Method for determining a faulty hardware device, and apparatus, program product, and electronic device

Abstract

The application discloses a kind of determination methods of fault hardware equipment and its device, program product, electronic equipment, it is related to the field of financial technology or other related fields, wherein the determination method comprises: collecting the multi-source index data of target equipment cluster, multi-source index data is processed by feature enhancement, obtain target feature, target feature is processed, obtain fault probability value, determine current early warning threshold, and in the case where fault probability value is greater than current early warning threshold, determine that target equipment cluster exists fault hardware equipment.The present application solves the technical problem that the hardware equipment with fault cannot be accurately determined in the related art.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and more specifically, to a method and apparatus for determining faulty hardware devices, a program product, and an electronic device. Background Technology

[0002] In related technologies, the operation and maintenance monitoring of hardware equipment in the financial sector mainly relies on solutions such as threshold alarm systems, statistical models, traditional machine learning methods, and monitoring tools. Threshold alarm systems trigger alarms by setting preset static thresholds (such as CPU utilization >90% and memory usage >85%). Their parameter settings are highly dependent on human experience and are difficult to adapt to the cyclical fluctuations of financial business. For example, during peak trading hours (09:30–11:30), normal resource usage caused by a surge in TPS (Transactions Per Second) may be misjudged as abnormal. Statistical models, such as ARIMA (Autoregressive Integrated Moving Average), can fit historical time-series trends, but are limited by linear assumptions and cannot characterize the non-linear, gradual degradation process of hardware indicators (such as memory leaks). Traditional machine learning methods (such as SVM (Support Vector Machine) and random forest) rely on manually constructed sliding window statistical features (such as 5-minute mean and standard deviation), lacking the ability to automatically discover the coupling relationship between cross-dimensional indicators (such as the coordinated anomalies of CPU and disk IOPS (Input / Output Operations Per Second)). Although monitoring tools can achieve data collection and rule engine linkage, their alarm logic is still based on static thresholds and simple condition judgments, which cannot achieve early prediction and root cause location of faults.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, program product, and electronic device for determining faulty hardware devices, in order to at least solve the technical problem in related technologies that it is impossible to accurately determine faulty hardware devices.

[0005] According to one aspect of the present invention, a method for determining faulty hardware devices is provided, comprising: collecting multi-source indicator data of a target device cluster, wherein the target device cluster includes: multiple hardware devices, and the multi-source indicator data includes at least: hardware indicator data, environmental topology indicator data, and service coupling indicator data; performing feature enhancement processing on the multi-source indicator data to obtain target features; processing the target features to obtain a fault probability value; determining a current warning threshold, and determining that there is a faulty hardware device in the target device cluster if the fault probability value is greater than the current warning threshold.

[0006] Furthermore, the steps for collecting multi-source indicator data of the target device cluster include: collecting hardware indicators for each hardware device in the target device cluster based on a preset sampling strategy to obtain hardware indicator data; obtaining the physical location topology information of each hardware device in the target device cluster and determining the device type of each hardware device; classifying all hardware devices belonging to the same device type into the same device set, and matching each pair of device sets based on the physical location topology information of each hardware device to construct an adjacency matrix, and representing the adjacency matrix as environmental topology indicator data; determining the target system running on the target device cluster, and collecting the business indicators of the target system to obtain business coupling indicator data.

[0007] Furthermore, the steps of performing feature enhancement processing on multi-source indicator data to obtain target features include: spatial feature encoding of environmental topology indicator data to obtain spatial feature vectors; temporal feature encoding of hardware indicator data and business coupling indicator data to obtain temporal feature vectors; and fusion processing of spatial feature vectors and temporal feature vectors to obtain target features.

[0008] Further, the step of spatial feature encoding of environmental topology index data to obtain spatial feature vectors includes: constructing a self-loop adjacency matrix based on the adjacency matrix contained in the environmental topology index data; constructing a symmetric normalized adjacency matrix based on the self-loop adjacency matrix; using a graph convolutional network to perform spatial feature encoding on the symmetric normalized adjacency matrix to obtain multiple graph embedding vectors; and concatenating all graph embedding vectors to obtain the spatial feature vector.

[0009] Furthermore, the step of encoding the hardware indicator data and business coupling indicator data with time features to obtain the time feature vector includes: determining the initial hidden state at the initial time step using a gated recurrent network based on the hardware indicator data and business coupling indicator data, and determining the hidden state at the next time step based on the initial hidden state, until the hidden state at the last time step is determined; determining the attention score based on the hidden state at each time step, and determining the attention weight based on the attention score; and determining the time feature vector based on the hidden state at each time step and the attention weight.

[0010] Further, the steps of fusing spatial feature vectors and temporal feature vectors to obtain target features include: concatenating spatial feature vectors and temporal feature vectors to obtain concatenated vectors, and determining gating vectors based on the concatenated vectors; determining gating fusion vectors based on the gating vectors, spatial feature vectors, and temporal feature vectors; performing feature enhancement on the gating fusion vectors to determine enhancement vectors; and normalizing the concatenated vectors and enhancement vectors to obtain target features.

[0011] Furthermore, the steps for determining the current warning threshold include: determining a basic threshold based on historical device data; obtaining the current business variables of the target system and determining the business weights based on the current business variables; and determining the current warning threshold based on the basic threshold, the business weights, and the minimum threshold.

[0012] Furthermore, after determining that there is a faulty hardware device in the target device cluster when the fault probability value is greater than the current warning threshold, the process further includes: determining the similarity between the target feature and each preset feature in the preset knowledge graph, wherein the preset knowledge graph includes: multiple device nodes, each device node is associated with a preset feature, and each preset feature corresponds to a fault mode, operation and maintenance strategy, and service level; determining the device node associated with the preset feature with the highest similarity as the target device node; determining the target faulty hardware device based on the target device node; and processing the target faulty hardware device based on the target fault mode, target operation and maintenance strategy, and target service level corresponding to the target device node.

[0013] Further, the step of processing the target features to obtain the fault probability value includes: processing the target features using the fully connected layer in the preset prediction model to obtain the intermediate feature vector, wherein the preset prediction model is a model trained using historical indicator data; and processing the intermediate feature vector using the output layer in the preset prediction model to obtain the fault probability value.

[0014] According to another aspect of the present invention, an apparatus for determining faulty hardware devices is also provided, comprising: a data acquisition unit for acquiring multi-source indicator data of a target device cluster, wherein the target device cluster includes multiple hardware devices, and the multi-source indicator data includes at least hardware indicator data, environmental topology indicator data, and service coupling indicator data; a first processing unit for performing feature enhancement processing on the multi-source indicator data to obtain target features; a second processing unit for processing the target features to obtain a fault probability value; and a determination unit for determining a current warning threshold, and determining that a faulty hardware device exists in the target device cluster if the fault probability value is greater than the current warning threshold.

[0015] Furthermore, the acquisition unit includes: a first acquisition module, used to acquire hardware metrics of each hardware device in the target device cluster based on a preset sampling strategy, and obtain hardware metric data; a first acquisition module, used to acquire the physical location topology information of each hardware device in the target device cluster, and determine the device type of each hardware device; a first construction module, used to classify all hardware devices belonging to the same device type into the same device set, and based on the physical location topology information of each hardware device, match each pair of device sets to construct an adjacency matrix, and represent the adjacency matrix as environmental topology metric data; and a first determination module, used to determine the target system running on the target device cluster, and acquire the business metrics of the target system, and obtain business coupling metric data.

[0016] Furthermore, the first processing unit includes: a first encoding module for spatial feature encoding of environmental topology indicator data to obtain a spatial feature vector; a second encoding module for temporal feature encoding of hardware indicator data and business coupling indicator data to obtain a temporal feature vector; and a first fusion module for fusion processing of the spatial feature vector and the temporal feature vector to obtain the target feature.

