each activated node in the transmission link, with the position weights being proportional to the position number of the activated node.

[0079] The basic activation ratio only reflects the proportion of activated nodes, but does not distinguish the differences in the positions of activated nodes in the transmission chain. In actual business scenarios, nodes with higher position numbers are farther from the starting node. The farther an anomaly can be transmitted to, the stronger its penetration and the wider its actual impact on downstream businesses. Therefore, the risk severity represented by the activation of a distant node should be higher than that represented by the activation of a nearby node. The system assigns position weights to each activated node in the transmission chain, and the position weights are proportional to the position number of the activated node. The position weight is a numerical coefficient assigned to each activated node to characterize the degree to which the activation of the node contributes to the overall risk assessment, and its value is equal to the position number of the activated node. Taking the aforementioned example, the activated node with position number 2 has a position weight of 2, and the activated node with position number 3 has a position weight of 3.

[0080] S53, calculate the normalized weighted mean of the position weights of each activated node to obtain the position weighting factor.

[0081] After assigning position weights to each activated node, the system needs to synthesize these discrete weight values ​​into a single index that reflects the overall positional distribution characteristics of the activated nodes. The system calculates the normalized weighted mean of the position weights of each activated node to obtain the position weighting factor. The normalized weighted mean is calculated by summing the position weights of each activated node and dividing by the sum of the position indices of all nodes in the transmission link (i.e., the sum of natural numbers from 1 to the total number of nodes), thus normalizing the value range of the position weighting factor to between 0 and 1, facilitating multiplication and combination with other factors. The position weighting factor is a value between 0 and 1; the closer its value is to 1, the more concentrated the activated nodes are at the far end of the transmission link, representing a greater penetration depth of the abnormal transmission. Taking the aforementioned example, the sum of the position weights of the activated nodes is 2 plus 3 equals 5, and the sum of the position indices of all nodes in the transmission link is 1 plus 2 plus 3 plus 4 plus 5 equals 15. The position weighting factor is 5 divided by 15, approximately equal to 0.33.

[0082] S54. Obtain the actual propagation time between the timestamp of the abnormal signal event of the starting node and the timestamp of the abnormal signal event of the last activated node. Obtain the cumulative value of the delay coefficient of each directed edge on the path from the starting node to the last activated node as the expected propagation time. Calculate the ratio of the expected propagation time to the actual propagation time to obtain the propagation acceleration factor.

[0083] Besides the breadth and depth of transmission coverage, the speed of anomaly propagation is also an important dimension for measuring the urgency of risk. If the actual time taken for an anomaly to propagate from the starting node to the downstream activated node is shorter than the normal time expected based on the delay coefficient, it indicates that the anomaly is propagating faster than historical norms, which may mean that normal business buffer mechanisms (such as safety stock, production queuing time, etc.) have been breached or failed, and the urgency of the risk is higher. The system obtains the actual propagation time between the timestamp of the anomaly signal event at the starting node and the timestamp of the anomaly signal event at the last activated node, obtains the cumulative value of the delay coefficients of each directed edge on the path from the starting node to the last activated node as the expected propagation time, and calculates the ratio of the expected propagation time to the actual propagation time to obtain the propagation acceleration factor. The last activated node is the node with the largest position number among all activated nodes in the propagation link, representing the farthest position actually reached by the anomaly propagation. The actual propagation time is the time difference between the timestamp of the anomaly signal event at the starting node and the timestamp of the anomaly signal event at the last activated node, representing the real time taken for the anomaly to actually propagate from the source to the farthest activated node. The expected propagation time is the sum of the delay coefficients of all directed edges along the path from the starting node to the last activated node, representing the typical expected propagation time of an anomaly to that node under normal business conditions. The propagation acceleration factor is the ratio of the expected propagation time to the actual propagation time. When this ratio is greater than 1, it indicates that the actual propagation speed is faster than expected (anomaly propagation is accelerating); when the ratio is equal to 1, it indicates that the actual propagation speed is consistent with the expectation; and when the ratio is less than 1, it indicates that the actual propagation speed is slower than expected. Taking the aforementioned example, the timestamp of the anomaly signal event at the starting node is 10:00, and the timestamp of the anomaly signal event at the last activated node (position number 3) is 19:00. Therefore, the actual propagation time is 9 hours; the delay coefficients of the two directed edges along the path from the starting node to this node are 4.1 hours and 6.3 hours respectively, resulting in an expected propagation time of 10.4 hours; the propagation acceleration factor is 10.4 divided by 9, approximately equal to 1.16, indicating that the actual propagation speed of the anomaly is about 16% faster than expected.