[0017] Furthermore, the first encoding module includes: a first construction submodule for constructing a self-loop adjacency matrix based on the adjacency matrix contained in the environmental topology index data; a second construction submodule for constructing a symmetric normalized adjacency matrix based on the self-loop adjacency matrix; a first encoding submodule for encoding the spatial features of the symmetric normalized adjacency matrix using a graph convolutional network to obtain multiple graph embedding vectors; and a first concatenation submodule for concatenating all graph embedding vectors to obtain spatial feature vectors.

[0018] Furthermore, the second encoding module includes: a first determination submodule, used to determine the initial hidden state at the initial time step based on hardware indicator data and business coupling indicator data, using a gated recurrent network, and to determine the hidden state at the next time step based on the initial hidden state, until the hidden state at the last time step is determined; a second determination submodule, used to determine the attention score based on the hidden state at each time step, and to determine the attention weight based on the attention score; and a third determination submodule, used to determine the temporal feature vector based on the hidden state at each time step and the attention weight.

[0019] Furthermore, the first fusion module includes: a fourth determining submodule, used to concatenate the spatial feature vector and the temporal feature vector to obtain a concatenated vector, and to determine a gating vector based on the concatenated vector; a fifth determining submodule, used to determine a gating fusion vector based on the gating vector, the spatial feature vector, and the temporal feature vector; a sixth determining submodule, used to perform feature enhancement on the gating fusion vector to determine an enhancement vector; and a first processing submodule, used to normalize the concatenated vector and the enhancement vector to obtain the target features.

[0020] Furthermore, the determining unit includes: a second determining module for determining a basic threshold based on historical device data; a third determining module for obtaining the current business variables of the target system and determining the business weight based on the current business variables; and a fourth determining module for determining the current warning threshold based on the basic threshold, the business weight, and the minimum threshold.

[0021] Furthermore, the determining device also includes: a fifth determining module, used to determine the similarity between the target feature and each preset feature in the preset knowledge graph after determining that there is a faulty hardware device in the target device cluster when the fault probability value is greater than the current warning threshold, wherein the preset knowledge graph includes: multiple device nodes, each device node is associated with a preset feature, and each preset feature corresponds to a fault mode, operation and maintenance strategy, and service level; a sixth determining module, used to determine the device node associated with the preset feature with the highest similarity as the target device node; a seventh determining module, used to determine the target faulty hardware device based on the target device node; and a first processing module, used to process the target faulty hardware device based on the target fault mode, target operation and maintenance strategy, and target service level corresponding to the target device node.

[0022] Furthermore, the second processing unit includes: a second processing module, used to process the target features using a fully connected layer in a preset prediction model to obtain an intermediate feature vector, wherein the preset prediction model is a model trained using historical indicator data; and a third processing module, used to process the intermediate feature vector using the output layer in the preset prediction model to obtain a fault probability value.

[0023] According to another aspect of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method for determining any of the above-described faulty hardware devices.

[0024] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described methods for determining faulty hardware devices.

[0025] In this invention, multi-source indicator data of the target device cluster is collected, feature enhancement processing is performed on the multi-source indicator data to obtain target features, the target features are processed to obtain fault probability values, the current warning threshold is determined, and if the fault probability value is greater than the current warning threshold, it is determined that there are faulty hardware devices in the target device cluster, thereby solving the technical problem in related technologies that it is impossible to accurately determine faulty hardware devices.

[0026] This invention employs a temporal modeling approach based on gated recurrent units and attention mechanisms, combined with spatial correlation analysis using graph convolutional networks. By fusing and adaptively enhancing spatiotemporal features from three types of multi-source data—hardware metrics, environmental topology, and business coupling—it achieves accurate quantification of equipment failure probabilities. This enables early failure prediction with low resource overhead, solving the technical problems of high false alarm rates, long-term dependency gaps, and inability to identify progressive failures caused by reliance on static thresholds and manual features. This invention does not rely on fixed alarm thresholds but dynamically adjusts warning boundaries based on business cycles. It automatically mines cross-device and cross-time failure evolution patterns through a lightweight GRU-ATT (Gated Recurrent Unit with Attention Mechanism) and GCN (Graph Convolutional Network) collaborative architecture, ensuring that failure probability values ​​accurately reflect hardware degradation trends. This significantly improves the proactiveness and accuracy of financial equipment maintenance, meeting the financial system's requirements for low-latency, high-reliability, and auditable predictive maintenance. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for determining faulty hardware devices is shown.

[0029] Figure 2 This is a flowchart of a method for determining faulty hardware devices according to Embodiment 1 of the present invention;

[0030] Figure 3 This is a schematic diagram of an optional lightweight predictive operation and maintenance process for financial equipment hardware indicators based on spatiotemporal feature fusion according to an embodiment of the present invention.

[0031] Figure 4 This is a schematic diagram of an optional faulty hardware device determination apparatus according to an embodiment of the present invention;

[0032] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] It should be noted that all related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, have taken necessary security measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained; if the user chooses to refuse, the process enters the expert decision-making process.

[0036] In this invention, through the collaborative design of the GRU-ATT (Gated Recurrent Unit + Attention Mechanism) lightweight engine and knowledge graph decision-making, an order-of-magnitude improvement in the efficiency of the entire fault prediction-location-handling process can be achieved while reducing computational resource consumption. This enables the detection of hardware anomalies and early anomaly prediction, thereby reducing the false alarm rate, especially in scenarios with cyclical business fluctuations. Furthermore, it can automatically learn the correlation features of multi-dimensional indicators (the coupling relationship between CPU, memory, and IO (input / output)) and build an adaptive full-link monitoring engine for financial hardware devices.

[0037] The present invention will now be described in detail with reference to various embodiments.

[0038] Example 1

[0039] According to an embodiment of this application, an embodiment of a method for determining a faulty hardware device is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0040] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for determining faulty hardware devices is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0041] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0042] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for determining faulty hardware devices in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned method for determining faulty hardware devices. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0043] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0044] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0045] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for identifying faulty hardware devices is shown. Figure 2 This is a flowchart of a method for determining a faulty hardware device according to Embodiment 1 of the present invention, as follows: Figure 2 As shown, the method includes the following steps:

[0046] Step S201: Collect multi-source indicator data of the target device cluster. The target device cluster includes multiple hardware devices. The multi-source indicator data includes at least hardware indicator data, environmental topology indicator data, and business coupling indicator data.

[0047] In this embodiment of the invention, a lightweight agent can be deployed to collect multi-source indicator data from a financial equipment cluster in real time: hardware indicator data, environmental topology indicator data, and business coupling indicator data. Hardware indicator data includes: CPU utilization, memory usage, disk IOPS, SMART (Self-Monitoring, Analysis and Reporting Technology) health, and network packet loss rate. Environmental topology indicator data can obtain server physical location information through the LLDP (Link Layer Discovery Protocol) to construct an adjacency matrix of racks, servers, and storage. Business coupling indicator data includes: transaction system TPS, clearing queue depth, and database connection pool utilization. The sampling strategy can adopt an adaptive sampling mechanism, adjusting according to the trading period, such as using 1-second high-precision sampling during peak periods and 10-second sampling during off-peak periods.

[0048] Step S202: Perform feature enhancement processing on the multi-source indicator data to obtain the target features.

[0049] In this embodiment of the invention, a spatiotemporal feature fusion module can be used for data feature enhancement. Specifically, the time dimension can employ a GRU-ATT model to model long-term dependencies of time-series indicators, outputting a time feature vector; the spatial dimension can utilize a three-layer graph convolutional network (GCN), taking the adjacency matrix as input, aggregating neighbor node features to generate a spatial embedding vector; the two are concatenated through a gating mechanism, and feature enhancement is achieved through linear transformation and layer normalization, outputting the target feature. In this way, the nonlinear coupling relationship between hardware indicators and topology / service load can be automatically extracted, overcoming the limitations of manual feature engineering and improving the representation capability of fault modes.

[0050] Step S203: Process the target features to obtain the fault probability value.

[0051] In this embodiment of the invention, the enhanced target features can be input into the fully connected output network, and mapped to a fault probability value in the [0,1] interval by a Sigmoid activation function, representing the confidence that the target device has failed at the current moment. This probability value is generated based on a pre-trained GRU-ATT-GCN model, which optimizes the sample imbalance problem through Focal Loss, making it suitable for the sparse fault samples in financial scenarios. In this way, high-dimensional fused features can be transformed into quantifiable fault risk indicators, providing continuous probability outputs for decision-making, rather than binary classification.

[0052] Step S204: Determine the current warning threshold, and if the fault probability value is greater than the current warning threshold, determine that there is a faulty hardware device in the target device cluster.

[0053] In this embodiment of the invention, the current warning threshold is generated in real time by a dynamic threshold algorithm. It uses historical normal data as a statistical benchmark as the base threshold, combines business variables (such as TPS and queue depth) with a Sigmoid linear transformation to generate business weights, calculates the real-time dynamic threshold, and adaptively updates the dynamic threshold for the next moment based on the real-time false alarm rate. When the fault probability value exceeds this dynamic threshold, a faulty hardware device is determined to exist. This eliminates false alarms caused by periodic fluctuations in business operations, achieves adaptive matching between the threshold and the operating environment, and improves alarm accuracy.

[0054] In summary, this invention employs a temporal modeling approach based on gated recurrent units and attention mechanisms, combined with spatial correlation analysis using graph convolutional networks. By fusing and adaptively enhancing spatiotemporal features from three types of multi-source data—hardware metrics, environmental topology, and business coupling—it achieves accurate quantification of equipment failure probabilities. This enables early failure prediction with low resource overhead, addressing the technical problems of high false alarm rates, long-term dependency issues, and inability to identify progressive failures caused by reliance on static thresholds and manual features. This invention does not rely on fixed alarm thresholds but dynamically adjusts warning boundaries based on business cycles. It automatically mines cross-device and cross-time failure evolution patterns through a lightweight GRU-ATT and GCN collaborative architecture, ensuring that failure probability values ​​accurately reflect hardware degradation trends. This significantly improves the proactiveness and accuracy of financial equipment maintenance, meeting the financial system's requirements for low-latency, high-reliability, and auditable predictive maintenance.

[0055] To improve the accuracy of collecting multi-source indicator data from the target device cluster, the method for determining faulty hardware devices provided in Embodiment 1 of this application collects hardware indicators for each hardware device in the target device cluster based on a preset sampling strategy to obtain hardware indicator data; obtains the physical location topology information of each hardware device in the target device cluster and determines the device type of each hardware device; classifies all hardware devices belonging to the same device type into the same device set, and matches each pair of device sets based on the physical location topology information of each hardware device to construct an adjacency matrix, which is then represented as environmental topology indicator data; and determines the target system running on the target device cluster and collects the business indicators of the target system to obtain business coupling indicator data.

[0056] In this embodiment of the invention, a preset sampling strategy can be used to collect hardware metrics (including CPU utilization (by core), memory usage / leakage rate, disk IOPS / latency / health (SMART), network packet loss rate, etc.) for each hardware device in the target device cluster to obtain hardware metric data. Here, the "preset sampling strategy" refers to a rule that dynamically adjusts the data collection frequency according to the business load cycle. For example, during peak periods of the financial transaction system (09:30–11:30 and 13:30–15:30), CPU utilization (by core), memory usage, memory leak rate, disk IOPS, disk latency, SMART health, and network packet loss rate are collected at 1-second intervals; during off-peak periods, they are collected at 10-second intervals. The hardware metric data is a numerical sequence of each device at the sampling time, constituting the original time-series observation set. In this way, high-precision, time-synchronized device operating status information can be obtained, ensuring that the data can truly reflect the operating characteristics of the hardware under real business loads, avoiding the omission of instantaneous anomalies due to sparse sampling or the increase of redundancy overhead due to excessive sampling.

[0057] In this embodiment of the invention, the physical location topology of the servers can be obtained through the LLDP protocol to construct a three-level adjacency matrix of rack, server, and storage. Specifically, the physical location topology information of each hardware device in the target device cluster can be obtained first through the LLDP (Link Layer Discovery Protocol), including the rack number, rack location, and uplink switch port. Device types are then categorized according to hardware function, such as "application server," "database server," and "storage array," which can be automatically identified by device model, deployment role, or configuration file. Then, logical groups are formed by aggregating multiple hardware devices of the same type, such as all "database servers" forming a set. Next, based on the physical location topology information of each hardware device, it is determined whether there is a direct connection between different types of devices in each set, thus constructing an adjacency matrix and obtaining environmental topology index data. Here, the "adjacency matrix" is a symmetric or directed two-dimensional matrix, where rows and columns correspond to two device sets, and matrix elements indicate whether there is a physical connection or communication dependency between the two sets (e.g., if the storage array and database server are directly connected via a fiber optic channel, the corresponding position is 1; otherwise, it is 0). In this way, by constructing a structured representation of the topological graph through the connection relationships between sets, the physical deployment relationships of discrete devices can be transformed into structured inputs that can be processed by graph convolutional networks (GCNs), thus realizing the quantitative modeling of spatial dependencies.

[0058] In this embodiment of the invention, a financial system (target system) with clearly defined business functions, such as a trading system, clearing system, or database service cluster, deployed on a hardware device cluster, can be identified first. Then, direct parameters reflecting the system's operational load are collected through system logs or operation and maintenance APIs (Application Programming Interfaces), including business metrics such as transaction throughput (TPS), clearing queue depth, database connection pool utilization, and average transaction response time, thereby obtaining business coupling indicator data. In this way, by introducing business-side load information, the model can perceive whether hardware anomalies are caused by a surge in business requests, thus distinguishing between real faults and load fluctuations, and improving the business relevance of anomaly identification.

[0059] In this embodiment, by structurally collecting and classifying three types of data sources—hardware metrics, device topology, and business load—a multi-dimensional input system deeply adapted to the operation and maintenance scenario of financial equipment is constructed. This provides high-quality input data with physical location semantics, functional type differentiation, and business context association for the subsequent spatiotemporal feature fusion module. This ensures that the input representation of the fault probability model has three dimensions: device status, spatial dependence, and business drive, thereby improving the model's accuracy and interpretability in identifying complex coupled faults.

[0060] To improve the accuracy of feature enhancement processing of multi-source indicator data, in the method for determining faulty hardware devices provided in Embodiment 1 of this application, spatial feature encoding is performed on environmental topology indicator data to obtain spatial feature vectors; temporal feature encoding is performed on hardware indicator data and business coupling indicator data to obtain temporal feature vectors; and spatial feature vectors and temporal feature vectors are fused to obtain target features.

[0061] In this embodiment of the invention, the GRU-ATT module (a lightweight deep learning framework for spatiotemporal feature extraction) can be used to encode the input data (hardware indicator data and business coupling indicator data) with time features to solve the following problems of financial time series data: (1) long-term dependency modeling: capturing the progressive degradation features of equipment indicators; (2) key feature focusing: automatically identifying anomalies in key periods such as business peaks. In addition, spatiotemporal alignment of environmental topology indicator data can be performed: for the server physical location topology information (graph structure, nodes are servers, edges are physical connections / communication relationships), a graph convolutional network (GCN) is used for spatial feature encoding. GCN generates a graph embedding vector that integrates topology information by aggregating the features of the nodes themselves and the features of the neighboring nodes, capturing the spatial dependency relationship of the server cluster. Then, feature fusion is performed based on a gating mechanism to obtain the target features.