[0084] S55 generates a risk coefficient by multiplying the base activation ratio, the position weighting factor, and the conduction acceleration factor.

[0085] like Figure 2 As shown, Figure 2This is a schematic diagram of the complete technical process of a multi-department production collaborative management method provided in this application embodiment. The top layer of the diagram represents the business module layer. The procurement module, inventory module, production module, sales module, and quality module each connect their generated business data to a unified database through data change events. The unified database serves as the data aggregation center of the collaborative management system, providing a unified data foundation for subsequent cross-module anomaly analysis. After normalization processing, the data change events in the unified database generate time-series sequences corresponding to each business indicator. The system extracts statistical features from the time-series sequences based on a sliding window and generates threshold intervals accordingly. When the sequence value of a certain time-series sequence exceeds the threshold interval, an abnormal signal event is generated. This process corresponds to step S102 shown in the second layer of the diagram. After detecting an abnormal signal event, the system performs a transmission link traversal based on the association graph constructed by the material hierarchy and business process flow relationship, as shown in the third layer of the figure. The gray-filled circular nodes represent activated nodes that have confirmed the existence of abnormal signal events within the expected transmission time window, and the white hollow circular nodes represent inactive nodes that have not detected abnormal signal events within the expected transmission time window. The directed edges between nodes indicate the direction of abnormal transmission, and the values ​​marked on the edges are the delay coefficients. The system starts from the starting node "Inventory M-0371", passes through the two activated nodes "Production S-0152" and "Production P-0088" along the directed edges, and then reaches the two inactive nodes "Inventory P-0088" and "Sales P-0088", forming a complete transmission link containing 5 nodes. The fourth layer at the bottom of the diagram illustrates the process of risk assessment and early warning generation. Since there are abnormal signal events at the starting node and the two consecutive downstream nodes in the transmission link, satisfying the condition that more than two consecutive nodes are activated, the system determines that the transmission link is in a chain risk activation state. Subsequently, the system calculates the risk coefficient of 0.153 by multiplying the basic activation ratio, the position weighting factor, and the transmission acceleration factor. This value is greater than the preset threshold of 0.12. Therefore, the system finally generates an early warning report, prompting managers that there is a chain risk in the transmission path that requires intervention.

[0086] Based on the above method, this application also discloses a multi-department production collaborative management system, such as... Figure 3 As shown, Figure 3 This is a schematic diagram of the structure of a multi-department production collaborative management system provided in an embodiment of this application. The system includes: a first acquisition module, a generation module, a construction module, a second generation module, and an output module; wherein, The first acquisition module is used to acquire data change events of business indicators in each business module, normalize each data change event, and generate time series sequences of each business indicator. The generation module is used to generate threshold intervals based on the statistical characteristics of each time series within a sliding window; when the sequence value of any time series is not within a threshold interval, an abnormal signal event is generated. The construction module is used to construct an association graph based on the material hierarchy and business process flow relationships in the unified database; the nodes of the association graph correspond to the business indicators of each business module, and directed edges represent the direction of abnormal propagation and carry delay coefficients. The second generation module is used to acquire materials related to abnormal signal events. The coding process involves locating the starting node in the association graph based on the material code, and traversing downstream nodes step by step along the directed edges from the starting node to generate multiple transmission links. For each downstream node in each transmission link, the expected transmission time window is determined based on the delay coefficient of the directed edge, and the time sequence of each downstream node is checked to see if there are any abnormal signal events within the expected transmission time window. The output module is used to determine that the transmission link is in a chain-like risk activation state when at least two consecutive nodes on the transmission link have abnormal signal events. The risk coefficient is determined based on the ratio of the number of activated nodes to the total number of nodes in the transmission link. When the risk coefficient is greater than a preset threshold, an early warning report is generated.

[0087] Please see Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 1000 may include: at least one processor 1001, at least one network interface 1004, a user interface 1003, a memory 1005, and at least one communication bus 1002.

[0088] The communication bus 1002 is used to realize the connection and communication between these components.

[0089] The user interface 1003 may include a display screen and a camera. Optionally, the user interface 1003 may also include a standard wired interface and a wireless interface.

[0090] The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0091] The processor 1001 may include one or more processing cores. The processor 1001 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1005, and by calling data stored in the memory 1005. Optionally, the processor 1001 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 1001 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content to be displayed on the screen; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 1001 and may be implemented as a separate chip.