[0062] Specifically, based on the physical connection relationships of servers collected via the LLDP protocol, an adjacency matrix can be constructed with servers as nodes and physical links or communication paths as edges. Then, a multi-layer graph convolutional network (GCN) is used to aggregate the feature information of each node and its neighboring nodes layer by layer, ultimately outputting a high-dimensional embedding vector that integrates spatial topological dependencies, i.e., a spatial feature vector. For example, when the CPU utilization of a server is abnormal, if related servers in neighboring racks exhibit similar load fluctuations, the GCN can identify that the anomaly has spatial propagation characteristics and generate a feature representation containing topological association information. Furthermore, the collected hardware metrics such as CPU utilization, memory usage, disk IOPS, and network packet loss rate are coupled with business metrics such as transaction TPS, clearing queue depth, and database connection pool utilization to form a multi-dimensional time-series input sequence. A gated recurrent unit (GRU) combined with an attention mechanism is used to model the sequence, outputting a weighted aggregated time feature vector. For example, during peak trading hours (09:30–11:30), the system adaptively increases the sampling frequency to 1 second. The GRU-ATT module focuses attention weights on abnormally high database connection pool usage, suppressing noise interference during off-peak periods and generating feature representations with time context awareness. Then, the spatial and temporal feature vectors are concatenated and nonlinearly fused with the residual connection structure through a gating fusion mechanism, outputting a final feature vector that comprehensively represents the hardware state and topology association. For instance, when a server memory leak causes an increase in I / O latency in a local topology region, the gating vector dynamically adjusts the spatiotemporal weights through the Sigmoid function, prioritizing the retention of progressive degradation features in the temporal dimension and propagation path features in the spatial dimension. After activation and normalization by ReLU (Rectified Linear Unit), the target feature is generated.

[0063] In this embodiment, by performing spatial feature encoding on environmental topology indicator data and temporal feature encoding on hardware and business coupling indicator data, and then fusing the two to generate target features, collaborative modeling of hardware indicators in both spatiotemporal dimensions is achieved. This effectively overcomes the shortcomings of current methods that only analyze time-series data in isolation or ignore physical topology relationships, significantly improves the completeness of the representation of abnormal patterns and the accuracy of prediction, and provides a structured and semantically rich feature foundation for subsequent implementation of predictive operation and maintenance with low false alarms and high sensitivity.

[0064] To improve the accuracy of determining spatial feature vectors, in the method for determining faulty hardware devices provided in Embodiment 1 of this application, a self-loop adjacency matrix is ​​constructed based on the adjacency matrix contained in the environmental topology index data; a symmetric normalized adjacency matrix is ​​constructed based on the self-loop adjacency matrix; a graph convolutional network is used to encode the spatial features of the symmetric normalized adjacency matrix to obtain multiple graph embedding vectors; and all graph embedding vectors are concatenated to obtain the spatial feature vector.

[0065] In this embodiment of the invention, an original adjacency matrix A is formed based on the physical connection relationships between servers collected via the LLDP protocol, wherein the matrix elements... This indicates whether there is direct communication or physical connection between device i and device j. Then, a self-loop connection is added to the main diagonal of this matrix, which is the identity matrix. Adding it to the original adjacency matrix A yields the self-loop adjacency matrix Ã, i.e. This ensures that the original characteristic information of each node is explicitly preserved. For example, in a data center rack, device A has network links with devices B and C. By constructing a network link, it is ensured that device A can still retain its original indicators such as CPU and memory in subsequent graph convolution operations, avoiding information dilution during neighborhood aggregation.

[0066] Then, the degree matrix normalization process is performed on the self-loop adjacency matrix Ã, that is, by calculating the degree of each node (i.e., the number of neighbors, including self-loops), a diagonal matrix D is constructed, whose diagonal elements D ii Let i be the degree of node i, and then use the formula The symmetric normalized adjacency matrix is ​​calculated. This eliminates the impact of uneven node degree on graph convolution propagation. For example, when a core server connects to 10 downstream nodes while an edge server connects to only 1 node, normalization can prevent the features of highly connected nodes from being over-amplified, ensuring the stability of feature propagation.

[0067] Next, the symmetric normalized adjacency matrix will be... The initial feature matrix H of each server node (0) The input is fed into a depth graph convolutional network, which propagates and performs nonlinear transformations layer by layer through three GCN layers, with each layer outputting a graph embedding vector. ,in, The number of layers represents the number of neighborhood dependency information captured at different orders. ,in, Indicates the first Layer weights This represents the activation function. For example, the first layer of the GCN aggregates one-hop neighbor features to capture cooperative fluctuations in directly connected servers; the second layer aggregates two-hop neighbors to identify rack-level anomaly propagation; the third layer aggregates global associations within three hops to identify cross-rack association degradation, ultimately outputting a three-layer graph embedding vector. , .

[0068] Next, the graph embedding vectors output by the three layers of GCN are used. , Concatenate along the feature dimensions to form a joint vector with expanded dimensions, which serves as the final spatial feature vector. ,Right now =Concat( , For example, if the output dimension of each layer is 64, the dimension of the spliced ​​spatial feature vector is 192. This vector contains multi-scale topological dependencies from local to global, providing a spatial representation with hierarchical awareness for the subsequent spatiotemporal fusion module.

[0069] In this embodiment, by constructing a self-loop adjacency matrix and a symmetric normalized adjacency matrix based on environmental topology index data, and using a graph convolutional network for multi-layer spatial feature encoding and vector concatenation, a multi-level, adaptive spatial feature modeling of the physical topology of financial equipment is achieved. This significantly enhances the model's ability to perceive regional and propagating hardware faults, overcomes the shortcomings of traditional monitoring methods that ignore the physical correlation of equipment, provides a structured and scalable spatial dimension input for spatiotemporal feature fusion, and effectively improves the accuracy and interpretability of fault prediction.

[0070] To improve the accuracy of determining the time feature vector, in the method for determining faulty hardware devices provided in Embodiment 1 of this application, a gated recurrent network is used to determine the initial hidden state at the initial moment based on hardware indicator data and business coupling indicator data, and the hidden state at the next moment is determined based on the initial hidden state, until the hidden state at the last moment is determined; an attention score is determined based on the hidden state at each moment, and an attention weight is determined based on the attention score; and a time feature vector is determined based on the hidden state at each moment and the attention weight.

[0071] In this embodiment of the invention, collected hardware metrics such as CPU utilization, memory usage, disk IOPS, and network packet loss rate can be combined with business coupling metrics such as transaction TPS, clearing queue depth, and database connection pool utilization to construct a multi-dimensional input sequence in chronological order. This sequence is then input into a gated recurrent unit (GRU) network. At the initial time t=0, the GRU initializes the hidden state h0 to a zero vector or a small random value, and then updates it step by step according to the current input and the hidden state at the previous time step. By updating the door In conjunction with the reset gate, calculate the candidate state at the current time step. and finally obtained ( (Element-wise multiplication) until the last time step in the sequence is processed, outputting the final hidden state sequence at the corresponding time. For example, during peak trading hours, the system uses a 1-second sampling frequency, and the GRU continuously receives multi-dimensional indicators updated every second, gradually accumulating the progressive evolution pattern of memory leaks, and finally outputting a complete time-series state representation at the last moment.

[0072] Then, hide the state at each time step of the GRU output. Through learnable parameter vectors Calculate its relevance score to the global context, i.e. Then, all scores are normalized using Softmax (soft maximum function) to obtain... ,in, Let represent the attention score at time k, and T represent the total duration. For example, when the database connection pool utilization spikes abnormally at a certain time while memory usage slowly increases, the corresponding... The value was significantly higher than in other stable periods, after Softmax. The value approaches 1, allowing the model to focus on the critical anomalous period in subsequent aggregations and suppress noise interference from non-critical periods.

[0073] Then, hide all the states at all times. Its corresponding attention weight We perform a weighted summation to obtain the time feature vector. This vector is a fixed-dimensional vector independent of the input sequence length, comprehensively representing the evolutionary features identified as key by the attention mechanism throughout the entire time series. For example, in a memory leak event, although the entire sequence contains 720 sampling points, only 15 key moments are represented. Significantly non-zero, time eigenvector This is a weighted aggregation of the hidden states at these 15 moments, which accurately carries the core semantics of the abnormal gradual trend, providing a temporal representation with semantic focus capabilities for subsequent spatiotemporal fusion.

[0074] In this embodiment, by using a gated recurrent network to update the hidden state sequentially and combining it with an attention mechanism to perform weighted aggregation of key time steps, adaptive time-series modeling of hardware and business coupling indicators is achieved. This effectively overcomes the shortcomings of traditional statistical models that rely on fixed sliding windows and are difficult to identify long-term progressive faults. It enables the model to dynamically focus on the core period of abnormal evolution, significantly improving the representation accuracy and noise resistance of time dimension features. This provides an efficient and lightweight time-series coding foundation for building a predictive operation and maintenance system with early warning capabilities.

[0075] To improve the accuracy of determining target features, in the method for determining faulty hardware devices provided in Embodiment 1 of this application, spatial feature vectors and temporal feature vectors are concatenated to obtain a concatenated vector, and a gating vector is determined based on the concatenated vector; a gating fusion vector is determined based on the gating vector, spatial feature vector, and temporal feature vector; feature enhancement is performed on the gating fusion vector to determine the enhancement vector; and the concatenated vector and the enhancement vector are normalized to obtain the target features.

[0076] In this embodiment of the invention, the spatial feature vector output by the graph convolutional network (GCN) is... Compared with the time feature vector output by the GRU-ATT architecture The vector is concatenated along the feature dimension to form a concatenated vector. For example, when the spatial feature vector has a dimension of 128 and the temporal feature vector has a dimension of 64, the concatenated vector has a dimension of 192, which contains a joint representation of the spatial dependencies between devices and the evolution pattern of indicators over time.

[0077] Then, concatenate the vectors The input is fed into a fully connected layer, through a weight matrix. With bias A linear transformation is performed, followed by activation with the Sigmoid function σ to generate a gated vector. Each element of the gating vector g takes values ​​in the range [0,1], representing the degree of preference for the fusion of spatial and temporal features. For example, when CPU and memory coordination anomalies occur during peak business periods, the temporal feature component in the gating vector g approaches 1, while the spatial feature component approaches 0, indicating that the model relies more on time-series anomaly signals for judgment.

[0078] Then, based on the gating vector g, the spatial feature vectors are... With time feature vector Perform weighted fusion and calculate the gated fusion vector. Where ⊙ represents element-wise multiplication. For example, in the early stages of a server memory leak, temporal features are significantly enhanced while spatial correlations are not yet apparent. The gating vector g is biased towards temporal features, making... Mainly composed of This prioritizes responding to incremental faults and avoids triggering due to topology noise delays.

[0079] Next, the gated fusion vectors The input is fed into a nonlinear transformation layer, through a weight matrix. With bias A linear mapping is performed, followed by processing with the ReLU activation function to obtain the enhancement vector. For example, ReLU activation can suppress low-value noise components after fusion, while amplifying discriminative anomalous features, making the enhanced vector form clearer anomalous cluster boundaries in the feature space.

[0080] Finally, the augmentation vector With the original concatenation vector Perform residual connection, i.e. The results were then processed using LayerNorm to obtain the target features. Here, layer normalization standardizes the mean and variance of all neuron activation values ​​for each sample, using the feature dimension as the unit, thereby stabilizing gradient propagation. For example, when the amplitude of input features fluctuates due to changes in sampling frequency or differences in device models, layer normalization can eliminate the influence of dimensions, ensuring that the model has robust generalization ability across data centers and device models, and ultimately outputting stable target features for subsequent dynamic threshold judgment and knowledge graph inference.

[0081] In this embodiment, by splicing spatial and temporal feature vectors, introducing a gating mechanism to achieve dynamic fusion, and combining nonlinear enhancement and layer normalization processing, a structured and adaptive fusion of multi-source heterogeneous features is achieved. This significantly improves the semantic integrity and stability of feature representation and effectively overcomes the prediction bias problem caused by feature dimension mismatch and rigid fusion methods in traditional methods. It provides a reliable and interpretable feature foundation for building a high-precision, low-false-probability predictive operation and maintenance system for financial equipment.

[0082] To improve the accuracy of determining the current warning threshold, in the method for determining faulty hardware devices provided in Embodiment 1 of this application, a basic threshold is determined based on historical device data; the current business variables of the target system are obtained, and the business weights are determined based on the current business variables; and the current warning threshold is determined based on the basic threshold, the business weights, and the minimum threshold.

[0083] In this embodiment of the invention, historical indicator data sequences (such as CPU utilization, memory usage, disk IOPS, etc.) of financial equipment under fault-free and normal operating conditions can be selected, and their 95th percentile can be calculated as the basic threshold. This is to reflect the upper limit of normal fluctuations in metrics under normal business load. ,in, Represents historical device data. This indicates a quantile operation. For example, if CPU utilization data of a batch of servers collected during off-peak hours (13:00–16:00) over the past three months are statistically analyzed, and the 95th percentile value is taken as 82%, this value is used as the basic threshold under no business interference to identify abnormal fluctuations that deviate significantly from the normal range.

[0084] Then, collect the current business load status parameters in real time. (i=1-k), a vector of business variables including transaction TPS, clearing queue depth, database connection pool utilization, etc. The input is then fed into a learnable linear transformation layer, via a weight matrix. With bias After mapping, the system is activated by the Sigmoid function, and the output is a normalized business weight. Its value range is [0,1], which represents the correction strength of the current business pressure on the abnormal judgment of hardware indicators.

[0085] Then, according to the formula , base threshold Minimum threshold set during peak business periods By business weight Perform linear interpolation to generate a dynamically adjusted current warning threshold. For example, given a base threshold of 82%, a minimum threshold of 90%, and a business weight of 0.78, calculate... 88.24%, meaning that during peak business periods, the system automatically raises the CPU warning threshold from 82% to 88.24% to avoid false alarms triggered by normal business growth.

[0086] In some alternative embodiments, it is possible to... The formula for adaptive updating is: , representing the threshold at time t+1 We can use the threshold at time t and the false alarm rate at time t as a basis. To determine, among which, The learning rate represents the step size for updating.

[0087] In this embodiment, by determining the basic threshold based on historical data, calculating the business weight by combining real-time business variables, and dynamically fusing the basic threshold and the minimum threshold to generate the current warning threshold, the threshold setting in the operation and maintenance of financial equipment is transformed from static to business-aware dynamic evolution. This effectively solves the problem of high false alarm rate in traditional threshold alarm systems under periodic business fluctuation scenarios, improves the accuracy of anomaly detection and system availability, and provides a key adaptive decision-making basis for building a predictive operation and maintenance system with low false alarm rate and high sensitivity.

[0088] To achieve root cause analysis of target faulty hardware devices, in the method for determining faulty hardware devices provided in Embodiment 1 of this application, after determining that there are faulty hardware devices in the target device cluster when the fault probability value is greater than the current warning threshold, the similarity between the target feature and each preset feature in the preset knowledge graph is determined. The preset knowledge graph includes: multiple device nodes, each device node is associated with a preset feature, and each preset feature corresponds to a fault mode, operation and maintenance strategy, and service level. The device node associated with the preset feature with the highest similarity is determined as the target device node. Based on the target device node, the target faulty hardware device is determined. Based on the target fault mode, target operation and maintenance strategy, and target service level corresponding to the target device node, the target faulty hardware device is processed.