[0092] The memory 1005 may include random access memory (RAM) or read-only memory. Optionally, the memory 1005 may include a non-transitory computer-readable storage medium. The memory 1005 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 1005 may also be at least one storage device located remotely from the aforementioned processor 1001. Figure 4 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for a multi-department production collaborative management method.

[0093] exist Figure 4In the electronic device 1000 shown, the user interface 1003 is mainly used to provide an input interface for the user and to obtain the user input data; while the processor 1001 can be used to call an application program stored in the memory 1005 for a multi-department production collaborative management method. When executed by one or more processors, the electronic device performs one or more of the methods described in the above embodiments.

[0094] An electronic device readable storage medium stores instructions that, when executed by one or more processors, cause the electronic device to perform one or more of the methods described in the above embodiments.

[0095] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0096] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0097] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some service interfaces; indirect couplings or communication connections between devices or units may be electrical or other forms.

[0098] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0099] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0100] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0101] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Other embodiments of this disclosure will be readily apparent to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described herein. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

Claims

1. A multi-department production collaborative management method, characterized in that, Applied to a collaborative management system that integrates business data from multiple business modules into a unified database, the method includes: Obtain data change events for business metrics in each business module, normalize each data change event, and generate a time series sequence for each business metric. Based on the statistical characteristics of each time series within the sliding window, a threshold interval is generated; when the sequence value of any time series is not within the threshold interval, an abnormal signal event is generated. Based on the material hierarchy and business process flow relationship in the unified database, an association graph is constructed; the nodes of the association graph correspond to the business indicators of each business module, and the directed edges represent the direction of anomaly propagation and carry a delay coefficient. Obtain the material code of the abnormal signal event, locate the starting node in the association graph according to the material code, and traverse the downstream nodes step by step from the starting node along the directed edge to generate multiple transmission links; for each downstream node in each transmission link, determine the expected transmission time window according to the delay coefficient of the directed edge, and check whether there is an abnormal signal event in the time sequence of each downstream node within the expected transmission time window. When at least two consecutive nodes on the transmission link have the abnormal signal event, the transmission link is determined to be in a chain-like risk activation state. The risk coefficient is determined based on the ratio of the number of activated nodes to the total number of nodes in the transmission link. When the risk coefficient is greater than a preset threshold, an early warning report is generated.

2. The multi-department production collaborative management method according to claim 1, characterized in that, The step of acquiring data change events for business metrics in each business module, normalizing each data change event, and generating a time-series sequence for each business metric includes: Through the data change capture mechanism of the unified database, the data tables corresponding to the preset business indicators in each business module are monitored in real time. When the field value in the data table changes, a data change event is generated carrying the change timestamp, the changed field identifier and the changed value. Align all the data change events according to a unified time granularity, aggregate the values ​​of business metrics that have multiple data change events within the same time granularity, and fill the previous values ​​of business metrics that do not have data change events within the same time granularity. The data sequences of the aligned business indicators are subjected to dimension elimination processing, which maps business indicators with different dimensions in different business modules to a unified numerical range, thereby generating the time series sequences of the business indicators.

3. The multi-department production collaborative management method according to claim 1, characterized in that, The statistical features include a weighted moving average and a weighted standard deviation, and a threshold interval is generated based on the statistical features of each time series within the sliding window; An abnormal signal event is generated when the sequence value of any time series is not within the threshold range, including: A threshold interval is generated based on the weighted moving average and the weighted standard deviation. The upper limit of the threshold interval is the sum of the weighted moving average and the weighted standard deviation by a preset multiple, and the lower limit of the threshold interval is the difference between the weighted moving average and the weighted standard deviation by a preset multiple. When any time series value continuously exceeds the same boundary of the threshold interval within a preset number of time units, or when the sequence value shows a monotonically increasing or monotonically decreasing trend drift within the sliding window, an abnormal signal event is generated. The abnormal signal event carries the module identifier of the business module to which the corresponding business indicator belongs and the associated material code.

4. The multi-department production collaborative management method according to claim 1, characterized in that, The step of constructing a relational graph based on the material hierarchy and business process flow relationships in the unified database includes: Extract the parent-child hierarchy of the material BOM from the unified database to determine the upstream and downstream correspondence of each material in different business modules; Based on the upstream and downstream correspondence and business process flow relationship, the business indicators of each business module are used as nodes, and directed edges are established between business indicators that have upstream and downstream correspondence. The direction of the directed edges is from the upstream business indicator to the downstream business indicator. Based on the time difference between historical data change events between the upstream and downstream nodes connected by each directed edge, the delay coefficient of each directed edge is calculated to generate an association graph.