[0089] In this embodiment of the invention, when a fault is detected, a decision can be automatically generated using a knowledge graph. Specifically, the cosine similarity between the target feature output by the spatiotemporal feature fusion module and the preset feature vector associated with each device node in the preset knowledge graph can be calculated first to quantify the semantic matching degree between the current anomaly representation and historical fault patterns. For example, when the target feature reflects a composite pattern of "continuous high CPU fluctuations + memory leak trend + increased disk latency + increased network packet loss rate," the system calculates that its similarity with the preset feature (an aggregated vector of similar historical faults) associated with the "storage controller aging" node in the knowledge graph is 0.91, significantly higher than other nodes (such as "network switch fault," which has a similarity of 0.43). Among the similarity calculation results of all device nodes, the node with the highest similarity is selected as the target device node. For example, in the above scenario, because the "storage controller aging" node has the highest similarity, it is determined as the target device node and serves as the starting point for root cause reasoning. Then, based on the IP (Internet Protocol) address, device model, and physical location (rack number, server number) recorded in the knowledge graph for the target device node, the system maps these attributes to the real-time monitored device cluster to pinpoint the specific physical device experiencing the anomaly. Next, it invokes the preset fault modes associated with the target device node (e.g., "accumulation of bad blocks on the disk SMART causing a surge in I / O latency"), preset operation and maintenance policies (e.g., "automatic switch to redundant storage channels, disabling the faulty disk"), and preset business service levels (e.g., SLA (Service Level Agreement) level P1 (Level 1 critical business service level), critical business dependencies), automatically generating handling instructions and triggering the execution process. For example, based on the P1 service level, the system automatically initiates a primary / standby switchover mechanism, disables the faulty disk, and notifies operations and maintenance personnel to complete a physical replacement within 15 minutes, while simultaneously recording handling logs to meet financial audit requirements.

[0090] For example, Table 1 is an optional list of knowledge graphs, as shown in Table 1.

[0091] Table 1

[0092]

[0093] In this embodiment, by matching the target features with preset features in the knowledge graph, the target device node is located, and the handling process is automatically triggered based on its associated fault mode, operation and maintenance strategy and business service level. This realizes an end-to-end closed loop from anomaly detection to root cause location and intelligent decision-making, which significantly improves the automation level and response efficiency of fault handling. At the same time, it ensures that the handling behavior complies with the financial system audit and SLA management requirements, effectively reduces the average repair time, and enhances the overall reliability of the system.

[0094] To improve the accuracy of determining the fault probability value, in the method for determining faulty hardware devices provided in Embodiment 1 of this application, the target features are processed by the fully connected layer in the preset prediction model to obtain the intermediate feature vector. The preset prediction model is a model trained by historical index data. The intermediate feature vector is processed by the output layer in the preset prediction model to obtain the fault probability value.

[0095] In this embodiment of the invention, the target features output by the spatiotemporal feature fusion module are input into the fully connected layer (LC layer) of the preset prediction model. This layer consists of a learnable weight matrix and a bias vector, and generates an intermediate feature vector through linear transformation to abstract and compress the original high-dimensional features, extracting higher-level semantics that are more discriminative for fault prediction. For example, when the target feature dimension is 192, the fully connected layer maps it to a 64-dimensional intermediate feature vector, preserving the structural information of key abnormal patterns while reducing subsequent computational complexity. Then, the intermediate feature vector is input into the output layer, which is a single-neuron fully connected layer. After linear transformation through the weight vector and bias, it is activated by the Sigmoid function and outputs a fault probability value between 0 and 1 to represent the confidence that the current device will fail in the next time window. For example, when the intermediate feature vector reflects a composite pattern of accelerated memory leaks, continuously rising I / O latency, and abnormal fluctuations in business TPS, the output layer calculates a fault probability value of 0.83, indicating that the system has a high probability of an impending hardware failure, triggering a critical warning mechanism.

[0096] In this embodiment, the target features are dimensionally compressed and semantically abstracted by the fully connected layer in the preset prediction model, and continuous fault probability values ​​are generated by the output layer. This achieves a precise mapping from high-dimensional spatiotemporal features to quantifiable fault risks, making the prediction results continuous, interpretable, and engineering feasible. This effectively supports hierarchical alarm and intelligent decision-making mechanisms, and significantly improves the accuracy of fault prediction and the reliability of system response.

[0097] Figure 3 This is a schematic diagram of an optional lightweight predictive operation and maintenance process for financial equipment hardware indicators based on spatiotemporal feature fusion, according to an embodiment of the present invention. Figure 3 As shown, the multi-source data acquisition module captures three types of hardware metrics through a lightweight agent and inputs them into the spatiotemporal feature joint module for temporal feature encoding (processed through a GRU+ATT network), spatial feature encoding (processed through a GCN network), and gated fusion. For temporal feature encoding, time-series data is modeled for long-term dependencies using a three-layer gated recurrent unit (GRU), outputting the hidden state sequence at each time step. Temporal weights are then calculated using an attention mechanism, and the aggregated data yields a weighted temporal feature vector to focus on the evolution patterns of key abnormal periods. For spatial feature encoding, the server's physical topology is represented by an adjacency matrix. After self-loop expansion and symmetric normalization, the matrix is ​​input into a three-layer graph convolutional network (GCN). Each layer gradually expands the receptive field by aggregating the features of the node itself and its neighbors, ultimately outputting a multi-scale fused spatial feature vector to characterize the physical and communication dependencies between devices. Then, the temporal and spatial feature vectors are fused through a gated fusion mechanism to obtain spatiotemporal fused features. Next, the spatiotemporal fusion features are processed through the early warning module (including: FC layer (prediction module), business-aware dynamic threshold early warning module, and hierarchical alarm mechanism module) to obtain early warning results. Then, the knowledge graph-supported fault root cause analysis module generates operation and maintenance strategies, and the visualization decision-making platform module visualizes the operation and maintenance process.

[0098] The method for determining faulty hardware devices provided in this application addresses the problems of high false alarm rate, limited feature capture, and prediction lag in the field of financial hardware indicator monitoring. Through the "spatiotemporal fusion prediction → intelligent decision-making closed loop" architecture, it can achieve the following technical effects: (1) By using a dynamic threshold engine to deeply perceive the business fluctuation cycle, it eliminates the misjudgment of static thresholds in scenarios such as transaction peaks, thus solving the problem of high false alarm rate; (2) It overcomes long-term dependency gaps by using a spatiotemporal fusion architecture (GCN+GRU-ATT) to realize cross-cycle correlation modeling of hardware indicators, accurately capturing progressive issues such as memory leaks. (3) The automatic feature extraction mechanism based on graph neural network breaks through the limitations of manually constructing statistical features (such as time period average) and autonomously discovers fault precursor patterns in multi-source heterogeneous data; (4) The prediction engine establishes minute-level early warning capability for faults, interrupts the business loss chain in advance, and the lightweight model design establishes faster fault response capability; (5) Intelligent decision-making closed loop, through the knowledge graph-driven disposal engine, the root cause is located and the solution is generated, realizing the full automation of "prediction-decision-execution", improving system availability and reducing the average repair time of faults.

[0099] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0100] Example 2

[0101] This application also provides a device for determining a faulty hardware device. It should be noted that this device can be used to execute the method for determining a faulty hardware device provided in this application. The following describes the device for determining a faulty hardware device provided in this application.

[0102] According to an embodiment of this application, an apparatus for implementing the above-described method for determining faulty hardware devices is also provided. Figure 4 This is a schematic diagram of an optional faulty hardware device determination apparatus according to an embodiment of the present invention, such as... Figure 4 As shown, the determining device may include: a data acquisition unit 40, a first processing unit 41, a second processing unit 42, and a determining unit 43.

[0103] The acquisition unit 40 is used to acquire multi-source indicator data of the target device cluster. The target device cluster includes multiple hardware devices, and the multi-source indicator data includes at least hardware indicator data, environmental topology indicator data, and business coupling indicator data.