5. The multi-department production collaborative management method according to claim 4, characterized in that, The step of calculating the delay coefficient of each directed edge based on the time difference between historical data change events between the upstream and downstream nodes connected by each directed edge includes: Get the first timestamp of the data change event generated by the upstream node connected by each directed edge within a preset historical time period, and the second timestamp of the data change event generated by the corresponding downstream node. Calculate the difference between the second timestamp and the first timestamp under the same material code to obtain multiple sets of transmission time samples; After removing outliers from the multiple sets of transmission time samples, the median of the remaining samples is taken as the delay coefficient of the directed edge; when the number of transmission time samples is less than the preset minimum sample size, the delay coefficient of the directed edge is set to the default process cycle value of the corresponding level in the material hierarchy structure.

6. The multi-department production collaborative management method according to claim 1, characterized in that, The process involves traversing downstream nodes step-by-step from the starting node along the directed edge to generate multiple transmission links. For each downstream node in each transmission link, an expected transmission time window is determined based on the delay coefficient of the directed edge. The process then checks whether any abnormal signal events exist in the time sequence of each downstream node within the expected transmission time window, including: Starting from the starting node, a breadth-first traversal is used to expand downstream along the directed edges. The traversal ends when the traversal depth reaches the preset maximum depth or when the current node has no downstream directed edges. The complete path from the starting node to each ending node is taken as a transmission link. For each downstream node in each transmission link, the timestamp of the occurrence of the abnormal signal event is added to the cumulative value of the delay coefficient of each directed edge on the path from the starting node to the downstream node to obtain the expected transmission arrival time. The expected transmission arrival time is then extended forward and backward by a preset tolerance time to generate the expected transmission time window. In the time series corresponding to each downstream node, it is searched whether there is an abnormal signal event that has been generated within the expected transmission time window. If it exists and the material code associated with the abnormal signal event belongs to the same BOM level tree as the material code of the starting node, it is determined that the abnormal signal event of the downstream node has a transmission correlation with the abnormal signal event of the starting node.

7. The multi-department production collaborative management method according to claim 1, characterized in that, The determination of the risk coefficient based on the ratio of the number of activated nodes to the total number of nodes in the transmission link includes: Obtain the position index of each node along the directed edge in the transmission link, and use the quotient of the number of activated nodes and the total number of nodes in the transmission link as the basic activation ratio; Assign position weights to each activated node in the transmission link, wherein the position weights are proportional to the position numbers of the activated nodes; Calculate the normalized weighted mean of the position weights of each activated node to obtain the position weighting factor; The actual propagation time between the timestamp of the abnormal signal event of the starting node and the timestamp of the abnormal signal event of the last activated node is obtained. The cumulative value of the delay coefficient of each directed edge on the path from the starting node to the last activated node is obtained as the expected propagation time. The ratio of the expected propagation time to the actual propagation time is calculated to obtain the propagation acceleration factor. The risk coefficient is generated by multiplying the base activation ratio, the location weighting factor, and the conduction acceleration factor.

8. A multi-department production collaborative management system, characterized in that, The system includes: a first acquisition module, a generation module, a construction module, a second generation module, and an output module; wherein, The first acquisition module is used to acquire data change events of business indicators in each business module, normalize each data change event, and generate a time sequence of each business indicator. The generation module is used to generate a threshold interval based on the statistical characteristics of each time series within a sliding window; when the sequence value of any time series is not within the threshold interval, an abnormal signal event is generated. The construction module is used to construct an association graph based on the material hierarchy and business process flow relationship in the unified database. The nodes of the association graph correspond to the business indicators of each business module, and the directed edges represent the direction of anomaly propagation and carry a delay coefficient. The second generation module is used to obtain the material code of the abnormal signal event, locate the starting node in the association graph according to the material code, and traverse from the starting node to the downstream node along the directed edge to generate multiple transmission links; for each downstream node in each transmission link, determine the expected transmission time window according to the delay coefficient of the directed edge, and check whether the time sequence of each downstream node has an abnormal signal event within the expected transmission time window. The output module is used to determine that the transmission link is in a chain-like risk activation state when at least two consecutive nodes on the transmission link have the abnormal signal event, determine the risk coefficient based on the ratio of the number of activated nodes to the total number of nodes in the transmission link, and generate an early warning report when the risk coefficient is greater than a preset threshold.

9. An electronic device, characterized in that, The device includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1-7.

Images