[0104] The first processing unit 41 is used to perform feature enhancement processing on multi-source indicator data to obtain target features;

[0105] The second processing unit 42 is used to process the target features to obtain the fault probability value;

[0106] The determination unit 43 is used to determine the current warning threshold, and if the fault probability value is greater than the current warning threshold, determine that there is a faulty hardware device in the target device cluster.

[0107] The faulty hardware device provided in this application adopts a temporal modeling approach based on gated recurrent units and attention mechanisms, combined with spatial correlation analysis using graph convolutional networks. By fusing and adaptively enhancing spatiotemporal features of three types of multi-source data—hardware indicators, environmental topology, and business coupling—it achieves accurate quantification of the probability of device failure. This enables early fault prediction with low resource overhead, solving the technical problems of high false alarm rates, long-term reliance on missing features, and inability to identify progressive faults caused by reliance on static thresholds and manual features. This invention does not rely on fixed alarm thresholds but dynamically adjusts the warning boundaries based on the business cycle. It automatically mines cross-device and cross-time fault evolution patterns through a lightweight GRU-ATT and GCN collaborative architecture, ensuring that the fault probability value truly reflects the hardware degradation trend. This significantly improves the initiative and accuracy of financial equipment operation and maintenance, meeting the financial system's requirements for low-latency, high-reliability, and auditable predictive operation and maintenance.

[0108] Optionally, the acquisition unit includes: a first acquisition module, used to acquire hardware metrics of each hardware device in the target device cluster based on a preset sampling strategy, and obtain hardware metric data; a first acquisition module, used to acquire the physical location topology information of each hardware device in the target device cluster, and determine the device type of each hardware device; a first construction module, used to classify all hardware devices belonging to the same device type into the same device set, and match each pair of device sets based on the physical location topology information of each hardware device to construct an adjacency matrix, and represent the adjacency matrix as environmental topology metric data; and a first determination module, used to determine the target system running on the target device cluster, and acquire the business metrics of the target system, and obtain business coupling metric data.

[0109] Optionally, the first processing unit includes: a first encoding module for spatial feature encoding of environmental topology indicator data to obtain a spatial feature vector; a second encoding module for temporal feature encoding of hardware indicator data and business coupling indicator data to obtain a temporal feature vector; and a first fusion module for fusion processing of the spatial feature vector and the temporal feature vector to obtain a target feature.

[0110] Optionally, the first encoding module includes: a first construction submodule for constructing a self-loop adjacency matrix based on the adjacency matrix contained in the environmental topology index data; a second construction submodule for constructing a symmetric normalized adjacency matrix based on the self-loop adjacency matrix; a first encoding submodule for encoding the spatial features of the symmetric normalized adjacency matrix using a graph convolutional network to obtain multiple graph embedding vectors; and a first concatenation submodule for concatenating all graph embedding vectors to obtain spatial feature vectors.

[0111] Optionally, the second encoding module includes: a first determining submodule, used to determine the initial hidden state at the initial time step based on hardware indicator data and business coupling indicator data using a gated recurrent network, and to determine the hidden state at the next time step based on the initial hidden state, until the hidden state at the last time step is determined; a second determining submodule, used to determine the attention score based on the hidden state at each time step, and to determine the attention weight based on the attention score; and a third determining submodule, used to determine the temporal feature vector based on the hidden state at each time step and the attention weight.

[0112] Optionally, the first fusion module includes: a fourth determining submodule, used to concatenate the spatial feature vector and the temporal feature vector to obtain a concatenated vector, and to determine a gating vector based on the concatenated vector; a fifth determining submodule, used to determine a gating fusion vector based on the gating vector, the spatial feature vector, and the temporal feature vector; a sixth determining submodule, used to perform feature enhancement on the gating fusion vector to determine an enhancement vector; and a first processing submodule, used to normalize the concatenated vector and the enhancement vector to obtain the target features.

[0113] Optionally, the determining unit includes: a second determining module for determining a basic threshold based on historical device data; a third determining module for obtaining the current business variables of the target system and determining the business weight based on the current business variables; and a fourth determining module for determining the current warning threshold based on the basic threshold, the business weight, and the minimum threshold.

[0114] Optionally, the determining device further includes: a fifth determining module, used to determine the similarity between the target feature and each preset feature in a preset knowledge graph after determining that there is a faulty hardware device in the target device cluster when the fault probability value is greater than the current warning threshold, wherein the preset knowledge graph includes: multiple device nodes, each device node is associated with a preset feature, and each preset feature corresponds to a fault mode, operation and maintenance strategy, and service level; a sixth determining module, used to determine the device node associated with the preset feature with the highest similarity as the target device node; a seventh determining module, used to determine the target faulty hardware device based on the target device node; and a first processing module, used to process the target faulty hardware device based on the target fault mode, target operation and maintenance strategy, and target service level corresponding to the target device node.

[0115] Optionally, the second processing unit includes: a second processing module, used to process the target features using a fully connected layer in a preset prediction model to obtain an intermediate feature vector, wherein the preset prediction model is a model trained using historical indicator data; and a third processing module, used to process the intermediate feature vector using the output layer in the preset prediction model to obtain a fault probability value.

[0116] The aforementioned determining device may also include a processor and a memory. The aforementioned acquisition unit 40, first processing unit 41, second processing unit 42, determining unit 43, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0117] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and the current warning threshold is determined by adjusting kernel parameters. If the fault probability value exceeds the current warning threshold, it is determined that there is a faulty hardware device in the target device cluster.

[0118] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0119] It should be noted that the acquisition unit 40, the first processing unit 41, the second processing unit 42, and the determination unit 43 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0120] Example 3

[0121] Embodiments of this application may provide an electronic device. Figure 5 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0122] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the method and apparatus for determining faulty hardware devices in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned method for determining faulty hardware devices. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0123] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: collecting multi-source indicator data of the target device cluster, wherein the target device cluster includes multiple hardware devices, and the multi-source indicator data includes at least hardware indicator data, environmental topology indicator data, and service coupling indicator data; performing feature enhancement processing on the multi-source indicator data to obtain target features; processing the target features to obtain a fault probability value; determining the current warning threshold, and if the fault probability value is greater than the current warning threshold, determining that there is a faulty hardware device in the target device cluster.

[0124] The processor can access information and applications stored in memory via a transmission device to execute the following steps: Based on a preset sampling strategy, collect hardware metrics for each hardware device in the target device cluster to obtain hardware metric data; acquire the physical location topology information of each hardware device in the target device cluster and determine the device type of each hardware device; group all hardware devices belonging to the same device type into the same device set, and match each pair of device sets based on the physical location topology information of each hardware device to construct an adjacency matrix, which is then represented as environmental topology metric data; determine the target system running on the target device cluster, and collect the business metrics of the target system to obtain business coupling metric data.

[0125] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: spatial feature encoding of environmental topology indicator data to obtain spatial feature vectors; temporal feature encoding of hardware indicator data and business coupling indicator data to obtain temporal feature vectors; and fusion processing of spatial feature vectors and temporal feature vectors to obtain target features.

[0126] The processor can access information and applications stored in memory via a transmission device to perform the following steps: construct a self-loop adjacency matrix based on the adjacency matrix contained in the environmental topology index data; construct a symmetric normalized adjacency matrix based on the self-loop adjacency matrix; encode the spatial features of the symmetric normalized adjacency matrix using a graph convolutional network to obtain multiple graph embedding vectors; and concatenate all graph embedding vectors to obtain a spatial feature vector.

[0127] The processor can access information and applications stored in memory via a transmission device to perform the following steps: Based on hardware indicator data and business coupling indicator data, a gated recurrent network is used to determine the initial hidden state at the initial moment, and the hidden state at the next moment is determined based on the initial hidden state, until the hidden state at the last moment is determined; based on the hidden state at each moment, an attention score is determined, and based on the attention score, an attention weight is determined; based on the hidden state at each moment and the attention weight, a temporal feature vector is determined.

[0128] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: concatenating spatial feature vectors and temporal feature vectors to obtain a concatenated vector, and determining a gating vector based on the concatenated vector; determining a gating fusion vector based on the gating vector, spatial feature vector, and temporal feature vector; performing feature enhancement on the gating fusion vector to determine an enhancement vector; and normalizing the concatenated vector and the enhancement vector to obtain the target feature.

[0129] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: determine a basic threshold based on historical device data; obtain the current business variables of the target system and determine the business weights based on the current business variables; and determine the current warning threshold based on the basic threshold, the business weights, and the minimum threshold.

[0130] The processor can invoke information and applications stored in the memory via a transmission device to perform the following steps: determining the similarity between a target feature and each preset feature in a preset knowledge graph, wherein the preset knowledge graph includes: multiple device nodes, each device node is associated with a preset feature, and each preset feature corresponds to a fault mode, operation and maintenance strategy, and service level; determining the device node associated with the preset feature with the highest similarity as the target device node; based on the target device node, determining the target faulty hardware device; and processing the target faulty hardware device based on the target fault mode, target operation and maintenance strategy, and target service level corresponding to the target device node.

[0131] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: process the target features using the fully connected layer in the preset prediction model to obtain intermediate feature vectors, wherein the preset prediction model is a model trained using historical index data; process the intermediate feature vectors using the output layer in the preset prediction model to obtain the fault probability value.

[0132] This application provides a scheme for identifying faulty hardware devices. It employs a temporal modeling approach based on gated recurrent units and attention mechanisms, combined with spatial correlation analysis using graph convolutional networks. By fusing and adaptively enhancing spatiotemporal features from three types of multi-source data—hardware indicators, environmental topology, and business coupling—it achieves accurate quantification of the probability of device failure. This enables early fault prediction with low resource overhead, solving the technical problems of high false alarm rates, long-term reliance on missing features, and inability to identify progressive faults caused by reliance on static thresholds and manual features. This invention does not rely on fixed alarm thresholds but dynamically adjusts the warning boundaries based on the business cycle. It automatically mines cross-device and cross-time fault evolution patterns through a lightweight GRU-ATT and GCN collaborative architecture, ensuring that the fault probability value truly reflects the hardware degradation trend. This significantly improves the initiative and accuracy of financial equipment operation and maintenance, meeting the financial system's requirements for low-latency, high-reliability, and auditable predictive operation and maintenance.

[0133] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0134] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0135] Example 4

[0136] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the method for determining faulty hardware devices provided in Embodiment 1.

[0137] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0138] This application also provides a computer program product that, when executed on a data processing device, is adapted to perform the steps of a method for determining a faulty hardware device.

[0139] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0140] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0141] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0142] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0143] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0144] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0145] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for determining faulty hardware devices, characterized in that, include: Collect multi-source indicator data of the target device cluster, wherein the target device cluster includes: multiple hardware devices, and the multi-source indicator data includes at least: hardware indicator data, environmental topology indicator data, and service coupling indicator data; The multi-source indicator data is subjected to feature enhancement processing to obtain the target features; The target features are processed to obtain a fault probability value; Determine the current warning threshold, and if the fault probability value is greater than the current warning threshold, determine that there is a faulty hardware device in the target device cluster.

2. The determination method according to claim 1, characterized in that, The steps for collecting multi-source indicator data from the target device cluster include: Based on a preset sampling strategy, hardware metrics of each hardware device in the target device cluster are collected to obtain the hardware metric data. Obtain the physical location topology information of each hardware device in the target device cluster, and determine the device type of each hardware device; All hardware devices belonging to the same device type are grouped into the same device set, and based on the physical location topology information of each hardware device, each pair of device sets is matched to construct an adjacency matrix, and the adjacency matrix is ​​represented as the environmental topology index data. Identify the target system running on the target device cluster, and collect the business metrics of the target system to obtain the business coupling metric data.

3. The determination method according to claim 1, characterized in that, The step of performing feature enhancement processing on the multi-source indicator data to obtain target features includes: Spatial feature encoding is performed on the environmental topology index data to obtain spatial feature vectors; The hardware indicator data and the business coupling indicator data are encoded with time features to obtain a time feature vector. The spatial feature vector and the temporal feature vector are fused to obtain the target feature.

4. The determination method according to claim 3, characterized in that, The step of spatial feature encoding the environmental topology index data to obtain spatial feature vectors includes: Based on the adjacency matrix contained in the environmental topology index data, a self-loop adjacency matrix is ​​constructed; Based on the self-loop adjacency matrix, a symmetric normalized adjacency matrix is ​​constructed; A graph convolutional network is used to encode the spatial features of the symmetric normalized adjacency matrix to obtain multiple graph embedding vectors. All the graph embedding vectors are concatenated to obtain the spatial feature vector.

5. The determination method according to claim 3, characterized in that, The step of performing time feature encoding on the hardware indicator data and the business coupling indicator data to obtain a time feature vector includes: Based on the hardware indicator data and the business coupling indicator data, a gated cyclic network is used to determine the initial hidden state at the initial moment, and the hidden state at the next moment is determined based on the initial hidden state, until the hidden state at the last moment is determined. Based on the hidden state at each time step, an attention score is determined, and based on the attention score, an attention weight is determined. The temporal feature vector is determined based on the hidden state at the given time and the attention weights.

6. The determining method according to claim 3, characterized in that, The step of fusing the spatial feature vector and the temporal feature vector to obtain the target feature includes: The spatial feature vector and the temporal feature vector are concatenated to obtain a concatenated vector, and a gating vector is determined based on the concatenated vector. Based on the gate vector, the spatial feature vector, and the temporal feature vector, a gate fusion vector is determined; The gated fusion vector is enhanced with features to determine the enhancement vector; The concatenated vector and the enhanced vector are normalized to obtain the target features.

7. The determination method according to claim 1, characterized in that, The steps to determine the current warning threshold include: Determine basic thresholds based on historical equipment data; Obtain the current business variables of the target system, and determine the business weights based on the current business variables; The current warning threshold is determined based on the basic threshold, the business weight, and the minimum threshold.

8. The determination method according to claim 1, characterized in that, After determining that there is a faulty hardware device in the target device cluster when the fault probability value is greater than the current warning threshold, the method further includes: Determine the similarity between the target feature and each preset feature in the preset knowledge graph, wherein the preset knowledge graph includes: multiple device nodes, each device node is associated with the preset feature, and each preset feature corresponds to a fault mode, operation and maintenance strategy, and business service level; The device node associated with the preset feature indicated by the maximum similarity is identified as the target device node; Based on the target device node, identify the target faulty hardware device; Based on the target fault mode, target operation and maintenance strategy, and target service level corresponding to the target device node, the target faulty hardware device is processed.

9. The determination method according to claim 1, characterized in that, The step of processing the target features to obtain the fault probability value includes: The target features are processed using a fully connected layer in a preset prediction model to obtain an intermediate feature vector. The preset prediction model is a model trained using historical indicator data. The intermediate feature vector is processed using the output layer of the preset prediction model to obtain the fault probability value.

10. A device for determining faulty hardware equipment, characterized in that, include: The acquisition unit is used to acquire multi-source indicator data of the target device cluster, wherein the target device cluster includes multiple hardware devices, and the multi-source indicator data includes at least hardware indicator data, environmental topology indicator data, and service coupling indicator data. The first processing unit is used to perform feature enhancement processing on the multi-source indicator data to obtain target features; The second processing unit is used to process the target features to obtain a fault probability value; The determining unit is used to determine the current warning threshold, and if the fault probability value is greater than the current warning threshold, determine that there is a faulty hardware device in the target device cluster.

11. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the method for determining a faulty hardware device as described in any one of claims 1 to 9.

12. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method for determining a faulty hardware device as described in any one of claims 1 to 9.

Images